prosím o kontrolu. nevím si rady s winlogon.exe

[Baron Prášil]

vypni skype,icq,qip a pod

vypni obnovu systému
pravím na Tento počítač>vlastnosti>obnova systému a zaškrtni a ok a potvrdit

fixni v hijackthis
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/t.....xdm080YYCZ
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/imag.....0.15-3.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\SYSTEM32\WLCtrl32.dll

poté
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok)
Zkopíruj do něj následující text označený zeleně:

Kód: Vybrat vše

Driver::
qwetab

File::
C:\WINDOWS\SYSTEM32\WLCtrl32.dll
C:\WINDOWS\system32\spmsg2.dll
C:\WINDOWS\inf\qwetab.inf

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WLCtrl32]

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť

- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu+restartuj do norm.režimu a pošli log z hijackthis

[Reklama]

[ivo.hriso]

Tak jsem vypnul skype, qip atd.
vypnul jsem obnovu systému
Fixnul jsem hijackthis dané body.
Spustil jsem Combofix pomocí cfscriptu s uvedeným textem.
posílám log .
WLCtrl32 změnil vzhled a koncovku. Vypadá nyní jako soubor, po jehož otevření, bych byl vyzván k výběru programu, s nímž ho chci otevřít. A dám li na něj pravím, pak ve vlastnostech vidím, že koncovka je DL_
Kerio hlásí stále pokus o průnik winlogon.
Jdu restartovat pc a pošlu Hijackthis


ComboFix 08-03-03.4 - User 2008-03-13 19:19:39.10 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1029.18.1554 [GMT 1:00]
Running from: C:\Documents and Settings\User\Plocha\ComboFix.exe
Command switches used :: C:\Documents and Settings\User\Plocha\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\inf\qwetab.inf
C:\WINDOWS\system32\spmsg2.dll
C:\WINDOWS\SYSTEM32\WLCtrl32.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\inf\qwetab.inf
C:\WINDOWS\system32\spmsg2.dll
C:\WINDOWS\SYSTEM32\WLCtrl32.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\qwetab


((((((((((((((((((((((((( Files Created from 2008-02-13 to 2008-03-13 )))))))))))))))))))))))))))))))
.

2008-03-13 19:25 . 2008-03-13 19:25 11,776 --a------ C:\WINDOWS\system32\WLCtrl32.dl_
2008-03-11 22:14 . 2008-03-11 22:20 <DIR> d-------- C:\Program Files\RegCleaner
2008-03-11 16:38 . 2008-03-11 16:38 <DIR> d-------- C:\Program Files\Alwil Software
2008-03-11 16:38 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-03-11 16:38 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-03-11 16:38 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-03-11 16:38 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-03-11 16:38 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-03-11 16:38 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-03-11 16:38 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-03-11 16:38 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-03-10 17:47 . 2006-11-24 14:13 <DIR> d--h----- C:\Documents and Settings\Administrator\ćablony
2008-03-10 17:47 . 2008-03-13 15:19 <DIR> d-------- C:\Documents and Settings\Administrator\Plocha
2008-03-10 17:47 . 2006-11-24 15:03 <DIR> d--h----- C:\Documents and Settings\Administrator\Okolnˇ tisk rny
2008-03-10 17:47 . 2006-11-24 15:03 <DIR> d--h----- C:\Documents and Settings\Administrator\Okolnˇ sˇś
2008-03-10 17:47 . 2006-11-24 15:03 <DIR> d-------- C:\Documents and Settings\Administrator\Oblˇben‚ polo§ky
2008-03-10 17:47 . 2006-11-24 15:03 <DIR> dr------- C:\Documents and Settings\Administrator\Nabˇdka Start
2008-03-10 17:47 . 2006-11-24 15:03 <DIR> d-------- C:\Documents and Settings\Administrator\Dokumenty
2008-03-10 17:47 . 2006-11-24 15:03 <DIR> dr-h----- C:\Documents and Settings\Administrator\Data aplikacˇ
2008-03-09 12:38 . 2008-03-10 22:22 <DIR> d-------- C:\Program Files\WinClamAVShield
2008-03-09 12:20 . 2008-03-09 12:20 <DIR> d-------- C:\searchplugins
2008-03-09 12:20 . 2008-03-09 12:20 <DIR> d-------- C:\Program Files\Crawler
2008-03-09 12:19 . 2008-03-10 05:29 <DIR> d-------- C:\Program Files\Spyware Terminator
2008-03-09 12:19 . 2008-03-10 04:48 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\Spyware Terminator
2008-03-09 12:19 . 2008-03-09 12:19 138,752 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2008-03-09 05:22 . 2008-03-09 05:22 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-09 05:22 . 2008-03-09 05:22 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-02 21:02 . 2008-03-02 21:02 <DIR> d-------- C:\Program Files\CCleaner
2008-03-02 19:21 . 2008-03-02 19:22 <DIR> d-------- C:\WINDOWS\ERUNT
2008-03-02 19:20 . 2008-03-13 18:59 116,962 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2008-03-02 18:59 . 2008-03-10 18:10 <DIR> d-------- C:\SDFix
2008-03-02 18:58 . 2008-03-02 18:58 1,312,273 --a------ C:\SDFix.exe
2008-03-02 18:48 . 2008-03-02 18:49 1,312,273 --a------ C:\default
2008-03-02 17:18 . 2008-03-02 17:18 <DIR> d-------- C:\Program Files\Sunbelt Software
2008-03-02 16:36 . 2008-03-13 19:25 26,240 --a------ C:\WINDOWS\system32\drivers\Fms64.sys
2008-03-02 16:19 . 2008-03-02 16:19 <DIR> d-------- C:\Program Files\Ashampoo
2008-03-01 14:16 . 2008-03-02 14:38 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-03-01 13:47 . 2008-03-01 13:47 <DIR> d-------- C:\Program Files\MagicISO
2008-02-27 15:52 . 2008-02-27 15:52 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\DassaultSystemes
2008-02-27 15:45 . 2008-02-27 15:45 0 --a------ C:\WINDOWS\eDrawingOfficeAutomator.INI
2008-02-27 15:43 . 2008-02-27 15:58 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-02-27 15:39 . 2008-02-27 15:39 <DIR> d-------- C:\WINDOWS\system32\GroupPolicy
2008-02-27 15:39 . 2008-02-27 16:02 <DIR> d-------- C:\Program Files\Common Files\SolidWorks Shared
2008-02-27 15:39 . 2008-02-27 15:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\SolidWorks
2008-02-27 15:38 . 2008-02-27 15:38 <DIR> d-------- C:\Program Files\Windows Desktop Search
2008-02-27 15:13 . 2008-02-27 15:13 <DIR> d-------- C:\Program Files\MSBuild
2008-02-27 15:11 . 2008-02-27 15:11 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-02-27 15:10 . 2008-02-27 15:10 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-02-27 15:09 . 2008-02-27 15:09 <DIR> d-------- C:\Program Files\MSECache
2008-02-27 14:55 . 2008-02-27 14:55 <DIR> d-------- C:\Program Files\PowerISO
2008-02-21 21:40 . 2008-03-02 17:53 <DIR> d-------- C:\Program Files\Opera
2008-02-15 19:07 . 2008-02-15 19:12 2,359,350 --a------ C:\WINDOWS\ACD Wallpaper.bmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-13 18:24 11,776 ----a-w C:\WINDOWS\system32\WLCtrl32.dll
2008-03-13 14:20 --------- d-----w C:\DOCUME~1\ALLUSE~1\DATAAP~1\avg7
2008-03-09 16:24 --------- d-----w C:\Program Files\ElcomSoft
2008-03-09 04:22 --------- d-----w C:\Program Files\QuickTime
2008-03-01 16:07 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-03-01 16:07 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-03-01 16:07 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-03-01 16:07 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-02-27 15:03 --------- d-----w C:\Program Files\SpeedFan
2008-02-27 14:55 --------- d-----w C:\Program Files\Software2000
2008-02-17 22:53 --------- d-----w C:\Program Files\Cool CENZURA
2008-02-07 20:15 --------- d-----w C:\Program Files\EA SPORTS
2008-02-06 20:19 --------- d-----w C:\Program Files\Electronic Arts
2008-02-06 19:38 --------- d-----w C:\Program Files\totalcmd
2008-02-03 19:48 278,984 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys
2008-02-03 19:48 --------- d-----w C:\Program Files\Zaklínač
2008-02-03 19:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-31 16:54 --------- d-----w C:\Program Files\THQ
2008-01-27 21:56 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-01-26 23:31 --------- d-----w C:\Program Files\uTorrent
2008-01-20 07:07 33,292 ----a-w C:\WINDOWS\system32\drivers\scdemu.sys
2008-01-16 16:20 52,736 ----a-w C:\WINDOWS\ipuninst.exe
2008-01-16 16:18 --------- d-----w C:\Program Files\BlackIsle
2008-01-02 10:13 197,120 ----a-w C:\WINDOWS\system32\FHMcom_OxleyStrip.scr
2007-09-23 21:32 4,687,304 ----a-w C:\Program Files\paradisepoker_com_cs.exe
2007-01-14 21:00 1 ----a-w C:\Documents and Settings\User\SI.bin
2005-08-08 00:41 35,328 ----a-w C:\Program Files\usb_format.exe
2002-05-27 08:25 295,424 ----a-w C:\Program Files\SubtitleToolCZ.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 13:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-12-18 17:32 25365032]
"pdfSaver3"="c:\Program Files\PDF\pdfSaver\pdfSaver3.exe" [2004-05-19 14:29 385024]
"uTorrent"="C:\Program Files\uTorrent\utorrent.exe" [2008-01-26 18:02 219952]
"QIP2005"="C:\Program Files\QIP\qip.exe" [2007-11-16 14:17 3264512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 14:43 7630848]
"nwiz"="nwiz.exe" [2006-08-11 14:43 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 14:43 86016]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 07:54 16248320 C:\WINDOWS\RTHDCPL.exe]
"pdfSaver3"="" []
"602PC SUITE PDF Saver"="C:\Program Files\Common Files\602phs\pdfSaver.exe" [2005-08-31 16:00 49152]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2005-10-18 10:58 278528]
"tsnpstd3"="C:\WINDOWS\tsnpstd3.exe" [2006-07-07 15:04 262144]
"snpstd3"="C:\WINDOWS\vsnpstd3.exe" [2006-09-18 14:12 843776]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-01-20 08:05 217088]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-03-09 12:19 2957824]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 13:00 15360]

C:\DOCUME~1\ALLUSE~1\NABDKA~1\Programy\POSPUT~1\
Mˇstnˇ vyhled v nˇ.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 15:40:46 118784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 15:39 294400]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\QIP\\qip.exe"=
"C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-02-20 13:34]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-02-20 13:34]
R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-03-09 12:19]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2006-03-02 13:00]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB;C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 23:08]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB;C:\WINDOWS\system32\DRIVERS\usbohci.sys [2006-03-02 13:00]
S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys [2006-08-28 23:54]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys []
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{23146296-69c9-11dc-a3cc-001617ba045b}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-13 19:26:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\WLCtrl32.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
.
**************************************************************************
.
Completion time: 2008-03-13 19:30:35 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-13 18:30:27
ComboFix2.txt 2008-03-13 15:01:16
ComboFix3.txt 2008-03-12 16:01:47
ComboFix4.txt 2008-03-12 19:53:12
ComboFix5.txt 2008-03-11 21:32:55
.
2008-03-11 22:22:05 --- E O F ---

[ivo.hriso]

A po restartu Pc je vedle WLCtrl.dl_ opět WLCtrl.dll. hmm.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:07:00, on 13.3.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\602phs\pdfSaver.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\tsnpstd3.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\PDF\pdfSaver\pdfSaver3.exe
C:\Program Files\uTorrent\utorrent.exe
C:\Program Files\QIP\qip.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Skype\Plugin Manager\SkypePM.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\User\Plocha\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [602PC SUITE PDF Saver] "C:\Program Files\Common Files\602phs\pdfSaver.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [pdfSaver3] "c:\Program Files\PDF\pdfSaver\pdfSaver3.exe"
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\utorrent.exe"
O4 - HKCU\..\Run: [QIP2005] C:\Program Files\QIP\qip.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Jádro Plánovače úloh SolidWorks.lnk = C:\Program Files\SolidWorks\swScheduler\swBOEngine.exe
O4 - Global Startup: Místní vyhledávání.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Poslat jako MMS - res://C:\Program Files\O2\SMSender\SMSender.E.dll/1001
O8 - Extra context menu item: Poslat jako SMS - res://C:\Program Files\O2\SMSender\SMSender.E.dll/1000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WLCtrl32 - C:\WINDOWS\SYSTEM32\WLCtrl32.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 7602 bytes

[Baron Prášil]

no,už to řešíme tři a podle mýho je tam nějakej růtkit mizernej.

zaskoč sem http://www.viry.cz/forum/viewtopic.php?t=14396
a udělej body 1.) 2.) a 5.) pošli logy

[ivo.hriso]

Tak bod jedna ccleaner provedeno.
Bod dva taktéž rootkit revealer log posílám a jdu na icesword.


HKU\.DEFAULT\Control Panel\International 13.3.2008 19:30 0 bytes Security mismatch.
HKU\.DEFAULT\Control Panel\International\Geo 13.3.2008 19:30 0 bytes Security mismatch.
HKU\S-1-5-21-507921405-1284227242-1801674531-1004\Control Panel\International 13.3.2008 21:33 0 bytes Security mismatch.
HKU\S-1-5-21-507921405-1284227242-1801674531-1004\Control Panel\International\Geo 13.3.2008 19:30 0 bytes Security mismatch.
HKU\S-1-5-21-507921405-1284227242-1801674531-1004\Software\SecuROM\!CAUTION! NEVER DELETE OR CHANGE ANY KEY* 6.2.2008 21:26 0 bytes Key name contains embedded nulls (*)
HKU\S-1-5-21-507921405-1284227242-1801674531-1004\Software\SecuROM\License information* 27.1.2008 22:56 0 bytes Key name contains embedded nulls (*)
HKU\S-1-5-18\Control Panel\International 13.3.2008 19:30 0 bytes Security mismatch.
HKU\S-1-5-18\Control Panel\International\Geo 13.3.2008 19:30 0 bytes Security mismatch.
HKLM\SECURITY\Policy\Secrets\SAC* 24.11.2006 14:32 0 bytes Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAI* 24.11.2006 14:32 0 bytes Key name contains embedded nulls (*)
C:\Documents and Settings\User\Data aplikací\Opera\Opera\profile\cache4\dcache4.url 13.3.2008 21:36 863.41 KB Hidden from Windows API.
C:\Documents and Settings\User\Data aplikací\Opera\Opera\profile\vlink4.dat 13.3.2008 21:36 217.65 KB Hidden from Windows API.

[ivo.hriso]

tak dva logy z Iceswordu Pochopil jsem zprávně, že ty dva s otazníky v kernel module jsou hlavní podezřelí?
V processu nic červeně.

Process:

System Idle Process
System
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.exe
C:\Program Files\Common Files\602PHS\pdfSaver.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\tsnpstd3.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PDF\pdfSaver\pdfSaver3.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\uTorrent\utorrent.exe
C:\Program Files\QIP\qip.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\searchindexer.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Documents and Settings\User\Plocha\Nov  slo§ka (2)\IceSword.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\alg.exe





Kernel Module:

\WINDOWS\system32\ntkrnlpa.exe
\WINDOWS\system32\hal.dll
\WINDOWS\system32\KDCOM.DLL
\WINDOWS\system32\BOOTVID.dll
ACPI.sys
\WINDOWS\system32\DRIVERS\WMILIB.SYS
pci.sys
ohci1394.sys
\WINDOWS\system32\DRIVERS\1394BUS.SYS
isapnp.sys
pciide.sys
\WINDOWS\system32\DRIVERS\PCIIDEX.SYS
MountMgr.sys
ftdisk.sys
PartMgr.sys
VolSnap.sys
atapi.sys
disk.sys
\WINDOWS\system32\DRIVERS\CLASSPNP.SYS
Fms64.sys
fltMgr.sys
sr.sys
KSecDD.sys
Ntfs.sys
NDIS.sys
speedfan.sys
Mup.sys
giveio.sys
\SystemRoot\system32\DRIVERS\AmdK8.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\irsir.sys
\SystemRoot\system32\DRIVERS\irenum.sys
\SystemRoot\system32\DRIVERS\fdc.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\usbohci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\imapi.sys
\SystemRoot\system32\drivers\pfc.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\redbook.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\System32\Drivers\GEARAspiWDM.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\nvnetbus.sys
\SystemRoot\system32\DRIVERS\NVNRM.SYS
\SystemRoot\system32\DRIVERS\NVSNPU.SYS
\SystemRoot\system32\DRIVERS\nv4_mini.sys
\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
\SystemRoot\system32\DRIVERS\audstub.sys
\SystemRoot\system32\DRIVERS\rasirda.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\psched.sys
\SystemRoot\system32\DRIVERS\msgpc.sys
\SystemRoot\system32\DRIVERS\ptilink.sys
\SystemRoot\system32\DRIVERS\raspti.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\update.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\NVENETFD.sys
\SystemRoot\system32\drivers\RtkHDAud.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\flpydisk.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\Drivers\mnmdd.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\fwdrv.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\rasacd.sys
\SystemRoot\system32\DRIVERS\ipsec.sys
\SystemRoot\system32\DRIVERS\tcpip.sys
\SystemRoot\System32\Drivers\aswTdi.SYS
\SystemRoot\system32\DRIVERS\netbt.sys
\SystemRoot\System32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
\SystemRoot\System32\Drivers\SCDEmu.SYS
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\drivers\khips.sys
\SystemRoot\system32\DRIVERS\ipnat.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\snpstd3.sys
\SystemRoot\system32\DRIVERS\STREAM.SYS
\SystemRoot\system32\drivers\usbaudio.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\System32\Drivers\Fips.SYS
\SystemRoot\System32\Drivers\Aavmker4.SYS
\SystemRoot\System32\Drivers\Cdfs.SYS
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_WMILIB.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\watchdog.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\drivers\dxgthk.sys
\SystemRoot\System32\nv4_disp.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\DRIVERS\irda.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\System32\Drivers\aswMon2.SYS
\SystemRoot\System32\Drivers\Fastfat.SYS
\SystemRoot\system32\drivers\wdmaud.sys
\SystemRoot\system32\drivers\sysaudio.sys
\SystemRoot\system32\drivers\kmixer.sys
\SystemRoot\system32\DRIVERS\mrxdav.sys
\SystemRoot\System32\Drivers\ParVdm.SYS
\SystemRoot\system32\DRIVERS\atksgt.sys
\SystemRoot\system32\DRIVERS\lirsgt.sys
\SystemRoot\system32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\secdrv.sys
\SystemRoot\System32\Drivers\HTTP.sys
\SystemRoot\System32\Drivers\aswRdr.SYS
\??\C:\WINDOWS\system32\Drivers\RKREVEAL150.SYS
\SystemRoot\System32\Drivers\IsDrv122.sys
\WINDOWS\system32\ntdll.dll
C:\WINDOWS\system32\giveio.sys
C:\WINDOWS\system32\speedfan.sys

[Baron Prášil]

toto
C:\WINDOWS\system32\drivers\Fms64.sys
nech zkontrolovat tady http://www.virustotal.com/flash/index_en.html
nepoužívej "Procházet" ale vlož do okna celou cestu,tučně označenou,k souboru metodou Ctrl+C > Ctrl+V

[ivo.hriso]

To je problem.
Přes operu se to tváří, že soubor odchází, ale nic se neděje.
Přes IE mi vyskočí hláška "0 bytes size received / Se ha recibido un archivo vacio"
a když skusím použít VirusTotalUploader, zahlásí mi to "eror! Access to the specified file was denied!
Nevim. Co s tím?

[ivo.hriso]

nejspíš mi to něco v Pc dokáže blokovat, hmm. ale co.

[Baron Prášil]

Stáhni si Suspicious File Packer
Rozbal ho a spusť ho (soubor sfp.exe)
Do okna které se ti zobrazí zkopíruj a vlož tento tučně označený text:
C:\WINDOWS\system32\drivers\Fms64.sys
pak klikni na tlačítko Continue
Program se ti přepne do druhého okna Step2: Create archive
Zavři program.
Na ploše se ti vytvoří soubor requested-files[2007-07-30_HH_MM].cab (místo 2007-07-30 budeš mít aktuální datum a kde HH - hodina a MM minuty)

Pokud se ti daný soubor vytvoří zabal ho např. do zipu a vlož ho ke svému příspěvku jako přílohu.

Poznámka: Je možné že už dané soubory nebudeš mít na disku, takže se ti nemusí vytvořit archiv.

[Baron Prášil]

hele,jinak. nic neposílej-použij superantispyware

Stáhni si SUPERAntiSpyware
Nainstaluj a spusť ho a klikni na tlačítko Check for Updates...
Po provedení Update klikni na tlačítko: Scan your computer
Zvol možnost: Perform Complete Scan a klikni na tlačítko Další >

Proběhne kontrola, po skončení vypíše vše co našel.
Ujisti se že všechny položko jsou zaškrtnuty a pak zvol tlačítko Další
Pak klikni na tlačítko Finish a měl by ses dostat na úvodní obrazovku.
Tam klikni na tlačítko: Preferences... a tam zvol záložku Statistics/Logs
Tam klikni na log s dnešním datem který tam bude a dej tlačítko: View Log...
Otevře se ti Okno s logem tak jeho obsah sem zkopíruj.

[ivo.hriso]

Posílám log z Superantispyware.


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 03/14/2008 at 06:00 PM

Application Version : 3.9.1008

Core Rules Database Version : 3259
Trace Rules Database Version: 1270

Scan type : Complete Scan
Total Scan Time : 00:30:47

Memory items scanned : 486
Memory threats detected : 0
Registry items scanned : 5238
Registry threats detected : 2
File items scanned : 34356
File threats detected : 4

Adware.Tracking Cookie
C:\Documents and Settings\User\Cookies\user@ad.seznam[1].txt

Adware.WhenU
HKCR\WUSE.1
HKCR\WUSE.1#WUSE_Id

Adware.Casino Games (Golden Palace Casino)
C:\GAMES\CASINO\SPORTINGBET CASINO\CASINO.EXE
C:\DOCUMENTS AND SETTINGS\USER\NABíDKA START\PROGRAMY\HRY\SPORTINGBET CASINO\SPORTINGBET CASINO.LNK
C:\GAMES\SPORTINGBET CASINO.LNK