Winlogon.exe - vir? - 100 CPU ? další blbosti?

[nardeus]

Furt nic

[Reklama]

[bledulka]

Combofix přesuň na plochu
-otevři si Poznámkový blok
-Do něj zkopíruj text z tohoto okénka

Kód: Vybrat vše

Collect::
e:\windows\system32\audiohd.exe
e:\program files\Common Files\WUDHost.exe
e:\documents and settings\Administrator\Data aplikací\Isass.Exe

Registry::
[-HKEY_CURRENT_USER\software\microsoft\active setup\installed components\{1AAEE6FF-3DF7-AF7E-EE5B-FCF7BED2CDE2}]
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1AAEE6FF-3DF7-AF7E-EE5B-FCF7BED2CDE2}]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"Windows SafeAssign"=-
"Microsoft SecureAssist"=-
"e:\\Documents and Settings\\Administrator\\Data aplikací\\Isass.exe"=-
"e:\\Documents and Settings\\Administrator\\Data aplikací\\Application Updater.exe"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"Isass"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Isass"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"MixerDef"=-

Driver::
SetupNTGLM7X
 


-vytvořený TXT soubor ulož jako CFScript.txt na plochu a levým myšítkem přesuň nad ikonu Combofixu, kde ho upustíš

-Po proběhnutí skenu a ukončení combofixu by se měl objevit log, vlož ho zde.

Upozornění : Může se stát, že po aplikaci skriptu a restartu počítače Windows nenaběhnou, pak znovu restartuj počítač, mačkej F8 a pak zvol poslední známou funkční konfiguraci.



Ten soubor máš někde v počítači, zkus ho najít, tu cestu na virustotal ručně.

[nardeus]

ComboFix 10-07-19.05 - Administrator 20.07.2010 20:07:27.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.277 [GMT 2:00]
Spuštěný z: e:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: e:\documents and settings\Administrator\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

file zipped: e:\documents and settings\Administrator\Data aplikací\Isass.Exe
file zipped: e:\program files\Common Files\WUDHost.exe
file zipped: e:\windows\system32\audiohd.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

e:\documents and settings\Administrator\Data aplikací\Isass.Exe
e:\program files\Common Files\WUDHost.exe
e:\windows\system32\audiohd.exe

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SETUPNTGLM7X
-------\Service_SetupNTGLM7X


((((((((((((((((((((((((( Soubory vytvořené od 2010-06-20 do 2010-07-20 )))))))))))))))))))))))))))))))
.

2010-07-20 13:29 . 2010-04-29 13:39 38224 ----a-w- e:\windows\system32\drivers\mbamswissarmy.sys
2010-07-20 13:29 . 2010-04-29 13:39 20952 ----a-w- e:\windows\system32\drivers\mbam.sys
2010-07-20 13:29 . 2010-07-20 13:29 -------- d-----w- e:\program files\Malwarebytes' Anti-Malware
2010-07-19 17:10 . 2010-07-19 17:10 -------- d-----w- e:\program files\Hijack
2010-07-19 15:45 . 2010-07-19 15:45 -------- d-----w- e:\program files\CCleaner
2010-07-15 12:45 . 2010-07-15 12:45 -------- d--h--w- e:\windows\system32\GroupPolicy
2010-07-14 06:03 . 2010-06-14 14:31 744448 -c----w- e:\windows\system32\dllcache\helpsvc.exe
2010-06-30 14:47 . 2010-06-30 14:47 -------- d-----w- e:\windows\1C4551A64743409391E41477CD655043.TMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-20 18:16 . 2010-04-10 16:08 -------- d-----w- e:\program files\Common Files\Akamai
2010-07-16 18:18 . 2010-03-10 15:17 -------- d-----w- e:\program files\NCSoft
2010-06-30 14:47 . 2009-10-16 13:27 -------- d-----w- e:\program files\Common Files\Wise Installation Wizard
2010-06-30 14:45 . 2009-08-14 18:33 -------- d--h--w- e:\program files\InstallShield Installation Information
2010-06-23 19:52 . 2001-10-25 14:00 85556 ----a-w- e:\windows\system32\perfc005.dat
2010-06-23 19:52 . 2001-10-25 14:00 446580 ----a-w- e:\windows\system32\perfh005.dat
2010-06-17 11:22 . 2009-11-08 17:19 -------- d-----w- e:\program files\Common Files\Adobe
2010-06-14 14:31 . 2009-08-14 18:17 744448 ----a-w- e:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-05-25 16:14 . 2010-05-25 16:14 -------- d-----w- e:\program files\DIFX
2010-05-06 10:35 . 2004-08-17 13:49 916480 ----a-w- e:\windows\system32\wininet.dll
2010-05-02 08:09 . 2004-08-17 13:44 1851264 ----a-w- e:\windows\system32\win32k.sys
2010-04-28 09:53 . 2010-04-27 18:02 96 ---ha-w- e:\windows\system32\HsInfo.dat
2009-10-26 13:51 . 2009-10-26 13:56 0 ----a-w- e:\program files\5b513cd108dc1c0eb8ffc39b495d82ba.db
2009-09-07 17:33 . 2009-09-07 17:33 227696 ----a-w- e:\program files\mozilla firefox\components\AdVComponent.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="e:\documents and settings\Administrator\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2009-08-15 133104]
"Skype"="e:\program files\Skype\Phone\Skype.exe" [2010-04-06 26102056]
"LightScribe Control Panel"="e:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-06-20 451872]
"Steam"="c:\program files\steam\steam.exe" [2010-07-20 1238352]
"CTRegRun"="e:\windows\CTRegRun.EXE" [2006-10-06 53248]
"DriverUpdaterPro"="e:\program files\iXi Tools\Driver Updater Pro\DriverUpdaterPro.exe" [2009-10-30 2765860]
"NVIDIA"="e:\documents and settings\Administrator\Data aplikací\nvdisp.exe" [2010-07-19 139145]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Photo Downloader"="c:\adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"P17Helper"="P17.dll" [2005-05-03 64512]
"UpdReg"="e:\windows\UpdReg.EXE" [2000-05-11 90112]
"egui"="e:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-10-07 1461080]
"diagent"="e:\program files\Creative\Diagnostics\diagent.exe" [2002-04-03 135264]
"C-Media Mixer"="Mixer.exe" [2002-10-15 1818624]
"Lachesis"="c:\program files\Razer\Lachesis\razerhid.exe" [2007-09-12 172032]
"NVIDIA"="e:\documents and settings\Administrator\Data aplikací\nvdisp.exe" [2010-07-19 139145]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="e:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

e:\documents and settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma.lnk - e:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
hamachi.lnk - e:\program files\Hamachi\hamachi.exe [2009-11-17 624416]

e:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Orbit.lnk - e:\program files\Orbitdownloader\orbitdm.exe [2009-8-27 1719568]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"e:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"e:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"e:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"e:\\Program Files\\AresTorrentDownloader\\AresTorrentDownloader.exe"=
"e:\\Program Files\\Metin2_CZ\\metin2.bin"=
"e:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WOW 3.2.2!\\WoW-3.1.3.9947-to-3.2.0.10192-enGB-downloader.exe"=
"c:\\WOW 3.2.2!\\Launcher.exe"=
"c:\\WOW 3.2.2!\\WoW-3.2.0.10192-to-3.2.0.10314-enGB-downloader.exe"=
"c:\\WOW 3.2.2!\\WoW-3.2.0.10314-to-3.2.2.10482-enGB-downloader.exe"=
"c:\\WOW 3.2.2!\\WoW-3.2.2.10482-to-3.2.2.10505-enGB-downloader.exe"=
"e:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"e:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=
"e:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"e:\\Documents and Settings\\Administrator\\Data aplikací\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Counter-Strike 1.6\\hl.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"e:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Steam\\steamapps\\nardeuss\\condition zero deleted scenes\\hl.exe"=
"c:\\Games\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\nardeuss\\counter-strike beta\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\srcds.exe"=
"c:\\Program Files\\Steam\\steamapps\\nardeuss\\condition zero\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\shattered_horizon\\client_exe\\shattered_horizon.exe"=
"Microsoft Windows Hosting Service Login"= e:\docume~1\ADMINI~1\LOCALS~1\Temp\scvhost.exe
"c:\\Program Files\\FlatOut2\\FlatOut2.exe"=
"c:\\Program Files\\Steam\\steamapps\\nardeuss\\counter-strike\\hl.exe"=
"e:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"3306:TCP"= 3306:TCP:MySQL Server
"1067:TCP"= 1067:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface

R1 epfwtdir;epfwtdir;e:\windows\system32\drivers\epfwtdir.sys [18.8.2008 13:27 35168]
R2 Akamai;Akamai NetSession Interface;e:\windows\System32\svchost.exe -k Akamai [17.8.2004 15:49 14336]
R2 ekrn;Eset Service;e:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [7.10.2009 10:16 472280]
R2 MySQL41;MySQL41;"c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt" --defaults-file="c:\program files\MySQL\MySQL Server 5.0\my.ini" MySQL41 --> c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt [?]
R3 LachesisFltr;Lachesis Mouse Driver;e:\windows\system32\drivers\Lachesis.sys [25.5.2010 18:14 12032]
S2 MySQL4;MySQL4;"e:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt" --defaults-file="e:\program files\MySQL\MySQL Server 5.0\my.ini" MySQL4 --> e:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt [?]
S2 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;"e:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe" --> e:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [?]
S2 XAMPP;XAMPP Service;e:\program files\xampp\service.exe --> e:\program files\xampp\service.exe [?]
S3 BeSk81;BeSk81;\??\e:\documents and settings\Administrator\Dokumenty\Downloads\Let_s_Engine_3.0__Auto-delete___Double_Kill_hack___Damage_Hack___Delay_Hack\Let's Engine 3.0 +Auto-delete + Double Kill hack + Damage Hack + Delay Hack\BeSk8.sys --> e:\documents and settings\Administrator\Dokumenty\Downloads\Let_s_Engine_3.0__Auto-delete___Double_Kill_hack___Damage_Hack___Delay_Hack\Let's Engine 3.0 +Auto-delete + Double Kill hack + Damage Hack + Delay Hack\BeSk8.sys [?]
S3 CEDRIVER53;CEDRIVER53;\??\e:\program files\Cheat Enginee\dbk32.sys --> e:\program files\Cheat Enginee\dbk32.sys [?]
S3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);e:\windows\system32\drivers\vcsvad.sys [13.3.2010 17:17 17792]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-06-20 10:47 451872 ----a-w- e:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'

2010-06-23 e:\windows\Tasks\AppleSoftwareUpdate.job
- e:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.zaparit.cz/
IE: &Download by Orbit - e:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - e:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - e:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - e:\program files\Orbitdownloader\orbitmxt.dll/202
FF - ProfilePath - e:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\o6tnuthg.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.orbitdownloader.com
FF - component: e:\program files\Mozilla Firefox\components\AdVComponent.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - e:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-20 20:16
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
"ImagePath"="\"e:\program files\MySQL\MySQL Server 5.1\bin\mysqld\" --defaults-file=\"e:\program files\MySQL\MySQL Server 5.1\my.ini\" MySQL"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL4]
"ImagePath"="\"e:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"e:\program files\MySQL\MySQL Server 5.0\my.ini\" MySQL4"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL41]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.0\my.ini\" MySQL41"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-507921405-725345543-680672661-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b8,e7,e3,d0,34,79,a6,47,a4,77,56,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b8,e7,e3,d0,34,79,a6,47,a4,77,56,\

[HKEY_USERS\S-1-5-21-507921405-725345543-680672661-500\Software\SecuROM\License information*]
"datasecu"=hex:30,3b,b9,9a,e6,dc,7e,ae,d2,4a,c6,32,54,0e,3b,42,52,03,ed,f2,a8,
a2,5b,80,b4,45,23,17,52,75,c5,9c,17,96,db,6f,09,f7,9e,47,61,23,b4,b2,48,ac,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(764)
e:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3720)
e:\windows\system32\webcheck.dll
e:\windows\system32\WPDShServiceObj.dll
e:\windows\system32\PortableDeviceTypes.dll
e:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
e:\windows\system32\Ati2evxx.exe
e:\windows\system32\Ati2evxx.exe
e:\windows\system32\Rundll32.exe
e:\windows\Mixer.exe
e:\documents and settings\Administrator\Local Settings\Data aplikací\Google\Update\1.2.183.29\GoogleCrashHandler.exe
e:\program files\Orbitdownloader\orbitnet.exe
e:\program files\Bonjour\mDNSResponder.exe
e:\program files\Common Files\InterVideo\DeviceService\DevSvc.exe
e:\windows\system32\CTsvcCDA.exe
e:\program files\Java\jre6\bin\jqs.exe
e:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
c:\program files\Razer\Lachesis\OSD.exe
c:\program files\Razer\Lachesis\razertra.exe
e:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Razer\Lachesis\razerofa.exe
e:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Celkový čas: 2010-07-20 20:19:49 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-07-20 18:19
ComboFix2.txt 2010-07-20 16:11

Před spuštěním: Volných bajtů: 58 010 103 808
Po spuštění: Volných bajtů: 57 931 399 168

- - End Of File - - B7A4FFC0ED733A38F7E4B1F0938E5B8A

[bledulka]

Fajn, vypadá to dobře, co počítač?
Byl bys ještě pro jeden sken, vzhledem k tomu, jak to bylo zavirované? Ale trvá dost dlouho.

[nardeus]

No já nevím :) Ale jestli to vypadá dobře tak ted ne .. Kdyžtak mi to sem písni jestli chceš.. Ale nevim, nevím.. A díky za pomoc.

[bledulka]

Log z combofixu vypadá dobře, ale samozřejmě že vždy záleží na otm, co počítač. Co jsou ted za problémy?

Odinstaluj combofix přes
Start >> Spustit zkopíruj do okénka:
ComboFix /Uninstall

stiskni Enter
-To odinstaluje ComboFix a smaže s ním související soubory a složky.


Stáhni T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

-Spusť,pro potvrzení volby mačkej klávesu A, Enter
-po použití prográmek vymaž.Pozor,antiviry ho mohou falešně označit za vir

*****************************************


Stahni AVPtool http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/
-nainstaluj, nech provést sken všechn jednotek
-co najde nech léčit
-pak sem vlož log.