Utility a zabezpečení Windows - 13. díl

Tento článek se bude zabývat utilitou HijackThis – 3. část.

Pro fanoušky HijackThis tu přináším pár procesů a klíčů v registrech, které jsou bezpečné, časem budu rozšiřovat.

Procesy

Systémové

• %windir%\System32\smss.exe
• %windir%\system32\winlogon.exe
• %windir%\system32\services.exe
• %windir%\system32\lsass.exe
• %windir%\system32\svchost.exe
• %windir%\System32\svchost.exe
• %windir%\Explorer.EXE
• %windir%\System32\svchost.exe

Antiviry

AVG

• avgcc.exe
• avgemc.exe
• avgamsvr.exe
• avgupsvc.exe

NOD32

• nod32krn.exe
• nod32kui.exe

NORTON Antivirus

• SAVScan.exe
• navapsvc.exe
• ccSetMgr.exe
• ccEvtMgr.exe
• ccApp.exe

PC-Cillin

• PCCPFW.exe
• Tmntsrv.exe

McAfee

• shstat.exe
• Mcshield.exe
• UpdaterUI.exe

Avast!

• aswUpdSv.exe
• ashserv.exe
• ashMaiSv.exe
• ashSimpl.exe
• ashDisp.exe

Firewally

Kerio

• kpf4gui.exe – proces je spuštěn 2×, to je v pořádku.
• kpf4gui.exe
• kpf4ss.exe

Zone Alarm

• zonealarm.exe
• zlclient.exe
• vsmon.exe

Grafické karty

• Ati2evxx.exe
• atiptaxx.exe
• nvsvc32.exe

Anti-Spyware

Spybot – Search & Destroy

• TeaTimer.exe

Zvukové karty

• CTsvcCDA.exe

Oblíbené programy

• winamp.exe
• Winampa.exe
• wmplayer.exe
• qip.exe
• ICQLite.exe
• Miranda.exe
• Xchat.exe
• mirc.exe
• firefox.exe
• iexplore.exe
• k-meleon.exe

Registry

Antiviry

AVG

• O4 - HKLM\..\Run: [AVG7_CC] "x:\xxx\avgcc.exe" /STARTUP
• O4 - HKLM\..\Run: [AVG7_EMC] "x:\xxx\avgemc.exe"
• O4 - HKLM\..\Run: [AVG7_RegCleaner] "x:\xxx\avgregcl.exe" /BOOT

NOD32

• O4 - HKLM\..\Run: [nod32kui] "x:\xxx\nod32kui.exe" /WAITSERVICE

McAfee

• O4 - HKLM\..\Run: [ShStatEXE] "x:\xxx\SHSTAT.EXE" /STANDALONE
• O4 - HKLM\..\Run: [McAfeeUpdaterUI] "x:\xxx\UpdaterUI.exe" /StartedFromRunKey
• O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - "x:\xxx\Mcshield.exe"
• O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - "x:\xxx\VsTskMgr.exe"
• O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - "x:\xxx\FrameworkService.exe" /ServiceStart

Avast!

• O4 - HKLM\..\Run: [avast!] "x:\xxx\ashDisp.exe
• O23 - Service: avast! iAVS4 Control Service - Unknown - "x:\xxx\aswUpdSv.exe
• O23 - Service: avast! Antivirus - Unknown - "x:\xxx\ashServ.exe
• O23 - Service: avast! Mail Scanner - ALWIL Software - "x:\xxx\ashMaiSv.exe

NORTON Antivirus

• O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - "x:\xxx\NavShExt.dll"
• O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - "x:\xxx\NavShExt.dll"
• O4 - HKLM\..\Run: [NAV Agent] "x:\xxx\navapw32.exe"
• O4 - HKLM\..\Run: [iamapp] "x:\xxx\IAMAPP.EXE"
• O4 - HKLM\..\Run: [Symantec NetDriver Monitor] "x:\xxx\SNDMon.exe"
• O4 - HKLM\..\Run: [SSC_UserPrompt] "x:\xxx\UsrPrmpt.exe"

Firewally

Kerio Personal Firewall

• O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - "x:\xxx\kpf4ss.exe"

Zone Alarm

• O4 - HKLM\..\Run: [Zone Labs Client] "x:\xxx\zlclient.exe"

Proxy

• O4 - HKLM\..\Run: [www.cproxy.com] "x:\xxx\CPROXY.exe"
• O8 - Extra context menu item: Zobrazit originál - x:\xxx\original.htm
• O8 - Extra context menu item: Zobrazit vše jako originál - x:\xxx\originalAll.htm

Wireless

• O4 - HKLM\..\Run: [GlobeTrotter Mobility Manager] "x:\xxx\MobilityManager.exe"

Grafické karty

ATI

• O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
• O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - "C:\WINDOWS\System32\Ati2evxx.exe"
• O23 - Service: ATI Smart - Unknown - "C:\WINDOWS\system32\ati2sgag.exe"

nVidia

• O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
• O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
• O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
• O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - "C:\WINDOWS\system32\nvsvc32.exe"

Spybot – Search & Destroy

• O4 - HKLM\..\Run: [SpybotSnD] "x:\xxx\SpybotSD.exe" /autoclose
• O4 - HKCU\..\Run: [SpybotSD TeaTimer] "x:\xxx\TeaTimer.exe
• O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - "C:\PROGRA~1\SPYBOT~1\SDHelper.dll"

Ovladače od Creative

• O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
• O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - "C:\WINDOWS\System32\CTsvcCDA.exe"

Winamp

• O4 - HKLM\..\Run: [WinampAgent] "x:\xxx\Winampa.exe"

ICQ Lite

• O9 - Extra button: ICQ 4 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - "x:\xxx\ICQLite.exe"
• O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - "x:\xxx\ICQLite.exe"

To je prozatím vše, nejspíše už začnu jiné téma než HijackThis, vše důležité jsem snad řekl. V příštím díle se dozvíme o viru Win32/Stration (Warezov).