Tento článek se bude zabývat utilitou HijackThis – 3. část.
Pro fanoušky HijackThis tu přináším pár procesů a klíčů v registrech, které jsou bezpečné, časem budu rozšiřovat.
Procesy
Systémové
- %windir%\System32\smss.exe
- %windir%\system32\winlogon.exe
- %windir%\system32\services.exe
- %windir%\system32\lsass.exe
- %windir%\system32\svchost.exe
- %windir%\System32\svchost.exe
- %windir%\Explorer.EXE
- %windir%\System32\svchost.exe
Antiviry
AVG
- avgcc.exe
- avgemc.exe
- avgamsvr.exe
- avgupsvc.exe
NOD32
- nod32krn.exe
- nod32kui.exe
NORTON Antivirus
- SAVScan.exe
- navapsvc.exe
- ccSetMgr.exe
- ccEvtMgr.exe
- ccApp.exe
PC-Cillin
- PCCPFW.exe
- Tmntsrv.exe
McAfee
- shstat.exe
- Mcshield.exe
- UpdaterUI.exe
Avast!
- aswUpdSv.exe
- ashserv.exe
- ashMaiSv.exe
- ashSimpl.exe
- ashDisp.exe
Firewally
Kerio
- kpf4gui.exe – proces je spuštěn 2×, to je v pořádku.
- kpf4gui.exe
- kpf4ss.exe
Zone Alarm
- zonealarm.exe
- zlclient.exe
- vsmon.exe
Grafické karty
- Ati2evxx.exe
- atiptaxx.exe
- nvsvc32.exe
Anti-Spyware
Spybot – Search & Destroy
- TeaTimer.exe
Zvukové karty
- CTsvcCDA.exe
Oblíbené programy
- winamp.exe
- Winampa.exe
- wmplayer.exe
- qip.exe
- ICQLite.exe
- Miranda.exe
- Xchat.exe
- mirc.exe
- firefox.exe
- iexplore.exe
- k-meleon.exe
Registry
Antiviry
AVG
- O4 - HKLM\..\Run: [AVG7_CC] "x:\xxx\avgcc.exe" /STARTUP
- O4 - HKLM\..\Run: [AVG7_EMC] "x:\xxx\avgemc.exe"
- O4 - HKLM\..\Run: [AVG7_RegCleaner] "x:\xxx\avgregcl.exe" /BOOT
NOD32
- O4 - HKLM\..\Run: [nod32kui] "x:\xxx\nod32kui.exe" /WAITSERVICE
McAfee
- O4 - HKLM\..\Run: [ShStatEXE] "x:\xxx\SHSTAT.EXE" /STANDALONE
- O4 - HKLM\..\Run: [McAfeeUpdaterUI] "x:\xxx\UpdaterUI.exe" /StartedFromRunKey
- O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - "x:\xxx\Mcshield.exe"
- O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - "x:\xxx\VsTskMgr.exe"
- O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - "x:\xxx\FrameworkService.exe" /ServiceStart
Avast!
- O4 - HKLM\..\Run: [avast!] "x:\xxx\ashDisp.exe
- O23 - Service: avast! iAVS4 Control Service - Unknown - "x:\xxx\aswUpdSv.exe
- O23 - Service: avast! Antivirus - Unknown - "x:\xxx\ashServ.exe
- O23 - Service: avast! Mail Scanner - ALWIL Software - "x:\xxx\ashMaiSv.exe
NORTON Antivirus
- O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - "x:\xxx\NavShExt.dll"
- O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - "x:\xxx\NavShExt.dll"
- O4 - HKLM\..\Run: [NAV Agent] "x:\xxx\navapw32.exe"
- O4 - HKLM\..\Run: [iamapp] "x:\xxx\IAMAPP.EXE"
- O4 - HKLM\..\Run: [Symantec NetDriver Monitor] "x:\xxx\SNDMon.exe"
- O4 - HKLM\..\Run: [SSC_UserPrompt] "x:\xxx\UsrPrmpt.exe"
Firewally
Kerio Personal Firewall
- O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - "x:\xxx\kpf4ss.exe"
Zone Alarm
- O4 - HKLM\..\Run: [Zone Labs Client] "x:\xxx\zlclient.exe"
Proxy
- O4 - HKLM\..\Run: [www.cproxy.com] "x:\xxx\CPROXY.exe"
- O8 - Extra context menu item: Zobrazit originál - x:\xxx\original.htm
- O8 - Extra context menu item: Zobrazit vše jako originál - x:\xxx\originalAll.htm
Wireless
- O4 - HKLM\..\Run: [GlobeTrotter Mobility Manager] "x:\xxx\MobilityManager.exe"
Grafické karty
ATI
- O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
- O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - "C:\WINDOWS\System32\Ati2evxx.exe"
- O23 - Service: ATI Smart - Unknown - "C:\WINDOWS\system32\ati2sgag.exe"
nVidia
- O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
- O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
- O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
- O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - "C:\WINDOWS\system32\nvsvc32.exe"
Spybot – Search & Destroy
- O4 - HKLM\..\Run: [SpybotSnD] "x:\xxx\SpybotSD.exe" /autoclose
- O4 - HKCU\..\Run: [SpybotSD TeaTimer] "x:\xxx\TeaTimer.exe
- O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - "C:\PROGRA~1\SPYBOT~1\SDHelper.dll"
Ovladače od Creative
- O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
- O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - "C:\WINDOWS\System32\CTsvcCDA.exe"
Winamp
- O4 - HKLM\..\Run: [WinampAgent] "x:\xxx\Winampa.exe"
ICQ Lite
- O9 - Extra button: ICQ 4 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - "x:\xxx\ICQLite.exe"
- O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - "x:\xxx\ICQLite.exe"
To je prozatím vše, nejspíše už začnu jiné téma než HijackThis, vše důležité jsem snad řekl. V příštím díle se dozvíme o viru Win32/Stration (Warezov).