Rundll32.exe - Skąd To W Procesach ?

[Bo$s]

Słyszałem, ze rundll32 w porcesach może oznaczać jakis syf. Ad-Aware, kaspersky i outpost spyware plugin nic nie wykryły. wydaje mi się że pojawiło się to po instalacji steów Ati (wcześniej miałem NV), ale nie jestem pewien. Jeśli ktoś ma grafe ati to proszę napisać czy rndll32.exe startuje razem z systemem.

 

wklejam log z Hijachthis:

 

Logfile of HijackThis v1.99.1

Scan saved at 16:17:43, on 2005-10-02

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

D:\cFosSpeed\spd.exe

C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

D:\Outpost Firewall\outpost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Microsoft IntelliPoint\point32.exe

D:\SpeedTouch USB\Dragdiag.exe

D:\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe

C:\WINDOWS\system32\Rundll32.exe

D:\cFosSpeed\cfos_speed.exe

D:\StatBar\StatBar.exe

D:\Radeon Omega Drivers\v2.6.71\ATI Tray Tools\atitray.exe

D:\AutoConnect\AutoConnect.exe

D:\Madotate\madotate.exe

D:\Konnekt\konnekt.exe

D:\Winamp\Winamp.exe

D:\eMule\emule.exe

C:\Documents and Settings\Tomek\Pulpit\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://update.microsoft.com/windowsupdate/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O4 - HKLM\..\Run: [KAVPersonal50] "D:\Kaspersky Anti-Virus Personal\kav.exe" /minimize

O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"

O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "D:\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [CTSysVol] D:\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r

O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper

O4 - HKLM\..\Run: [cFosSpeed] D:\cFosSpeed\cfos_speed.exe

O4 - HKLM\..\Run: [Outpost Firewall] D:\Outpost Firewall\outpost.exe /waitservice

O4 - HKLM\..\Run: [OutpostFeedBack] D:\Outpost Firewall\feedback.exe /dump:os_startup

O4 - HKCU\..\Run: [statBar] D:\StatBar\StatBar.exe

O4 - HKCU\..\Run: [ccleaner] "D:\CCleaner\ccleaner.exe" /AUTO

O4 - HKCU\..\Run: [AtiTrayTools] D:\Radeon Omega Drivers\v2.6.71\ATI Tray Tools\atitray.exe

O4 - HKCU\..\Run: [AutoConnect] D:\AutoConnect\AutoConnect.exe

O4 - HKCU\..\Run: [Konnekt] "D:\Konnekt\konnekt.exe" /autostart

O4 - Startup: madotate.lnk = D:\Madotate\madotate.exe

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\MICROS~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\OFFICE11\REFIEBAR.DLL

O17 - HKLM\System\CCS\Services\Tcpip\..\{0F5578B2-002D-49A4-8F99-E901E36CF82E}: NameServer = 212.244.88.3,193.110.120.5

O17 - HKLM\System\CCS\Services\Tcpip\..\{DC7A90FF-CB78-4E0F-BDA4-A8402D00BBB2}: NameServer = 212.244.88.3 193.110.120.5

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 193.110.120.5

O17 - HKLM\System\CS1\Services\Tcpip\..\{0F5578B2-002D-49A4-8F99-E901E36CF82E}: NameServer = 212.244.88.3,193.110.120.5

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 193.110.120.5

O17 - HKLM\System\CS2\Services\Tcpip\..\{0F5578B2-002D-49A4-8F99-E901E36CF82E}: NameServer = 212.244.88.3,193.110.120.5

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 193.110.120.5

O20 - AppInit_DLLs: D:\OUTPOS~1\wl_hook.dll

O21 - SSODL: IconPackager Repair - {1799460C-0BC8-4865-B9DF-4A36CD703FF0} - D:\IconPackager\iprepair.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - D:\cFosSpeed\spd.exe" -service (file missing)

O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: kavsvc - Kaspersky Lab - D:\Kaspersky Anti-Virus Personal\kavsvc.exe

O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - D:\Outpost Firewall\outpost.exe

[SGJ]

O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper

[Bo$s]

Hmmm.. sterowniki mojego SB Live! 24-bit. Tak ma być ?