Anonymous (0)
비회원
|  게시일: 2008-03-02 11:29| |
kykkysp 님 autoruns 로그 화일 내용에 빠진 부분이 있는듯 싶네요.
winlogon 부분 등이 없는것으로 보아서 로그가 잘 생성되지 않은듯 싶습니다. autoruns 는 실행을 하고 searching 하는 시간이 좀 걸리므로 바로 저장하지 마시고 기다렸다가 searching 이 다 된후에 저장하시면 됩니다. 다시 저장해서 보내주세요. 아니면 게시판에 글처럼 붙여넣기로 하시면 됩니다.
hijackthis 를 보니 DPF ( ActiveXcontrol) 이 엄청나게 많더군요.
전 한국이 아닌 안드로메다에(?) 살기 때문에 은행이라던지 특별하게 ActiveXcontrol 을 많이 설치하지 않게 되는 환경인데 역시 한국은 이게 무쟈게 많네요. 거의 60~70여개 정도 되어 보이더군요. 이게 모두 필요하지 않는 것이라면 싹 정리하시길 권하는데 혹시 모르니 아버지와 상의 하셔서 제거 하시면 좋겠군요. 어차피 필요할때 다시 다운받으면 되기 때문에...
그리고
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
은 지워도 되는데 최근에 bluescreen 에러가 system 에서 발생한것으로 보여지는군요.
로그를 보아하니 특별하게 문제되어 보이는것은 없구요. DPF 가 많이 있다고 컴퓨터가 느려지진 않는것 같으므로 다른 이유인듯 합니다.
컴퓨터가 느리다는것이 시스템 운영이 느린것인지 인터넷 브라우져를 열때 느린것인지 궁금하네요. IE 를 열면 네이버 툴바나 다른 addon 툴바 등이 같이 실행되니깐 느려진다고 봐야 합니다. 네이버 툴바를 uncheck 하신후 IE 여는 속도를 확인해 보셔야 할것 같군요. 컴퓨터의 운영속도가 느린것은 메모리가 얼마나 있는지 CPU 사양이 얼마나 있는지 에 따라서도 차이가 나므로 관련정보 없이 말씀드리기가 모호합니다. 다만 xp sp1이 설치되어 있는것으로 보아 방화벽이 현재 설치되어 있지 않으며 컴퓨터 사양이 좀 옛날것이라 메모리나 시피유 속도가 적을것이다라고 생각되어 지는군요. 웜이 있는경우 방화벽을 설치하면 바로 적발이 되는 경우가 있으므로 방화벽이 없다면 sp2로 업글하거나 zonealarm 같은 방화벽을 설치해 보시기 바랍니다.
현재 주신 로그로 봤을때 특별하게 의심가는 화일이나 프로세스 목록은 없어 보입니다.
O18 - Protocol: s-http - {D37E6C5F-1C0F-47C0-A3B6-403EEC555402} - C:\Program Files\INITECH\SHTTP\InitechSHTTPInterface.10111.dll
은 저한테 생소한데 inisafe web v.7 인가 하는 은행아니면 관공서 관련 프로그램이나 프로토콜 같아 보이므로 그냥 제거 하지 않으셔도 될것 같네요.
현재 주신 autoruns 로그에서 보면
+ 작업 표시줄 및 시작 메뉴 File not found: CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\InprocServer32
이런식으로 File not found 라고 된 entries 는 모두 삭제하셔도 됩니다. 이것은 현재 해당위치에 있는 화일은 없거나 제거 되었는데 레지스트리에 남아서 나타나는 것이고 이런 불필요한 레지스트리들은 나중에 컴퓨터를 느리게 할 수있으므로 레지스트리 백업을 하셨다면 지우시길 권유 합니다.
다시 한번 autoruns 로그를 저장해서 올려주시구요. 시스템 사양도 알려주시구요.
보통 바이러스들은 winlogon.exe, userinit.exe, explorer.exe 같은 shell 프로세스에 hook 을 하거나 Internet explorer 에 툴바등의 addon 형식이나 system32 또는 windows 폴더, Temp 폴더에서 직접 실행하기 위해 run 레지스트리 부분에 등록을 합니다. 요즘엔 아예 Driver.sys 나 System Volume information 폴더 또는 가짜 비디오 오디오 codec 등으로 위장을 하더군요.
한가지 더 Sp2 업그래이드 할때 포멧을 한다고 하셨는데 포멧을 하지는 않구요,
업그래이드 하기전에 설치되어 있는 프로그램들 중에 혹시 호환이 안되는게 있는지 (보통 요즘엔 다 호환이 잘 되는것으로 압니다.) 혹은 바이러스에 감염되어 있는 상태거나 불안정한 상태에서 업글을 하면 중간에 에러가 나서 제거하는데 고생을 하게 되지요. 분명 중간에 잘못되어도 복구 콘솔 명령행에서 제거하는 방법도 있습니다만 웬만하면 업글이 잘 된답니다.
다른 고수님들을 위해 보내주신 로그를 여기에 제가 올리겠습니다.
hijackthis 로그 화일
인용 Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 오후 4:27:19, on 2008-03-01
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\System32\npkcmsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: IWebInterception Class - {BFDDBDBB-F62C-4D4A-B574-59D276F47196} - C:\Program Files\Click To Tweak [Basic]\WebInterception.dll
O2 - BHO: NoPhishing - {D3B071BE-7C15-43f6-8348-01EFC6092591} - C:\Progra~1\SoftRun\NoPhishing\NoPhishing.dll
O3 - Toolbar: 네이버 툴바(&N) - {D09CFF09-A42A-4EDC-9804-E61224F59CA1} - C:\Program Files\naver\NaverToolbar\NaverTB_3_0_1_56.dll
O3 - Toolbar: 라디오(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] ctfmon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] ctfmon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] ctfmon.exe (User 'Default user')
O8 - Extra context menu item: Microsoft Excel로 내보내기(&X) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: 네이버 검색 - res://C:\Program Files\naver\NaverToolbar\NaverTB_3_0_1_56.dll /SEARCH.HTML
O8 - Extra context menu item: 네이버 북마크하기 - res://C:\Program Files\naver\NaverToolbar\NaverTB_3_0_1_56.dll /BOOKMARK.HTML
O8 - Extra context menu item: 네이버 블로그 담기 - res://C:\Program Files\naver\NaverToolbar\NaverTB_3_0_1_56.dll /BLOG.HTML
O8 - Extra context menu item: 네이버 사전 검색 - res://C:\Program Files\naver\NaverToolbar\NaverTB_3_0_1_56.dll /DIC.HTML
O8 - Extra context menu item: 네이버 일한 번역 - res://C:\Program Files\naver\NaverToolbar\NaverTB_3_0_1_56.dll /JKTRANS.HTML
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.samsungfire.com
O15 - Trusted Zone: http://*.suhyup-bank.com
O16 - DPF: FnWPro001 - http://www.samsungfn.com/applet/FnWPro001.cab
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://singo.ncomservice.co.kr/include/font/fontserver.cab
O16 - DPF: {02FE7E8D-9DBD-4F77-8824-26C45D56CA9A} (CHZERO MAP CTRL) - http://gisweb4.chzero.com/zeromap/IMAPOCX_WEB.CAB
O16 - DPF: {042D97DD-E197-411A-8298-6EE85F1C1421} (mkdsfwCtrl Class) - http://ahnlabdownload.nefficient.co.kr/asp/cab/mkdsfw.cab
O16 - DPF: {044123B5-35DF-4C4E-BAED-26B8ED964342} (HLiveRobotWeb Control) - http://fx.hauri.net/HProduct/livesuite/shinhan/CLIENT/LiveSuite/web/HLiveRobotWeb.cab
O16 - DPF: {0C2955F4-8400-4EDB-BA3E-6960865CCC0E} (SecureSession Class) - http://www.samsungnetwork.com:5000/PKI/SecuiSecContractIE.cab
O16 - DPF: {0CD2EC08-3CF6-4BC4-BF48-824F4C1994F1} (SecureSession Class) - http://www.samsungfn.com/contents/trustnet/TNWebToolkit.cab
O16 - DPF: {0DAF3967-7DBB-4A85-8CA7-F143483F09CD} (GISWareClient Control) - http://road.moct.go.kr/webserver/GisWared.Cab
O16 - DPF: {162C9EF4-C989-4A60-A465-8D0E8F25A3B7} (FileDownLoadObj Class) - http://mall-etax.interpark.com/interpark/FileDownLoad_vista.cab
O16 - DPF: {1A29905C-C082-11D4-9376-00AA00BFFB71} (checkVerX Control) - http://download.hts.nefficient.co.kr/hts/wcom/cab/checkVer.cab
O16 - DPF: {1AC030E0-4571-483F-A6E0-5DBEB1150AD7} (MAWS_NHIC Class) - http://222.239.77.94/viewer30_new/MARKANY/MAOnFPS_NHIC.cab
O16 - DPF: {1B3E813B-EF11-4CE2-93E7-9A033CB3E336} (PsAction Control) - http://toolbar.pressian.com/toolbar/setup/psAction.cab
O16 - DPF: {1BC0F715-34E2-4C99-A6EF-CDBC7508374A} (SecureSession Class) - https://partnerlogin.samsungelectronics.com/ko/secui/SecuiB2BIE-ko.cab
O16 - DPF: {1CC26E3F-F20A-4074-8BB0-F34242591459} (ReportExpress.Viewer) - http://ipsi.snu.ac.kr/rpt/instRE/reportexpress.cab
O16 - DPF: {1CD4FAEE-09F6-4B77-8A49-EF2A9EBC8D46} (RSUpCtrl Control) - http://203.254.193.247/cab/rsupctrl.cab
O16 - DPF: {1D4FC3AF-3253-43A4-B346-5D1198D1EB8E} (CINIWebPlus Class) - http://img.shinhan.com/rib/common/INISWebPlus/INISWebPlus10.cab
O16 - DPF: {1DE9BB01-B121-401D-8877-BCD5ED5B7EE5} (Tpwin Control) - http://www.crezio.com/test/leeyunho/AlwaysOn/AlwaysOn.CAB
O16 - DPF: {2022EE84-1E1F-45B0-8D35-FF9DA75366BC} (ExpressViewer Class) - http://download.softforum.com/Published/XecureExpressI/v2.4.0.5/xei_install2.cab
O16 - DPF: {20BBA18F-5BC8-47B5-8FC9-5DFCA8E56A4B} (XacsPop Control) - http://mpi.dacom.net/XMPI/js/xmpi2007.cab
O16 - DPF: {270EC7A6-4096-469B-865C-F9678A2C742B} (EasyPayX Control) - http://www.payzone.co.kr/EasyPayX/EasyPayX.cab
O16 - DPF: {286A75C3-11FB-4FB4-AC4A-4DD1B0750050} (INISAFEWeb6 V6 Class) - http://img.shinhan.com/initech/plugin/ver6106/down/INIS60.cab
O16 - DPF: {2882C368-D508-11D4-A2AB-000102598CE4} (LProtect Control) - http://fx.hauri.net/CLIENT/LiveSuite/livecall/livecall.cab
O16 - DPF: {293834C7-05B9-418C-A7DC-B59B08C8716C} (IntraMap2DXSeBIS Control) - http://210.96.13.83/ActiveX/IntraMap2DXSeBIS.cab
O16 - DPF: {2EF3C53E-E0C0-4076-9A7B-51D7B2D1549E} (KDownLoadExec Class) - http://sims-ebook.kia.co.kr/goods/component/kdlexec.cab
O16 - DPF: {2F8A9AB6-4A0B-47F1-95D9-2A0F100064E1} (MAGETDATA Class) - http://mpi.dacom.net/XMPI/js/XACSDATA.cab
O16 - DPF: {39461460-2552-4D51-A062-3AB6A7B902E9} (INISAFE Updater Control) - http://img.shinhan.com/shttp/install/down/INIS70.cab
O16 - DPF: {39FC0CF9-86F3-4502-B773-D16706EDEC83} (SCSK Control) - http://img.shinhan.com/rib/common/keyStroke/SoftCamp/402011/scsk4.cab
O16 - DPF: {3A90D051-E921-4741-8288-D1B6747A8A51} (Yessign5 Control) - http://www.giro.or.kr/html/yessign/cab/yessign5.cab
O16 - DPF: {3B56E5F0-7B20-48BF-B439-A995BE5191EF} (SessionControl Control) - http://pib.wooribank.com/com/common/SessionControl.cab
O16 - DPF: {3C36DCBE-5CDF-4C35-9D0B-4A1882B2EB0A} (AllatPayREAtl Class) - https://tx.allatpay.com/component/AllatPayRE.cab
O16 - DPF: {3D17B84E-BCB2-49E0-B7CC-6732425B2A7F} (Qubi Install Control) - http://local.qubi.com/activex/Install.CAB
O16 - DPF: {3DDB716E-8BA8-43B5-A926-6FB04193FFA0} (Maws_KRail Class) - http://ret.qubi.com/qubi/markany/client/MAOnFPS_KORAIL.cab
O16 - DPF: {42E8651D-C437-4203-93F5-24E20C2C4465} (KvpVCardCtl Control) - https://www.vpay.co.kr/kvpfiles/KVPCyberCard.cab
O16 - DPF: {447F9423-2046-4267-9B93-11626D001183} (RewardNetwork amLauncher Class) - http://affiliate.rewardnetwork.net/codebase/launcher/WShani.cab
O16 - DPF: {45091AA2-1574-4EC8-B520-4C27E29CF889} (GifFreezerCtrl Class) - http://www.gmarket.co.kr/challenge/neo_goods/dlls/gifFreezer.cab
O16 - DPF: {4646547A-22E8-485F-95BC-B4C76835BF80} (RSAutoUp Control) - http://rsup.net/cab/rsautoup.cab
O16 - DPF: {48ECCD73-123C-4C25-A64C-76E8E8A30CAF} (XPayMPIOCX Control) - https://mpi.dacom.net/XPayMPI/Xecure_LiveUpdate_XPayMPIOCX.cab
O16 - DPF: {4B48CEDD-EB09-4FD3-AA22-5BDE98EDEF90} (EZXSActiveX Control) - http://www.globalwindow.org/wps/ezxssso/install/ezxsactivex.cab
O16 - DPF: {4C68DACE-E6BC-4650-9C7E-D036720CA729} (Nps Control) - http://update.nprotect.net/npcore/npav/nps.cab
O16 - DPF: {4E8B516E-94F7-4E23-BBA8-794EED477AD5} (MPReg Control) - http://www.sbs.co.kr/new/mplay/movie_cp/pmang_players/SBSiMPReg.cab
O16 - DPF: {4F7C1FA4-2588-4233-90DF-B3EDB16DE222} (SPEngine Class) - http://222.239.77.94/viewer30_new/BCQRE/SPSetup.cab
O16 - DPF: {523E756E-9A65-45C4-A438-4C5522F59CE8} (ShellBTM20Com Class) - https://ansim.suhyup.co.kr/PkiCube/BtCxBTM20.cab
O16 - DPF: {53EED863-B547-40F8-B24A-2D6DE807CFE8} (Printmade Control) - http://img.shinhan.com/rib//ko/print/Printmade.cab
O16 - DPF: {57979411-BD4D-4896-9A89-415A902430B6} (eKSys SmartMapGX SDK 4.0) - http://map.visitkorea.or.kr/Scripts/Common/MapData/SmartMapGXW.cab
O16 - DPF: {5797A411-BD4D-4896-9A89-415A902430B6} (eKSys SmartMapGX SDK 3.0) - http://update.speednavi.co.kr/Whereis/MapCommon/SmartMapGX.cab
O16 - DPF: {5797C411-BD4D-4896-9A89-415A902430B6} (KSys SmartMapGX SDK 3.0 for Mozen, HMC, KMC) - http://www.kia.co.kr/common/SmartMapGX_Mozen.cab
O16 - DPF: {5CA5E00D-80A8-475A-BF08-816FD56DBC38} (KTCtrl Class) - http://support.kornet.net/sw5/order/Speed/cab/KTSpeedNewCtrl.cab
O16 - DPF: {5DAEF053-DEF0-4752-A963-CCE9B49B0B79} (Gogs Class) - http://bridge.item2.naver.com/music/cab/nbgm.cab
O16 - DPF: {5E582BD1-6FAA-40F2-87A8-130AD325DABB} (Kdfense7 Control) - http://www.samsungfn.com/contents/kdefense/cab/04121518/kdfense7.cab
O16 - DPF: {6531D99C-0D0E-4293-B3CB-A3E1D0D41847} (AhnASP Control) - http://ahnlabdownload.nefficient.co.kr/asp/cab/AhnASP.cab
O16 - DPF: {66413DC2-F891-40BC-822D-B7EEC8ADC281} (ProWorksGrid Control) - http://img.shinhan.com/cib/common/ProWorksGrid_78.cab
O16 - DPF: {67090735-D541-4FF9-B466-8778676ECD31} (WebPriKotra Control) - http://www.kotra.or.kr/webpri/WebPri_Kotra.cab
O16 - DPF: {67169E1F-5405-4780-8419-DA342168429C} (MAWS_SMFIRE Class) - http://globaltps.samsungfire.com/aireport/AIViewer/MAOnFPS_SMFire.cab
O16 - DPF: {68253470-5D4F-4CDF-8D9C-353C14A2F013} (SVPorsche Control) - http://img.yahoo.co.kr/multi/2005/tool/player/20060116/SVPorsche.cab
O16 - DPF: {6A2E758A-028B-46BB-A11D-0608AB5A4ED3} (DaumBGMCtrl Class) - http://listen.daum.net/52st/bgmplayer/Daum52stBGMPlayer.cab
O16 - DPF: {6A599FB1-6CF1-42D8-9293-88B6FCC89E78} (CyberInstaller Control) - http://www.cybermed.co.kr/~distribution/CyberInstaller.cab
O16 - DPF: {6AD54F1E-D241-48B4-ACFF-37BA1B1BF7AD} (SMInstallCom Class) - http://ax.spymedic.co.kr/control/SpyMedicWebInst.cab
O16 - DPF: {6CE20149-ABE3-462E-A1B4-5B549971AA38} (XecureCKKB Class) - http://www.nhic.or.kr/XecureCK/CKKeyPro.cab
O16 - DPF: {70EE0AA4-5A3A-4052-8FFA-2EEDA43F7942} (Innotive Cibrowser Control 1.1) - http://www.congnamul.com/bluebird/ActiveX/cibrowser_1_1_1_148.cab
O16 - DPF: {7114AB1F-A8FE-4EB8-8AEB-0D0C47E866AD} (MA_POP Class) - https://mpi.dacom.net/XMPI/js/XacsPlugin.cab
O16 - DPF: {7876A60C-6116-4AD9-B0EE-C53A06C08747} (IPCheckerX Control) - http://203.248.245.162:8080/ftth/ftth/popup/IPCheckerX.cab
O16 - DPF: {79C871A6-F9C8-44DA-B2C9-CD9438D9642C} (EZXSInstaller Control) - http://www.globalwindow.org/wps/ezxssso/install/ezxsinstaller.cab
O16 - DPF: {7C65E65F-5ACA-409E-9D44-79AD833919F8} (ExpressViewer Class) - http://download.softforum.co.kr/XecureExpressI/xei_install.cab
O16 - DPF: {7E9FDB80-5316-11D4-B02C-00C04F0CD404} (XecureWeb 4.0 Client Control) - http://download.softforum.co.kr/Published/XecureWeb/v7.2.1.2/xw_install.cab
O16 - DPF: {87150955-C8C8-4693-B8E3-69E9B4EC23EC} (Yessign5 CMP Control) - http://www.yessign.or.kr/yessignCert5/yesCMP5.cab
O16 - DPF: {8871DC33-DFB8-4A36-9DF1-E3CD3334ABA5} (JUploadLib Class) - http://ktdom.com/ActiveX/KTdomUpload.cab
O16 - DPF: {8FA8D5F7-7CBA-46D4-9568-68D70C5280E8} (NoPhishingX Control) - http://www.nophishing.co.kr/softrun/SR02/SRNPSH.cab
O16 - DPF: {90227A18-E482-47B8-83F2-146CABA6ABF7} - http://update.nprotect.net/nprotect/kb/npws/npwsx.cab
O16 - DPF: {91A6D076-F1AA-44DC-9825-9F7DE41E2398} (WooricyMap Control) - http://traffic.local.naver.com/Traffic_browser/map/Objects/WooricyMap(1,0,0,25).cab
O16 - DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} - http://cafeimg.hanmail.net/cab9_1/dmcc2.cab
O16 - DPF: {95660C51-0E11-4133-AA4C-492E62F2D123} (AX_KTX_eTicket Control) - http://ret.qubi.com/tk/Ax_KTX_eTicket.cab
O16 - DPF: {95ECBC00-7121-4379-BD64-69B42A0F1123} (MapID Control) - http://www.mapid.net/ActiveX/MapID_V15.cab
O16 - DPF: {9730FE74-2ADD-4AB4-BB46-9C4B6978C6B9} (WebPriGiro Control) - http://biz.giro.or.kr/webpri/WebPri_Giro.cab
O16 - DPF: {97533519-FBD3-42D5-BB07-C49F022B39EE} (MAWS_NTS Class) - http://download.hts.nefficient.co.kr/hts/yesone/cab/MAOnFPS_NTS.cab
O16 - DPF: {999257DE-B873-4E51-9478-F015EE1F76B2} (BTTrustSite Class) - http://download.banktown.com/suhyup/BTTrustSite.cab
O16 - DPF: {99C709C7-4F58-46C1-855B-90213C760395} (v3d Class) - https://secure.kcp.co.kr/webpay/v3d/file/kcp_ansimclick.cab
O16 - DPF: {9AEBAA67-8B4D-4884-9EB7-8C6BEA20CE5C} (FileManager Control) - http://img.anycall.com/cab/NetEditor.cab
O16 - DPF: {9BDBC41E-C335-4263-83C0-ECE78EE28A33} (SysMonOCX Control) - http://ahnlabdownload.nefficient.co.kr/plugin/myfirewall/myfirewall20.cab
O16 - DPF: {9CDD57AC-CA86-464C-B920-3228A388CC78} (NaverFileControl Control) - http://file.naver.com/activex/NaverFile.cab
O16 - DPF: {9DEFEDFC-8193-4BE6-AA60-B6375AB7C8BE} (Launcher Class) - http://patch.mnet.com/NaverMusic/ActiveX/naverx.cab
O16 - DPF: {9FC84F7D-D177-4A75-A7BB-429DA5BD0A3E} (SG_CAppAtx Control) - http://download.signgate.com/download/common/ews/release/ewsinstaller.cab
O16 - DPF: {A1832535-5218-42F9-8959-19E2BCABFABF} (INIwallet50 Control) - http://plugin.inicis.com/wallet50/INIwallet50.cab
O16 - DPF: {A1D886C6-4039-4451-97A9-515F5BE5D4C2} (mkdplusCtrl Class) - http://ahnlabdownload.nefficient.co.kr/asp/cab/mkdplus.cab
O16 - DPF: {A349609D-1864-443A-AD48-EE577A17264A} (AIIntegratedGenCtrl Class) - http://www.samsungfire.com/aireport/AIViewer/AIIntegratedGen.cab
O16 - DPF: {A4508A45-F1C4-40F3-99B4-0CA08AC77E3B} (Kdfense8 Control) - http://kings.nefficient.co.kr/kings/kdfx/kdfx308/kdfense8.cab
O16 - DPF: {A47D74C2-CB98-4692-BF7C-32CE695AF689} (FreeMap Control) - http://map.isuperpage.co.kr/ocx/FreeMap.cab
O16 - DPF: {A88BBD0A-5C41-4014-B447-1FDAB89C8BBB} (GISClientITS Control) - http://road.moct.go.kr/webserver/GisWare.cab
O16 - DPF: {A8917DCC-6DBE-4562-99DE-62D633DE412D} (MLInstaller Class) - http://www.dla.go.kr/magicline/setup/MLInstaller.cab
O16 - DPF: {A9F090E5-FC80-4772-AFEE-D102AB6E77D6} (IssacWebProCMS Class) - http://pgdownload.lgdacom.net/dacom/IssacWebProCMS_4_2_6_8_DACOM.cab
O16 - DPF: {B0A75875-3622-48BA-B5FF-45AD77AC2D0E} (BankPayEFTCtrl Control) - http://www.bankpay.or.kr/BankPayEFT.cab
O16 - DPF: {B3260660-93AC-48D8-8DDC-2C22192CA2AB} (Naver Mail BigFile Upload Control2) - http://mail.naver.com/activex/NvBigFileUpload2_NT.cab
O16 - DPF: {B45E969D-924F-4C83-ACF3-38CDD115AA2C} (MpiPlugin Class) - https://www.samsungmall.co.kr/order/ilk/ilkactx2006.cab
O16 - DPF: {B5BFFF5D-CA0D-4593-AB84-7F8ACB2AC42A} (MAPntCtrl Class) - http://ret.qubi.com/qubi/markany/client/MAOnFPS_PNT.cab
O16 - DPF: {B640AB04-7C42-49F1-BFBB-1B65AC47B0B2} (CpcFTP Control) - https://cpcex.sec.samsung.net/Windchill/ext/cpcex/auth/CpcFTP1059.cab
O16 - DPF: {B9B38E70-EEF6-4E3A-AE84-DDE59A053B7C} (Daum ActiveX manager Class) - http://cafeimg.hanmail.net/cto/xman.cab?ver=1,2,2,0
O16 - DPF: {BBB0FC2D-1D95-45CA-BDCF-03B53F247FCC} (EwsLoader Class) - http://download.signgate.com/download/ews/ewsinstaller.cab
O16 - DPF: {BD6BB450-7C69-43B8-96F3-689CAE57AB51} (SBSWebPlayer Class) - http://netv.sbs.co.kr/object/player/SBSWebPlayer.cab
O16 - DPF: {C1143E84-B2B1-473B-9F20-E62DD754FCAF} (VineTransfer Control) - http://img.shinhan.com/rib/common/infovine/ver1023/VineTransfer.cab
O16 - DPF: {C2C16510-10F4-46FE-A82C-4846435EBDEB} (p3muzset Class) - http://casx.musiccity.co.kr/empas/dll/p3empasset.cab
O16 - DPF: {C2F50390-8033-4CC2-A0C6-DD7D3E6A9550} (AxTSAPI2 Class) - http://www.ctradeworld.com/tradesign/certcenter/setup/AxTSAPI2.cab
O16 - DPF: {C63E3330-049F-4C31-B47E-425C84A5A725} (EpAdm2 Control) - http://cpc.sec.samsung.net/EpAdm2.cab
O16 - DPF: {C7C7225A-9476-47AC-B0B0-FF3B79D55E67} (ZTransferX Control) - http://222.239.77.94/viewer30_new/ZTransferX.cab
O16 - DPF: {CAB259A5-1873-4D24-B743-AD16B60F6821} (EgiroFileDown Control) - http://e-giro.giro.or.kr/yessign/cab/egiroYessign5.cab
O16 - DPF: {CB5C683C-416A-4701-B018-0F1B21D64D6B} (SKCInst1 Class) - http://cyimg7.cyworld.nate.com/cymusic/package/skcinst.cab
O16 - DPF: {CDF26594-A9E2-4E41-87F9-6E79DD38CFE3} (AutoTrustHTTPControl Control) - http://www.ubistar.co.kr/ir/AutoTrustHTTP.cab
O16 - DPF: {CEB5C2A3-180A-4121-BDAC-B9B92859D652} (MaPrtRail Class) - http://ret.qubi.com/ht/markany/client/MaPrtChk_KRAIL.cab
O16 - DPF: {CEE326E8-7571-4086-B347-3C0ACA9A9DE8} (PcubeSet Class) - http://casx.musiccity.co.kr/empas/dll/p3empasset.cab
O16 - DPF: {CF392830-663F-11D5-89EE-000086551DF6} (PS_NTSATL Class) - http://download.hts.nefficient.co.kr/hts/yesone/cab/yesone_crypto.cab
O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) - http://update.nprotect.net/nprotect/module/npx.cab
O16 - DPF: {D26A941D-7E89-4098-B583-43291FC14218} (Pull0PlayerX Control) - http://image.pullbbang.com/images/Pull0Control.ocx
O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} (NPKCX Control) - http://update.nprotect.net/keycrypt/kftc/npkcx_vista.cab
O16 - DPF: {D7EBA5BF-69D0-40E4-B513-87078CA7DD87} (Woori Credit Card Class) - http://ccd.wooribank.com/com/common/wooricard.cab
O16 - DPF: {D7EFD319-098B-4918-8ECF-25A8E8EE1940} (Maptopia WindW Control) - http://www.inavi.com/_Lib/Component/WindW_R%20Maptopia%20Control.cab
O16 - DPF: {D912AABC-6CB0-416F-85B6-CABBB86FD558} (INIwallet60 Control) - https://plugin.inicis.com/wallet60/INIwallet60.cab
O16 - DPF: {D923AE0C-190D-4EDF-B07A-76AC571FBFD4} (SCSKEx Control) - http://img.shinhan.com/rib/common/keyStroke/SoftCamp/4091_ex/scskex.cab
O16 - DPF: {D96D2F74-0B74-47D2-964F-B67E9F69F1CD} (CongnamulMap4Asp Control) - http://www.congnamul.com/ActiveX/Release/ASP/CongnamulMap4Asp_V29.cab
O16 - DPF: {DA756535-F523-4414-B167-DBDD8AA8C4A1} (S151AX Control) - http://cryptotelecom.net/S151AX.cab
O16 - DPF: {DA76E8AE-2E7F-49A8-B5F2-D1C4FF70ECD5} (SamsungMap Control) - http://mapsvc.samsung.co.kr/ActiveX/SamsungMap_V25.cab
O16 - DPF: {DC4207CE-C03E-4449-ACB1-032CA4137053} (Npz Control) - https://updates.nprotect.net/nprotect2004/hyundaecard/ansimclick/npz2.cab
O16 - DPF: {DC5C4F1B-8F7A-47CE-ACCA-EBB25D1567C6} (Naver_ZaolMap2Client Control) - http://traffic.local.naver.com/Traffic_browser/Objects/Naver_ZaolMap2Client.1017.cab
O16 - DPF: {DFFD6203-ACAF-4AE3-92EA-E0323FBF4BF3} (SesureSession Class) - http://www.samsungfire.com/download/secui/SecuiFireIE.cab
O16 - DPF: {E0BF7A2B-2F7C-497A-B50F-292D3F317965} (CongnamulMap Control) - http://www.congnamul.com/ActiveX/Release/Congnamul/CongnamulMap_V17.cab
O16 - DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} (KvpIspCtlD Control) - https://www.vpay.co.kr/kvpfiles/KVPISPCTLD.cab
O16 - DPF: {E831AA9C-C980-4F16-B252-09AAF40D0E9B} (Kdfense9 Control) - http://kings.cachenet.com/kdfx218/kbstar/kdfense9.cab
O16 - DPF: {EA0995BF-45DD-4DB0-ADD5-A39C37397841} (ShbAutoTrustSite Control) - http://img.shinhan.com/rib/common/TrustSite/20041202/ShbAutoTrustSiteX.cab
O16 - DPF: {EC5D5118-9FDE-4A3E-84F3-C2B711740E70} (SKCommAX Control) - http://www.samsungfn.com/skcab/SKCommAX.cab
O16 - DPF: {ED698244-D3B6-4016-95AB-7FF6BA95FF5E} (CMMapASP Control) - http://cybermap.co.kr/cm2000/company/hanaro-club/CMHANARO2.cab
O16 - DPF: {EF648869-6D94-4ED9-8426-FAABDACB9604} (EZXSVistaX Control) - http://www.globalwindow.org/wps/ezxssso/install/ezxsvistax.cab
O16 - DPF: {F1149E8A-79EB-4859-835E-95432B72FEA2} (AnycallLAND_DownCheck Control) - http://img.anycall.com/anycall/support/activex/AnycallLAND_DownCheckProj1.cab
O16 - DPF: {F1F07506-6CB4-44AC-8615-66D1234EFD05} (WebCtl Class) - http://www.shinhancard.com/initech/plugin/down/INIS50.cab
O16 - DPF: {F2B794F5-B8F0-4378-B05C-E26C310D9CE2} (Viewer Control) - http://www.yes24.com/home/openinside/yes24preview.cab
O16 - DPF: {F3222ADD-F760-4ACC-A70F-3839AD82FF88} (mkdsecuiCtrl Class) - http://ahnlabdownload.nefficient.co.kr/asp/cab/mkdsecui.cab
O16 - DPF: {F4A1D5E2-AF49-47A7-A945-23038106F3A4} (Pandora_SetUp Control) - http://imgcdn.pandora.tv/pan_img/launcher/codebase/Pandora_SetUpAX.cab
O16 - DPF: {F9143948-F472-4397-8B9F-237B6CB07C48} (DSProxyX Class) - http://dla.go.kr/magicline/setup/DSProxyX.cab
O16 - DPF: {FB49C5D6-ABCC-47ED-AC05-B80E578183B0} (DSCertManagerX Class) - http://www.dla.go.kr/magicline/setup/DSCertManagerX.cab
O18 - Protocol: s-http - {D37E6C5F-1C0F-47C0-A3B6-403EEC555402} - C:\Program Files\INITECH\SHTTP\InitechSHTTPInterface.10111.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ALYac_PZSrv - Unknown owner - C:\Program.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: npkcmsvc - INCA Internet Co., Ltd. - C:\WINDOWS\System32\npkcmsvc.exe
O23 - Service: Pml Driver OEM12 - HP - C:\WINDOWS\System32\OEMipm12.exe
--
End of file - 22259 bytes
Autoruns 로그 화일.
인용 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+ AVG7_CC AVG Control Center (Not verified) GRISOFT, s.r.o. c:\program files\grisoft\avg7\avgcc.exe
+ IntelliPoint Point32.exe (Not verified) Microsoft Corporation c:\program files\microsoft intellipoint\point32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
+ Skype Skype. Take a deep breath (Verified) Skype Technologies SA c:\program files\skype\phone\skype.exe
HKLM\SOFTWARE\Classes\Protocols\Filter
+ application/octet-stream Microsoft .NET Runtime Execution Engine (Not verified) Microsoft Corporation c:\windows\system32\mscoree.dll
+ application/x-complus Microsoft .NET Runtime Execution Engine (Not verified) Microsoft Corporation c:\windows\system32\mscoree.dll
+ application/x-msdownload Microsoft .NET Runtime Execution Engine (Not verified) Microsoft Corporation c:\windows\system32\mscoree.dll
HKLM\SOFTWARE\Classes\Protocols\Handler
+ cdo Microsoft SharePoint Portal Server Object Model (Not verified) Microsoft Corporation c:\program files\common files\microsoft shared\web folders\pkmcdo.dll
+ s-http INITECH HTTP Wrapper Handler (Not verified) (c) INITECH c:\program files\initech\shttp\initechshttpinterface.10111.dll
+ skype4com Skype for COM API (Verified) Skype Technologies SA c:\program files\common files\skype\skype4com.dll
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
+ n/a Microsoft .NET IE SECURITY REGISTRATION (Not verified) Microsoft Corporation c:\windows\system32\mscories.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
+ AVG7 Find Extension AVG Shell Extension (Not verified) GRISOFT, s.r.o. c:\program files\grisoft\avg7\avgse.dll
+ AVG7 Shell Extension AVG Shell Extension (Not verified) GRISOFT, s.r.o. c:\program files\grisoft\avg7\avgse.dll
+ Fusion Cache Microsoft .NET Runtime Execution Engine (Not verified) Microsoft Corporation c:\windows\system32\mscoree.dll
+ IntelliPoint Activities Control Panel Property Page ipcplact.dll (Not verified) Microsoft Corporation c:\program files\microsoft intellipoint\ipcplact.dll
+ IntelliPoint Buttons Control Panel Property Page ipcplbtn.dll (Not verified) Microsoft Corporation c:\program files\microsoft intellipoint\ipcplbtn.dll
+ IntelliPoint Wheel Control Panel Property Page ipcplwhl.dll (Not verified) Microsoft Corporation c:\program files\microsoft intellipoint\ipcplwhl.dll
+ IntelliPoint Wireless Control Panel Property Page ipcplwir.dll (Not verified) Microsoft Corporation c:\program files\microsoft intellipoint\ipcplwir.dll
+ User Accounts File not found: CLSID\{7A9D77BD-5403-11d2-8785-2E0420524153}\InprocServer32
+ Web Folders Microsoft Web Folders (Not verified) Microsoft Corporation c:\program files\common files\microsoft shared\web folders\msonsext.dll
+ WinRAR shell extension c:\program files\winrar\rarext.dll
+ 디스플레이 패닝 CPL 확장 File not found: deskpan.dll
+ 작업 표시줄 및 시작 메뉴 File not found: CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\InprocServer32
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
+ IWebInterception Class WebInterception Module (Not verified) Realization of Dream c:\program files\click to tweak [basic]\webinterception.dll
+ NoPhishing NoPhishing DLL Module (Not verified) Softrun Inc. c:\program files\softrun\nophishing\nophishing.dll
+ Skype add-on (mastermind) Skype add-on for IE (Verified) Skype Technologies SA c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
HKLM\Software\Microsoft\Internet Explorer\Toolbar
+ NaverToolbar NaverToolbar Module (Verified) NHN corp. c:\program files\naver\navertoolbar\navertb_3_0_1_56.dll
HKLM\System\CurrentControlSet\Services
+ Avg7Alrt AVG Alert Manager (Not verified) GRISOFT, s.r.o. c:\program files\grisoft\avg7\avgamsvr.exe
+ Avg7UpdSvc AVG Update Service (Not verified) GRISOFT, s.r.o. c:\program files\grisoft\avg7\avgupsvc.exe
+ npkcmsvc nProtect KeyCrypt Manager Service (Not verified) INCA Internet Co., Ltd. c:\windows\system32\npkcmsvc.exe
HKLM\System\CurrentControlSet\Services
+ AFPAnsi Windows NT File System Protector Network Edition (Not verified) Alfa Corporation c:\windows\system32\drivers\afpansi.sys
+ Avg7Core AVG Scanning Engine (Not verified) GRISOFT, s.r.o. c:\windows\system32\drivers\avg7core.sys
+ Avg7RsW AVG Resident Shield Unload Helper (Not verified) GRISOFT, s.r.o. c:\windows\system32\drivers\avg7rsw.sys
+ Avg7RsXP AVG Resident Anti-Virus Shield (Not verified) GRISOFT, s.r.o. c:\windows\system32\drivers\avg7rsxp.sys
+ AvgClean AVG7 Clean Driver (Verified) GRISOFT, s.r.o. c:\windows\system32\drivers\avgclean.sys
+ AYDrvNT_ALYAC Kernel Mode Driver (Verified) ESTsoft Corp. c:\program files\estsoft\alyac\aydrvnt.sys
+ Changer File not found: C:\WINDOWS\System32\Drivers\Changer.sys
+ DgiVecp Windows 2k,XP IEEE-1284 parallel class driver for ECP, Byte, and Nibble modes (Not verified) Samsung Electronics Co., Ltd. c:\windows\system32\drivers\dgivecp.sys
+ extdrv File not found: C:\WINDOWS\system32\drivers\extdrv.sys
+ extdrv.sys File not found: C:\WINDOWS\system32\drivers\extdrv.sys
+ i2omgmt File not found: C:\WINDOWS\System32\Drivers\i2omgmt.sys
+ JRSKD24 ClientKeeper KeyPro Keyboard Driver (Not verified) SoftForum Corporation c:\windows\system32\jrskd24.sys
+ JRSUKD24 ClientKeeper KeyPro Keyboard Driver (Not verified) SoftForum Corporation c:\windows\system32\jrsukd24.sys
+ kdss File not found: C:\WINDOWS\system32\Drivers\kdss.sys
+ lbrtfdc File not found: C:\WINDOWS\System32\Drivers\lbrtfdc.sys
+ Mkd2kfNt MyKeyDefense Keyboard Filter Driver (Not verified) AhnLab, Inc. c:\windows\system32\drivers\mkd2kfnt.sys
+ Mkd2Usbf MyKeyDefense USB Keyboard Filter Driver (Not verified) AhnLab, Inc. c:\windows\system32\drivers\mkd2usbf.sys
+ neokdss File not found: system32\Drivers\neokdss.sys
+ NMProPPPoE ACEMan-pro PPP over Ethernet Adapter (Not verified) SITECSOFT Co., Ltd. c:\windows\system32\drivers\netmanp.sys
+ NPFWFLT nProtect Firewall Filter Driver (Not verified) INCA Internet Co., Ltd. c:\windows\system32\npfwflt.sys
+ npkcrypt nProtect KeyCrypt Driver (Verified) INCA Internet Co.,Ltd. c:\windows\system32\npkcrypt.sys
+ NSavFlt Filter Driver (Not verified) NHN c:\windows\system32\drivers\nsavflt.sys
+ PCIDump File not found: C:\WINDOWS\System32\Drivers\PCIDump.sys
+ PDCOMP File not found: C:\WINDOWS\System32\Drivers\PDCOMP.sys
+ PDFRAME File not found: C:\WINDOWS\System32\Drivers\PDFRAME.sys
+ PDRELI File not found: C:\WINDOWS\System32\Drivers\PDRELI.sys
+ PDRFRAME File not found: C:\WINDOWS\System32\Drivers\PDRFRAME.sys
+ scsk5 File not found: system32\drivers\scsk5.sys
+ smgihqap File not found: C:\Program Files\smgihqap.sys
+ SSPORT File not found: C:\WINDOWS\System32\Drivers\SSPORT.sys
+ VRVD212 Virtual Remote Video Driver v2.0 (Not verified) RSupport Corporation c:\windows\system32\drivers\vrvd212.sys
+ VRVD302 Virtual Remote Video Driver(VRVD303) (Verified) Rsupport Co., Ltd. c:\windows\system32\drivers\vrvd302.sys
+ WDICA File not found: C:\WINDOWS\System32\Drivers\WDICA.sys
[ 메시지수정: yoonsangfan 일시: 2008-03-02 11:43 ] |
게시일: 2008-03-01 04:26|
(