Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

ufa.exe

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Zamčeno
Zpráva
Autor
Emkej
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 25 čer 2006 14:03

ufa.exe

#1 Příspěvek od Emkej »

Zdravím,
bratovi sa zrejme podarilo zavíriť PC, pretože proces ufa.exe vyťažuje procesor na 100% našťastie to aspoň ide cez task managera vypnúť. Pri startupe sa spúšťajú zrejme ďalšie vírusy, ktoré aj vidím v Ccleanery ale po vymazaní sa znova po reštarte obnovia. Hodím sem log z RSIT a dúfam, že Vás niečo napadne. Za každú radu vopred ďakujem :)


Logfile of random's system information tool 1.09 (written by random/random)
Run by Emk at 2011-08-10 18:38:18
Microsoft Windows XP Professional Service Pack 3, v.6055
System drive C: has 15 GB (49%) free of 30 GB
Total RAM: 3582 MB (79% free)

HijackThis download failed

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Emk\Application Data\Mozilla\Firefox\Profiles\bs0gdbhx.default

prefs.js - "browser.startup.homepage" - "http://www.google.sk"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@pandonetworks.com/PandoWebPlugin]
"Description"=This plugin detects and launches Pando Media Booster
"Path"=C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\plugins\
NPOFF12.DLL
nppdf32.dll

C:\Program Files\Mozilla Firefox\searchplugins\
atlas-sk.xml
azet-sk.xml
dunaj-sk.xml
eBay.xml
google.xml
slovnik-sk.xml
wikipedia-sk.xml
zoznam-sk.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-11-15 62376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2011-01-20 988480]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2011-01-07 13880424]
"wxpdrv"=C:\WINDOWS\services32.exe [2011-07-16 1170432]
"tray_ico"= []
"tray_ico0"=C:\WINDOWS\update.tray-9-0\svchost.exe [2011-07-16 1170432]
"tray_ico1"=C:\WINDOWS\update.tray-12-0\svchost.exe [2011-07-16 1170432]
"tray_ico2"=C:\WINDOWS\update.tray-7-0\svchost.exe [2011-07-16 1170432]
"tray_ico3"= []
"tray_ico4"= []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2007-12-01 15360]
"Pando Media Booster"=C:\Program Files\Pando Networks\Media Booster\PMB.exe [2011-08-10 3077528]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-30 937920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe [2010-11-15 35736]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\conhost]
C:\Documents and Settings\Emkej\Application Data\Microsoft\conhost.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe [2007-12-01 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-02-19 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2011-08-04 1955208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\WINDOWS\system32\NvMcTray.dll [2011-01-07 111208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
C:\WINDOWS\system32\dumprep 0 -u []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wxpdrv]
C:\WINDOWS\services32.exe [2011-07-16 1170432]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w_distrib.exe]
C:\WINDOWS\update.3\svchost.exe [2011-07-22 272896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
C:\PROGRA~1\HP\DIGITA~1\bin\hpqtra08.exe [2006-02-19 288472]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Antiwpa]
C:\WINDOWS\system32\antiwpa.dll [2003-05-25 60416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, credssp.dll, msnsspc.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\wxpdrivers]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0
"EnableSecureUIAPaths"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\Heroes of Might and Magic V - Collectors Edition\HMM5\bina2\bin\H5_Game.exe"="C:\Heroes of Might and Magic V - Collectors Edition\HMM5\bina2\bin\H5_Game.exe:*:Enabled:Heroes of Might and Magic V- Tribes of the East"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Documents and Settings\Emkej\Desktop\Flash-Player.exe"="C:\Documents and Settings\Emkej\Desktop\Flash-Player.exe:*:Enabled:C:\Documents and Settings\Emkej\Desktop\Flash-Player.exe"
"C:\WINDOWS\update.1\svchost.exe"="C:\WINDOWS\update.1\svchost.exe:*:Enabled:C:\WINDOWS\update.1\svchost.exe"
"C:\WINDOWS\services32.exe"="C:\WINDOWS\services32.exe:*:Enabled:C:\WINDOWS\services32.exe"
"C:\WINDOWS\update.tray-9-0\svchost.exe"="C:\WINDOWS\update.tray-9-0\svchost.exe:*:Enabled:C:\WINDOWS\update.tray-9-0\svchost.exe"
"C:\WINDOWS\update.2\svchost.exe"="C:\WINDOWS\update.2\svchost.exe:*:Enabled:C:\WINDOWS\update.2\svchost.exe"
"C:\WINDOWS\update.3\svchost.exe"="C:\WINDOWS\update.3\svchost.exe:*:Enabled:C:\WINDOWS\update.3\svchost.exe"
"C:\WINDOWS\update.2\3777.exe"="C:\WINDOWS\update.2\3777.exe:*:Enabled:C:\WINDOWS\update.2\3777.exe"
"D:\Emkej\Hry\League of Legends\air\LolClient.exe"="D:\Emkej\Hry\League of Legends\air\LolClient.exe:*:Enabled:League of Legends Lobby"
"D:\Emkej\Hry\League of Legends\game\League of Legends.exe"="D:\Emkej\Hry\League of Legends\game\League of Legends.exe:*:Enabled:League of Legends Game Client"
"D:\Emkej\Hry\League of Legends\lol.launcher.exe"="D:\Emkej\Hry\League of Legends\lol.launcher.exe:*:Enabled:League of Legends Launcher"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm

======List of files/folders created in the last 1 month======

2011-08-10 18:38:18 ----D---- C:\rsit
2011-08-10 18:38:18 ----D---- C:\Program Files\trend micro
2011-08-10 18:11:04 ----D---- C:\Documents and Settings\All Users\Application Data\PMB Files
2011-08-10 18:10:33 ----D---- C:\Program Files\Pando Networks
2011-08-10 18:09:05 ----D---- C:\Documents and Settings\Emk\Application Data\Macromedia
2011-08-10 18:09:05 ----D---- C:\Documents and Settings\Emk\Application Data\Adobe
2011-08-10 18:03:22 ----HD---- C:\WINDOWS\update.tray-12-0-lnk
2011-08-10 18:02:38 ----A---- C:\WINDOWS\ntbtlog.txt
2011-08-10 17:45:41 ----D---- C:\Documents and Settings\Emk\Application Data\Mozilla
2011-08-10 17:44:56 ----D---- C:\Documents and Settings\Emk\Application Data\Identities
2011-08-10 17:44:52 ----SD---- C:\Documents and Settings\Emk\Application Data\Microsoft
2011-08-10 17:44:52 ----ASH---- C:\Documents and Settings\Emk\Application Data\desktop.ini
2011-08-10 16:16:48 ----HDC---- C:\WINDOWS\$NtUninstallKB2536276-v2$
2011-08-10 16:16:44 ----HDC---- C:\WINDOWS\$NtUninstallKB2570222$
2011-08-10 16:16:42 ----A---- C:\WINDOWS\system32\MRT.INI
2011-08-10 16:13:39 ----HDC---- C:\WINDOWS\$NtUninstallKB2562937$
2011-08-10 16:13:35 ----HDC---- C:\WINDOWS\$NtUninstallKB2566454$
2011-08-10 16:13:31 ----HDC---- C:\WINDOWS\$NtUninstallKB2567680$
2011-08-10 16:13:05 ----HDC---- C:\WINDOWS\$NtUninstallKB971029$
2011-08-10 13:51:32 ----HD---- C:\WINDOWS\update.tray-9-0-lnk
2011-08-10 13:51:32 ----HD---- C:\WINDOWS\update.tray-9-0
2011-08-10 13:51:32 ----HD---- C:\WINDOWS\update.tray-7-0-lnk
2011-08-10 13:51:32 ----HD---- C:\WINDOWS\update.tray-7-0
2011-08-10 13:51:32 ----HD---- C:\WINDOWS\update.tray-12-0
2011-08-10 13:51:04 ----SHD---- C:\WINDOWS\CSC
2011-08-08 21:42:39 ----D---- C:\Program Files\LogMeIn Hamachi
2011-08-03 10:45:09 ----HDC---- C:\WINDOWS\$NtUninstallKB2507938$
2011-08-03 10:45:03 ----HDC---- C:\WINDOWS\$NtUninstallKB2555917$
2011-08-02 23:31:34 ----A---- C:\WINDOWS\ODBC.INI
2011-08-02 23:25:26 ----N---- C:\WINDOWS\system32\vxblock.dll
2011-08-02 23:25:26 ----N---- C:\WINDOWS\system32\pxwave.dll
2011-08-02 23:25:26 ----N---- C:\WINDOWS\system32\pxmas.dll
2011-08-02 23:25:26 ----N---- C:\WINDOWS\system32\pxinsa64.exe
2011-08-02 23:25:26 ----N---- C:\WINDOWS\system32\pxhpinst.exe
2011-08-02 23:25:26 ----N---- C:\WINDOWS\system32\pxdrv.dll
2011-08-02 23:25:26 ----N---- C:\WINDOWS\system32\pxcpya64.exe
2011-08-02 23:25:26 ----N---- C:\WINDOWS\system32\px.dll
2011-08-02 23:25:26 ----N---- C:\WINDOWS\system32\drivers\PxHelp20.sys
2011-08-02 23:25:22 ----D---- C:\Program Files\Winamp
2011-08-02 23:24:04 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2011-08-02 23:24:03 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2011-08-02 23:24:02 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2011-08-02 23:24:02 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2011-08-02 23:24:02 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2011-08-02 23:23:59 ----A---- C:\WINDOWS\system32\AVASTSS.scr
2011-08-02 23:23:59 ----A---- C:\WINDOWS\system32\aswBoot.exe
2011-07-22 18:09:13 ----A---- C:\WINDOWS\w_distrib_iplist.txt
2011-07-22 18:08:51 ----HD---- C:\WINDOWS\update.3
2011-07-16 20:32:05 ----HD---- C:\Documents and Settings\All Users\Application Data\Common Files
2011-07-16 13:57:35 ----D---- C:\Documents and Settings\All Users\Application Data\MFAData
2011-07-16 13:47:31 ----D---- C:\WINDOWS\ufa
2011-07-16 13:47:31 ----D---- C:\WINDOWS\rpcminer
2011-07-16 13:47:31 ----D---- C:\WINDOWS\phoenix
2011-07-16 13:47:30 ----A---- C:\WINDOWS\unrar.exe
2011-07-16 13:46:37 ----A---- C:\WINDOWS\iecheck_iplist.txt
2011-07-16 13:46:37 ----A---- C:\WINDOWS\ddh_iplist.txt
2011-07-16 13:46:33 ----A---- C:\WINDOWS\btc_client_iplist.txt
2011-07-16 13:46:31 ----D---- C:\Microsoft
2011-07-16 13:46:21 ----A---- C:\WINDOWS\gbot111.exe
2011-07-16 13:46:17 ----HD---- C:\WINDOWS\update.2
2011-07-16 13:46:13 ----HD---- C:\WINDOWS\update.5.0
2011-07-16 13:45:52 ----A---- C:\WINDOWS\iplist.txt
2011-07-16 13:45:30 ----D---- C:\WINDOWS\av_ico
2011-07-16 13:45:30 ----A---- C:\WINDOWS\front_ip_list.txt
2011-07-16 13:44:21 ----HD---- C:\WINDOWS\update.1
2011-07-16 13:33:43 ----A---- C:\WINDOWS\winlog-ids.txt
2011-07-16 13:33:43 ----A---- C:\WINDOWS\winlog-dirs.txt
2011-07-16 13:33:40 ----A---- C:\WINDOWS\services32.exe
2011-07-13 21:51:19 ----D---- C:\_games
2011-07-13 19:24:27 ----A---- C:\WINDOWS\system32\XAudio2_7.dll
2011-07-13 19:24:27 ----A---- C:\WINDOWS\system32\XAPOFX1_5.dll
2011-07-13 19:24:26 ----A---- C:\WINDOWS\system32\xactengine3_7.dll
2011-07-13 19:24:26 ----A---- C:\WINDOWS\system32\D3DCompiler_43.dll
2011-07-13 19:24:25 ----A---- C:\WINDOWS\system32\d3dx11_43.dll
2011-07-13 19:24:25 ----A---- C:\WINDOWS\system32\d3dx10_43.dll
2011-07-13 19:24:25 ----A---- C:\WINDOWS\system32\d3dcsx_43.dll
2011-07-13 19:24:24 ----A---- C:\WINDOWS\system32\XAudio2_6.dll
2011-07-13 19:24:24 ----A---- C:\WINDOWS\system32\XAPOFX1_4.dll
2011-07-13 19:24:24 ----A---- C:\WINDOWS\system32\xactengine3_6.dll
2011-07-13 19:24:24 ----A---- C:\WINDOWS\system32\D3DX9_43.dll
2011-07-13 19:24:23 ----A---- C:\WINDOWS\system32\X3DAudio1_7.dll

======List of files/folders modified in the last 1 month======

2011-08-10 18:38:18 ----RD---- C:\Program Files
2011-08-10 18:13:43 ----D---- C:\MRP
2011-08-10 18:13:34 ----D---- C:\WINDOWS\Temp
2011-08-10 18:09:21 ----D---- C:\WINDOWS\system32
2011-08-10 18:09:21 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-08-10 18:05:08 ----D---- C:\WINDOWS
2011-08-10 18:03:35 ----A---- C:\boot.ini
2011-08-10 18:01:47 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-08-10 17:59:27 ----D---- C:\WINDOWS\Debug
2011-08-10 17:59:26 ----SHD---- C:\RECYCLER
2011-08-10 17:45:20 ----SHD---- C:\WINDOWS\Installer
2011-08-10 17:45:20 ----HD---- C:\Config.Msi
2011-08-10 17:44:51 ----D---- C:\Documents and Settings
2011-08-10 17:38:39 ----D---- C:\WINDOWS\system32\CatRoot2
2011-08-10 17:18:13 ----HD---- C:\WINDOWS\inf
2011-08-10 16:58:07 ----D---- C:\WINDOWS\system32\drivers
2011-08-10 16:58:07 ----D---- C:\Program Files\Internet Explorer
2011-08-10 16:16:50 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-08-10 16:16:47 ----HD---- C:\WINDOWS\$hf_mig$
2011-08-10 16:13:23 ----D---- C:\WINDOWS\system32\en-US
2011-08-10 16:09:30 ----D---- C:\WINDOWS\SoftwareDistribution
2011-08-10 14:04:54 ----D---- C:\WINDOWS\system32\DirectX
2011-08-10 14:02:03 ----HD---- C:\Program Files\InstallShield Installation Information
2011-08-10 13:42:05 ----D---- C:\Program Files\Messenger
2011-08-02 23:20:40 ----D---- C:\WINDOWS\Prefetch
2011-07-30 10:05:12 ----A---- C:\WINDOWS\system32\MRT.exe
2011-07-22 18:35:31 ----A---- C:\WINDOWS\system32\mshtml.dll
2011-07-16 21:05:12 ----D---- C:\Mrpprn
2011-07-16 20:57:22 ----A---- C:\AUTOEXEC.BAT
2011-07-16 14:07:48 ----D---- C:\WINDOWS\WinSxS
2011-07-16 13:47:04 ----SHD---- C:\System Volume Information
2011-07-16 13:47:04 ----D---- C:\WINDOWS\system32\Restore
2011-07-16 13:46:38 ----D---- C:\WINDOWS\system32\drivers\etc
2011-07-13 19:16:39 ----D---- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 ohci1394;VIA OHCI Compliant IEEE 1394 Host Controller; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2007-11-30 61312]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2005-12-05 20640]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys [2011-03-12 218688]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2007-11-30 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2007-11-30 14592]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2007-12-29 60800]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-03-18 26176]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2007-11-30 10368]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2007-12-29 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2007-12-29 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2011-01-08 9888672]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2009-06-05 142336]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2007-11-30 32128]
S3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2005-05-20 16176]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-13 49664]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-13 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-13 21568]
S3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver; C:\WINDOWS\system32\DRIVERS\silabenm.sys [2011-01-27 47176]
S3 silabser;Silicon Labs CP210x USB to UART Bridge Driver; C:\WINDOWS\system32\DRIVERS\silabser.sys [2011-01-27 58496]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2007-11-30 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2007-11-30 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2007-11-30 26368]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2011-08-04 1361288]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2011-01-07 156776]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2006-03-03 69632]
R2 srvbtcclient;srvbtcclient; C:\WINDOWS\update.5.0\svchost.exe [2011-07-26 348672]
R2 srviecheck;srviecheck; C:\WINDOWS\update.2\svchost.exe [2011-08-06 726016]
R2 wxpdrivers;wxpdrivers; C:\WINDOWS\update.1\svchost.exe [2011-07-16 1170432]
S2 srvsysdriver32;srvsysdriver32; C:\WINDOWS\sysdriver32.exe srv []
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe []
S3 npggsvc;nProtect GameGuard Service; C:\WINDOWS\system32\GameMon.des [2011-03-28 4323256]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2007-12-01 14336]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119508
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: ufa.exe

#2 Příspěvek od Rudy »

Také zdravím!
Máte FB virus. Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Emkej
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 25 čer 2006 14:03

Re: ufa.exe

#3 Příspěvek od Emkej »

vďaka za rýchlu odpoveď tu je log:


Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Verzia databázy: 7427

Windows 5.1.2600 Service Pack 3, v.6055
Internet Explorer 7.0.5730.13

10. 8. 2011 20:57:27
mbam-log-2011-08-10 (20-57-23).txt

Typ kontroly: Úplná kontrola (C:\|D:\|)
Objektov kontrolovaných: 249987
Uplynutý čas: 58 min, 22 sek

Infikované služby pamäte: 8
Infikované moduly pamäte: 1
Infikované registračné kľúče: 11
Infikované registračné hodnoty: 6
Infikované položky registračných dát: 3
Infikované priečinky: 1
Infikované súbory: 98

Infikované služby pamäte:
c:\WINDOWS\update.5.0\svchost.exe (Trojan.Agent.H) -> 424 -> No action taken.
c:\WINDOWS\update.5.0\svchost.exe (Trojan.Agent.H) -> 1888 -> No action taken.
c:\WINDOWS\update.1\svchost.exe (Trojan.Dropper) -> 1320 -> No action taken.
c:\WINDOWS\update.tray-9-0\svchost.exe (Trojan.Dropper) -> 2708 -> No action taken.
c:\WINDOWS\update.tray-12-0\svchost.exe (Trojan.Dropper) -> 2796 -> No action taken.
c:\WINDOWS\update.tray-7-0\svchost.exe (Trojan.Dropper) -> 2812 -> No action taken.
c:\WINDOWS\update.2\svchost.exe (Backdoor.Agent) -> 1228 -> No action taken.
c:\WINDOWS\update.2\svchost.exe (Backdoor.Agent) -> 1232 -> No action taken.

Infikované moduly pamäte:
c:\WINDOWS\system32\antiwpa.dll (PUP.Wpakill) -> No action taken.

Infikované registračné kľúče:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Antiwpa (PUP.Wpakill) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvbtcclient (Trojan.Agent.H) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpdrivers (Trojan.Dropper) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srviecheck (Backdoor.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\sysdriver32.exe (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\systeminfog (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\SERVICES32.EXE (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SRVSYSDRIVER32 (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvsysdriver32 (Trojan.Agent) -> No action taken.

Infikované registračné hodnoty:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tray_ico0 (Trojan.Dropper) -> Value: tray_ico0 -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tray_ico1 (Trojan.Dropper) -> Value: tray_ico1 -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tray_ico2 (Trojan.Dropper) -> Value: tray_ico2 -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wxpdrv (Trojan.Dropper) -> Value: wxpdrv -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Services32.exe\close (Trojan.Agent) -> Value: close -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpDrivers\ImagePath (Trojan.Agent) -> Value: ImagePath -> No action taken.

Infikované položky registračných dát:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infikované priečinky:
c:\WINDOWS\rpcminer (Trojan.BCMiner) -> No action taken.

Infikované súbory:
c:\WINDOWS\system32\antiwpa.dll (PUP.Wpakill) -> No action taken.
c:\WINDOWS\update.5.0\svchost.exe (Trojan.Agent.H) -> No action taken.
c:\WINDOWS\update.1\svchost.exe (Trojan.Dropper) -> No action taken.
c:\WINDOWS\update.tray-9-0\svchost.exe (Trojan.Dropper) -> No action taken.
c:\WINDOWS\update.tray-12-0\svchost.exe (Trojan.Dropper) -> No action taken.
c:\WINDOWS\update.tray-7-0\svchost.exe (Trojan.Dropper) -> No action taken.
c:\WINDOWS\services32.exe (Trojan.Dropper) -> No action taken.
c:\program files\internet explorer\conhost.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP80\A0056964.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP80\A0056965.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP85\A0058006.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP85\A0058007.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP85\A0058008.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP85\A0058009.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP87\A0059198.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP87\A0059199.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP87\A0059220.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP87\A0059221.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP88\A0059234.exe (Trojan.BCMiner) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP88\A0059246.exe (Trojan.Downloader) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP88\A0059258.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP88\A0059259.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP88\A0059273.exe (Backdoor.Delf) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP88\A0059274.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP88\A0059275.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP88\A0059286.exe (Trojan.Downloader.H) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP88\A0059318.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP88\A0059319.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP88\A0059356.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP88\A0059371.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP89\A0060431.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP89\A0060455.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP89\A0060511.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP89\A0061511.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP89\A0061512.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP89\A0061513.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP89\A0061514.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0061675.exe (Trojan.Agent.H) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0061691.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0061707.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0061708.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0063868.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0062747.exe (Trojan.FakeAlert) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0062826.exe (Trojan.FakeAlert) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0063862.exe (Trojan.FakeAlert) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0063865.exe (Trojan.FakeAlert) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0063867.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0063869.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0063870.exe (Trojan.Agent) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0063871.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0063872.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0063873.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0063874.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0063875.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0063876.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0063887.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0063888.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0063889.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0063890.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0063891.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0063892.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0064886.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0064887.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0064888.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0064889.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0064890.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0064891.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP91\A0064905.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP92\A0064921.exe (Trojan.FakeAlert) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP93\A0065026.exe (Trojan.FakeAlert) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP93\A0065027.exe (Trojan.FakeAlert) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP93\A0065298.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP93\A0065299.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP93\A0065300.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP93\A0065301.exe (Trojan.Dropper) -> No action taken.
c:\system volume information\_restore{9758ed3b-dde5-41f8-a729-f40ed48f5446}\RP93\A0065302.exe (Trojan.Dropper) -> No action taken.
c:\WINDOWS\gbot111.exe (Trojan.Agent) -> No action taken.
c:\WINDOWS\update.2\3777.exe (Trojan.Downloader.H) -> No action taken.
c:\WINDOWS\update.tray-12-0-lnk\svchost.exe (Trojan.Dropper) -> No action taken.
c:\WINDOWS\update.tray-7-0-lnk\svchost.exe (Trojan.Dropper) -> No action taken.
c:\WINDOWS\update.tray-9-0-lnk\svchost.exe (Trojan.Dropper) -> No action taken.
d:\Emkej\downloady\Programy\bsplayer pro\bsplayer.pro_2.37.build.992\bsplayer.pro_2.37.build.992\Keygen\CORE10k.EXE (Dont.Steal.Our.Software) -> No action taken.
c:\WINDOWS\update.2\svchost.exe (Backdoor.Agent) -> No action taken.
c:\WINDOWS\rpcminer\bitcoinmineropencl.cl (Trojan.BCMiner) -> No action taken.
c:\WINDOWS\rpcminer\bitcoinminercuda_10.cubin (Trojan.BCMiner) -> No action taken.
c:\WINDOWS\rpcminer\bitcoinminercuda_11.cubin (Trojan.BCMiner) -> No action taken.
c:\WINDOWS\rpcminer\bitcoinminercuda_20.cubin (Trojan.BCMiner) -> No action taken.
c:\WINDOWS\rpcminer\cudart32_32_16.dll (Trojan.BCMiner) -> No action taken.
c:\WINDOWS\rpcminer\curllib.dll (Trojan.BCMiner) -> No action taken.
c:\WINDOWS\rpcminer\libeay32.dll (Trojan.BCMiner) -> No action taken.
c:\WINDOWS\rpcminer\libsasl.dll (Trojan.BCMiner) -> No action taken.
c:\WINDOWS\rpcminer\openldap.dll (Trojan.BCMiner) -> No action taken.
c:\WINDOWS\rpcminer\rpcminer-4way.exe (Trojan.BCMiner) -> No action taken.
c:\WINDOWS\rpcminer\rpcminer-cpu.exe (Trojan.BCMiner) -> No action taken.
c:\WINDOWS\rpcminer\rpcminer-cuda.exe (Trojan.BCMiner) -> No action taken.
c:\WINDOWS\rpcminer\rpcminer-opencl.exe (Trojan.BCMiner) -> No action taken.
c:\WINDOWS\rpcminer\ssleay32.dll (Trojan.BCMiner) -> No action taken.
c:\WINDOWS\update.3\svchost.exe (Trojan.Downloader) -> No action taken.
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119508
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: ufa.exe

#4 Příspěvek od Rudy »

Smažte vše, co MBAM nalezl. Restartujte a pak dejte ještě log z ComboFix.
Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Emkej
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 25 čer 2006 14:03

Re: ufa.exe

#5 Příspěvek od Emkej »

ComboFix 11-08-10.01 - Emk . 08. 2011 21:50:39.1.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.3582.3235 [GMT 2:00]
Running from: c:\documents and settings\Emk\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Microsoft
c:\windows\btc_client_iplist.txt
c:\windows\ddh_iplist.txt
c:\windows\front_ip_list.txt
c:\windows\geoiplist
c:\windows\geoiplist.rar
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\loader2.exe_ok
c:\windows\phoenix
c:\windows\phoenix.rar
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\__init__.pyc
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\BFIPatcher.pyc
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\BFIPatcher.pyc
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\proc_list1.log
c:\windows\rpcminer.rar
c:\windows\system32\drivers\etc\HSTS~1
c:\windows\ufa.rar
c:\windows\update.1
c:\windows\update.2
c:\windows\update.3
c:\windows\update.5.0
c:\windows\w_distrib_iplist.txt
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
c:\windows\winsetupapi.log
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SRVBTCCLIENT
-------\Legacy_SRVIECHECK
-------\Legacy_WXPDRIVERS
.
.
((((((((((((((((((((((((( Files Created from 2011-07-10 to 2011-08-10 )))))))))))))))))))))))))))))))
.
.
2011-08-10 17:34 . 2011-08-10 17:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-08-10 17:34 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-10 17:34 . 2011-08-10 18:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-10 17:34 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-10 16:38 . 2011-08-10 16:40 -------- d-----w- C:\rsit
2011-08-10 16:38 . 2011-08-10 16:39 -------- d-----w- c:\program files\trend micro
2011-08-10 16:11 . 2011-08-10 17:47 -------- d-----w- c:\documents and settings\All Users\Application Data\PMB Files
2011-08-10 16:10 . 2011-08-10 16:10 -------- d-----w- c:\program files\Pando Networks
2011-08-10 16:03 . 2011-08-10 19:45 -------- d--h--w- c:\windows\update.tray-12-0-lnk
2011-08-10 15:44 . 2011-08-10 15:59 -------- d-----w- c:\documents and settings\Emk
2011-08-10 11:54 . 2011-08-10 11:54 -------- d-----w- c:\documents and settings\Administrator
2011-08-10 11:51 . 2011-08-10 19:45 -------- d--h--w- c:\windows\update.tray-9-0
2011-08-10 11:51 . 2011-08-10 19:45 -------- d--h--w- c:\windows\update.tray-9-0-lnk
2011-08-10 11:51 . 2011-08-10 19:45 -------- d--h--w- c:\windows\update.tray-7-0
2011-08-10 11:51 . 2011-08-10 19:45 -------- d--h--w- c:\windows\update.tray-7-0-lnk
2011-08-10 11:51 . 2011-08-10 19:45 -------- d--h--w- c:\windows\update.tray-12-0
2011-08-08 19:42 . 2011-08-08 19:42 -------- d-----w- c:\program files\LogMeIn Hamachi
2011-08-02 21:25 . 2005-12-05 05:12 20640 ------w- c:\windows\system32\drivers\PxHelp20.sys
2011-08-02 21:25 . 2011-08-10 16:01 -------- d-----w- c:\program files\Winamp
2011-08-02 21:24 . 2005-05-20 21:46 16176 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-08-02 21:24 . 2005-05-20 21:46 36048 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-08-02 21:24 . 2005-05-20 21:48 85760 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-08-02 21:24 . 2005-05-20 21:47 83968 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-08-02 21:24 . 2005-05-20 21:45 21680 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-08-02 21:23 . 2005-05-20 21:50 372736 ----a-w- c:\windows\system32\aswBoot.exe
2011-08-02 21:23 . 2005-05-20 21:44 90112 ----a-w- c:\windows\system32\AVASTSS.scr
2011-08-02 21:23 . 2004-01-09 09:13 380928 ----a-w- c:\windows\system32\actskin4.ocx
2011-07-16 18:32 . 2011-07-16 18:32 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files
2011-07-16 11:57 . 2011-07-17 14:18 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2011-07-16 11:47 . 2011-07-16 11:47 -------- d-----w- c:\windows\ufa
2011-07-16 11:47 . 2011-07-18 07:22 246272 ----a-w- c:\windows\unrar.exe
2011-07-16 11:45 . 2011-08-02 21:38 -------- d-----w- c:\windows\av_ico
2011-07-16 11:41 . 2011-07-16 11:41 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-13 19:51 . 2011-07-13 19:51 -------- d-----w- C:\_games
2011-07-13 17:24 . 2010-06-02 02:55 74072 ----a-w- c:\windows\system32\XAPOFX1_5.dll
2011-07-13 17:24 . 2010-06-02 02:55 527192 ----a-w- c:\windows\system32\XAudio2_7.dll
2011-07-13 17:24 . 2010-06-02 02:55 239960 ----a-w- c:\windows\system32\xactengine3_7.dll
2011-07-13 17:24 . 2010-05-26 09:41 2106216 ----a-w- c:\windows\system32\D3DCompiler_43.dll
2011-07-13 17:24 . 2010-05-26 09:41 470880 ----a-w- c:\windows\system32\d3dx10_43.dll
2011-07-13 17:24 . 2010-05-26 09:41 248672 ----a-w- c:\windows\system32\d3dx11_43.dll
2011-07-13 17:24 . 2010-05-26 09:41 1868128 ----a-w- c:\windows\system32\d3dcsx_43.dll
2011-07-13 17:24 . 2010-05-26 09:41 1998168 ----a-w- c:\windows\system32\D3DX9_43.dll
2011-07-13 17:24 . 2010-02-04 08:01 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2011-07-13 17:24 . 2010-02-04 08:01 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2011-07-13 17:24 . 2010-02-04 08:01 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2011-07-13 17:24 . 2010-02-04 08:01 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-15 13:29 . 2007-11-30 17:14 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2007-11-30 16:50 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2011-03-11 22:52 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-21 18:45 . 2007-12-29 14:04 832512 ----a-w- c:\windows\system32\wininet.dll
2011-06-21 18:45 . 2007-12-29 14:03 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2011-06-21 18:45 . 2007-12-29 14:02 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-06-21 18:45 . 2007-12-29 14:01 17408 ----a-w- c:\windows\system32\corpol.dll
2011-06-21 11:47 . 2007-12-29 14:01 389120 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2007-11-30 23:26 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-02 14:02 . 2007-11-30 17:24 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-06-24 15:12 . 2011-05-25 19:57 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
.
[-] 2007-12-29 . 6EB0FCD71AAB8E5378321475AE8DB732 . 1613824 . . [5.1.2600.3264] . . c:\windows\system32\sfcfiles.dll
.
c:\windows\System32\ksuser.dll ... is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2011-08-10 3077528]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-01-07 13880424]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2007-11-30 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2011-06-21 124928]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, credssp.dll, msnsspc.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
c:\windows\system32\dumprep 0 -u [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-30 17:29 937920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-11-15 20:02 35736 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2007-11-30 23:26 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2011-01-20 09:20 1305408 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2006-02-19 01:41 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2011-08-04 12:34 1955208 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2011-01-07 18:58 111208 ----a-w- c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Heroes of Might and Magic V - Collectors Edition\\HMM5\\bina2\\bin\\H5_Game.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"d:\\Emkej\\Hry\\League of Legends\\lol.launcher.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8395:TCP"= 8395:TCP:League of Legends Launcher
"8395:UDP"= 8395:UDP:League of Legends Launcher
"6908:TCP"= 6908:TCP:League of Legends Launcher
"6908:UDP"= 6908:UDP:League of Legends Launcher
"8396:TCP"= 8396:TCP:League of Legends Launcher
"8396:UDP"= 8396:UDP:League of Legends Launcher
"6968:TCP"= 6968:TCP:League of Legends Launcher
"6968:UDP"= 6968:UDP:League of Legends Launcher
"8397:TCP"= 8397:TCP:League of Legends Launcher
"8397:UDP"= 8397:UDP:League of Legends Launcher
"6956:TCP"= 6956:TCP:League of Legends Launcher
"6956:UDP"= 6956:UDP:League of Legends Launcher
"8398:TCP"= 8398:TCP:League of Legends Launcher
"8398:UDP"= 8398:UDP:League of Legends Launcher
"8393:TCP"= 8393:TCP:League of Legends Lobby
"8393:UDP"= 8393:UDP:League of Legends Lobby
"8390:TCP"= 8390:TCP:League of Legends Game Client
"8390:UDP"= 8390:UDP:League of Legends Game Client
"6941:TCP"= 6941:TCP:League of Legends Launcher
"6941:UDP"= 6941:UDP:League of Legends Launcher
"57754:TCP"= 57754:TCP:Pando Media Booster
"57754:UDP"= 57754:UDP:Pando Media Booster
.
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [12. 3. 2011 18:44 218688]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [4. 8. 2011 14:34 1361288]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [10. 8. 2011 19:34 366640]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [10. 8. 2011 19:34 22712]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [10. 8. 2011 19:34 41272]
S3 McComponentHostService;McAfee Security Scan Component Host Service;"c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe" --> c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\drivers\silabenm.sys [27. 1. 2011 20:18 47176]
S3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\drivers\silabser.sys [27. 1. 2011 20:18 58496]
.
.
------- Supplementary Scan -------
.
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Emk\Application Data\Mozilla\Firefox\Profiles\bs0gdbhx.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-tray_ico - (no file)
HKLM-Run-tray_ico3 - (no file)
HKLM-Run-tray_ico4 - (no file)
MSConfigStartUp-avast! - c:\progra~1\ALWILS~1\Avast4\ashDisp.exe
MSConfigStartUp-conhost - c:\documents and settings\Emkej\Application Data\Microsoft\conhost.exe
MSConfigStartUp-wxpdrv - c:\windows\services32.exe
MSConfigStartUp-w_distrib - c:\windows\update.3\svchost.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-10 22:05
Windows 5.1.2600 Service Pack 3, v.6055 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\WPAEvents]
@Denied: (Full) (LocalSystem)
"OOBETimer"=hex:ff,d5,71,d6,8b,6a,8d,6f,d5,33,93,fd
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2228)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2011-08-10 22:07:42 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-10 20:07
.
Pre-Run: 15 133 908 992 bytes free
Post-Run: 15 091 470 336 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=AlwaysOff /fastdetect
.
- - End Of File - - FAED5C08F3356E3267283EACF61A6FD6
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119508
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: ufa.exe

#6 Příspěvek od Rudy »

Stáhněte soubor ksuser.dll: http://www.dll-files.com/dllindex/dll-f ... tml?ksuser a rozbalte ho na plochu. Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:
KillAll::

Collect::
c:\windows\unrar.exe

Folder::
c:\windows\update.tray-12-0-lnk
c:\windows\update.tray-9-0
c:\windows\update.tray-9-0-lnk
c:\windows\update.tray-7-0
c:\windows\update.tray-7-0-lnk
c:\windows\update.tray-12-0
c:\windows\ufa
c:\windows\av_ico

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]

FCopy::
c:\documents and settings\Emk\Desktop\ksuser.dll | c:\windows\System32\ksuser.dll
Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Obrázek
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Emkej
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 25 čer 2006 14:03

Re: ufa.exe

#7 Příspěvek od Emkej »

ďakujem veľmi pekne za pomoc :)

ComboFix 11-08-10.03 - Emk . 08. 2011 23:15:54.2.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.3582.3183 [GMT 2:00]
Running from: c:\documents and settings\Emk\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Emk\Desktop\CFScript.txt
.
file zipped: c:\windows\unrar.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\av_ico
c:\windows\av_ico\ico_avast_desktop.ico
c:\windows\av_ico\ico_avast_start.ico
c:\windows\av_ico\ico_mcafee_start.ico
c:\windows\ufa
c:\windows\ufa\ufa.exe
c:\windows\unrar.exe
c:\windows\update.tray-12-0-lnk
c:\windows\update.tray-12-0
c:\windows\update.tray-7-0-lnk
c:\windows\update.tray-7-0
c:\windows\update.tray-9-0-lnk
c:\windows\update.tray-9-0
.
.
--------------- FCopy ---------------
.
c:\documents and settings\Emk\Desktop\ksuser.dll --> c:\windows\System32\ksuser.dll
.
((((((((((((((((((((((((( Files Created from 2011-07-10 to 2011-08-10 )))))))))))))))))))))))))))))))
.
.
2011-08-10 21:15 . 2007-11-30 22:25 4096 -c--a-w- c:\windows\system32\dllcache\ksuser.dll
2011-08-10 21:15 . 2007-11-30 22:25 4096 ----a-w- c:\windows\system32\ksuser.dll
2011-08-10 17:34 . 2011-08-10 17:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-08-10 17:34 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-10 17:34 . 2011-08-10 18:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-10 17:34 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-10 16:38 . 2011-08-10 16:40 -------- d-----w- C:\rsit
2011-08-10 16:38 . 2011-08-10 16:39 -------- d-----w- c:\program files\trend micro
2011-08-10 16:11 . 2011-08-10 17:47 -------- d-----w- c:\documents and settings\All Users\Application Data\PMB Files
2011-08-10 16:10 . 2011-08-10 16:10 -------- d-----w- c:\program files\Pando Networks
2011-08-10 15:44 . 2011-08-10 15:59 -------- d-----w- c:\documents and settings\Emk
2011-08-10 11:54 . 2011-08-10 11:54 -------- d-----w- c:\documents and settings\Administrator
2011-08-08 19:42 . 2011-08-08 19:42 -------- d-----w- c:\program files\LogMeIn Hamachi
2011-08-02 21:25 . 2005-12-05 05:12 20640 ------w- c:\windows\system32\drivers\PxHelp20.sys
2011-08-02 21:25 . 2011-08-10 16:01 -------- d-----w- c:\program files\Winamp
2011-08-02 21:24 . 2005-05-20 21:46 16176 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-08-02 21:24 . 2005-05-20 21:46 36048 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-08-02 21:24 . 2005-05-20 21:48 85760 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-08-02 21:24 . 2005-05-20 21:47 83968 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-08-02 21:24 . 2005-05-20 21:45 21680 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-08-02 21:23 . 2005-05-20 21:50 372736 ----a-w- c:\windows\system32\aswBoot.exe
2011-08-02 21:23 . 2005-05-20 21:44 90112 ----a-w- c:\windows\system32\AVASTSS.scr
2011-08-02 21:23 . 2004-01-09 09:13 380928 ----a-w- c:\windows\system32\actskin4.ocx
2011-07-16 18:32 . 2011-07-16 18:32 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files
2011-07-16 11:57 . 2011-07-17 14:18 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2011-07-16 11:41 . 2011-07-16 11:41 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-13 19:51 . 2011-07-13 19:51 -------- d-----w- C:\_games
2011-07-13 17:24 . 2010-06-02 02:55 74072 ----a-w- c:\windows\system32\XAPOFX1_5.dll
2011-07-13 17:24 . 2010-06-02 02:55 527192 ----a-w- c:\windows\system32\XAudio2_7.dll
2011-07-13 17:24 . 2010-06-02 02:55 239960 ----a-w- c:\windows\system32\xactengine3_7.dll
2011-07-13 17:24 . 2010-05-26 09:41 2106216 ----a-w- c:\windows\system32\D3DCompiler_43.dll
2011-07-13 17:24 . 2010-05-26 09:41 470880 ----a-w- c:\windows\system32\d3dx10_43.dll
2011-07-13 17:24 . 2010-05-26 09:41 248672 ----a-w- c:\windows\system32\d3dx11_43.dll
2011-07-13 17:24 . 2010-05-26 09:41 1868128 ----a-w- c:\windows\system32\d3dcsx_43.dll
2011-07-13 17:24 . 2010-05-26 09:41 1998168 ----a-w- c:\windows\system32\D3DX9_43.dll
2011-07-13 17:24 . 2010-02-04 08:01 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2011-07-13 17:24 . 2010-02-04 08:01 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2011-07-13 17:24 . 2010-02-04 08:01 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2011-07-13 17:24 . 2010-02-04 08:01 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-15 13:29 . 2007-11-30 17:14 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2007-11-30 16:50 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2011-03-11 22:52 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-21 18:45 . 2007-12-29 14:04 832512 ----a-w- c:\windows\system32\wininet.dll
2011-06-21 18:45 . 2007-12-29 14:03 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2011-06-21 18:45 . 2007-12-29 14:02 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-06-21 18:45 . 2007-12-29 14:01 17408 ----a-w- c:\windows\system32\corpol.dll
2011-06-21 11:47 . 2007-12-29 14:01 389120 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2007-11-30 23:26 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-02 14:02 . 2007-11-30 17:24 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-06-24 15:12 . 2011-05-25 19:57 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2007-12-29 . 6EB0FCD71AAB8E5378321475AE8DB732 . 1613824 . . [5.1.2600.3264] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2011-08-10 3077528]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-01-07 13880424]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2007-11-30 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2011-06-21 124928]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, credssp.dll, msnsspc.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-30 17:29 937920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-11-15 20:02 35736 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2007-11-30 23:26 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2011-01-20 09:20 1305408 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2006-02-19 01:41 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2011-08-04 12:34 1955208 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2011-01-07 18:58 111208 ----a-w- c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Heroes of Might and Magic V - Collectors Edition\\HMM5\\bina2\\bin\\H5_Game.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"d:\\Emkej\\Hry\\League of Legends\\lol.launcher.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8395:TCP"= 8395:TCP:League of Legends Launcher
"8395:UDP"= 8395:UDP:League of Legends Launcher
"6908:TCP"= 6908:TCP:League of Legends Launcher
"6908:UDP"= 6908:UDP:League of Legends Launcher
"8396:TCP"= 8396:TCP:League of Legends Launcher
"8396:UDP"= 8396:UDP:League of Legends Launcher
"6968:TCP"= 6968:TCP:League of Legends Launcher
"6968:UDP"= 6968:UDP:League of Legends Launcher
"8397:TCP"= 8397:TCP:League of Legends Launcher
"8397:UDP"= 8397:UDP:League of Legends Launcher
"6956:TCP"= 6956:TCP:League of Legends Launcher
"6956:UDP"= 6956:UDP:League of Legends Launcher
"8398:TCP"= 8398:TCP:League of Legends Launcher
"8398:UDP"= 8398:UDP:League of Legends Launcher
"8393:TCP"= 8393:TCP:League of Legends Lobby
"8393:UDP"= 8393:UDP:League of Legends Lobby
"8390:TCP"= 8390:TCP:League of Legends Game Client
"8390:UDP"= 8390:UDP:League of Legends Game Client
"6941:TCP"= 6941:TCP:League of Legends Launcher
"6941:UDP"= 6941:UDP:League of Legends Launcher
"57754:TCP"= 57754:TCP:Pando Media Booster
"57754:UDP"= 57754:UDP:Pando Media Booster
.
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [12. 3. 2011 18:44 218688]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [4. 8. 2011 14:34 1361288]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [10. 8. 2011 19:34 366640]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [10. 8. 2011 19:34 22712]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [10. 8. 2011 19:34 41272]
S3 McComponentHostService;McAfee Security Scan Component Host Service;"c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe" --> c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\drivers\silabenm.sys [27. 1. 2011 20:18 47176]
S3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\drivers\silabser.sys [27. 1. 2011 20:18 58496]
.
.
------- Supplementary Scan -------
.
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Emk\Application Data\Mozilla\Firefox\Profiles\bs0gdbhx.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-10 23:19
Windows 5.1.2600 Service Pack 3, v.6055 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\WPAEvents]
@Denied: (Full) (LocalSystem)
"OOBETimer"=hex:ff,d5,71,d6,8b,6a,8d,6f,d5,33,93,fd
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3556)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-08-10 23:22:06 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-10 21:22
ComboFix2.txt 2011-08-10 20:07
.
Pre-Run: 15 130 624 000 bytes free
Post-Run: 15 115 636 736 bytes free
.
- - End Of File - - CA763AEDA276892BFD522A3AA2CA92A5
Upload was successful
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119508
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: ufa.exe

#8 Příspěvek od Rudy »

Log již vypadá čistý. Nemáte zač!
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Fantomas
Návštěvník
Návštěvník
Příspěvky: 1
Registrován: 19 srp 2011 11:32

Re: ufa.exe

#9 Příspěvek od Fantomas »

Zdravím, nejspíš mám stejný problém - ufa.exe
dle návodu jsem udělal jsem sken MBAM:


Malwarebytes' Anti-Malware
www.malwarebytes.org

Verze databáze:

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

19.8.2011 12:19:29
mbam-log-2011-08-19 (12-19-29).txt

Typ: Úplná kontrola (C:\|D:\|)
Kontrolované objekty: 208206
Uplynulý čas: 14 minut, 23 sekund

Infikované procesy v paměti: 11
Infikované moduly v paměti: 0
Infikované klíče v registru: 7
Infikované hodnoty v registru: 8
Infikované datové položky v registru: 3
Infikované složky: 0
Infikované soubory: 24

Infikované procesy v paměti:
c:\WINDOWS\update.1\svchost.exe (Trojan.Dropper) -> 1572 -> Unloaded process successfully.
c:\WINDOWS\update.tray-7-0\svchost.exe (Trojan.Dropper) -> 3564 -> Unloaded process successfully.
c:\WINDOWS\systemup.exe (Trojan.Agent) -> 3652 -> Unloaded process successfully.
c:\WINDOWS\l1rezerv.exe (Trojan.Agent) -> 3644 -> Unloaded process successfully.
c:\WINDOWS\sysdriver32.exe (Trojan.Delf) -> 1240 -> Unloaded process successfully.
c:\WINDOWS\sysdriver32_.exe (Trojan.Delf) -> 3616 -> Unloaded process successfully.
c:\WINDOWS\update.2\svchost.exe (Backdoor.Agent) -> 780 -> Unloaded process successfully.
c:\WINDOWS\update.2\svchost.exe (Backdoor.Agent) -> 2896 -> Unloaded process successfully.
c:\WINDOWS\update.5.0\svchost.exe (Trojan.Downloader) -> 456 -> Unloaded process successfully.
c:\WINDOWS\update.5.0\svchost.exe (Trojan.Downloader) -> 808 -> Unloaded process successfully.
c:\WINDOWS\update.3\svchost.exe (Trojan.Agent) -> 3668 -> Unloaded process successfully.

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpdrivers (Trojan.Dropper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvsysdriver32 (Trojan.Delf) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srviecheck (Backdoor.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvbtcclient (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SRVSYSDRIVER32 (Trojan.Agent) -> Quarantined and deleted successfully.

Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tray_ico0 (Trojan.Dropper) -> Value: tray_ico0 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\systemup (Trojan.Agent) -> Value: systemup -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\l1rezerv.exe (Trojan.Agent) -> Value: l1rezerv.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysdriver32.exe (Trojan.Delf) -> Value: sysdriver32.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysdriver32_.exe (Trojan.Delf) -> Value: sysdriver32_.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\NVIDIA driver monitor (Backdoor.Agent) -> Value: NVIDIA driver monitor -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\w_distrib.exe (Trojan.Agent) -> Value: w_distrib.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpDrivers\ImagePath (Trojan.Agent) -> Value: ImagePath -> Quarantined and deleted successfully.

Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
c:\WINDOWS\update.1\svchost.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\WINDOWS\update.tray-7-0\svchost.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\WINDOWS\systemup.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\update.tray-7-0-lnk\svchost.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\Kateřina\dokumenty\downloads\flash-player.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\Kateřina\dokumenty\downloads\flash-player (1).exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\Kateřina\dokumenty\downloads\facebook-pic000934519.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{f97bfe47-c1c1-40cb-9248-fcaf3a3c8cc7}\RP363\A0055007.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{f97bfe47-c1c1-40cb-9248-fcaf3a3c8cc7}\RP370\A0056284.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\system volume information\_restore{f97bfe47-c1c1-40cb-9248-fcaf3a3c8cc7}\RP370\A0056285.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\system volume information\_restore{f97bfe47-c1c1-40cb-9248-fcaf3a3c8cc7}\RP370\A0056301.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\system volume information\_restore{f97bfe47-c1c1-40cb-9248-fcaf3a3c8cc7}\RP370\A0056302.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\system volume information\_restore{f97bfe47-c1c1-40cb-9248-fcaf3a3c8cc7}\RP370\A0056348.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\system volume information\_restore{f97bfe47-c1c1-40cb-9248-fcaf3a3c8cc7}\RP370\A0056349.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\system volume information\_restore{f97bfe47-c1c1-40cb-9248-fcaf3a3c8cc7}\RP370\A0056360.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\system volume information\_restore{f97bfe47-c1c1-40cb-9248-fcaf3a3c8cc7}\RP370\A0056361.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\system volume information\_restore{f97bfe47-c1c1-40cb-9248-fcaf3a3c8cc7}\RP370\A0056366.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\system volume information\_restore{f97bfe47-c1c1-40cb-9248-fcaf3a3c8cc7}\RP370\A0056367.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\WINDOWS\l1rezerv.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\sysdriver32.exe (Trojan.Delf) -> Quarantined and deleted successfully.
c:\WINDOWS\sysdriver32_.exe (Trojan.Delf) -> Quarantined and deleted successfully.
c:\WINDOWS\update.2\svchost.exe (Backdoor.Agent) -> Delete on reboot.
c:\WINDOWS\update.5.0\svchost.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\update.3\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.


SMAZAL VZBRANÉ - vím, asi trochu risk

a následně (po odinstalici Avastu Free, který se prostě nedá jen vypnout - v nouzovém režimu)
ComboFix


ComboFix 11-08-18.03 - Kateřina 19.08.2011 12:26:30.1.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.502.150 [GMT 2:00]
Spuštěný z: c:\documents and settings\Kateřina\Plocha\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\btc_client_iplist.txt
c:\windows\ddh_iplist.txt
c:\windows\front_ip_list.txt
c:\windows\geoiplist
c:\windows\geoiplist.rar
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\iun6002.exe
c:\windows\loader2.exe_ok
c:\windows\phoenix
c:\windows\phoenix.rar
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\__init__.pyc
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\proc_list1.log
c:\windows\rpcminer
c:\windows\rpcminer.rar
c:\windows\rpcminer\bitcoinminercuda_10.cubin
c:\windows\rpcminer\bitcoinminercuda_11.cubin
c:\windows\rpcminer\bitcoinminercuda_20.cubin
c:\windows\rpcminer\bitcoinmineropencl.cl
c:\windows\rpcminer\cudart32_32_16.dll
c:\windows\rpcminer\curllib.dll
c:\windows\rpcminer\libeay32.dll
c:\windows\rpcminer\libsasl.dll
c:\windows\rpcminer\openldap.dll
c:\windows\rpcminer\rpcminer-4way.exe
c:\windows\rpcminer\rpcminer-cpu.exe
c:\windows\rpcminer\rpcminer-cuda.exe
c:\windows\rpcminer\rpcminer-opencl.exe
c:\windows\rpcminer\ssleay32.dll
c:\windows\ufa.rar
c:\windows\update.1
c:\windows\update.2
c:\windows\update.3
c:\windows\update.5.0
c:\windows\w_distrib_iplist.txt
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
c:\windows\winsetupapi.log
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SRVBTCCLIENT
-------\Legacy_SRVIECHECK
-------\Legacy_WXPDRIVERS
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-19 do 2011-08-19 )))))))))))))))))))))))))))))))
.
.
2011-08-19 09:16 . 2011-08-19 09:16 -------- d-----w- c:\documents and settings\Administrator
2011-08-18 22:15 . 2011-08-18 22:15 -------- d-----w- c:\documents and settings\Kateřina\Data aplikací\Malwarebytes
2011-08-18 22:15 . 2011-08-18 22:15 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-08-18 22:15 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-18 22:15 . 2011-08-18 22:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-18 22:15 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-18 20:43 . 2011-08-18 20:43 -------- d-----w- C:\FOUND.002
2011-08-14 19:54 . 2011-08-14 19:54 -------- d-----w- c:\windows\system32\20-20 Technologies
2011-08-14 07:15 . 2011-06-24 14:10 139656 ------w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-14 07:15 . 2011-04-21 13:37 105472 ------w- c:\windows\system32\dllcache\mup.sys
2011-08-14 07:15 . 2011-07-08 14:02 10496 ------w- c:\windows\system32\dllcache\ndistapi.sys
2011-07-26 17:41 . 2011-07-26 17:41 -------- d-----w- c:\windows\ufa
2011-07-26 17:37 . 2011-07-26 17:41 246272 ----a-w- c:\windows\unrar.exe
2011-07-26 17:28 . 2011-07-26 17:28 -------- d-----w- c:\windows\av_ico
2011-07-26 17:26 . 2011-07-26 17:26 -------- d--h--w- c:\windows\update.tray-7-0
2011-07-26 17:26 . 2011-07-26 17:26 -------- d--h--w- c:\windows\update.tray-7-0-lnk
2011-07-26 17:11 . 2011-07-26 17:11 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-15 13:29 . 2004-08-18 18:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2004-08-18 18:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2004-08-18 18:00 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-21 18:39 . 2006-01-09 18:08 832512 ----a-w- c:\windows\system32\wininet.dll
2011-06-21 18:39 . 2004-08-18 18:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-06-21 18:39 . 2004-08-18 18:00 1830912 ------w- c:\windows\system32\inetcpl.cpl
2011-06-21 18:39 . 2004-08-18 18:00 17408 ------w- c:\windows\system32\corpol.dll
2011-06-21 11:47 . 2004-08-18 18:00 389120 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2004-08-18 18:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-06 11:35 . 2004-08-18 18:00 1858944 ----a-w- c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"SoftAuto.exe"="c:\program files\Creative\Software Update 3\SoftAuto.exe" [2008-08-13 405504]
"ICQ"="c:\program files\ICQ7.4\ICQ.exe" [2011-04-05 119608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 16248320]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 53248]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"ADMTray.exe"="c:\acer\Empowering Technology\admtray.exe" [2005-10-24 2462208]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2005-12-27 69632]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-18 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-18 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-18 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-18 455168]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-08-10 352256]
"Acer ePower Management"="c:\acer\Empowering Technology\ePower\Acer ePower Management.exe" [2006-05-22 3080704]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\Monitor.exe" [2006-01-24 397312]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Kateýina\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bluetooth.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Bluetooth.lnk
backup=c:\windows\pss\Bluetooth.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 21:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2006-05-16 16:04 2879488 ----a-w- c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-17 14:49 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\groove.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\ICQ7.4\\ICQ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [17.10.2009 13:37 721904]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [27.11.2009 20:11 247096]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2.4.2011 20:56 136176]
S3 CTUPnPSv;Creative Centrale Media Server;c:\program files\Creative\Creative Centrale\CTUPnPSv.exe [21.5.2008 12:42 64000]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2.4.2011 20:56 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [19.8.2011 0:15 41272]
.
Obsah adresáře 'Naplánované úlohy'
.
2011-08-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-02 06:28]
.
2011-08-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-02 06:28]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search.babylon.com/home?AF=15627
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://cs.intl.acer.yahoo.com
uInternet Connection Wizard,ShellNext = hxxp://cs.intl.acer.yahoo.com/
uSearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe
TCP: DhcpNameServer = 192.168.81.254
DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} - hxxp://kitchenplanner.ikea.com/CZ/Core/Player/2020PlayerAX_IKEA_Win32.cab
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
URLSearchHooks-{EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
HKLM-Run-wxpdrv - c:\windows\services32.exe
HKLM-Run-tray_ico - (no file)
HKLM-Run-tray_ico1 - (no file)
HKLM-Run-tray_ico2 - (no file)
HKLM-Run-tray_ico3 - (no file)
HKLM-Run-tray_ico4 - (no file)
AddRemove-avast - c:\program files\Alwil Software\Avast5\aswRunDll.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-19 12:34
Windows 5.1.2600 Service Pack 3 FAT NTAPI
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(772)
c:\windows\system32\vorbis.dll
c:\windows\system32\ogg.dll
.
- - - - - - - > 'lsass.exe'(1036)
c:\windows\system32\vorbis.dll
c:\windows\system32\ogg.dll
.
- - - - - - - > 'explorer.exe'(2096)
c:\windows\system32\vorbis.dll
c:\windows\system32\ogg.dll
c:\windows\system32\MSNChatHook.dll
c:\windows\system32\sysenv.dll
c:\windows\system32\MSVCR71.dll
c:\acer\Empowering Technology\ePower\SysHook.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\acer\Empowering Technology\admServ.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Creative\Shared Files\CTDevSrv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\rundll32.exe
c:\windows\system32\wbem\unsecapp.exe
c:\docume~1\KATEc:\windows\explorer.exe
.
**************************************************************************
.
Celkový čas: 2011-08-19 12:37:35 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-19 10:37
.
Před spuštěním: Volných bajtů: 30 353 129 472
Po spuštění: Volných bajtů: 30 253 318 144
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=AlwaysOff /fastdetect
.
- - End Of File - - D999CCC575E1976A975A3B82AC8B7581


prosím o kontrolu logu a eventuelně dočištění.

Díky moc
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119508
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: ufa.exe

#10 Příspěvek od Rudy »

2Fantomas: Založte si, prosím, vlastní topic. Děkujeme.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
ufA.exe
Návštěvník
Návštěvník
Příspěvky: 2
Registrován: 29 říj 2011 19:19

Re: ufa.exe

#11 Příspěvek od ufA.exe »

dobrý den,mam počítač s os windows7homepremium64bit, a dostala se mi tam ufa provádím prave log v systemu malware byt anti malware.predem se omlouvam za mou neznalost a me minimalni znalosti PC jazyka .snazi se postupovat podle vzoroveho prikladu odstraneni výše.ale nejsem si jist zda to bude fungovaTR NA MUJ OS JELIKOZ RESENI ODSTRANENI BYLO PROVADENO NA XP.dekuji za odpoved a budu vas jiste kontaktovat ohleden dalsiho postupu
Nahoru
ufA.exe
Návštěvník
Návštěvník
Příspěvky: 2
Registrován: 29 říj 2011 19:19

Re: ufa.exe

#12 Příspěvek od ufA.exe »

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Verze databáze: 8041

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

29.10.2011 20:42:08
mbam-log-2011-10-29 (20-42-08).txt

Typ: Úplná kontrola (C:\|D:\|)
Kontrolované objekty: 449678
Uplynulý čas: 38 minut, 1 sekund

Infikované procesy v paměti: 1
Infikované moduly v paměti: 0
Infikované klíče v registru: 15
Infikované hodnoty v registru: 13
Infikované datové položky v registru: 4
Infikované složky: 9
Infikované soubory: 42

Infikované procesy v paměti:
c:\Windows\sysdriver32.exe (Trojan.Agent) -> 1844 -> Unloaded process successfully.

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvsysdriver32 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvbtcclient (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpdrivers (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{D518921A-4A03-425E-9873-B9A71756821E} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srviecheck (Backdoor.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\sysdriver32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\systeminfog (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\SERVICES32.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers (Trojan.Agent) -> Quarantined and deleted successfully.

Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysdriver32.exe (Trojan.Agent) -> Value: sysdriver32.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wxpdrv (Trojan.Agent) -> Value: wxpdrv -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tray_ico0 (Trojan.Agent) -> Value: tray_ico0 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2695073.exe (Trojan.Agent) -> Value: 2695073.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysdriver32_.exe (Trojan.Agent) -> Value: sysdriver32_.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6707143.exe (Trojan.Agent) -> Value: 6707143.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8863155.exe (Trojan.Agent) -> Value: 8863155.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{00A6FAF6-072E-44cf-8957-5838F569A31D} (Adware.MyWebSearch) -> Value: {00A6FAF6-072E-44cf-8957-5838F569A31D} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{00A6FAF6-072E-44cf-8957-5838F569A31D} (Adware.MyWebSearch) -> Value: {00A6FAF6-072E-44cf-8957-5838F569A31D} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2735732.exe (Trojan.Agent) -> Value: 2735732.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5971296.exe (Trojan.Downloader.Gen) -> Value: 5971296.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Services32.exe\close (Trojan.Agent) -> Value: close -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpDrivers\ImagePath (Trojan.Agent) -> Value: ImagePath -> Quarantined and deleted successfully.

Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SAFEBOOT\AlternateShell (Hijack.Altshell) -> Bad: (services32.exe) Good: (cmd.exe) -> Quarantined and deleted successfully.

Infikované složky:
c:\Windows\rpcminer (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\program files (x86)\funwebproducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files (x86)\funwebproducts\screensaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files (x86)\funwebproducts\screensaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files (x86)\mywebsearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files (x86)\mywebsearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files (x86)\mywebsearch\bar\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files (x86)\mywebsearch\bar\2.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files (x86)\mywebsearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Infikované soubory:
c:\Windows\sysdriver32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\services32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\update.tray-3-0\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Admin\AppData\Local\Temp\2695073.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\sysdriver32_.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\Temp\6707143.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\Temp\8863155.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\update.5.0\svchost.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\update.1\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Admin\AppData\Local\Opera\Opera\temporary_downloads\flash-player.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Admin\AppData\Local\Opera\Opera\temporary_downloads\nfscarbtrn19m-ch\chnfsmtrn.exe (Malware.Packer.as) -> Quarantined and deleted successfully.
c:\Users\Admin\AppData\Local\Temp\temp1_nfscarbtrn19m-ch.zip\chnfsmtrn.exe (Malware.Packer.as) -> Quarantined and deleted successfully.
c:\Users\Admin\downloads\flash-player.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Admin\downloads\ra2.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Admin\downloads\smileycentralpfsetup2.3.76.6.znman000.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Windows\Temp\18412_myunrar2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Windows\Temp\2873_myunrar2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Windows\Temp\85384_myunrar2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Windows\Temp\8782062.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\ufa\ufa.exe (PUP.BitMiner) -> Not selected for removal.
c:\Windows\update.tray-3-0-lnk\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\Temp\2735732.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\Temp\2940786.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\Temp\3145772.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\Temp\5971296.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\Temp\424074479.exe (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.
c:\Windows\update.2\svchost.exe (Backdoor.Agent) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinmineropencl.cl (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinminercuda_10.cubin (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinminercuda_11.cubin (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinminercuda_20.cubin (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\cudart32_32_16.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\curllib.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\libeay32.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\libsasl.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\openldap.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-4way.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-cpu.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-cuda.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-opencl.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\ssleay32.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\program files (x86)\mywebsearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.

co ted??
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119508
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: ufa.exe

#13 Příspěvek od Rudy »

2ufA.exe: Založte si prosím vlastní topic. Jelikož jste už druhý, který se do tohoto topic "namontoval" (čímž dal nejvo, že nečetl upozornění výše), tento topic zamykám.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Zamčeno

Zpět na „Řešení problémů, logy“