ARP poisoning

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
had21
Návštěvník
Návštěvník
Příspěvky: 30
Registrován: 23 Bře 2012 10:13

ARP poisoning

#1 Příspěvek od had21 »

Ahoj,
prosím o radu. Mám na síti jeden počítač, OS win 7 64 bit HP, antivirus NOD32 v. 4, aktualizovaný. Před několika dny odstranil nějaké viry, nějaký spyware a zřejmě něco, co pocházelo od anitvirem zkontrolované instalace PDF Creatoru. Antivir zablokoval vše, přesunul do karantény, dnes jsem je odstranil.

Dnes od odpoledne neustále vyskakují okna NODu, že se jedná o pokus o ARP cache poisoning z IP adresy z lokální sítě, ke které jsem připojený. IP adresa (-1.25) je v rezervaci na DHCP pro pc, který se zapne cca 1x za týden a aktuálně je zřejmě zapnutý. Asi jednou nebo dvakrát došlo ke kolizi IP adres, což se mi zdá jako naprostý nesmysl, vzhledem k tomu, že všichni tu mají nastavené DHCP přidělování, včetně tohoto problematického počítače.

A protože mi nikdo jiný ze sítě nehlásil žádný podobný problém (a síť běží dál jako obvykle) a vzhledem k předchozím virům, rozhodl jsem se vás požádat o pomoc a o kontrolu logu (přikládám). Předem Vám děkuji za ochotu a pomoc.

Honza - had
Nahoru
had21
Návštěvník
Návštěvník
Příspěvky: 30
Registrován: 23 Bře 2012 10:13

Re: ARP poisoning

#2 Příspěvek od had21 »

Logfile of random's system information tool 1.09 (written by random/random)
Run by Jozef at 2012-03-29 15:44:22
Microsoft Windows 7 Home Premium
System drive C: has 99 GB (80%) free of 124 GB
Total RAM: 3874 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:44:26, on 29.3.2012
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Winamp\winampa.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Users\Jozef\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jozef\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Jozef\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jozef\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Jozef.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: IESpeakDoc - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Jozef\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O9 - Extra 'Tools' menuitem: Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: AtherosSvc - Atheros Commnucations - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files (x86)\WinPcap\rpcapd.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: ZAtheros Bt&Wlan Coex Agent - Atheros - C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe

--
End of file - 7421 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe"
"C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe"
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Bluetooth Suite\adminservice.exe"
"C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe"
"C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe"
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
taskeng.exe {5E503218-B190-4C4D-B596-E06EA85A3E7E}
"taskhost.exe"
"C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe"
"C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
"C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /SF3
"C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
"C:\Program Files (x86)\Winamp\winampa.exe"
"C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe"
"C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe"
ATKOSD.exe
KBFiltr.exe
WDC.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
"C:\Users\Jozef\AppData\Local\Google\Chrome\Application\chrome.exe"
"C:\Users\Jozef\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=CacheListSize/CacheListSize_14/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Instant/InstantExperimentA/Prefetch/ContentPrefetchPrerender2/PrerenderFromOmnibox/OmniboxPrerenderEnabled/PrerenderFromOmniboxHeuristic/ExactFullAlgorithm/ProxyConnectionImpact/proxy_connections_32/SpdyCwnd/cwndMin16/SpdyImpact/npn_with_spdy/WarmSocketImpact/last_accessed_socket/ --enable-print-preview --channel=3000.052F2380.740441065 /prefetch:3
C:\Windows\system32\rundll32.exe "C:\Users\Jozef\AppData\Local\Google\Chrome\APPLIC~1\170963~1.83\gcswf32.dll",BrokerMain browser=chrome
"C:\Users\Jozef\AppData\Local\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Users\Jozef\AppData\Local\Google\Chrome\Application\17.0.963.83\gcswf32.dll" --lang=cs --channel=3000.06FB9730.2016870979 --flash-broker=304 /prefetch:4
"C:\Users\Jozef\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=CacheListSize/CacheListSize_14/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/DnsParallelism/parallel_default/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_10/Instant/InstantExperimentA/Prefetch/ContentPrefetchPrerender2/PrerenderFromOmnibox/OmniboxPrerenderEnabled/PrerenderFromOmniboxHeuristic/ExactFullAlgorithm/ProxyConnectionImpact/proxy_connections_32/SpdyCwnd/cwndMin16/SpdyImpact/npn_with_spdy/WarmSocketImpact/last_accessed_socket/ --enable-print-preview --channel=3000.078CEE00.1290634174 /prefetch:3
"C:\Program Files\Wireshark\wireshark.exe"
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe7_ Global\UsGthrCtrlFltPipeMssGthrPipe7 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
"D:\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-453814299-1699875595-3336299601-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-453814299-1699875595-3336299601-1000UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8D10F6C4-0E01-4BD4-8601-11AC1FDF8126}]
CIESpeechBHO Class - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2011-09-30 51872]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AmIcoSinglun64"=C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [2012-03-09 361984]
"AtherosBtStack"=C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [2011-09-30 981664]
"AthBtTray"=C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [2011-09-30 799904]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2012-03-10 11775592]
"RtHDVBg"=C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2012-03-10 2188904]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2011-09-22 4035152]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\Jozef\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-09 136176]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2012-02-29 17148552]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"=C:\Program Files (x86)\Winamp\winampa.exe [2011-12-09 74752]
"ATKOSD2"=C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2011-07-21 5716608]
"ATKMEDIA"=C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [2010-10-07 170624]
"HControlUser"=C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [2009-06-19 105016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave2"=wdmaud.drv
"mixer2"=wdmaud.drv
"midi2"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2012-03-29 15:44:22 ----D---- C:\rsit
2012-03-29 15:44:22 ----D---- C:\Program Files\trend micro
2012-03-29 15:29:29 ----D---- C:\Program Files (x86)\WinPcap
2012-03-29 15:28:27 ----D---- C:\Program Files\Wireshark
2012-03-23 15:22:05 ----D---- C:\Program Files\ESET
2012-03-15 21:02:16 ----D---- C:\Program Files (x86)\ASUS
2012-03-15 20:22:07 ----A---- C:\Windows\system32\drivers\IntelMEFWVer.dll
2012-03-15 20:22:05 ----A---- C:\Windows\SYSWOW64\log.txt
2012-03-15 20:21:35 ----D---- C:\Users\Jozef\AppData\Roaming\InstallShield
2012-03-10 20:32:23 ----D---- C:\Program Files\CCleaner
2012-03-10 20:23:10 ----D---- C:\Users\Jozef\AppData\Roaming\Skype
2012-03-10 20:23:02 ----RD---- C:\Program Files (x86)\Skype
2012-03-10 20:22:56 ----D---- C:\ProgramData\Skype
2012-03-10 15:20:28 ----D---- C:\Program Files (x86)\Foxit Software
2012-03-10 15:00:08 ----D---- C:\Users\Jozef\AppData\Roaming\Ahead
2012-03-10 11:49:06 ----D---- C:\Windows\SYSWOW64\Macromed
2012-03-10 11:48:40 ----A---- C:\Windows\SYSWOW64\tsccvid.dll
2012-03-10 11:48:31 ----A---- C:\Windows\SYSWOW64\zlib1.dll
2012-03-10 11:48:31 ----A---- C:\Windows\SYSWOW64\unzip32.dll
2012-03-10 11:48:31 ----A---- C:\Windows\SYSWOW64\patchw32.dll
2012-03-10 11:48:31 ----A---- C:\Windows\SYSWOW64\patchw.dll
2012-03-10 11:48:31 ----A---- C:\Windows\SYSWOW64\bwplay.exe
2012-03-10 11:48:31 ----A---- C:\Windows\SYSWOW64\bwntsend.dll
2012-03-10 11:48:31 ----A---- C:\Windows\SYSWOW64\bwnthook.dll
2012-03-10 11:48:31 ----A---- C:\Windows\SYSWOW64\bwbits70.dll
2012-03-10 11:46:27 ----D---- C:\Program Files (x86)\BibleWorks 7
2012-03-10 11:40:45 ----D---- C:\Users\Jozef\AppData\Roaming\DAEMON Tools Lite
2012-03-10 11:40:43 ----D---- C:\ProgramData\DAEMON Tools Lite
2012-03-10 11:31:39 ----D---- C:\ProgramData\SonicFocus
2012-03-10 11:31:34 ----D---- C:\Windows\SYSWOW64\RTCOM
2012-03-10 11:31:34 ----D---- C:\Program Files\Realtek
2012-03-10 11:31:16 ----A---- C:\Windows\system32\drivers\SamSfPa.dat
2012-03-10 11:31:15 ----A---- C:\Windows\system32\WavesGUILib.dll
2012-03-10 11:31:15 ----A---- C:\Windows\system32\SRSWOW64.dll
2012-03-10 11:31:15 ----A---- C:\Windows\system32\SRSTSX64.dll
2012-03-10 11:31:15 ----A---- C:\Windows\system32\SRSTSH64.dll
2012-03-10 11:31:15 ----A---- C:\Windows\system32\SRSHP64.dll
2012-03-10 11:31:14 ----A---- C:\Windows\SYSWOW64\SFCOM.dll
2012-03-10 11:31:14 ----A---- C:\Windows\system32\SFSAPO64.dll
2012-03-10 11:31:14 ----A---- C:\Windows\system32\SFProc64.dll
2012-03-10 11:31:14 ----A---- C:\Windows\system32\SFNHK64.dll
2012-03-10 11:31:14 ----A---- C:\Windows\system32\SFHAPO64.dll
2012-03-10 11:31:14 ----A---- C:\Windows\system32\SFDAPO64.dll
2012-03-10 11:31:14 ----A---- C:\Windows\system32\SFComm64.dll
2012-03-10 11:31:14 ----A---- C:\Windows\system32\SFCOM64.dll
2012-03-10 11:31:14 ----A---- C:\Windows\system32\SFAPO64.dll
2012-03-10 11:31:14 ----A---- C:\Windows\system32\RtPgEx64.dll
2012-03-10 11:31:14 ----A---- C:\Windows\system32\RtlCPAPI64.dll
2012-03-10 11:31:14 ----A---- C:\Windows\system32\drivers\RTKVHD64.sys
2012-03-10 11:31:13 ----A---- C:\Windows\system32\RtkCfg64.dll
2012-03-10 11:31:13 ----A---- C:\Windows\system32\RtkAPO64.dll
2012-03-10 11:31:13 ----A---- C:\Windows\system32\RtkApi64.dll
2012-03-10 11:31:13 ----A---- C:\Windows\system32\RTEEP64A.dll
2012-03-10 11:31:13 ----A---- C:\Windows\system32\RTEEL64A.dll
2012-03-10 11:31:13 ----A---- C:\Windows\system32\RTEEG64A.dll
2012-03-10 11:31:13 ----A---- C:\Windows\system32\RTEED64A.dll
2012-03-10 11:31:12 ----A---- C:\Windows\system32\RTCOM64.dll
2012-03-10 11:31:12 ----A---- C:\Windows\system32\RP3DHT64.dll
2012-03-10 11:31:12 ----A---- C:\Windows\system32\RP3DAA64.dll
2012-03-10 11:31:12 ----A---- C:\Windows\system32\RCoRes64.dat
2012-03-10 11:31:12 ----A---- C:\Windows\system32\RCoInst64.dll
2012-03-10 11:31:12 ----A---- C:\Windows\system32\MaxxAudioEQ.dll
2012-03-10 11:31:12 ----A---- C:\Windows\system32\MaxxAudioAPO20.dll
2012-03-10 11:31:10 ----A---- C:\Windows\system32\FMAPO64.dll
2012-03-10 11:31:10 ----A---- C:\Windows\system32\DTSVoiceClarityDLL64.dll
2012-03-10 11:31:10 ----A---- C:\Windows\system32\DTSS2SpeakerDLL64.dll
2012-03-10 11:31:10 ----A---- C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2012-03-10 11:31:09 ----D---- C:\Program Files (x86)\Realtek
2012-03-10 11:31:09 ----A---- C:\Windows\system32\DTSNeoPCDLL64.dll
2012-03-10 11:31:09 ----A---- C:\Windows\system32\DTSLimiterDLL64.dll
2012-03-10 11:31:09 ----A---- C:\Windows\system32\DTSLFXAPO64.dll
2012-03-10 11:31:09 ----A---- C:\Windows\system32\DTSGFXAPO64.dll
2012-03-10 11:31:09 ----A---- C:\Windows\system32\DTSGainCompensatorDLL64.dll
2012-03-10 11:31:09 ----A---- C:\Windows\system32\DTSBoostDLL64.dll
2012-03-10 11:31:09 ----A---- C:\Windows\system32\DTSBassEnhancementDLL64.dll
2012-03-10 11:31:09 ----A---- C:\Windows\system32\AERTAR64.dll
2012-03-10 11:31:09 ----A---- C:\Windows\system32\AERTAC64.dll
2012-03-10 11:31:07 ----HD---- C:\Program Files (x86)\Temp
2012-03-10 11:31:07 ----A---- C:\Windows\RtlExUpd.dll
2012-03-10 11:26:17 ----D---- C:\ProgramData\Atheros
2012-03-09 21:15:32 ----A---- C:\Windows\UC.PIF
2012-03-09 21:15:32 ----A---- C:\Windows\RAR.PIF
2012-03-09 21:15:32 ----A---- C:\Windows\PKZIP.PIF
2012-03-09 21:15:32 ----A---- C:\Windows\PKUNZIP.PIF
2012-03-09 21:15:32 ----A---- C:\Windows\NOCLOSE.PIF
2012-03-09 21:15:32 ----A---- C:\Windows\LHA.PIF
2012-03-09 21:15:32 ----A---- C:\Windows\ARJ.PIF
2012-03-09 21:15:31 ----D---- C:\totalcmd
2012-03-09 21:11:46 ----D---- C:\Program Files (x86)\MSECache
2012-03-09 21:10:48 ----A---- C:\Windows\ODBC.INI
2012-03-09 21:10:39 ----D---- C:\Program Files\Recuva
2012-03-09 21:09:32 ----D---- C:\Windows\PCHEALTH
2012-03-09 21:09:32 ----D---- C:\Program Files (x86)\Microsoft.NET
2012-03-09 21:09:32 ----D---- C:\Program Files (x86)\Microsoft Office
2012-03-09 21:05:57 ----D---- C:\ProgramData\Nero
2012-03-09 21:05:57 ----D---- C:\Program Files (x86)\Nero
2012-03-09 21:03:54 ----A---- C:\Windows\SYSWOW64\d3dx9_30.dll
2012-03-09 21:03:54 ----A---- C:\Windows\SYSWOW64\d3dx9_28.dll
2012-03-09 17:54:30 ----D---- C:\Users\Jozef\AppData\Roaming\ESET
2012-03-09 17:53:44 ----D---- C:\ProgramData\ESET
2012-03-09 17:52:09 ----A---- C:\Windows\SYSWOW64\pncrt.dll
2012-03-09 17:51:55 ----D---- C:\Program Files (x86)\FormatFactory
2012-03-09 17:50:25 ----D---- C:\Users\Jozef\AppData\Roaming\pdfforge
2012-03-09 17:50:23 ----A---- C:\Windows\system32\pdfcmnnt.dll
2012-03-09 17:50:22 ----D---- C:\Program Files (x86)\PDFCreator
2012-03-09 17:50:22 ----A---- C:\Windows\SYSWOW64\MSMPIDE.DLL
2012-03-09 17:48:21 ----D---- C:\Users\Jozef\AppData\Roaming\vlc
2012-03-09 17:48:02 ----D---- C:\Program Files (x86)\VideoLAN
2012-03-09 17:47:20 ----D---- C:\Users\Jozef\AppData\Roaming\YouTube Downloader
2012-03-09 17:46:54 ----D---- C:\Program Files (x86)\YTD
2012-03-09 17:44:27 ----A---- C:\Windows\SYSWOW64\D3DX9_42.dll
2012-03-09 17:44:27 ----A---- C:\Windows\SYSWOW64\d3dx9_31.dll
2012-03-09 17:44:09 ----D---- C:\Program Files (x86)\Winamp Detect
2012-03-09 17:44:00 ----D---- C:\Users\Jozef\AppData\Roaming\Winamp
2012-03-09 17:44:00 ----D---- C:\Program Files (x86)\Winamp
2012-03-09 17:40:07 ----D---- C:\Program Files\IrfanView
2012-03-09 17:39:38 ----D---- C:\Users\Jozef\AppData\Roaming\IrfanView
2012-03-09 17:39:38 ----D---- C:\Program Files (x86)\IrfanView
2012-03-09 17:37:10 ----D---- C:\Users\Jozef\AppData\Roaming\Macromedia
2012-03-09 17:37:09 ----D---- C:\Users\Jozef\AppData\Roaming\Adobe
2012-03-09 17:22:27 ----D---- C:\Users\Jozef\AppData\Roaming\Atheros
2012-03-09 17:21:10 ----D---- C:\Program Files (x86)\Bluetooth Suite
2012-03-09 17:07:49 ----D---- C:\Program Files (x86)\Intel
2012-03-09 17:07:49 ----A---- C:\Windows\SYSWOW64\CSVer.dll
2012-03-09 17:07:37 ----D---- C:\Intel
2012-03-09 17:03:27 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2012-03-09 17:03:24 ----D---- C:\ProgramData\AmUStor
2012-03-09 17:03:23 ----D---- C:\Program Files (x86)\AmIcoSingLun
2012-03-09 17:02:54 ----SHD---- C:\Windows\Installer
2012-03-09 16:56:18 ----N---- C:\Windows\system32\MpSigStub.exe
2012-03-09 16:40:35 ----D---- C:\Users\Jozef\AppData\Roaming\Identities
2012-03-09 16:40:21 ----SD---- C:\Users\Jozef\AppData\Roaming\Microsoft
2012-03-09 16:40:21 ----D---- C:\Users\Jozef\AppData\Roaming\Media Center Programs
2012-03-09 16:40:12 ----SHD---- C:\Recovery
2012-03-09 16:40:12 ----SHD---- C:\ProgramData\Šablony
2012-03-09 16:40:12 ----SHD---- C:\ProgramData\Plocha
2012-03-09 16:40:12 ----SHD---- C:\ProgramData\Oblíbené položky
2012-03-09 16:40:12 ----SHD---- C:\ProgramData\Nabídka Start
2012-03-09 16:40:12 ----SHD---- C:\ProgramData\Dokumenty
2012-03-09 16:40:12 ----SHD---- C:\ProgramData\Data aplikací
2012-03-09 16:35:36 ----D---- C:\Windows\SoftwareDistribution
2012-03-09 16:32:59 ----D---- C:\Windows\Prefetch
2012-03-09 16:32:36 ----ASH---- C:\pagefile.sys
2012-03-09 16:32:34 ----ASH---- C:\hiberfil.sys
2012-03-09 16:32:33 ----SHD---- C:\System Volume Information
2012-03-09 16:31:53 ----D---- C:\Windows\Panther
2012-03-09 16:31:48 ----RASH---- C:\BOOTSECT.BAK
2012-03-09 16:31:46 ----SHD---- C:\Boot

======List of files/folders modified in the last 1 month======

2012-03-29 15:44:22 ----RD---- C:\Program Files
2012-03-29 15:44:18 ----D---- C:\Windows\Temp
2012-03-29 15:30:58 ----D---- C:\Windows\System32
2012-03-29 15:30:58 ----D---- C:\Windows\inf
2012-03-29 15:30:58 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-03-29 15:29:29 ----RD---- C:\Program Files (x86)
2012-03-29 15:29:29 ----D---- C:\Windows\SysWOW64
2012-03-29 15:29:29 ----D---- C:\Windows\system32\drivers
2012-03-29 15:29:11 ----D---- C:\Windows\winsxs
2012-03-29 15:28:43 ----D---- C:\Windows\system32\config
2012-03-29 15:28:36 ----D---- C:\Program Files\Common Files\Microsoft Shared
2012-03-29 13:38:17 ----D---- C:\Windows
2012-03-23 15:23:35 ----D---- C:\Windows\system32\DriverStore
2012-03-23 15:23:35 ----D---- C:\Windows\system32\catroot
2012-03-15 21:02:33 ----D---- C:\Windows\system32\Tasks
2012-03-15 20:22:13 ----HD---- C:\ProgramData
2012-03-15 20:22:01 ----D---- C:\Program Files (x86)\Common Files
2012-03-12 18:21:16 ----D---- C:\Windows\system32\catroot2
2012-03-12 09:25:22 ----D---- C:\Windows\system32\wdi
2012-03-10 20:32:58 ----D---- C:\Windows\Logs
2012-03-10 20:32:58 ----D---- C:\Windows\debug
2012-03-10 14:56:04 ----D---- C:\Windows\system32\LogFiles
2012-03-10 11:48:38 ----RSD---- C:\Windows\Fonts
2012-03-09 21:10:39 ----RSD---- C:\Windows\assembly
2012-03-09 21:10:09 ----D---- C:\Windows\ShellNew
2012-03-09 21:09:32 ----SD---- C:\ProgramData\Microsoft
2012-03-09 21:08:09 ----D---- C:\Windows\system
2012-03-09 17:33:00 ----D---- C:\Windows\Tasks
2012-03-09 16:56:05 ----D---- C:\Windows\system32\restore
2012-03-09 16:49:22 ----D---- C:\Windows\system32\drivers\UMDF
2012-03-09 16:47:35 ----D---- C:\Windows\system32\CodeIntegrity
2012-03-09 16:41:37 ----D---- C:\Windows\Microsoft.NET
2012-03-09 16:40:32 ----SHD---- C:\$Recycle.Bin
2012-03-09 16:40:21 ----RD---- C:\Users
2012-03-09 16:40:12 ----D---- C:\Program Files\Windows NT
2012-03-09 16:39:24 ----D---- C:\Windows\rescache
2012-03-09 16:36:21 ----D---- C:\Windows\system32\sysprep
2012-03-09 16:31:29 ----D---- C:\Windows\system32\oobe
2012-03-09 16:31:29 ----D---- C:\Windows\Setup

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2011-08-04 62496]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R1 ATKWMIACPIIO;ATKWMIACPI Driver; \??\C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-09-07 17536]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2011-08-04 146432]
R1 EpfwLWF;Epfw NDIS LightWeight Filter; C:\Windows\system32\DRIVERS\EpfwLWF.sys [2011-08-04 38288]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 ASMMAP64;ASMMAP64; \??\C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-02 15416]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2011-08-09 202576]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2011-08-04 187632]
R2 NPF;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2010-06-25 35344]
R3 AthBTPort;Atheros Virtual Bluetooth Class; C:\Windows\system32\DRIVERS\btath_flt.sys [2011-09-30 36000]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2011-10-07 2770944]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver; C:\Windows\system32\drivers\btath_a2dp.sys [2011-09-30 330912]
R3 btath_avdt;Atheros Bluetooth AVDT Service; C:\Windows\system32\drivers\btath_avdt.sys [2011-09-30 110240]
R3 BTATH_BUS;Atheros Bluetooth Bus; C:\Windows\system32\DRIVERS\btath_bus.sys [2011-09-30 30368]
R3 BTATH_HCRP;Bluetooth HCRP Server driver; C:\Windows\system32\DRIVERS\btath_hcrp.sys [2011-09-30 167584]
R3 BTATH_LWFLT;Bluetooth LWFLT Device; C:\Windows\system32\DRIVERS\btath_lwflt.sys [2011-09-30 68256]
R3 BTATH_RCP;Bluetooth AVRCP Device; C:\Windows\system32\DRIVERS\btath_rcp.sys [2011-09-30 280992]
R3 BtFilter;BtFilter; C:\Windows\system32\DRIVERS\btfilter.sys [2011-09-30 519328]
R3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-07-14 79360]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2012-03-10 2736872]
R3 kbfiltr;Keyboard Filter; C:\Windows\system32\DRIVERS\kbfiltr.sys [2012-03-15 15416]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1C62x64.sys [2012-03-09 169584]
R3 MEIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2010-10-20 56344]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2009-07-14 551936]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ASLDRService;ASLDR Service; C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe [2009-06-15 84536]
R2 AtherosSvc;AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [2011-09-30 105120]
R2 ATKGFNEXSrv;ATKGFNEX Service; C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe [2009-12-15 96896]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [2011-09-22 974944]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2010-12-20 325656]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-20 2656280]
R2 ZAtheros Bt&Wlan Coex Agent;ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-09-30 158880]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856]
S3 NMIndexingService;NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files (x86)\WinPcap\rpcapd.exe [2010-06-25 117264]

-----------------EOF-----------------
Nahoru
had21
Návštěvník
Návštěvník
Příspěvky: 30
Registrován: 23 Bře 2012 10:13

Re: ARP poisoning

#3 Příspěvek od had21 »

...dohledal jsem ty viry, jednalo se o:

F:\grijehom\sirodjena.exe - varianta infiltrace Win32/Bflient.AA červ - vyléčen smazáním - uložen do karantény [1]
F:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx - Win32/Conficker.AE červ - vyléčen smazáním - uložen do karantény [1]

C:\Program Files (x86)\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe » INNO » file0000.bin - Win32/Adware.Toolbar.Dealio aplikace
C:\Program Files (x86)\PDFCreator\Toolbar\pdfforge Toolbar_setup.exe » INNO » file0000.bin - Win32/Adware.Toolbar.Dealio aplikace - byl součástí smazaného objektu

...díky.
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: ARP poisoning

#4 Příspěvek od vyosek »

Zdravim a pekny vecer preji :)

:arrow: Zapojte do PC vsechny USB klice (flashky, ext. disky apod.)
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
had21
Návštěvník
Návštěvník
Příspěvky: 30
Registrován: 23 Bře 2012 10:13

Re: ARP poisoning

#5 Příspěvek od had21 »

děkuju, tak tady je log:


############################## | UsbFix 7.059 | [Deletion]

User: Jozef (Administrator) # JOZEF-PC [ASUSTeK Computer Inc. K53E]
Updated 16/09/2011 by El Desaparecido
Started at 10:17:24 | 30/03/2012
Website: http://eldesaparecido.com
Submit your sample: http://eldesaparecido.com/support.php
Contact: contact@eldesaparecido.com

CPU: Intel(R) Core(TM) i3-2310M CPU @ 2.10GHz
CPU 2: Intel(R) Core(TM) i3-2310M CPU @ 2.10GHz
Microsoft Windows 7 Home Premium (6.1.7600 64-Bit) #
Internet Explorer 8.0.7600.16385

Windows Firewall: Disabled /!\
RAM -> 3874 Mb
C:\ (%systemdrive%) -> Fixed drive # 121 Gb (97 Mb free - 80%) [] # NTFS
D:\ -> Fixed drive # 450 Gb (404 Mb free - 90%) [DATA] # NTFS
E:\ -> CD-ROM
F:\ -> Removable drive # 2 Gb (976 Mb free - 51%) [KINGSTON] # FAT32
H:\ -> Removable drive # 4 Gb (3 Mb free - 78%) [CORSAIR] # FAT32

################## | Files # Infected Folders |

Deleted ! C:\$RECYCLE.BIN\S-1-5-21-453814299-1699875595-3336299601-1000
Deleted ! D:\$RECYCLE.BIN\S-1-5-21-1486121893-3566804749-1632448800-1000
Deleted ! D:\$RECYCLE.BIN\S-1-5-21-453814299-1699875595-3336299601-1000
Deleted ! F:\Recycler\S-5-3-42-2819952290-8240758988-879315005-3665

(!) Temporary files deleted.


################## | Registry |


################## | Mountpoints2 |


################## | Listing |

[30/03/2012 - 10:18:48 | SHD ] C:\$Recycle.Bin
[09/03/2012 - 16:31:46 | D ] C:\Boot
[14/07/2009 - 03:38:58 | RASH | 383562] C:\bootmgr
[09/03/2012 - 16:31:48 | N | 8192] C:\BOOTSECT.BAK
[14/07/2009 - 07:08:56 | SHD ] C:\Documents and Settings
[30/03/2012 - 10:09:16 | ASH | 3046809600] C:\hiberfil.sys
[09/03/2012 - 17:07:37 | D ] C:\Intel
[30/03/2012 - 10:09:19 | ASH | 4062412800] C:\pagefile.sys
[14/07/2009 - 05:20:08 | D ] C:\PerfLogs
[29/03/2012 - 15:44:22 | D ] C:\Program Files
[29/03/2012 - 15:29:29 | D ] C:\Program Files (x86)
[15/03/2012 - 20:22:13 | HD ] C:\ProgramData
[09/03/2012 - 16:40:12 | SHD ] C:\Recovery
[29/03/2012 - 15:44:28 | D ] C:\rsit
[23/03/2012 - 14:59:55 | SHD ] C:\System Volume Information
[20/03/2012 - 11:32:29 | D ] C:\totalcmd
[30/03/2012 - 10:18:48 | D ] C:\UsbFix
[30/03/2012 - 10:17:25 | A | 2191] C:\UsbFix.txt
[09/03/2012 - 16:40:21 | D ] C:\Users
[29/03/2012 - 13:38:17 | D ] C:\Windows
[30/03/2012 - 10:18:48 | SHD ] D:\$RECYCLE.BIN
[29/02/2012 - 16:50:24 | D ] D:\Arcs Praha
[29/02/2012 - 15:05:01 | D ] D:\Dano
[30/03/2012 - 10:15:50 | D ] D:\Downloads
[29/02/2012 - 15:48:37 | D ] D:\Farnosť Dlhé
[29/02/2012 - 15:57:30 | D ] D:\Filmy
[29/02/2012 - 15:59:49 | D ] D:\Fotky
[21/03/2012 - 20:43:00 | D ] D:\História
[29/02/2012 - 16:15:09 | D ] D:\Humor a oddych
[29/02/2012 - 16:22:45 | D ] D:\KTF UK Praha
[29/02/2012 - 16:23:45 | D ] D:\Literatúra
[29/02/2012 - 16:24:07 | D ] D:\Mix
[29/02/2012 - 16:24:13 | D ] D:\Moje súkromné
[29/02/2012 - 16:34:04 | D ] D:\Music
[09/03/2012 - 15:16:56 | D ] D:\PFiles
[29/02/2012 - 16:36:57 | D ] D:\Programy
[09/03/2012 - 12:13:03 | D ] D:\Programy 02
[23/03/2012 - 14:59:56 | SHD ] D:\System Volume Information
[09/03/2012 - 12:14:21 | D ] D:\Theology
[06/03/2012 - 18:04:38 | D ] D:\Vlastné práce z histórie
[06/08/2011 - 20:37:18 | D ] F:\Madrid
[06/03/2012 - 17:03:30 | D ] F:\Štěpán - diplomka
[13/02/2012 - 12:47:04 | N | 143090] F:\1778573.pdf
[21/09/2011 - 09:26:26 | RSHD ] F:\RECYCLER
[21/02/2012 - 08:47:50 | D ] F:\codex rosanensis
[01/09/2011 - 18:25:44 | D ] F:\BiGy - výlet
[12/12/2011 - 12:39:08 | N | 51238400] F:\Biskup Antonín Liška.ppt
[17/02/2012 - 12:53:28 | N | 972179] F:\TÉMA Pastiersky list na Facebooku Postoy.mht
[29/12/2011 - 15:09:56 | N | 31232] F:\Obsah diplomové práce.doc
[06/02/2012 - 12:56:44 | N | 153774] F:\Gmail - Pozdrav z USA.mht
[17/11/2011 - 16:02:14 | N | 77312] F:\PoT_8_MEDITACE_poznamky_pro_ucastniky.doc
[25/01/2012 - 15:48:26 | D ] F:\Fotky január 2011
[17/02/2012 - 12:57:42 | N | 196133] F:\KTF-611-version1-Otazky_SZZ_KT_2011_2012_aktual_unor.pdf
[30/01/2012 - 11:27:38 | D ] F:\Záloha
[06/02/2012 - 13:01:32 | N | 229216] F:\Nota-k-Roku-viry-20120131.pdf
[16/12/2011 - 17:30:16 | N | 110592] F:\AL v ČB.doc
[21/03/2012 - 17:08:04 | N | 60064768] F:\Diplomovka Antonín Liška.doc
[21/03/2012 - 17:11:56 | N | 13594746] F:\Diplomovka Antonín Liška.pdf
[20/03/2011 - 18:50:34 | SH | 58368] F:\Thumbs.db
[13/04/2011 - 09:45:16 | D ] F:\Mix
[11/02/2012 - 16:24:38 | N | 140587] F:\Rozvrh NG - Můj rozvrh - KTF - LS 11-12_php.mht
[21/02/2012 - 12:41:02 | N | 725520630] H:\Goyovy_prizraky.avi
[27/02/2012 - 21:20:56 | N | 9502424] H:\mbam--setup-1.60.1.1000.exe
[27/01/2011 - 08:46:58 | SH | 14848] H:\Thumbs.db
[21/03/2012 - 17:11:56 | N | 13594746] H:\Diplomovka Antonín Liška.pdf
[21/03/2012 - 17:43:02 | N | 843741] H:\153a.pdf
[27/03/2012 - 08:24:48 | D ] H:\Definitivní verze

################## | Vaccin |

C:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
D:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
F:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)
H:\Autorun.inf -> Vaccine created by UsbFix (TeamXscript)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_JOZEF-PC.zip
http://eldesaparecido.com/support.php
Thank you for your contribution.

################## | E.O.F |
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: ARP poisoning

#6 Příspěvek od vyosek »

:arrow: Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
:arrow: Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
  • Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
  • Pokud mate Win XP spustte pod uctem Spravce\Administratora
  • Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
  • Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
  • Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
  • Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
  • Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
  • Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
  • Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
had21
Návštěvník
Návštěvník
Příspěvky: 30
Registrován: 23 Bře 2012 10:13

Re: ARP poisoning

#7 Příspěvek od had21 »

ComboFix 12-04-01.01 - Jozef 01.04.2012 19:14:51.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.3874.2977 [GMT 2:00]
Spuštěný z: c:\users\Jozef\Desktop\ComboFix.exe
AV: ESET Smart Security 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Disabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-03-01 do 2012-04-01 )))))))))))))))))))))))))))))))
.
.
2012-04-01 17:17 . 2012-04-01 17:17 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-03-30 08:15 . 2012-03-30 08:19 -------- d-----w- C:\UsbFix
2012-03-29 13:44 . 2012-03-29 13:44 -------- d-----w- C:\rsit
2012-03-29 13:44 . 2012-03-29 13:44 -------- d-----w- c:\program files\trend micro
2012-03-29 13:29 . 2012-03-29 13:29 -------- d-----w- c:\program files (x86)\WinPcap
2012-03-29 13:28 . 2012-03-29 13:29 -------- d-----w- c:\program files\Wireshark
2012-03-23 13:22 . 2012-03-23 13:22 -------- d-----w- c:\program files\ESET
2012-03-15 19:02 . 2012-03-15 19:02 -------- d-----w- c:\program files (x86)\ASUS
2012-03-15 18:22 . 2010-12-20 17:08 8192 ----a-w- c:\windows\system32\drivers\IntelMEFWVer.dll
2012-03-15 18:22 . 2012-03-15 18:22 -------- d-----w- c:\program files (x86)\Common Files\postureAgent
2012-03-10 18:32 . 2012-03-10 18:32 -------- d-----w- c:\program files\CCleaner
2012-03-10 18:23 . 2012-03-10 18:23 -------- d-----w- c:\program files (x86)\Common Files\Skype
2012-03-10 18:23 . 2012-03-10 18:23 -------- d-----r- c:\program files (x86)\Skype
2012-03-10 18:22 . 2012-03-10 18:23 -------- d-----w- c:\programdata\Skype
2012-03-10 13:20 . 2012-03-10 13:20 -------- d-----w- c:\program files (x86)\Foxit Software
2012-03-10 09:49 . 2012-03-10 09:49 -------- d-----w- c:\windows\SysWow64\Macromed
2012-03-10 09:48 . 2000-10-31 01:11 98304 ----a-w- c:\windows\SysWow64\tsccvid.dll
2012-03-10 09:48 . 2005-10-05 13:52 1982464 ----a-w- c:\windows\SysWow64\bwbits70.dll
2012-03-10 09:48 . 2005-08-06 07:45 55808 ----a-w- c:\windows\SysWow64\zlib1.dll
2012-03-10 09:48 . 2005-02-28 21:52 102400 ----a-w- c:\windows\SysWow64\unzip32.dll
2012-03-10 09:48 . 2003-09-17 11:43 81920 ----a-w- c:\windows\SysWow64\bwplay.exe
2012-03-10 09:48 . 2000-03-14 04:21 181760 ----a-w- c:\windows\SysWow64\patchw32.dll
2012-03-10 09:48 . 1997-12-05 11:33 116736 ----a-w- c:\windows\SysWow64\patchw.dll
2012-03-10 09:48 . 1996-04-04 17:01 20992 ----a-w- c:\windows\SysWow64\bwntsend.dll
2012-03-10 09:48 . 1996-04-04 17:00 16896 ----a-w- c:\windows\SysWow64\bwnthook.dll
2012-03-10 09:46 . 2012-03-10 09:48 -------- d-----w- c:\program files (x86)\BibleWorks 7
2012-03-10 09:40 . 2012-03-10 09:40 -------- d-----w- c:\programdata\DAEMON Tools Lite
2012-03-10 09:26 . 2012-03-10 09:26 -------- d-----w- c:\programdata\Atheros
2012-03-09 19:15 . 2012-02-24 06:57 545 ----a-w- c:\windows\UC.PIF
2012-03-09 19:15 . 2012-02-24 06:57 545 ----a-w- c:\windows\RAR.PIF
2012-03-09 19:15 . 2012-02-24 06:57 545 ----a-w- c:\windows\NOCLOSE.PIF
2012-03-09 19:15 . 2012-02-24 06:57 545 ----a-w- c:\windows\LHA.PIF
2012-03-09 19:15 . 2012-02-24 06:57 545 ----a-w- c:\windows\ARJ.PIF
2012-03-09 19:15 . 2012-03-20 09:32 -------- d-----w- C:\totalcmd
2012-03-09 19:11 . 2012-03-09 19:11 -------- d-----w- c:\program files (x86)\MSECache
2012-03-09 19:10 . 2012-03-09 19:10 -------- d-----w- c:\program files\Recuva
2012-03-09 19:09 . 2012-03-09 19:09 -------- d-----w- c:\windows\PCHEALTH
2012-03-09 19:09 . 2012-03-09 19:09 -------- d-----w- c:\program files (x86)\Microsoft.NET
2012-03-09 19:05 . 2012-03-09 19:06 -------- d-----w- c:\program files (x86)\Common Files\Ahead
2012-03-09 19:05 . 2012-03-09 19:05 -------- d-----w- c:\programdata\Nero
2012-03-09 19:05 . 2012-03-09 19:05 -------- d-----w- c:\program files (x86)\Nero
2012-03-09 15:51 . 2012-03-09 15:52 -------- d-----w- c:\program files (x86)\FormatFactory
2012-03-09 15:50 . 2005-04-15 19:58 1071088 ----a-w- c:\windows\SysWow64\MSCOMCTL.OCX
2012-03-09 15:50 . 2005-03-12 00:07 87040 ----a-w- c:\windows\system32\pdfcmnnt.dll
2012-03-09 15:50 . 2004-03-09 00:00 662288 ----a-w- c:\windows\SysWow64\MSCOMCT2.OCX
2012-03-09 15:50 . 1998-06-24 00:00 137000 ----a-w- c:\windows\SysWow64\MSMAPI32.OCX
2012-03-09 15:50 . 2012-03-09 15:50 -------- d-----w- c:\program files (x86)\PDFCreator
2012-03-09 15:50 . 1998-07-06 00:00 23552 ----a-w- c:\windows\SysWow64\MSMPIDE.DLL
2012-03-09 15:48 . 2012-03-09 15:48 -------- d-----w- c:\program files (x86)\VideoLAN
2012-03-09 15:46 . 2012-03-09 15:46 -------- d-----w- c:\program files (x86)\YTD
2012-03-09 15:44 . 2009-09-04 16:29 1892184 ----a-w- c:\windows\SysWow64\D3DX9_42.dll
2012-03-09 15:44 . 2006-09-28 15:05 2414360 ----a-w- c:\windows\SysWow64\d3dx9_31.dll
2012-03-09 15:44 . 2012-03-09 15:44 -------- d-----w- c:\program files (x86)\Winamp Detect
2012-03-09 15:44 . 2012-03-09 15:44 -------- d-----w- c:\program files (x86)\Common Files\PX Storage Engine
2012-03-09 15:44 . 2012-03-09 15:44 -------- d-----w- c:\program files (x86)\Winamp
2012-03-09 15:40 . 2012-03-09 15:40 -------- d-----w- c:\program files\IrfanView
2012-03-09 15:39 . 2012-03-09 15:40 -------- d-----w- c:\program files (x86)\IrfanView
2012-03-09 15:21 . 2012-03-09 15:21 -------- d-----w- c:\program files (x86)\Common Files\Atheros
2012-03-09 15:21 . 2012-03-09 15:22 -------- d-----w- c:\program files (x86)\Bluetooth Suite
2012-03-09 15:07 . 2012-03-15 18:22 -------- d-----w- c:\program files (x86)\Intel
2012-03-09 15:07 . 2012-03-09 15:07 53248 ----a-w- c:\windows\SysWow64\CSVer.dll
2012-03-09 15:07 . 2012-03-09 15:07 -------- d-----w- C:\Intel
2012-03-09 15:03 . 2012-03-15 18:21 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
2012-03-09 15:03 . 2012-03-09 15:03 -------- d-----w- c:\programdata\AmUStor
2012-03-09 15:03 . 2012-03-09 15:03 -------- d-----w- c:\program files (x86)\AmIcoSingLun
2012-03-09 15:02 . 2012-03-29 13:29 -------- d-sh--w- c:\windows\Installer
2012-03-09 14:56 . 2012-03-01 12:21 8643640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{624596B4-B027-4D78-97F5-0B6D3B42A87F}\mpengine.dll
2012-03-09 14:56 . 2012-02-23 08:18 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-03-09 14:31 . 2012-03-10 18:32 -------- d-----w- c:\windows\Panther
2012-03-09 14:31 . 2012-03-09 14:31 -------- d-----w- C:\Boot
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-30 08:19 . 2012-03-30 08:19 6314 ----a-w- C:\UsbFix_Upload_Me_JOZEF-PC.zip
2012-03-15 18:22 . 2009-07-20 16:29 15416 ----a-w- c:\windows\system32\drivers\kbfiltr.sys
2012-03-09 14:55 . 2011-04-20 16:24 169584 ----a-w- c:\windows\system32\drivers\L1C62x64.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-02-29 17148552]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2011-12-09 74752]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2011-07-21 5716608]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-09-07 17536]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-02 15416]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2011-09-30 105120]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2011-09-22 974944]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-20 2656280]
S2 ZAtheros Bt&Wlan Coex Agent;ZAtheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-09-30 158880]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [x]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [x]
S3 btath_avdt;Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2012-04-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-453814299-1699875595-3336299601-1000Core.job
- c:\users\Jozef\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-09 15:32]
.
2012-04-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-453814299-1699875595-3336299601-1000UA.job
- c:\users\Jozef\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-09 15:32]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2012-03-09 361984]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-09-30 981664]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-09-30 799904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-03-10 11775592]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2012-03-10 2188904]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-09-22 4035152]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.4
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-Macromedia Shockwave Player - c:\windows\System32\Macromed\SHOCKW~1\UNWISE.EXE
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\ESET\ESET Security\CurrentVersion\Info]
@Denied: (2) (LocalSystem)
@SACL=
"ProductCode"="{BA0C98EF-FDD6-423D-BFFD-57580DE283F0}"
"PackageFeatures"=dword:00000003
"LanguageCode"="cs"
"ProductACode"=dword:0000006e
"ProductBase"=dword:00000001
"ProductName"="ESET Smart Security"
"ProductType"="ess"
"ProductVersion"="5.0.95.0"
"AppDataDir"="c:\\ProgramData\\ESET\\ESET Smart Security\\"
"DataDir"="ESET\\ESET Smart Security\\"
"EditionName"=" "
"InstallDir"="c:\\Program Files\\ESET\\ESET Smart Security\\"
"LanguageId"=dword:00000405
"PackageTag"=dword:6090e758
"UniqueId"="000531C94F6C795D"
"ScannerBuild"=dword:0000270e
"ScannerVersionId"=dword:00001954
"ScannerVersion"="Locked/open ESET for status."
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2012-04-01 19:19:18
ComboFix-quarantined-files.txt 2012-04-01 17:19
.
Před spuštěním: Volných bajtů: 105 075 793 920
Po spuštění: Volných bajtů: 104 878 006 272
.
- - End Of File - - 65D4936E51B6928A856FF39D597ABB5F
Nahoru
had21
Návštěvník
Návštěvník
Příspěvky: 30
Registrován: 23 Bře 2012 10:13

Re: ARP poisoning

#8 Příspěvek od had21 »

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 01.04.2012 at 19:10:51.
Operating System: Windows 7 Home Premium


Processes terminated by Rkill or while it was running:

C:\Windows\SysWOW64\grpconv.exe


Rkill completed on 01.04.2012 at 19:10:55.
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: ARP poisoning

#9 Příspěvek od vyosek »

Jak se chova PC :???:
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
had21
Návštěvník
Návštěvník
Příspěvky: 30
Registrován: 23 Bře 2012 10:13

Re: ARP poisoning

#10 Příspěvek od had21 »

PC se zdá být už v pořádku, žádná upozornění neskáčou, pouze se mírně zpomalilo načítání některých webových stránek, ale podle mě spíš bude na vině vytíženost sítě. Myslíte, že už to jinak bude v pořádku? :-)
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: ARP poisoning

#11 Příspěvek od vyosek »

:arrow: Logy jiz vypadaji ciste

:arrow: Odinstalujte Combofix
  • Prejmenujte ComboFix na Uninstall
  • Spustte jej
  • Tohle smaze Combofix a jeho slozky
:arrow: T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe
  • Stahnete a spustte
  • Pro potvrzeni volby mackejte A, Enter
  • Po pouziti utilitu smazte
  • Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)
:arrow: OTC http://oldtimer.geekstogo.com/OTC.exe
  • Stahnete a spustte
  • Kliknete na CleanUp a potvrdte YES
  • Program uklidi a restartuje PC

:arrow: TFC http://oldtimer.geekstogo.com/TFC.exe
  • Stahnete a spustte
  • Kliknete na Start a potvrdte OK
  • Program uklidi a restartuje pc
  • Po pouziti utilitu smazte
:arrow: Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič
  • Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner
Panel registry
  • dejte Hledej problémy
  • nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
  • postup opakujte dokud nebude bez problemu - vetsinou cca 3x
Panel nástroje
  • Zde muzete odinstalovat nepotrebne programy
CCleaner doporucuji pouzivat cca jednou za tyden

:arrow: Napiste co PC
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
had21
Návštěvník
Návštěvník
Příspěvky: 30
Registrován: 23 Bře 2012 10:13

Re: ARP poisoning

#12 Příspěvek od had21 »

Tak počítač se zdá být v pořádku, rovněž i logy na serveru a přípojných bodech.
Opravdu velmi moc děkuji za pomoc, bez vás bych to asi nezvládl a honil se s tím virem ještě teď. :-) Díky!
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: ARP poisoning

#13 Příspěvek od vyosek »

Neni zac, rado se stalo :worship:
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Odpovědět

Vrátit se na „Řešení problémů, logy“