skype trojan

[vyosek]

Uploadnete mi sem http://vyosek.ic.cz/havet/uploader.php prosim soubor c:\windows\system32\reem.bat

[pesslovany]

refreshuju tu stránku jak dlouho a nevšiml jsem si že už jsme na druhé straně diskuse

máte to tam

[vyosek]

Odinstalujte Spybot - Search & Destroy - program ma uz nejlepsi leta davno za sebou a posledni cca 3 roky neni schopen celit aktualnim hrozbam

• Nahrady za Spybota:
  • Spyware Terminator - info o nem http://www.viry.cz/forum/viewtopic.php?f=29&t=44730
  • SuperAntiSpyare - info o nem http://www.viry.cz/forum/viewtopic.php?f=29&t=51359
• Samozrejme pouzivejte jen jeden z nich
• Osobne doporucuji SuperAntiSpyware

Odinstalujte vse od IOBit - jsou to cinske smejdy a spise jen skodi nez jsou uzitkem. Hledaji nesmyslne a neexistujici problemy, databazi haveti ukradli jine renomovane spolecnosti

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  File::
  c:\windows\system32\reem.bat
  c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
  c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
  
  Folder::
  c:\programdata\Spybot - Search & Destroy
  c:\program files\Spybot - Search & Destroy
  c:\programdata\IObit
  c:\program files\IObit
  
  Registry::
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "SpybotSD TeaTimer"=-
  
  Driver::
  gupdate
  gupdatem
  
  ClearJavaCache::
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

[pesslovany]

ComboFix 12-10-04.02 - Jakub 07.10.2012 21:49:53.4.3 - x86 NETWORK
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.3326.2303 [GMT 2:00]
Spuštěný z: c:\users\Jakub\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Jakub\Desktop\CFScript.txt
AV: ESET Smart Security 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Disabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\windows\system32\reem.bat"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\IObit
c:\programdata\IObit
c:\programdata\Spybot - Search & Destroy
c:\windows\system32\reem.bat
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-09-07 do 2012-10-07 )))))))))))))))))))))))))))))))
.
.
2012-10-07 19:52 . 2012-10-07 20:09 -------- d-----w- c:\users\Jakub\AppData\Local\temp
2012-10-07 19:52 . 2012-10-07 19:52 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-10-07 19:52 . 2012-10-07 19:52 -------- d-----w- c:\users\Mamka\AppData\Local\temp
2012-10-07 11:29 . 2012-10-07 17:07 -------- d-----w- C:\UsbFix
2012-10-07 10:43 . 2012-10-07 10:43 -------- d-----w- C:\rsit
2012-10-07 10:14 . 2012-10-07 10:14 -------- d-----w- c:\users\Jakub\AppData\Local\ElevatedDiagnostics
2012-10-06 22:24 . 2012-10-06 22:24 -------- d-----w- c:\users\Jakub\AppData\Roaming\Malwarebytes
2012-10-06 22:24 . 2012-10-06 22:24 -------- d-----w- c:\programdata\Malwarebytes
2012-10-06 19:52 . 2012-10-06 19:52 54 ----a-w- c:\windows\system32\inv.vbs
2012-10-05 23:07 . 2004-03-29 15:23 90112 ----a-w- c:\windows\unvise32.exe
2012-10-05 23:07 . 2012-10-05 23:07 -------- d-----w- c:\program files\LooksBuilderSE
2012-10-05 23:04 . 2012-10-05 23:04 -------- d-----w- c:\program files\Common Files\Pinnacle
2012-10-05 23:03 . 2012-10-05 23:03 -------- d-----w- c:\users\Jakub\AppData\Local\Pinnacle
2012-10-05 23:03 . 2012-10-05 23:03 -------- d-----w- c:\programdata\Pinnacle Studio Ultimate Collection
2012-10-05 22:58 . 2012-10-05 22:58 -------- d-----w- c:\program files\Common Files\Pegasus Imaging
2012-10-05 22:58 . 2012-10-05 22:58 -------- d-----w- c:\program files\Common Files\Yahoo!
2012-10-05 22:58 . 2012-10-05 22:58 -------- d-----w- c:\programdata\Studio 14
2012-10-05 22:58 . 2012-10-05 22:58 -------- d-----w- c:\programdata\Pinnacle Studio Plus
2012-10-05 22:56 . 2012-10-05 23:06 -------- d-----w- c:\program files\Pinnacle
2012-10-05 22:53 . 2012-10-05 23:02 -------- d-----w- c:\programdata\Pinnacle
2012-10-05 14:13 . 2012-10-05 16:39 2828 --sha-w- c:\programdata\KGyGaAvL.sys
2012-10-05 14:13 . 2012-10-05 14:13 -------- d-----w- c:\users\Jakub\AppData\Roaming\Corel
2012-10-05 14:11 . 2012-10-05 14:11 -------- d-----w- c:\programdata\Corel
2012-10-05 14:11 . 2012-10-05 14:11 -------- d-----w- c:\program files\Common Files\Protexis
2012-10-05 14:09 . 2012-10-05 14:09 -------- d-----w- c:\program files\Common Files\Corel
2012-10-05 14:09 . 2012-10-05 14:09 -------- d-----w- c:\program files\Corel
2012-10-05 12:08 . 2012-08-30 08:17 6980552 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F9AE8501-91AD-4FFE-89F0-F7E918E60912}\mpengine.dll
2012-10-03 12:56 . 2012-10-03 12:56 -------- d-----w- c:\program files\Black Isle
2012-09-25 21:18 . 2012-09-25 21:18 -------- d-----w- c:\users\Jakub\AppData\Local\Sony
2012-09-25 21:18 . 2012-09-25 21:18 -------- d-----w- c:\users\Jakub\AppData\Roaming\Sony
2012-09-25 21:11 . 2012-09-25 21:58 -------- d-----w- c:\program files\Sony
2012-09-23 19:03 . 2012-09-23 19:03 -------- d-----w- c:\program files\unreal tournament
2012-09-23 17:45 . 2012-09-23 17:45 -------- d-----w- c:\programdata\id Software
2012-09-16 11:55 . 2012-09-16 11:55 -------- d-----w- c:\program files\3DO
2012-09-14 19:28 . 2012-09-14 19:29 21840 ----atw- c:\windows\system32\SIntfNT.dll
2012-09-14 19:28 . 2012-09-14 19:29 17212 ----atw- c:\windows\system32\SIntf32.dll
2012-09-14 19:28 . 2012-09-14 19:29 12067 ----atw- c:\windows\system32\SIntf16.dll
2012-09-12 11:09 . 2012-08-22 17:16 712048 ----a-w- c:\windows\system32\drivers\ndis.sys
2012-09-12 11:09 . 2012-07-04 19:45 33280 ----a-w- c:\windows\system32\drivers\RNDISMP.sys
2012-09-12 11:09 . 2012-08-22 17:16 1292144 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-09-12 11:09 . 2012-08-22 17:16 240496 ----a-w- c:\windows\system32\drivers\netio.sys
2012-09-12 11:09 . 2012-08-22 17:16 187760 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2012-09-12 11:08 . 2012-08-02 16:57 490496 ----a-w- c:\windows\system32\d3d10level9.dll
2012-09-10 19:41 . 2012-09-10 19:41 -------- d-----w- c:\program files\ffdshow
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-07 17:07 . 2012-10-07 17:06 853546672 ----a-w- C:\UsbFix_Upload_Me_PES-DESKTOP.zip
2012-10-03 11:56 . 2012-04-05 09:30 696240 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-03 11:56 . 2012-01-14 10:54 73136 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-24 07:18 . 2012-01-14 11:04 16400 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2012-08-10 11:11 . 2012-02-08 15:19 140800 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-08-10 11:11 . 2012-04-05 21:58 283304 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-08-10 11:11 . 2012-02-08 15:19 283304 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-08-10 11:11 . 2012-02-08 15:19 280904 ----a-w- c:\windows\system32\PnkBstrB.ex0
2012-07-27 20:47 . 2012-07-27 20:47 159232 ----a-w- c:\windows\system32\clinfo.exe
2012-07-27 20:47 . 2012-07-27 20:47 65024 ----a-w- c:\windows\system32\OpenVideo.dll
2012-07-27 20:47 . 2012-07-27 20:47 56320 ----a-w- c:\windows\system32\OVDecode.dll
2012-07-27 20:46 . 2012-07-27 20:46 13013504 ----a-w- c:\windows\system32\amdocl.dll
2012-07-18 17:47 . 2012-08-19 20:13 2345984 ----a-w- c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17 94208 ----a-w- c:\users\Jakub\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17 94208 ----a-w- c:\users\Jakub\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17 94208 ----a-w- c:\users\Jakub\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-08-26 10828392]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2012-10-03 3080264]
"PLF2050"="c:\windows\PLF2050.exe" [2008-07-10 40960]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1387288]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2011-04-07 2565520]
"CanonSolutionMenuEx"="c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE" [2011-03-28 1611160]
"IJNetworkScannerSelectorEX"="c:\program files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe" [2011-01-15 452016]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-08-06 642216]
"USBToolTip"="c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe" [2007-02-20 199752]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2011-09-27 19:03 66328 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux4"=wdmaud.drv
.
R2 AODDriver4.1;AODDriver4.1;c:\program files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [x]
R2 AODService;AODService;c:\program files\AMD\OverDrive\AODAssist.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 ALSysIO;ALSysIO;c:\users\Jakub\AppData\Local\Temp\ALSysIO.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 TVICHW32;TVICHW32;c:\windows\system32\DRIVERS\TVICHW32.SYS [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 ACPService;ACPService;c:\program files\Philips\CamSuite\1.0.9.0\ACPService.exe [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [x]
S2 AODDriver4.2.0;AODDriver4.2.0;c:\program files\AMD\OverDrive\i386\AODDriver2.sys [x]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [x]
S2 MsDepSvc;Web Deployment Agent Service;c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe [x]
S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [x]
S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
S3 SPC2050;USB2.0 PC Camera (SPC2050);c:\windows\system32\DRIVERS\spc2050.sys [x]
.
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.109.181.238 10.109.255.254
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsDepSvc]
"ImagePath"="\"c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe\" -runService:MsDepSvc"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'Explorer.exe'(4632)
c:\users\Jakub\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\atieclxx.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Philips\CamSuite\1.0.9.0\ACPGUI.dll
c:\windows\system32\taskhost.exe
c:\program files\Google\Update\GoogleUpdate.exe
c:\windows\system32\conhost.exe
c:\program files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Opera\opera.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
.
**************************************************************************
.
Celkový čas: 2012-10-07 22:12:22 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-10-07 20:12
ComboFix2.txt 2012-10-07 17:15
.
Před spuštěním: Volných bajtů: 358 318 686 208
Po spuštění: Volných bajtů: 358 141 014 016
.
- - End Of File - - CA159E831FC5A077921D6EF51DC1C7CD

[vyosek]

Log jiz vypada OK, jak se chova PC

[pesslovany]

pc je v pořádku, harddisk také. děkuji za pomoc, jsem připraven na vyčištění

[vyosek]

Tak jeste uklidime

Odinstalujte Combofix

• Prejmenujte ComboFix na Uninstall
• Spustte jej
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse