Pomalé PC

Zpráva

#16 Příspěvek od **vyosek** » 04 úno 2013 20:04

Stahnete Malwarebytes Anti-Rootkit http://www.bleepingcomputer.com/downloa ... i-rootkit/

Ulozte nejlepe na Plochu a rozbalte
Spustte kliknutim na mbanr
Nyni postupne kliknete na Next a Update
Po dokonceni update (aktualizace) databaze kliknete opet na Next
Nechte zaskrtnute vsechny tri moznosti a klinete na Scan cimz spustite prohledavani PC
Po dokonceni skenu (cca 5 minutek) zkontrolujte, zda-li je u vsech nalezu (samozrejme pokud budou) zatrzitko
Tez zkontrolujte, jetsli je zatrzitko u Create Restore point
Nyni kliknete na CleanUp cimz nalezenou infekci odstranime
PC bude restartovan
Slozka mbar by mela obsahovat log (a zrejme se i sam otevre) mbar-log-rok-mesic-den (hodina-minuta-sekunda).txt, ten mi sem dejte

Šmíďák · #17 Příspěvek od **Šmíďák** » 24 úno 2013 11:14

Omlouvám se za dlouhou prodlevu, mBar nic nenašel - log:

Malwarebytes Anti-Rootkit BETA 1.01.0.1020
www.malwarebytes.org

Database version: v2013.02.16.02

Windows 7 x86 NTFS
Internet Explorer 9.0.8112.16421
Janinka :: KLEMENT [administrator]

16.2.2013 12:58:15
mbar-log-2013-02-16 (12-58-15).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 30195
Time elapsed: 14 minute(s), 22 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

#18 Příspěvek od **vyosek** » 24 úno 2013 19:22

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

KillAll::

DDS::
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE= ... ll&pf=cmnb
uURLSearchHooks: <No Name>: - LocalServer32 - <no file>
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/

Driver::
yksvc
Lbd

File::
c:\windows\system32\drivers\Lbd.sys
C:\windows\tasks\Ad-Aware Update (Weekly).job
C:\windows\tasks\Adobe Flash Player Updater.job
C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1007189617-1149851593-3231655990-1001Core.job
C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1007189617-1149851593-3231655990-1001UA.job
C:\windows\tasks\HPCeeScheduleForJaninka.job

NetSvc::
yksvc

Registry::
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"=-
"Adobe Reader Speed Launcher"=-
"Adobe ARM"=-
"TkBellExe"=-
"ISUSScheduler"=-
"SunJavaUpdateSched"=-
"TuneClone"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"WindowsSysControl"=-
"JDK5SWFMZY"=-
"Google Update"=-
"RegistryBooster"=-
"ISUSPM Startup"=-
"Fydsdx"=-

Firefof::
FF - ProfilePath - c:\users\Janinka\AppData\Roaming\Mozilla\Firefox\Profiles\qr69lpao.default\
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... r=1.5.3&q=

RegNull::
[HKEY_USERS\S-1-5-21-1007189617-1149851593-3231655990-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
[HKEY_USERS\S-1-5-21-1007189617-1149851593-3231655990-1001\Software\SecuROM\License information*]

RegLock::
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

ClearJavaCache::

Reboot::

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

Šmíďák · #19 Příspěvek od **Šmíďák** » 25 úno 2013 21:09

Požadovaný log:

ComboFix 13-02-24.01 - Janinka 25.02.2013 20:51:54.2.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.3066.1960 [GMT 1:00]
Spuštěný z: c:\users\Janinka\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Janinka\Desktop\CFScript.txt
AV: COMODO Antivirus *Disabled/Updated* {675CEE69-9702-A524-3989-6D7CC8BF3695}
FW: COMODO Firewall *Disabled* {5F676F4C-DD6D-A47C-12D6-C449366C71EE}
SP: COMODO Defense+ *Disabled/Updated* {DC3D0F8D-B138-AAAA-0339-560EB3387C28}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\windows\system32\drivers\Lbd.sys"
"c:\windows\tasks\Ad-Aware Update (Weekly).job"
"c:\windows\tasks\Adobe Flash Player Updater.job"
"c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1007189617-1149851593-3231655990-1001Core.job"
"c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1007189617-1149851593-3231655990-1001UA.job"
"c:\windows\tasks\HPCeeScheduleForJaninka.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\drivers\Lbd.sys
c:\windows\tasks\Adobe Flash Player Updater.job
c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1007189617-1149851593-3231655990-1001Core.job
c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1007189617-1149851593-3231655990-1001UA.job
c:\windows\tasks\HPCeeScheduleForJaninka.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_LBD
-------\Service_Lbd
-------\Service_yksvc
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-01-25 do 2013-02-25 )))))))))))))))))))))))))))))))
.
.
2013-02-25 20:00 . 2013-02-25 20:00 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-02-17 14:18 . 2013-02-17 14:20 -------- d-----w- c:\program files\GIMP 2
2013-02-16 11:37 . 2013-02-16 11:37 -------- d-----w- c:\programdata\Malwarebytes
2013-02-13 11:53 . 2013-01-04 03:00 2345984 ----a-w- c:\windows\system32\win32k.sys
2013-02-13 11:53 . 2013-01-05 05:02 3957608 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-02-13 11:53 . 2013-01-05 05:02 3902312 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-02-10 23:14 . 2013-02-10 23:14 -------- d-----w- c:\program files\Banshee Screamer Alarm
2013-02-09 13:04 . 2013-02-09 13:04 -------- d-----w- c:\users\Janinka\AppData\Local\Opera
2013-02-09 13:04 . 2013-02-09 13:06 -------- d-----w- c:\program files\Opera
2013-02-05 13:04 . 2013-02-05 13:04 -------- d-----w- c:\program files\Common Files\Skype
2013-02-05 13:04 . 2013-02-05 13:04 -------- d-----r- c:\program files\Skype
2013-02-03 20:47 . 2013-02-03 20:47 -------- d-----w- c:\programdata\Trymedia
2013-02-03 18:35 . 2013-02-03 18:35 -------- d-----w- c:\users\Janinka\AppData\Local\GHISLER
2013-02-03 11:51 . 2013-02-03 11:54 -------- d-----w- C:\rsit
2013-02-03 11:51 . 2013-02-03 11:54 -------- d-----w- c:\program files\trend micro
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-08 12:11 . 2013-01-22 20:47 697712 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-02-08 12:11 . 2011-09-03 10:24 74096 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-16 14:25 . 2012-12-22 02:00 295424 ----a-w- c:\windows\system32\atmfd.dll
2012-12-16 14:25 . 2012-12-22 02:00 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-12-07 05:04 . 2013-01-09 18:22 308736 ----a-w- c:\windows\system32\Wpc.dll
2012-12-07 04:57 . 2013-01-09 18:22 2576384 ----a-w- c:\windows\system32\gameux.dll
2012-12-07 03:21 . 2013-01-09 18:22 45568 ----a-w- c:\windows\system32\oflc-nz.rs
2012-12-07 03:21 . 2013-01-09 18:22 43520 ----a-w- c:\windows\system32\csrr.rs
2012-12-07 03:21 . 2013-01-09 18:22 44544 ----a-w- c:\windows\system32\pegibbfc.rs
2012-12-07 03:21 . 2013-01-09 18:22 30720 ----a-w- c:\windows\system32\usk.rs
2012-12-07 03:21 . 2013-01-09 18:22 23552 ----a-w- c:\windows\system32\oflc.rs
2012-12-07 03:21 . 2013-01-09 18:22 20480 ----a-w- c:\windows\system32\pegi-pt.rs
2012-12-07 03:21 . 2013-01-09 18:22 20480 ----a-w- c:\windows\system32\pegi.rs
2012-12-07 03:21 . 2013-01-09 18:22 20480 ----a-w- c:\windows\system32\pegi-fi.rs
2012-12-07 03:21 . 2013-01-09 18:22 46592 ----a-w- c:\windows\system32\fpb.rs
2012-12-07 03:21 . 2013-01-09 18:22 21504 ----a-w- c:\windows\system32\grb.rs
2012-12-07 03:21 . 2013-01-09 18:22 51712 ----a-w- c:\windows\system32\esrb.rs
2012-12-07 03:21 . 2013-01-09 18:22 55296 ----a-w- c:\windows\system32\cero.rs
2012-12-07 03:21 . 2013-01-09 18:22 40960 ----a-w- c:\windows\system32\cob-au.rs
2012-12-07 03:21 . 2013-01-09 18:22 15360 ----a-w- c:\windows\system32\djctq.rs
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392]
"Olympus ib"="c:\program files\Olympus\ib\olycamdetect.exe" [2010-02-04 93376]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-01-08 18705664]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-07-27 288312]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-25 186904]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2009-06-18 563736]
"WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-07-30 1545512]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-08-04 98304]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2009-05-18 1314816]
"MDS_Menu"="c:\program files\Olympus\ib\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2010-11-03 1246544]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-01-10 2548040]
"ActivControl"="c:\program files\Activ Software\ActivDriver\ActivControl2.exe" [2012-02-24 1094000]
.
c:\users\Janinka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Banshee Screamer Alarm.lnk - c:\program files\Banshee Screamer Alarm\alarm.exe [2013-2-11 274432]
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-30 795936]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R0 tclondrv;tclondrv;c:\windows\system32\DRIVERS\tclondrv.sys [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [x]
R3 connctfy;Connectify Service;c:\windows\system32\DRIVERS\connctfy.sys [x]
R3 connctfyMP;connctfyMP;c:\windows\system32\DRIVERS\connctfy.sys [x]
R3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys [x]
R3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [x]
R3 NETw1v32;Intel(R) Wireless WiFi Link 1000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw1v32.sys [x]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]
R3 OlyCamComm;OLYMPUS USB Communication Device;c:\windows\system32\DRIVERS\OlyCamComm.sys [x]
R3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [x]
R3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys [x]
R3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\Drivers\RTL2832UUSB.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\DRIVERS\cmderd.sys [x]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [x]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]
S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [x]
S3 5U876UVC;HP Webcam [2 MP series];c:\windows\system32\DRIVERS\5U876.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
S3 NETw5s32;Ovladač adaptéru Intel(R) Wireless WiFi Link pro systém Windows 7 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
yksvcs REG_MULTI_SZ yksvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 19:11 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = 10.20.100.1
TCP: Interfaces\{C0BE6625-7FBE-48A7-AA57-F152A1EDE1EB}: NameServer = 156.154.70.25,156.154.71.25
TCP: Interfaces\{DE605EB3-C8BA-4782-971A-A468AE27B873}: NameServer = 156.154.70.25,156.154.71.25
TCP: Interfaces\{DE605EB3-C8BA-4782-971A-A468AE27B873}\2457B616A6E65647: NameServer = 156.154.70.25,156.154.71.25
TCP: Interfaces\{DE605EB3-C8BA-4782-971A-A468AE27B873}\661627F6D266275656: NameServer = 156.154.70.25,156.154.71.25
TCP: Interfaces\{DE605EB3-C8BA-4782-971A-A468AE27B873}\840584B4: NameServer = 156.154.70.25,156.154.71.25
TCP: Interfaces\{DE605EB3-C8BA-4782-971A-A468AE27B873}\E43423: NameServer = 156.154.70.25,156.154.71.25
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(620)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'Explorer.exe'(1500)
c:\windows\system32\guard32.dll
c:\windows\system32\authui.dll
c:\program files\WIDCOMM\Bluetooth Software\btncopy.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\COMODO\COMODO Internet Security\cmdagent.exe
c:\windows\system32\atieclxx.exe
c:\windows\system32\AEADISRV.EXE
c:\program files\WIDCOMM\Bluetooth Software\btwdins.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Protexis\License Service\PSIService.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\taskhost.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\conhost.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Celkový čas: 2013-02-25 21:08:16 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-02-25 20:08
ComboFix2.txt 2013-02-03 13:14
.
Před spuštěním: Volných bajtů: 152 426 262 528
Po spuštění: Volných bajtů: 152 063 426 560
.
- - End Of File - - 204F7191065634F1E4808A105C609FDC

#20 Příspěvek od **vyosek** » 25 úno 2013 23:56

Fajn, jak se chova PC

VIRY.CZ

Pomalé PC

Re: Pomalé PC

Re: Pomalé PC

Re: Pomalé PC

Re: Pomalé PC

Re: Pomalé PC