Dotaz na vir pro Vyoska :)

[takos]

Dobrej, nainstaloval jsem si zkušebně nový antivirový program AVG a po skenu mi to našlo vir. V příloze obrázek. Chci se zeptat jestli je to opodstatněný nález nebo jen "jak si zařídit klienty"
Také jsem zvědav jestli máte s tímto antivirovým programem nějaké dobré zkušenosti a doporučil by jste ho. Děkuji Jirka D.

[vyosek]

Zdravim

AVG ma vseobecne slabsi detekci a u nas na foru neni doporucovan. Je to spise takova parodie na antivir\bezpecnostni balik

Z free resenich bych se spise drzel Avastu

[takos]

OK, mám stejný názor Avast je Avast,

jen bych chtěl ještě vědět jestli to co ten program našel je doopravdy virus?

Ještě bych rád vědět jestli Avast muže nějak blokovat Windows Defender od jisté doby ho nemůžu spustit a hlásí mi to nějaké chybové hlášky. "Nemůže to najít cestu k souboru atd". A ani jsem ho nenašel v programech po spuštění, kde by podle Windows měl být.

Díky Jirka

[vyosek]

Tezko soudit, ale nemyslim si ze by byl a kdyz uz, tak nic vazneho

Stahnete Service Repair http://kb.eset.com/library/ESET/KB%20Te ... Repair.exe

• Ulozte nejlepe na Plochu
• Spustte a potvrdte Yes abyste potvrdil reinstalaci sluzeb
• Nasledne kliknutim na Yes potvrdte restart PC
• Na Plose vznikne slozka CC Support, najdete tam log SvcRepair.txt - mel by byt CC Support\Logs\SvcRepair.txt - vlozte mi jej sem

[takos]

Zdravím, doufám že je to ono

Díky Jirka

Log Opened: 2013-02-22 @ 19:37:18
19:37:18 - -----------------
19:37:18 - | Begin Logging |
19:37:18 - -----------------
19:37:18 - Fix started on a WIN_VISTA X86 computer
19:37:18 - Prep in progress. Please Wait.
19:37:20 - Prep complete
19:37:20 - Repairing Services Now. Please wait...
19:37:21 - Services Repair Complete.
19:37:26 - Reboot Initiated

[vyosek]

Tohle vypada OK, jeste na to mrknem lepe

Stahnete Farbar Service Scanner http://download.bleepingcomputer.com/farbar/FSS.exe

• Ulozte nejlepe na Plochu
• U vsech polozek udelejte zatrzitko (tim je oznacite pro skenovani)
• Kliknete na Scan
• Po dokonceni skenu se objevi log FSS.txt ten sem vlozte

[takos]

Tak tady to je. Díky za pomoc, doufám že na něco přijdete.

Farbar Service Scanner Version: 20-02-2013
Ran by sangoko (administrator) on 23-02-2013 at 17:29:35
Running from "C:\Users\sangoko\Desktop"
Windows Vista (TM) Home Premium Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Security Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is OK.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Other Services:
==============


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys
[2013-02-16 00:06] - [2013-01-04 12:28] - 0905576 ____A (Microsoft Corporation) 74E2D020C47BB2B2FCCBA29A518A7EB4

C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****

[vyosek]

Stahnete SytemLook http://jpshortstuff.247fixes.com/SystemLook.exe a ulozte jej na plochu

• Do okna vlozte skript nize

• Kód: Vybrat vše

  :services
  WinDefend
  
  :reg
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend /sub

• Kliknete na Look
• Tlacitko Look se zmeni na Scanning a zsedne
• Pockejte pokud se tlacitko Scanning opet nezmeni na Look - tak poznate ze SystemLook dokoncil svou praci
• Vyskoci na Vas log s nazvem SystemLook (pripadne bude ulozen na plose), jeho obsah mi sem vlozte

[takos]

Díky za kontrolu

SystemLook 30.07.11 by jpshortstuff
Log created at 10:05 on 26/02/2013 by sangoko
Administrator - Elevation successful

Invalid Context: services

No Context: WinDefend

========== reg ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend]
"DisplayName"="Windows Defender"
"ErrorControl"= 0x0000000001 (1)
"Group"="COM Infrastructure"
"ImagePath"="%SystemRoot%\System32\svchost.exe -k secsvcs"
"Start"= 0x0000000002 (2)
"Type"= 0x0000000120 (288)
"Description"="@%ProgramFiles%\Windows Defender\MsMpRes.dll,-3068"
"DependOnService"="RpcSs"
"ObjectName"="LocalSystem"
"ServiceSidType"= 0x0000000001 (1)
"RequiredPrivileges"="SeImpersonatePrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeChangeNotifyPrivilege SeSecurityPrivilege"
"FailureActions"=80 51 01 00 00 00 00 00 00 00 00 00 03 00 00 00 14 00 00 00 03 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 01 00 00 00 60 ea 00 00 (REG_BINARY)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend\Parameters]
"ServiceDllUnloadOnStop"= 0x0000000001 (1)
"ServiceDll"="%ProgramFiles%\Windows Defender\mpsvc.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend\Security]
"Security"=01 00 14 80 04 01 00 00 10 01 00 00 14 00 00 00 30 00 00 00 02 00 1c 00 01 00 00 00 02 80 14 00 ff 01 0f 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 d4 00 07 00 00 00 00 00 28 00 ff 01 0f 00 01 06 00 00 00 00 00 05 50 00 00 00 b5 89 fb 38 19 84 c2 cb 5c 6c 23 6d 57 00 77 6e c0 02 64 87 00 0b 28 00 00 00 00 10 01 06 00 00 00 00 00 05 50 00 00 00 b5 89 fb 38 19 84 c2 cb 5c 6c 23 6d 57 00 77 6e c0 02 64 87 00 00 14 00 fd 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 ff 01 0f 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 9d 01 02 00 01 01 00 00 00 00 00 05 04 00 00 00 00 00 14 00 8d 01 02 00 01 01 00 00 00 00 00 05 06 00 00 00 00 00 28 00 15 00 00 00 01 06 00 00 00 00 00 05 50 00 00 00 49 59 9d 77 91 56 e5 55 dc f4 e2 0e a7 8b eb ca 7b 42 13 56 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 (REG_BINARY)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend\Enum]
"0"="Root\LEGACY_WINDEFEND\0000"
"Count"= 0x0000000001 (1)
"NextInstance"= 0x0000000001 (1)


-= EOF =-

[vyosek]

Jeste jeden skript pro SystemLook

Kód: Vybrat vše

:service
WinDefend

[takos]

SystemLook 30.07.11 by jpshortstuff
Log created at 19:48 on 26/02/2013 by sangoko
Administrator - Elevation successful

========== service ==========

WinDefend
Windows Defender
"Vyhledat v počítači nežádoucí software, naplánovat kontroly a získat nejnovější definice nežádoucího softwaru"
Current Status: Stopped
Startup Type: Automatic
Error Control: Severe
Binary: C:\Windows\System32\svchost.exe -k secsvcs
Group: COM Infrastructure
SafeBoot: Minimal Network
Dependencies:
->RpcSs
Dependant Services:
(none)

-= EOF =-

[vyosek]

Kolega jiz resi http://forum.viry.cz/viewtopic.php?f=30 ... 7#p1198405

[takos]

Ok, doufám že se mu to podaří. Jirka

[vyosek]

OK, pokracujme tam, zde