Preventivní kontrola logu po napadení účtu - Seznam.cz

[be_happy]

Dobrý den, chtěl bych požádat o kontrolu logů. Mám podezření na napadení nějakým botnetem. Dle technické podpory Seznam.cz byl botnetem zneužit e-mailový účet k rozesílání spamu a nevím zda není do toho botnetu zapojen i počítač. Zdá se mi velmi pomalý a někdy přestává pracovat úplně, že je lepší jej restartovat....

Připojuji log z RSIT:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Tata at 2013-11-29 19:07:24
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 27 GB (42%) free of 65 GB
Total RAM: 2046 MB (59% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:09:21, on 29.11.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16736)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Zoner\Photo Studio 15\Program32\ZPSTray.exe
C:\Program Files\CrashPlan\CrashPlanTray.exe
C:\Windows\twain_32\PUSH650C.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\TeamViewer\Version8\TeamViewer.exe
C:\Program Files\GFI Software\VIPRE\SBAMTray.exe
D:\Portable\_UTILS_RESCUE\RSIT\RSIT.exe
C:\Program Files\trend micro\Tata.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SBAMTray] "C:\Program Files\GFI Software\VIPRE\SBAMTray.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [Zoner Photo Studio Autoupdate] C:\PROGRAM FILES\ZONER\PHOTO STUDIO 15\Program32\ZPSTRAY.EXE
O4 - Global Startup: CrashPlan Tray.lnk = C:\Program Files\CrashPlan\CrashPlanTray.exe
O4 - Global Startup: PUSH650C.lnk = C:\Windows\twain_32\PUSH650C.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (file missing)
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Advanced Monitoring Agent - Remote Monitoring - C:\Program Files\Advanced Monitoring Agent\winagent.exe
O23 - Service: CrashPlan Backup Service (CrashPlanService) - CrashPlan - C:\Program Files\CrashPlan\CrashPlanService.exe
O23 - Service: GFI LanGuard 10 Attendant Service (gfi_lanss10_attservice) - GFI Software Development Ltd. - C:\Program Files\GFI Software\VIPRE\LanGuard 10 Agent\lnssatt.exe
O23 - Service: GFI LanGuard 11 Attendant Service (gfi_lanss11_attservice) - GFI Software Development Ltd. - C:\PROGRA~1\ADVANC~1\patchman\lnssatt.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: VIPRE Internet Security (SBAMSvc) - ThreatTrack Security, Inc. - C:\Program Files\GFI Software\VIPRE\SBAMSvc.exe
O23 - Service: SB Recovery Service (SBPIMSvc) - ThreatTrack Security, Inc. - C:\Program Files\GFI Software\VIPRE\SBPIMSvc.exe
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: TeamViewer 8 (TeamViewer8) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe

--
End of file - 4006 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2013-04-04 462752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-04-04 171424]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SBAMTray"=C:\Program Files\GFI Software\VIPRE\SBAMTray.exe [2013-04-18 3155776]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04 958576]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2013-06-21 19875432]
"Zoner Photo Studio Autoupdate"=C:\PROGRAM FILES\ZONER\PHOTO STUDIO 15\Program32\ZPSTRAY.EXE [2013-02-18 774168]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
CrashPlan Tray.lnk - C:\Program Files\CrashPlan\CrashPlanTray.exe
PUSH650C.lnk - C:\Windows\twain_32\PUSH650C.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBPIMSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SBAMSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SBPIMSvc]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2013-11-29 19:07:26 ----D---- C:\Program Files\trend micro
2013-11-29 19:07:24 ----D---- C:\rsit
2013-11-29 09:40:16 ----D---- C:\32788R22FWJFW
2013-11-29 09:36:19 ----R---- C:\ComboFix.exe
2013-11-22 20:46:00 ----D---- C:\327882R2FWJFW
2013-11-22 18:10:26 ----D---- C:\Users\Tata\AppData\Roaming\Malwarebytes
2013-11-14 09:35:50 ----A---- C:\Windows\system32\jscript.dll
2013-11-14 09:35:48 ----A---- C:\Windows\system32\jscript9.dll
2013-11-14 09:35:46 ----A---- C:\Windows\system32\jsproxy.dll
2013-11-14 09:35:46 ----A---- C:\Windows\system32\iesetup.dll
2013-11-14 09:35:45 ----A---- C:\Windows\system32\ieui.dll
2013-11-14 09:35:43 ----A---- C:\Windows\system32\msfeeds.dll
2013-11-14 09:35:42 ----A---- C:\Windows\system32\iernonce.dll
2013-11-14 09:35:42 ----A---- C:\Windows\system32\ie4uinit.exe
2013-11-14 09:35:40 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-14 09:35:39 ----A---- C:\Windows\system32\iesysprep.dll
2013-11-14 09:35:38 ----A---- C:\Windows\system32\urlmon.dll
2013-11-14 09:35:36 ----A---- C:\Windows\system32\iertutil.dll
2013-11-14 09:35:32 ----A---- C:\Windows\system32\wininet.dll
2013-11-14 09:35:29 ----A---- C:\Windows\system32\ieframe.dll
2013-11-14 09:35:25 ----A---- C:\Windows\system32\mshtml.dll
2013-11-14 09:04:30 ----A---- C:\Windows\system32\authui.dll
2013-11-14 09:04:29 ----A---- C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-14 09:04:29 ----A---- C:\Windows\system32\credui.dll
2013-11-14 09:04:15 ----A---- C:\Windows\system32\schannel.dll
2013-11-14 09:04:15 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2013-11-14 09:04:15 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2013-11-14 09:04:14 ----A---- C:\Windows\system32\lsasrv.dll
2013-11-14 09:04:14 ----A---- C:\Windows\system32\drivers\cng.sys
2013-11-14 09:04:13 ----A---- C:\Windows\system32\sspicli.dll
2013-11-14 09:04:13 ----A---- C:\Windows\system32\ncrypt.dll
2013-11-14 09:04:12 ----A---- C:\Windows\system32\sspisrv.dll
2013-11-14 09:04:12 ----A---- C:\Windows\system32\secur32.dll
2013-11-14 09:04:12 ----A---- C:\Windows\system32\lsass.exe
2013-11-14 09:04:06 ----A---- C:\Windows\system32\gdi32.dll
2013-11-14 09:04:03 ----A---- C:\Windows\system32\IKEEXT.DLL
2013-11-14 09:04:02 ----A---- C:\Windows\system32\FWPUCLNT.DLL
2013-11-14 09:04:01 ----A---- C:\Windows\system32\nshwfp.dll
2013-11-14 09:03:55 ----A---- C:\Windows\system32\crypt32.dll

======List of files/folders modified in the last 1 month======

2013-11-29 19:09:20 ----D---- C:\Windows\Temp
2013-11-29 19:09:10 ----D---- C:\Program Files\Advanced Monitoring Agent
2013-11-29 19:08:22 ----D---- C:\Windows\system32\config
2013-11-29 19:08:22 ----D---- C:\Windows
2013-11-29 19:07:26 ----RD---- C:\Program Files
2013-11-29 19:04:54 ----D---- C:\Windows\System32
2013-11-29 19:04:53 ----D---- C:\Windows\inf
2013-11-29 19:04:53 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-11-29 19:00:39 ----D---- C:\Users\Tata\AppData\Roaming\Skype
2013-11-29 09:53:04 ----D---- C:\ProgramData\Malwarebytes
2013-11-29 09:40:34 ----D---- C:\Windows\system32\drivers
2013-11-26 09:38:58 ----D---- C:\Windows\system32\catroot2
2013-11-24 17:42:32 ----SHD---- C:\System Volume Information
2013-11-22 20:35:33 ----D---- C:\Program Files\Google
2013-11-22 20:35:24 ----D---- C:\Windows\security
2013-11-22 17:31:42 ----D---- C:\ProgramData
2013-11-22 17:31:40 ----SHD---- C:\Windows\Installer
2013-11-14 13:24:46 ----D---- C:\Windows\winsxs
2013-11-14 13:22:07 ----D---- C:\Windows\system32\cs-CZ
2013-11-14 13:22:05 ----D---- C:\Program Files\Internet Explorer
2013-11-14 09:38:02 ----D---- C:\Windows\system32\catroot
2013-11-14 09:33:15 ----D---- C:\Windows\system32\MRT
2013-11-14 09:33:07 ----A---- C:\Windows\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 SbFw;SbFw; C:\Windows\system32\drivers\SbFw.sys [2013-04-12 226672]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R2 sbapifs;sbapifs; C:\Windows\system32\DRIVERS\sbapifs.sys [2013-04-16 69856]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-07-13 4194816]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
R3 SBFWIMCLMP;GFI Software Firewall NDIS IM Filter Miniport; C:\Windows\system32\DRIVERS\SBFWIM.sys [2012-10-24 96288]
R3 sbwtis;sbwtis; C:\Windows\system32\DRIVERS\sbwtis.sys [2013-04-12 76064]
R3 VM650FVM11;UMAX AstraSlim Scanner ProdID x0104; C:\Windows\System32\Drivers\usb650c.sys [2001-08-17 13824]
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 catchme;catchme; \??\C:\Users\Tata\AppData\Local\Temp\catchme.sys []
S3 DrvAgent32;DrvAgent32; \??\C:\Windows\system32\Drivers\DrvAgent32.sys [2012-12-25 23456]
S3 gfiark;gfiark; C:\Windows\system32\drivers\gfiark.sys [2013-05-23 43368]
S3 gfiutil;gfiutil; C:\Windows\system32\drivers\gfiutil.sys [2013-09-04 24040]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848]
S3 SBFWIMCL;GFI Software Firewall NDIS IM Filter Service; C:\Windows\system32\DRIVERS\sbfwim.sys [2012-10-24 96288]
S3 sbhips;sbhips; C:\Windows\system32\drivers\sbhips.sys [2013-04-12 95344]
S3 scsiscan;Ovladač skeneru SCSI; C:\Windows\system32\DRIVERS\scsiscan.sys [2009-07-14 14848]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2012-08-23 49664]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2012-08-23 27136]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-05-11 65640]
R2 Advanced Monitoring Agent;Advanced Monitoring Agent; C:\Program Files\Advanced Monitoring Agent\winagent.exe [2013-11-12 6897664]
R2 CrashPlanService;CrashPlan Backup Service; C:\Program Files\CrashPlan\CrashPlanService.exe [2013-04-09 152576]
R2 gfi_lanss10_attservice;GFI LanGuard 10 Attendant Service; C:\Program Files\GFI Software\VIPRE\LanGuard 10 Agent\lnssatt.exe [2012-10-24 115568]
R2 gfi_lanss11_attservice;GFI LanGuard 11 Attendant Service; C:\PROGRA~1\ADVANC~1\patchman\lnssatt.exe [2012-07-17 118640]
R2 SBAMSvc;VIPRE Internet Security; C:\Program Files\GFI Software\VIPRE\SBAMSvc.exe [2013-04-18 3680512]
R2 SBPIMSvc;SB Recovery Service; C:\Program Files\GFI Software\VIPRE\SBPIMSvc.exe [2013-04-18 175936]
R2 Skype C2C Service;Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2013-10-09 3275136]
R2 TeamViewer8;TeamViewer 8; C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe [2013-10-01 5091168]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-12-25 116648]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2013-06-21 162408]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-15 256904]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2012-12-25 116648]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-10-31 1343400]

-----------------EOF-----------------

[Márty84]

Zdravim

Co jste dprovadel s ComboFixem?

Vidim tam stopy MBAM, nasel neco pri uplne kontrile?



25.12. pro neaktivitu http://forum.viry.cz/viewtopic.php?f=12&t=123975