Dobrý den, dnes mi z Micosoft Security Essentials vyskočila hláška o trojském koni, takže jsem jej přesunul do karantény. Jedná se o Trojan:Win32/Reveton!Ink a Trojan:Win32/Reveton.V. Dále je antivir po operaci neaktivní a žádá restart, což jsem udělal, ale vir/y neodstranil ale nechal v karanténě. Před restartem jsem ale zkoušel zapnout RSIT, který se zasekl a antivir vždy opětovně hlásil vir, který jsem tedy musel vždy dát do karantény a nyní jich tam mám 8, z toho 6 Reveton!Ink a 2 Reveton.V. Chci se ujistit že v PC už nemám žánou havěť a zjistit, co mohl tento virus napáchat. Předem děkuji za odpověď.
Log:
Logfile of random's system information tool 1.09 (written by random/random)
Run by Admin at 2013-12-25 14:23:53
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 45 GB (74%) free of 60 GB
Total RAM: 3325 MB (85% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:24:23, on 25.12.2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Microsoft Security Client\msseces.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Adobe\Reader 11.0\Reader\Reader_sl.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Admin\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\Admin.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{04FE91B6-1F6F-496E-A9C0-EBABAC64204D}: NameServer = 192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{04FE91B6-1F6F-496E-A9C0-EBABAC64204D}: NameServer = 192.168.1.254
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
Trojský kůň
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Trojský kůň
Naposledy upravil(a) Joker93 dne 25 pro 2013 14:29, celkem upraveno 1 x.
Re: Trojský kůň
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen
od 1. února 2011.
Člen
od 1. února 2011.Re: Trojský kůň
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-12-2013 01
Ran by Admin (administrator) on ADMIN on 25-12-2013 14:34:42
Running from C:\Documents and Settings\Admin\Plocha
Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: Czech
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(forum.viry.cz) C:\Documents and Settings\Admin\Plocha\FRSTLauncher.exe
(Microsoft Corporation) C:\WINDOWS\system32\cmd.exe
(Microsoft Corporation) C:\WINDOWS\system32\ping.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDCPL] - C:\WINDOWS\RTHDCPL.EXE [20065936 2012-06-06] (Realtek Semiconductor Corp.)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2012-04-05] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [947152 2013-01-27] (Microsoft Corporation)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
Winlogon\Notify\AtiExtEvent: C:\Windows\system32\Ati2evxx.dll (ATI Technologies Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.search.msn.com/{SUB_RFC1766}/ ... chasst.htm
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
Tcpip\..\Interfaces\{04FE91B6-1F6F-496E-A9C0-EBABAC64204D}: [NameServer]192.168.1.254
FireFox:
========
FF ProfilePath: C:\Documents and Settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\rz9xrwqd.default-1380989125015
FF Homepage: seznam.cz
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\heureka-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\jyxo-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\seznam-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\slunecnice-cz.xml
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
========================== Services (Whitelisted) =================
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
S3 Ambfilt; C:\Windows\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative)
R3 L1c; C:\Windows\System32\DRIVERS\l1c51x86.sys [82032 2012-04-25] (Atheros Communications, Inc.)
S3 Monfilt; C:\Windows\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
R3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtKHDMI.sys [4125352 2011-12-02] (Realtek Semiconductor Corp.)
S1 akludgrm; \??\C:\WINDOWS\system32\drivers\akludgrm.sys [x]
S1 bdousemo; \??\C:\WINDOWS\system32\drivers\bdousemo.sys [x]
S1 bqjtnyhs; \??\C:\WINDOWS\system32\drivers\bqjtnyhs.sys [x]
S1 foaqmyrd; \??\C:\WINDOWS\system32\drivers\foaqmyrd.sys [x]
S3 gdrv; \??\C:\WINDOWS\gdrv.sys [x]
S4 IntelIde; No ImagePath
S1 itqnjbci; \??\C:\WINDOWS\system32\drivers\itqnjbci.sys [x]
S1 pmvgpvmn; \??\C:\WINDOWS\system32\drivers\pmvgpvmn.sys [x]
S1 qvlogdgn; \??\C:\WINDOWS\system32\drivers\qvlogdgn.sys [x]
U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
U3 TlntSvr;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-25 14:34 - 2013-12-25 14:34 - 00005516 _____ C:\Documents and Settings\Admin\Plocha\FRST.txt
2013-12-25 14:34 - 2013-12-25 14:34 - 00000000 ____D C:\FRST
2013-12-25 14:33 - 2013-12-25 14:33 - 00112640 _____ (forum.viry.cz) C:\Documents and Settings\Admin\Plocha\FRSTLauncher.exe
2013-12-25 14:33 - 2013-12-25 14:33 - 00029696 _____ C:\Documents and Settings\Admin\Local Settings\Data aplikací\MSGBOX.EXE
2013-12-25 14:33 - 2013-12-25 14:33 - 00015327 _____ C:\Documents and Settings\Admin\Plocha\LM.bat
2013-12-25 14:32 - 2013-12-25 14:32 - 01061545 _____ (Farbar) C:\Documents and Settings\Admin\Plocha\FRST.exe
2013-12-25 14:10 - 2013-12-25 14:24 - 00000000 ____D C:\rsit
2013-12-25 14:05 - 2013-12-25 14:20 - 00012600 _____ C:\Documents and Settings\All Users\Data aplikací\oaod7t9l.fee
2013-12-25 14:00 - 2013-12-25 14:00 - 00228864 _____ (http://tortoisesvn.net) C:\Documents and Settings\All Users\Data aplikací\l9t7doao.jss
2013-12-25 14:00 - 2013-12-25 14:00 - 00000000 _____ C:\Documents and Settings\All Users\Data aplikací\oaod7t9l.odd
2013-12-21 13:51 - 2013-12-21 13:51 - 00000667 _____ C:\Documents and Settings\All Users\Plocha\Vietcong - Fist Alpha.lnk
2013-12-21 13:51 - 2013-12-21 13:51 - 00000633 _____ C:\Documents and Settings\All Users\Plocha\Vietcong.lnk
2013-12-21 13:51 - 2013-12-21 13:51 - 00000000 ____D C:\Program Files\Cenega Czech
2013-12-21 13:51 - 2013-12-21 13:51 - 00000000 ____D C:\Documents and Settings\All Users\Nabídka Start\Programy\Vietcong
2013-12-11 16:11 - 2013-12-11 16:11 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2904266$
2013-12-11 16:11 - 2013-12-11 16:11 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2898715$
2013-12-11 16:10 - 2013-12-11 16:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2893984$
2013-12-11 16:10 - 2013-12-11 16:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2893294$
2013-12-11 16:10 - 2013-12-11 16:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2892075$
2013-12-06 18:39 - 2013-12-06 21:01 - 00002315 _____ C:\Documents and Settings\All Users\Nabídka Start\Programy\Adobe Reader XI.lnk
2013-12-06 18:39 - 2013-12-06 18:39 - 00001734 _____ C:\Documents and Settings\All Users\Plocha\Adobe Reader XI.lnk
2013-12-06 18:39 - 2013-12-06 18:39 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-12-06 18:39 - 2013-12-06 18:39 - 00000000 ____D C:\Program Files\Adobe
==================== One Month Modified Files and Folders =======
2013-12-25 14:34 - 2013-12-25 14:34 - 00005516 _____ C:\Documents and Settings\Admin\Plocha\FRST.txt
2013-12-25 14:34 - 2013-12-25 14:34 - 00000000 ____D C:\FRST
2013-12-25 14:34 - 2013-05-11 22:36 - 00000000 ____D C:\Documents and Settings\Admin\Plocha
2013-12-25 14:33 - 2013-12-25 14:33 - 00112640 _____ (forum.viry.cz) C:\Documents and Settings\Admin\Plocha\FRSTLauncher.exe
2013-12-25 14:33 - 2013-12-25 14:33 - 00029696 _____ C:\Documents and Settings\Admin\Local Settings\Data aplikací\MSGBOX.EXE
2013-12-25 14:33 - 2013-12-25 14:33 - 00015327 _____ C:\Documents and Settings\Admin\Plocha\LM.bat
2013-12-25 14:33 - 2013-09-27 18:49 - 00000366 ____H C:\WINDOWS\Tasks\MpIdleTask.job
2013-12-25 14:33 - 2013-05-16 14:09 - 00000000 ____D C:\Documents and Settings\Admin\Dokumenty\Stažené soubory
2013-12-25 14:33 - 2013-05-11 22:36 - 00000000 ___HD C:\Documents and Settings\Admin\Local Settings\Data aplikací
2013-12-25 14:32 - 2013-12-25 14:32 - 01061545 _____ (Farbar) C:\Documents and Settings\Admin\Plocha\FRST.exe
2013-12-25 14:27 - 2013-05-12 00:25 - 01023836 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-12-25 14:25 - 2013-05-11 22:32 - 01750612 _____ C:\WINDOWS\WindowsUpdate.log
2013-12-25 14:24 - 2013-12-25 14:10 - 00000000 ____D C:\rsit
2013-12-25 14:24 - 2013-09-27 05:54 - 00000000 ____D C:\Program Files\trend micro
2013-12-25 14:23 - 2013-05-11 22:36 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-12-25 14:23 - 2013-05-11 22:36 - 00000000 ___RD C:\Documents and Settings\Admin\Nabídka Start\Programy\Po spuštění
2013-12-25 14:22 - 2013-05-11 22:36 - 00032404 _____ C:\WINDOWS\SchedLgU.Txt
2013-12-25 14:22 - 2013-05-11 22:36 - 00000178 ___SH C:\Documents and Settings\Admin\ntuser.ini
2013-12-25 14:22 - 2013-05-11 17:18 - 00524288 _____ C:\WINDOWS\system32\config\ACEEvent.evt
2013-12-25 14:20 - 2013-12-25 14:05 - 00012600 _____ C:\Documents and Settings\All Users\Data aplikací\oaod7t9l.fee
2013-12-25 14:05 - 2013-05-12 00:24 - 00000000 __RHD C:\Documents and Settings\All Users\Data aplikací
2013-12-25 14:00 - 2013-12-25 14:00 - 00228864 _____ (http://tortoisesvn.net) C:\Documents and Settings\All Users\Data aplikací\l9t7doao.jss
2013-12-25 14:00 - 2013-12-25 14:00 - 00000000 _____ C:\Documents and Settings\All Users\Data aplikací\oaod7t9l.odd
2013-12-25 13:59 - 2013-05-11 22:36 - 00000000 ____D C:\Documents and Settings\Admin
2013-12-25 11:44 - 2013-10-05 15:01 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-12-24 11:59 - 2006-03-02 13:00 - 00013646 _____ C:\WINDOWS\system32\wpa.dbl
2013-12-21 13:51 - 2013-12-21 13:51 - 00000667 _____ C:\Documents and Settings\All Users\Plocha\Vietcong - Fist Alpha.lnk
2013-12-21 13:51 - 2013-12-21 13:51 - 00000633 _____ C:\Documents and Settings\All Users\Plocha\Vietcong.lnk
2013-12-21 13:51 - 2013-12-21 13:51 - 00000000 ____D C:\Program Files\Cenega Czech
2013-12-21 13:51 - 2013-12-21 13:51 - 00000000 ____D C:\Documents and Settings\All Users\Nabídka Start\Programy\Vietcong
2013-12-21 13:51 - 2013-05-12 00:24 - 00000000 ___RD C:\Documents and Settings\All Users\Nabídka Start\Programy
2013-12-21 13:51 - 2013-05-12 00:24 - 00000000 ____D C:\Documents and Settings\All Users\Plocha
2013-12-16 18:37 - 2013-09-29 20:04 - 00000000 ____D C:\Documents and Settings\Admin\Dokumenty\Historie
2013-12-14 18:24 - 2013-05-11 22:36 - 00000000 ___RD C:\Documents and Settings\Admin\Dokumenty\Obrázky
2013-12-11 16:13 - 2013-05-12 00:23 - 00294072 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-12-11 16:11 - 2013-12-11 16:11 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2904266$
2013-12-11 16:11 - 2013-12-11 16:11 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2898715$
2013-12-11 16:11 - 2013-08-14 07:22 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-12-11 16:11 - 2013-05-12 12:07 - 00019306 _____ C:\WINDOWS\system32\TZLog.log
2013-12-11 16:10 - 2013-12-11 16:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2893984$
2013-12-11 16:10 - 2013-12-11 16:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2893294$
2013-12-11 16:10 - 2013-12-11 16:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2892075$
2013-12-11 16:10 - 2013-05-12 12:13 - 88123800 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2013-12-07 16:32 - 2013-05-11 22:36 - 00000000 ___RD C:\Documents and Settings\Admin\Dokumenty
2013-12-06 21:01 - 2013-12-06 18:39 - 00002315 _____ C:\Documents and Settings\All Users\Nabídka Start\Programy\Adobe Reader XI.lnk
2013-12-06 18:39 - 2013-12-06 18:39 - 00001734 _____ C:\Documents and Settings\All Users\Plocha\Adobe Reader XI.lnk
2013-12-06 18:39 - 2013-12-06 18:39 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-12-06 18:39 - 2013-12-06 18:39 - 00000000 ____D C:\Program Files\Adobe
2013-12-06 18:39 - 2013-05-12 10:10 - 00000000 ____D C:\Documents and Settings\All Users\Data aplikací\Adobe
2013-12-04 21:32 - 2013-05-11 22:42 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-12-04 21:32 - 2013-05-11 22:36 - 00000000 __RHD C:\Documents and Settings\Admin\Data aplikací
2013-11-29 23:08 - 2013-05-12 10:48 - 00000000 ___RD C:\Documents and Settings\Admin\Dokumenty\Filmy
Some content of TEMP:
====================
C:\Documents and Settings\Admin\Local Settings\temp\ITal.dll
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe
[2006-03-02 13:00] - [2008-04-14 07:52] - 1034240 ____A (Microsoft Corporation) 27afd587c462e280ee046b8cca3c2cd1
C:\Windows\System32\winlogon.exe
[2006-03-02 13:00] - [2008-04-14 07:52] - 0507904 ____A (Microsoft Corporation) cddb1f8e1aea356f3ad106f2cf9b7fea
C:\Windows\System32\svchost.exe
[2006-03-02 13:00] - [2008-04-14 07:52] - 0014336 ____A (Microsoft Corporation) be4a520e29b6391f49e79ccc52044d93
C:\Windows\System32\services.exe
[2006-03-02 13:00] - [2009-02-09 12:25] - 0111104 ____A (Microsoft Corporation) 9ef697af07bb8dd82c3b02ca953a95b7
C:\Windows\System32\User32.dll
[2006-03-02 13:00] - [2008-04-14 07:52] - 0578560 ____A (Microsoft Corporation) e16e0990967374e76f3e40cacafd3d53
C:\Windows\System32\userinit.exe
[2006-03-02 13:00] - [2008-04-14 07:52] - 0026112 ____A (Microsoft Corporation) 7dc1830f22e7d275b438127b68030239
C:\Windows\System32\Drivers\volsnap.sys
[2006-03-02 13:00] - [2008-04-14 06:42] - 0052480 ____A (Microsoft Corporation) 28a4b296b47782173c346e376cb374d1
==================== End Of Log ============================
Ran by Admin (administrator) on ADMIN on 25-12-2013 14:34:42
Running from C:\Documents and Settings\Admin\Plocha
Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: Czech
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(forum.viry.cz) C:\Documents and Settings\Admin\Plocha\FRSTLauncher.exe
(Microsoft Corporation) C:\WINDOWS\system32\cmd.exe
(Microsoft Corporation) C:\WINDOWS\system32\ping.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDCPL] - C:\WINDOWS\RTHDCPL.EXE [20065936 2012-06-06] (Realtek Semiconductor Corp.)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2012-04-05] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [947152 2013-01-27] (Microsoft Corporation)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
Winlogon\Notify\AtiExtEvent: C:\Windows\system32\Ati2evxx.dll (ATI Technologies Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.search.msn.com/{SUB_RFC1766}/ ... chasst.htm
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
Tcpip\..\Interfaces\{04FE91B6-1F6F-496E-A9C0-EBABAC64204D}: [NameServer]192.168.1.254
FireFox:
========
FF ProfilePath: C:\Documents and Settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\rz9xrwqd.default-1380989125015
FF Homepage: seznam.cz
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\heureka-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\jyxo-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\seznam-cz.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\slunecnice-cz.xml
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
========================== Services (Whitelisted) =================
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
S3 Ambfilt; C:\Windows\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative)
R3 L1c; C:\Windows\System32\DRIVERS\l1c51x86.sys [82032 2012-04-25] (Atheros Communications, Inc.)
S3 Monfilt; C:\Windows\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
R3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtKHDMI.sys [4125352 2011-12-02] (Realtek Semiconductor Corp.)
S1 akludgrm; \??\C:\WINDOWS\system32\drivers\akludgrm.sys [x]
S1 bdousemo; \??\C:\WINDOWS\system32\drivers\bdousemo.sys [x]
S1 bqjtnyhs; \??\C:\WINDOWS\system32\drivers\bqjtnyhs.sys [x]
S1 foaqmyrd; \??\C:\WINDOWS\system32\drivers\foaqmyrd.sys [x]
S3 gdrv; \??\C:\WINDOWS\gdrv.sys [x]
S4 IntelIde; No ImagePath
S1 itqnjbci; \??\C:\WINDOWS\system32\drivers\itqnjbci.sys [x]
S1 pmvgpvmn; \??\C:\WINDOWS\system32\drivers\pmvgpvmn.sys [x]
S1 qvlogdgn; \??\C:\WINDOWS\system32\drivers\qvlogdgn.sys [x]
U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
U3 TlntSvr;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-25 14:34 - 2013-12-25 14:34 - 00005516 _____ C:\Documents and Settings\Admin\Plocha\FRST.txt
2013-12-25 14:34 - 2013-12-25 14:34 - 00000000 ____D C:\FRST
2013-12-25 14:33 - 2013-12-25 14:33 - 00112640 _____ (forum.viry.cz) C:\Documents and Settings\Admin\Plocha\FRSTLauncher.exe
2013-12-25 14:33 - 2013-12-25 14:33 - 00029696 _____ C:\Documents and Settings\Admin\Local Settings\Data aplikací\MSGBOX.EXE
2013-12-25 14:33 - 2013-12-25 14:33 - 00015327 _____ C:\Documents and Settings\Admin\Plocha\LM.bat
2013-12-25 14:32 - 2013-12-25 14:32 - 01061545 _____ (Farbar) C:\Documents and Settings\Admin\Plocha\FRST.exe
2013-12-25 14:10 - 2013-12-25 14:24 - 00000000 ____D C:\rsit
2013-12-25 14:05 - 2013-12-25 14:20 - 00012600 _____ C:\Documents and Settings\All Users\Data aplikací\oaod7t9l.fee
2013-12-25 14:00 - 2013-12-25 14:00 - 00228864 _____ (http://tortoisesvn.net) C:\Documents and Settings\All Users\Data aplikací\l9t7doao.jss
2013-12-25 14:00 - 2013-12-25 14:00 - 00000000 _____ C:\Documents and Settings\All Users\Data aplikací\oaod7t9l.odd
2013-12-21 13:51 - 2013-12-21 13:51 - 00000667 _____ C:\Documents and Settings\All Users\Plocha\Vietcong - Fist Alpha.lnk
2013-12-21 13:51 - 2013-12-21 13:51 - 00000633 _____ C:\Documents and Settings\All Users\Plocha\Vietcong.lnk
2013-12-21 13:51 - 2013-12-21 13:51 - 00000000 ____D C:\Program Files\Cenega Czech
2013-12-21 13:51 - 2013-12-21 13:51 - 00000000 ____D C:\Documents and Settings\All Users\Nabídka Start\Programy\Vietcong
2013-12-11 16:11 - 2013-12-11 16:11 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2904266$
2013-12-11 16:11 - 2013-12-11 16:11 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2898715$
2013-12-11 16:10 - 2013-12-11 16:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2893984$
2013-12-11 16:10 - 2013-12-11 16:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2893294$
2013-12-11 16:10 - 2013-12-11 16:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2892075$
2013-12-06 18:39 - 2013-12-06 21:01 - 00002315 _____ C:\Documents and Settings\All Users\Nabídka Start\Programy\Adobe Reader XI.lnk
2013-12-06 18:39 - 2013-12-06 18:39 - 00001734 _____ C:\Documents and Settings\All Users\Plocha\Adobe Reader XI.lnk
2013-12-06 18:39 - 2013-12-06 18:39 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-12-06 18:39 - 2013-12-06 18:39 - 00000000 ____D C:\Program Files\Adobe
==================== One Month Modified Files and Folders =======
2013-12-25 14:34 - 2013-12-25 14:34 - 00005516 _____ C:\Documents and Settings\Admin\Plocha\FRST.txt
2013-12-25 14:34 - 2013-12-25 14:34 - 00000000 ____D C:\FRST
2013-12-25 14:34 - 2013-05-11 22:36 - 00000000 ____D C:\Documents and Settings\Admin\Plocha
2013-12-25 14:33 - 2013-12-25 14:33 - 00112640 _____ (forum.viry.cz) C:\Documents and Settings\Admin\Plocha\FRSTLauncher.exe
2013-12-25 14:33 - 2013-12-25 14:33 - 00029696 _____ C:\Documents and Settings\Admin\Local Settings\Data aplikací\MSGBOX.EXE
2013-12-25 14:33 - 2013-12-25 14:33 - 00015327 _____ C:\Documents and Settings\Admin\Plocha\LM.bat
2013-12-25 14:33 - 2013-09-27 18:49 - 00000366 ____H C:\WINDOWS\Tasks\MpIdleTask.job
2013-12-25 14:33 - 2013-05-16 14:09 - 00000000 ____D C:\Documents and Settings\Admin\Dokumenty\Stažené soubory
2013-12-25 14:33 - 2013-05-11 22:36 - 00000000 ___HD C:\Documents and Settings\Admin\Local Settings\Data aplikací
2013-12-25 14:32 - 2013-12-25 14:32 - 01061545 _____ (Farbar) C:\Documents and Settings\Admin\Plocha\FRST.exe
2013-12-25 14:27 - 2013-05-12 00:25 - 01023836 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-12-25 14:25 - 2013-05-11 22:32 - 01750612 _____ C:\WINDOWS\WindowsUpdate.log
2013-12-25 14:24 - 2013-12-25 14:10 - 00000000 ____D C:\rsit
2013-12-25 14:24 - 2013-09-27 05:54 - 00000000 ____D C:\Program Files\trend micro
2013-12-25 14:23 - 2013-05-11 22:36 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-12-25 14:23 - 2013-05-11 22:36 - 00000000 ___RD C:\Documents and Settings\Admin\Nabídka Start\Programy\Po spuštění
2013-12-25 14:22 - 2013-05-11 22:36 - 00032404 _____ C:\WINDOWS\SchedLgU.Txt
2013-12-25 14:22 - 2013-05-11 22:36 - 00000178 ___SH C:\Documents and Settings\Admin\ntuser.ini
2013-12-25 14:22 - 2013-05-11 17:18 - 00524288 _____ C:\WINDOWS\system32\config\ACEEvent.evt
2013-12-25 14:20 - 2013-12-25 14:05 - 00012600 _____ C:\Documents and Settings\All Users\Data aplikací\oaod7t9l.fee
2013-12-25 14:05 - 2013-05-12 00:24 - 00000000 __RHD C:\Documents and Settings\All Users\Data aplikací
2013-12-25 14:00 - 2013-12-25 14:00 - 00228864 _____ (http://tortoisesvn.net) C:\Documents and Settings\All Users\Data aplikací\l9t7doao.jss
2013-12-25 14:00 - 2013-12-25 14:00 - 00000000 _____ C:\Documents and Settings\All Users\Data aplikací\oaod7t9l.odd
2013-12-25 13:59 - 2013-05-11 22:36 - 00000000 ____D C:\Documents and Settings\Admin
2013-12-25 11:44 - 2013-10-05 15:01 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-12-24 11:59 - 2006-03-02 13:00 - 00013646 _____ C:\WINDOWS\system32\wpa.dbl
2013-12-21 13:51 - 2013-12-21 13:51 - 00000667 _____ C:\Documents and Settings\All Users\Plocha\Vietcong - Fist Alpha.lnk
2013-12-21 13:51 - 2013-12-21 13:51 - 00000633 _____ C:\Documents and Settings\All Users\Plocha\Vietcong.lnk
2013-12-21 13:51 - 2013-12-21 13:51 - 00000000 ____D C:\Program Files\Cenega Czech
2013-12-21 13:51 - 2013-12-21 13:51 - 00000000 ____D C:\Documents and Settings\All Users\Nabídka Start\Programy\Vietcong
2013-12-21 13:51 - 2013-05-12 00:24 - 00000000 ___RD C:\Documents and Settings\All Users\Nabídka Start\Programy
2013-12-21 13:51 - 2013-05-12 00:24 - 00000000 ____D C:\Documents and Settings\All Users\Plocha
2013-12-16 18:37 - 2013-09-29 20:04 - 00000000 ____D C:\Documents and Settings\Admin\Dokumenty\Historie
2013-12-14 18:24 - 2013-05-11 22:36 - 00000000 ___RD C:\Documents and Settings\Admin\Dokumenty\Obrázky
2013-12-11 16:13 - 2013-05-12 00:23 - 00294072 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-12-11 16:11 - 2013-12-11 16:11 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2904266$
2013-12-11 16:11 - 2013-12-11 16:11 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2898715$
2013-12-11 16:11 - 2013-08-14 07:22 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-12-11 16:11 - 2013-05-12 12:07 - 00019306 _____ C:\WINDOWS\system32\TZLog.log
2013-12-11 16:10 - 2013-12-11 16:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2893984$
2013-12-11 16:10 - 2013-12-11 16:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2893294$
2013-12-11 16:10 - 2013-12-11 16:10 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2892075$
2013-12-11 16:10 - 2013-05-12 12:13 - 88123800 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2013-12-07 16:32 - 2013-05-11 22:36 - 00000000 ___RD C:\Documents and Settings\Admin\Dokumenty
2013-12-06 21:01 - 2013-12-06 18:39 - 00002315 _____ C:\Documents and Settings\All Users\Nabídka Start\Programy\Adobe Reader XI.lnk
2013-12-06 18:39 - 2013-12-06 18:39 - 00001734 _____ C:\Documents and Settings\All Users\Plocha\Adobe Reader XI.lnk
2013-12-06 18:39 - 2013-12-06 18:39 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-12-06 18:39 - 2013-12-06 18:39 - 00000000 ____D C:\Program Files\Adobe
2013-12-06 18:39 - 2013-05-12 10:10 - 00000000 ____D C:\Documents and Settings\All Users\Data aplikací\Adobe
2013-12-04 21:32 - 2013-05-11 22:42 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-12-04 21:32 - 2013-05-11 22:36 - 00000000 __RHD C:\Documents and Settings\Admin\Data aplikací
2013-11-29 23:08 - 2013-05-12 10:48 - 00000000 ___RD C:\Documents and Settings\Admin\Dokumenty\Filmy
Some content of TEMP:
====================
C:\Documents and Settings\Admin\Local Settings\temp\ITal.dll
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe
[2006-03-02 13:00] - [2008-04-14 07:52] - 1034240 ____A (Microsoft Corporation) 27afd587c462e280ee046b8cca3c2cd1
C:\Windows\System32\winlogon.exe
[2006-03-02 13:00] - [2008-04-14 07:52] - 0507904 ____A (Microsoft Corporation) cddb1f8e1aea356f3ad106f2cf9b7fea
C:\Windows\System32\svchost.exe
[2006-03-02 13:00] - [2008-04-14 07:52] - 0014336 ____A (Microsoft Corporation) be4a520e29b6391f49e79ccc52044d93
C:\Windows\System32\services.exe
[2006-03-02 13:00] - [2009-02-09 12:25] - 0111104 ____A (Microsoft Corporation) 9ef697af07bb8dd82c3b02ca953a95b7
C:\Windows\System32\User32.dll
[2006-03-02 13:00] - [2008-04-14 07:52] - 0578560 ____A (Microsoft Corporation) e16e0990967374e76f3e40cacafd3d53
C:\Windows\System32\userinit.exe
[2006-03-02 13:00] - [2008-04-14 07:52] - 0026112 ____A (Microsoft Corporation) 7dc1830f22e7d275b438127b68030239
C:\Windows\System32\Drivers\volsnap.sys
[2006-03-02 13:00] - [2008-04-14 06:42] - 0052480 ____A (Microsoft Corporation) 28a4b296b47782173c346e376cb374d1
==================== End Of Log ============================
Re: Trojský kůň
Tvorba fixlistu pro FRST
- Spustte poznamkovy blok (Start-spustit-notepad)
- Zkopirujte skript nize
Kód: Vybrat vše
Start HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.) HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated) HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm SearchScopes: HKLM - DefaultScope value is missing. S1 akludgrm; \??\C:\WINDOWS\system32\drivers\akludgrm.sys [x] S1 bdousemo; \??\C:\WINDOWS\system32\drivers\bdousemo.sys [x] S1 bqjtnyhs; \??\C:\WINDOWS\system32\drivers\bqjtnyhs.sys [x] S1 foaqmyrd; \??\C:\WINDOWS\system32\drivers\foaqmyrd.sys [x] S3 gdrv; \??\C:\WINDOWS\gdrv.sys [x] S4 IntelIde; No ImagePath S1 itqnjbci; \??\C:\WINDOWS\system32\drivers\itqnjbci.sys [x] S1 pmvgpvmn; \??\C:\WINDOWS\system32\drivers\pmvgpvmn.sys [x] S1 qvlogdgn; \??\C:\WINDOWS\system32\drivers\qvlogdgn.sys [x] U3 TlntSvr; C:\WINDOWS\system32\drivers\akludgrm.sys C:\WINDOWS\system32\drivers\bdousemo.sys C:\WINDOWS\system32\drivers\bqjtnyhs.sys C:\WINDOWS\system32\drivers\foaqmyrd.sys C:\WINDOWS\system32\drivers\itqnjbci.sys C:\WINDOWS\system32\drivers\pmvgpvmn.sys C:\WINDOWS\system32\drivers\qvlogdgn.sys 2013-12-25 14:33 - 2013-12-25 14:33 - 00112640 _____ (forum.viry.cz) C:\Documents and Settings\Admin\Plocha\FRSTLauncher.exe 2013-12-25 14:33 - 2013-12-25 14:33 - 00029696 _____ C:\Documents and Settings\Admin\Local Settings\Data aplikací\MSGBOX.EXE 2013-12-25 14:33 - 2013-12-25 14:33 - 00015327 _____ C:\Documents and Settings\Admin\Plocha\LM.bat 2013-12-25 14:05 - 2013-12-25 14:20 - 00012600 _____ C:\Documents and Settings\All Users\Data aplikací\oaod7t9l.fee 2013-12-25 14:00 - 2013-12-25 14:00 - 00228864 _____ (http://tortoisesvn.net) C:\Documents and Settings\All Users\Data aplikací\l9t7doao.jss 2013-12-25 14:00 - 2013-12-25 14:00 - 00000000 _____ C:\Documents and Settings\All Users\Data aplikací\oaod7t9l.odd C:\Documents and Settings\Admin\Local Settings\temp\ITal.dll Hosts: CMD: shutdown /r /f /t 2 End- Ulozte vytvoreny TXT jako fixlist.txt
- Presunte vytvoreny fixlist vedle FRST
Spustte znovu FRST.exe
- Kliknete na Fix
- Probehne oprava a vytvori log Fixlog.txt
Restart PC a dejte mi sem fixlog.txt"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.Re: Trojský kůň
Ještě radši doplním, že po nynějším spuštění FRST (předtím jsem spouštěl FRST Launcher) se mi na ploše vytvořila složka FRST older Version, kde se obě ikony nacházejí a na ploše zůstal jen FRST a logy.
Log:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 25-12-2013
Ran by Admin at 2013-12-25 15:25:31 Run:1
Running from C:\Documents and Settings\Admin\Plocha
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
Start
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.search.msn.com/{SUB_RFC1766}/ ... chasst.htm
SearchScopes: HKLM - DefaultScope value is missing.
S1 akludgrm; \??\C:\WINDOWS\system32\drivers\akludgrm.sys [x]
S1 bdousemo; \??\C:\WINDOWS\system32\drivers\bdousemo.sys [x]
S1 bqjtnyhs; \??\C:\WINDOWS\system32\drivers\bqjtnyhs.sys [x]
S1 foaqmyrd; \??\C:\WINDOWS\system32\drivers\foaqmyrd.sys [x]
S3 gdrv; \??\C:\WINDOWS\gdrv.sys [x]
S4 IntelIde; No ImagePath
S1 itqnjbci; \??\C:\WINDOWS\system32\drivers\itqnjbci.sys [x]
S1 pmvgpvmn; \??\C:\WINDOWS\system32\drivers\pmvgpvmn.sys [x]
S1 qvlogdgn; \??\C:\WINDOWS\system32\drivers\qvlogdgn.sys [x]
U3 TlntSvr;
C:\WINDOWS\system32\drivers\akludgrm.sys
C:\WINDOWS\system32\drivers\bdousemo.sys
C:\WINDOWS\system32\drivers\bqjtnyhs.sys
C:\WINDOWS\system32\drivers\foaqmyrd.sys
C:\WINDOWS\system32\drivers\itqnjbci.sys
C:\WINDOWS\system32\drivers\pmvgpvmn.sys
C:\WINDOWS\system32\drivers\qvlogdgn.sys
2013-12-25 14:33 - 2013-12-25 14:33 - 00112640 _____ (forum.viry.cz) C:\Documents and Settings\Admin\Plocha\FRSTLauncher.exe
2013-12-25 14:33 - 2013-12-25 14:33 - 00029696 _____ C:\Documents and Settings\Admin\Local Settings\Data aplikací\MSGBOX.EXE
2013-12-25 14:33 - 2013-12-25 14:33 - 00015327 _____ C:\Documents and Settings\Admin\Plocha\LM.bat
2013-12-25 14:05 - 2013-12-25 14:20 - 00012600 _____ C:\Documents and Settings\All Users\Data aplikací\oaod7t9l.fee
2013-12-25 14:00 - 2013-12-25 14:00 - 00228864 _____ (http://tortoisesvn.net) C:\Documents and Settings\All Users\Data aplikací\l9t7doao.jss
2013-12-25 14:00 - 2013-12-25 14:00 - 00000000 _____ C:\Documents and Settings\All Users\Data aplikací\oaod7t9l.odd
C:\Documents and Settings\Admin\Local Settings\temp\ITal.dll
Hosts:
CMD: shutdown /r /f /t 2
End
*****************
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task => Value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM => Value deleted successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Bar => Value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
akludgrm => Service deleted successfully.
bdousemo => Service deleted successfully.
bqjtnyhs => Service deleted successfully.
foaqmyrd => Service deleted successfully.
gdrv => Service deleted successfully.
IntelIde => Service deleted successfully.
itqnjbci => Service deleted successfully.
pmvgpvmn => Service deleted successfully.
qvlogdgn => Service deleted successfully.
TlntSvr => Service deleted successfully.
"C:\WINDOWS\system32\drivers\akludgrm.sys" => File/Directory not found.
"C:\WINDOWS\system32\drivers\bdousemo.sys" => File/Directory not found.
"C:\WINDOWS\system32\drivers\bqjtnyhs.sys" => File/Directory not found.
"C:\WINDOWS\system32\drivers\foaqmyrd.sys" => File/Directory not found.
"C:\WINDOWS\system32\drivers\itqnjbci.sys" => File/Directory not found.
"C:\WINDOWS\system32\drivers\pmvgpvmn.sys" => File/Directory not found.
"C:\WINDOWS\system32\drivers\qvlogdgn.sys" => File/Directory not found.
"C:\Documents and Settings\Admin\Plocha\FRSTLauncher.exe" => File/Directory not found.
"C:\Documents and Settings\Admin\Local Settings\Data aplikací\MSGBOX.EXE" => File/Directory not found.
"C:\Documents and Settings\Admin\Plocha\LM.bat" => File/Directory not found.
C:\Documents and Settings\All Users\Data aplikací\oaod7t9l.fee => Moved successfully.
C:\Documents and Settings\All Users\Data aplikací\l9t7doao.jss => Moved successfully.
C:\Documents and Settings\All Users\Data aplikací\oaod7t9l.odd => Moved successfully.
C:\Documents and Settings\Admin\Local Settings\temp\ITal.dll => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
========= shutdown /r /f /t 2 =========
========= End of CMD: =========
==== End of Fixlog ====
Log:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 25-12-2013
Ran by Admin at 2013-12-25 15:25:31 Run:1
Running from C:\Documents and Settings\Admin\Plocha
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
Start
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.search.msn.com/{SUB_RFC1766}/ ... chasst.htm
SearchScopes: HKLM - DefaultScope value is missing.
S1 akludgrm; \??\C:\WINDOWS\system32\drivers\akludgrm.sys [x]
S1 bdousemo; \??\C:\WINDOWS\system32\drivers\bdousemo.sys [x]
S1 bqjtnyhs; \??\C:\WINDOWS\system32\drivers\bqjtnyhs.sys [x]
S1 foaqmyrd; \??\C:\WINDOWS\system32\drivers\foaqmyrd.sys [x]
S3 gdrv; \??\C:\WINDOWS\gdrv.sys [x]
S4 IntelIde; No ImagePath
S1 itqnjbci; \??\C:\WINDOWS\system32\drivers\itqnjbci.sys [x]
S1 pmvgpvmn; \??\C:\WINDOWS\system32\drivers\pmvgpvmn.sys [x]
S1 qvlogdgn; \??\C:\WINDOWS\system32\drivers\qvlogdgn.sys [x]
U3 TlntSvr;
C:\WINDOWS\system32\drivers\akludgrm.sys
C:\WINDOWS\system32\drivers\bdousemo.sys
C:\WINDOWS\system32\drivers\bqjtnyhs.sys
C:\WINDOWS\system32\drivers\foaqmyrd.sys
C:\WINDOWS\system32\drivers\itqnjbci.sys
C:\WINDOWS\system32\drivers\pmvgpvmn.sys
C:\WINDOWS\system32\drivers\qvlogdgn.sys
2013-12-25 14:33 - 2013-12-25 14:33 - 00112640 _____ (forum.viry.cz) C:\Documents and Settings\Admin\Plocha\FRSTLauncher.exe
2013-12-25 14:33 - 2013-12-25 14:33 - 00029696 _____ C:\Documents and Settings\Admin\Local Settings\Data aplikací\MSGBOX.EXE
2013-12-25 14:33 - 2013-12-25 14:33 - 00015327 _____ C:\Documents and Settings\Admin\Plocha\LM.bat
2013-12-25 14:05 - 2013-12-25 14:20 - 00012600 _____ C:\Documents and Settings\All Users\Data aplikací\oaod7t9l.fee
2013-12-25 14:00 - 2013-12-25 14:00 - 00228864 _____ (http://tortoisesvn.net) C:\Documents and Settings\All Users\Data aplikací\l9t7doao.jss
2013-12-25 14:00 - 2013-12-25 14:00 - 00000000 _____ C:\Documents and Settings\All Users\Data aplikací\oaod7t9l.odd
C:\Documents and Settings\Admin\Local Settings\temp\ITal.dll
Hosts:
CMD: shutdown /r /f /t 2
End
*****************
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task => Value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM => Value deleted successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Bar => Value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
akludgrm => Service deleted successfully.
bdousemo => Service deleted successfully.
bqjtnyhs => Service deleted successfully.
foaqmyrd => Service deleted successfully.
gdrv => Service deleted successfully.
IntelIde => Service deleted successfully.
itqnjbci => Service deleted successfully.
pmvgpvmn => Service deleted successfully.
qvlogdgn => Service deleted successfully.
TlntSvr => Service deleted successfully.
"C:\WINDOWS\system32\drivers\akludgrm.sys" => File/Directory not found.
"C:\WINDOWS\system32\drivers\bdousemo.sys" => File/Directory not found.
"C:\WINDOWS\system32\drivers\bqjtnyhs.sys" => File/Directory not found.
"C:\WINDOWS\system32\drivers\foaqmyrd.sys" => File/Directory not found.
"C:\WINDOWS\system32\drivers\itqnjbci.sys" => File/Directory not found.
"C:\WINDOWS\system32\drivers\pmvgpvmn.sys" => File/Directory not found.
"C:\WINDOWS\system32\drivers\qvlogdgn.sys" => File/Directory not found.
"C:\Documents and Settings\Admin\Plocha\FRSTLauncher.exe" => File/Directory not found.
"C:\Documents and Settings\Admin\Local Settings\Data aplikací\MSGBOX.EXE" => File/Directory not found.
"C:\Documents and Settings\Admin\Plocha\LM.bat" => File/Directory not found.
C:\Documents and Settings\All Users\Data aplikací\oaod7t9l.fee => Moved successfully.
C:\Documents and Settings\All Users\Data aplikací\l9t7doao.jss => Moved successfully.
C:\Documents and Settings\All Users\Data aplikací\oaod7t9l.odd => Moved successfully.
C:\Documents and Settings\Admin\Local Settings\temp\ITal.dll => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
========= shutdown /r /f /t 2 =========
========= End of CMD: =========
==== End of Fixlog ====
Re: Trojský kůň
To je OK, FRST se aktualizoval a do te slozky dal sve zalohy Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com
- Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane
Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe
Rkill iExplore.exe:
http://download.bleepingcomputer.com/gr ... xplore.exe
Rkill uSeRiNiT.exe:
http://download.bleepingcomputer.com/gr ... eRiNiT.exe
Rkill WiNlOgOn.exe:
http://download.bleepingcomputer.com/gr ... NlOgOn.exe - Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
- Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
- RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
- Na plose vznikne log Rkill.txt ten mi sem vlozte
- Ted nerestartujte PC - prisli byste o ucinek RKillu
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
- Pokud mate Win XP spustte pod uctem Spravce\Administratora
- Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
- Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
- Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
- Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
- Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
- Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
- Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.Re: Trojský kůň
Rkill 2.6.4 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html
Program started at: 12/25/2013 03:45:34 PM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 3
Checking for Windows services to stop:
* No malware services found to stop.
Checking for processes to terminate:
* No malware processes found to kill.
Checking Registry for malware related settings:
* No issues found in the Registry.
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
Performing miscellaneous checks:
* No issues found.
Checking Windows Service Integrity:
* No issues found.
Searching for Missing Digital Signatures:
* No issues found.
Checking HOSTS File:
* HOSTS file entries found:
127.0.0.1 localhost
Program finished at: 12/25/2013 03:46:09 PM
Execution time: 0 hours(s), 0 minute(s), and 34 seconds(s)
Tak činnost CF proběhla docela rychle.
ComboFix 13-12-24.02 - Admin 25.12.2013 15:50:22.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.3325.2714 [GMT 1:00]
Spuštěný z: c:\documents and settings\Admin\Plocha\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\TZLog.log
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-11-25 do 2013-12-25 )))))))))))))))))))))))))))))))
.
.
2013-12-25 13:37 . 2013-12-04 02:57 7760024 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{9687B1E5-E866-4BB3-8D2F-1127075295F0}\mpengine.dll
2013-12-25 13:34 . 2013-12-25 14:25 -------- d-----w- C:\FRST
2013-12-25 13:10 . 2013-12-25 13:24 -------- d-----w- C:\rsit
2013-12-24 14:14 . 2013-12-04 02:57 7760024 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-12-21 12:51 . 2013-12-21 12:51 -------- d-----w- c:\program files\Cenega Czech
2013-12-21 12:51 . 2013-12-21 12:51 163972 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll
2013-12-21 12:51 . 2002-12-05 13:12 692224 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll
2013-12-21 12:51 . 2002-12-05 13:10 155648 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll
2013-12-21 12:51 . 2002-12-02 14:22 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
2013-12-21 12:51 . 2002-12-02 12:33 57344 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
2013-12-21 12:51 . 2002-12-02 12:33 237568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll
2013-12-21 12:51 . 2013-12-21 12:51 282756 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll
2013-12-06 17:39 . 2013-12-06 17:39 -------- d-----w- c:\program files\Common Files\Adobe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-19 10:21 . 2013-05-11 16:20 230048 ------w- c:\windows\system32\MpSigStub.exe
2013-11-13 03:00 . 2006-03-02 12:00 150528 ----a-w- c:\windows\system32\imagehlp.dll
2013-11-07 05:38 . 2006-03-02 12:00 591360 ----a-w- c:\windows\system32\rpcrt4.dll
2013-11-06 01:36 . 2010-08-13 16:44 7168 ----a-w- c:\windows\system32\xpsp4res.dll
2013-10-30 02:51 . 2006-03-02 12:00 1879040 ----a-w- c:\windows\system32\win32k.sys
2013-10-29 07:45 . 2006-03-02 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2013-10-29 07:45 . 2006-03-02 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2013-10-29 07:45 . 2006-03-02 12:00 18944 ----a-w- c:\windows\system32\corpol.dll
2013-10-29 07:45 . 2006-03-02 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2013-10-29 00:45 . 2006-03-02 12:00 385024 ------w- c:\windows\system32\html.iec
2013-10-23 23:45 . 2006-03-02 12:00 172032 ----a-w- c:\windows\system32\scrrun.dll
2013-10-12 15:57 . 2006-03-02 12:00 279552 ----a-w- c:\windows\system32\oakley.dll
2013-10-09 13:13 . 2006-03-02 12:00 287744 ----a-w- c:\windows\system32\gdi32.dll
2013-10-07 11:00 . 2006-03-02 12:00 606208 ----a-w- c:\windows\system32\crypt32.dll
2013-10-05 18:42 . 2013-10-05 18:42 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2012-06-06 20065936]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-04-05 98304]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2011-07-27 434080]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Cenega Czech\\VIETCONG\\vietcong.exe"=
.
R3 L1c;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [11.5.2013 22:45 82032]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [11.5.2013 22:42 1691480]
.
Obsah adresáře 'Naplánované úlohy'
.
2013-12-25 c:\windows\Tasks\MpIdleTask.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-01-27 09:11]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: Interfaces\{04FE91B6-1F6F-496E-A9C0-EBABAC64204D}: NameServer = 192.168.1.254
FF - ProfilePath - c:\documents and settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\rz9xrwqd.default-1380989125015\
FF - prefs.js: browser.startup.homepage - seznam.cz
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-12-25 15:52
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(748)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
Celkový čas: 2013-12-25 15:53:02
ComboFix-quarantined-files.txt 2013-12-25 14:53
.
Před spuštěním: Volných bajtů: 46 561 755 136
Po spuštění: Volných bajtů: 46 523 244 544
.
- - End Of File - - DF8462C16A2A12BB13AE5CF8F7304A6E
413FC2A0C716421B3158746D63736515
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html
Program started at: 12/25/2013 03:45:34 PM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 3
Checking for Windows services to stop:
* No malware services found to stop.
Checking for processes to terminate:
* No malware processes found to kill.
Checking Registry for malware related settings:
* No issues found in the Registry.
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
Performing miscellaneous checks:
* No issues found.
Checking Windows Service Integrity:
* No issues found.
Searching for Missing Digital Signatures:
* No issues found.
Checking HOSTS File:
* HOSTS file entries found:
127.0.0.1 localhost
Program finished at: 12/25/2013 03:46:09 PM
Execution time: 0 hours(s), 0 minute(s), and 34 seconds(s)
Tak činnost CF proběhla docela rychle.
ComboFix 13-12-24.02 - Admin 25.12.2013 15:50:22.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.3325.2714 [GMT 1:00]
Spuštěný z: c:\documents and settings\Admin\Plocha\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\TZLog.log
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-11-25 do 2013-12-25 )))))))))))))))))))))))))))))))
.
.
2013-12-25 13:37 . 2013-12-04 02:57 7760024 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{9687B1E5-E866-4BB3-8D2F-1127075295F0}\mpengine.dll
2013-12-25 13:34 . 2013-12-25 14:25 -------- d-----w- C:\FRST
2013-12-25 13:10 . 2013-12-25 13:24 -------- d-----w- C:\rsit
2013-12-24 14:14 . 2013-12-04 02:57 7760024 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-12-21 12:51 . 2013-12-21 12:51 -------- d-----w- c:\program files\Cenega Czech
2013-12-21 12:51 . 2013-12-21 12:51 163972 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll
2013-12-21 12:51 . 2002-12-05 13:12 692224 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll
2013-12-21 12:51 . 2002-12-05 13:10 155648 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll
2013-12-21 12:51 . 2002-12-02 14:22 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
2013-12-21 12:51 . 2002-12-02 12:33 57344 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
2013-12-21 12:51 . 2002-12-02 12:33 237568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll
2013-12-21 12:51 . 2013-12-21 12:51 282756 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll
2013-12-06 17:39 . 2013-12-06 17:39 -------- d-----w- c:\program files\Common Files\Adobe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-19 10:21 . 2013-05-11 16:20 230048 ------w- c:\windows\system32\MpSigStub.exe
2013-11-13 03:00 . 2006-03-02 12:00 150528 ----a-w- c:\windows\system32\imagehlp.dll
2013-11-07 05:38 . 2006-03-02 12:00 591360 ----a-w- c:\windows\system32\rpcrt4.dll
2013-11-06 01:36 . 2010-08-13 16:44 7168 ----a-w- c:\windows\system32\xpsp4res.dll
2013-10-30 02:51 . 2006-03-02 12:00 1879040 ----a-w- c:\windows\system32\win32k.sys
2013-10-29 07:45 . 2006-03-02 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2013-10-29 07:45 . 2006-03-02 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2013-10-29 07:45 . 2006-03-02 12:00 18944 ----a-w- c:\windows\system32\corpol.dll
2013-10-29 07:45 . 2006-03-02 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2013-10-29 00:45 . 2006-03-02 12:00 385024 ------w- c:\windows\system32\html.iec
2013-10-23 23:45 . 2006-03-02 12:00 172032 ----a-w- c:\windows\system32\scrrun.dll
2013-10-12 15:57 . 2006-03-02 12:00 279552 ----a-w- c:\windows\system32\oakley.dll
2013-10-09 13:13 . 2006-03-02 12:00 287744 ----a-w- c:\windows\system32\gdi32.dll
2013-10-07 11:00 . 2006-03-02 12:00 606208 ----a-w- c:\windows\system32\crypt32.dll
2013-10-05 18:42 . 2013-10-05 18:42 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2012-06-06 20065936]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-04-05 98304]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2011-07-27 434080]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Cenega Czech\\VIETCONG\\vietcong.exe"=
.
R3 L1c;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [11.5.2013 22:45 82032]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [11.5.2013 22:42 1691480]
.
Obsah adresáře 'Naplánované úlohy'
.
2013-12-25 c:\windows\Tasks\MpIdleTask.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-01-27 09:11]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: Interfaces\{04FE91B6-1F6F-496E-A9C0-EBABAC64204D}: NameServer = 192.168.1.254
FF - ProfilePath - c:\documents and settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\rz9xrwqd.default-1380989125015\
FF - prefs.js: browser.startup.homepage - seznam.cz
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-12-25 15:52
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(748)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
Celkový čas: 2013-12-25 15:53:02
ComboFix-quarantined-files.txt 2013-12-25 14:53
.
Před spuštěním: Volných bajtů: 46 561 755 136
Po spuštění: Volných bajtů: 46 523 244 544
.
- - End Of File - - DF8462C16A2A12BB13AE5CF8F7304A6E
413FC2A0C716421B3158746D63736515
Re: Trojský kůň
Ještě se zeptám na ten antivir nebo mi to nedá pokoj, můžu nalezené trojany smazat nebo je mám zatím nechat v karanténě?
Re: Trojský kůň
Kde jej nachazi?? Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
- Ulozte nejlepe na plochu
- Ukoncete vsechny programy
- Kliknete na Scan a nasledne Clean
- Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte
Stahnete si TDSSKiller http://support.kaspersky.com/downloads/ ... killer.exe
- Kliknete na volbu Change parametrs
- V okne Additional Option zakliknete vsechny moznosti
- Kliknete na OK
- Utilite prikazte, at skenuje - klik na Start Scan
- Po dokonceni skenu se objevi okno, zkontrolujte, zda-li je vsude moznost Skip
- Pokud moznost Skip nebude primarne nastavena, prekliknete ji na Skip
- Pokud mate vsude Skip, kliknete na Continue
- Na disku, kde mate Windows (obvykle c:\) ve tvaru TDSSKiller.nejaka cisilka _log.txt bude log - jeho obsah sem vlozte
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.Re: Trojský kůň
Nemyslím nové viry, ale již ty nalezené, které mám stále v karanténě.
Re: Trojský kůň
V karantene jsou neskodne, ale muzete ji vymazat"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.Re: Trojský kůň
# AdwCleaner v3.016 - Report created 25/12/2013 at 19:49:54
# Updated 23/12/2013 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Admin - ADMIN
# Running from : C:\Documents and Settings\Admin\Plocha\adwcleaner.exe
# Option : Clean
***** [ Services ] *****
***** [ Files / Folders ] *****
***** [ Shortcuts ] *****
***** [ Registry ] *****
***** [ Browsers ] *****
-\\ Internet Explorer v8.0.6001.18702
-\\ Mozilla Firefox v24.0 (cs)
[ File : C:\Documents and Settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\rz9xrwqd.default-1380989125015\prefs.js ]
*************************
AdwCleaner[R0].txt - [807 octets] - [25/12/2013 19:49:35]
AdwCleaner[S0].txt - [729 octets] - [25/12/2013 19:49:54]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [788 octets] ##########
# Updated 23/12/2013 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Admin - ADMIN
# Running from : C:\Documents and Settings\Admin\Plocha\adwcleaner.exe
# Option : Clean
***** [ Services ] *****
***** [ Files / Folders ] *****
***** [ Shortcuts ] *****
***** [ Registry ] *****
***** [ Browsers ] *****
-\\ Internet Explorer v8.0.6001.18702
-\\ Mozilla Firefox v24.0 (cs)
[ File : C:\Documents and Settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\rz9xrwqd.default-1380989125015\prefs.js ]
*************************
AdwCleaner[R0].txt - [807 octets] - [25/12/2013 19:49:35]
AdwCleaner[S0].txt - [729 octets] - [25/12/2013 19:49:54]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [788 octets] ##########
Re: Trojský kůň
TDSSKiller chce update, mám jej načíst nebo pokračovat bez něj? Pokud se hloupě ptám tak mě zaražte, ale pro jistotu se vždy zeptám. 
Re: Trojský kůň
V pohode, radeji se vzdy zeptat
Ano, update povolte
Ano, update povolte
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.Re: Trojský kůň
Scan se dokončil a v programu se objevilo No threats found, ale nevidím možnost Skip.
Přispějete na provoz fóra?