Cierna obrazovka

[ikra]

z toho OTM sa mi zasekol pocitac.... a zasa sa mi stalo to s tou ciernou obrazovkou

[motji]

U čeho se Vám OTm zasekl,nevíte?

Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe

- ComboFix je třeba spustit pod účtem s právy administrátora

- Před použitím vypněte všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary

- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího se okna

- Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, skopírujte celý jeho obsah sem

[ikra]

dala som move it, zmizlo vsetko z plochy okrem toho otm okna, potom to chcelo aby som restartovala pocitac, a zaseklo sa to ked mi ukazoval Welcome

[motji]

Ale po dalším restartu už to bylo v pořádku,ne?
Pro jistotu ten combofix

[ikra]

po restarte uz isiel. a co znamena spustit pod účtem s právy administrátora?

[motji]

Máte na počítači víc uživatelských učtů?
Pokud jen jeden, tak je to v pořádku, pokud více, nesmíte ho spouštět pod učtem s omezenými právy.

[ikra]

ja som to zapla ale bolo to tam dlhsie ako 10 minut a nic sa nedialo a seklo sa to... musela som pc vypnut tym tlacitkom vzadu

[motji]

Zkuste ho spustit v nouzovém režimu - po restartu mačkejte F8.
Nechte ho běžet i déle než 10 minut

[ikra]

podarilo sa

ComboFix 10-02-03.07 - Administrator 05.02.2010 12:57:04.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1033.18.959.602 [GMT 1:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\AutoRun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ACPI32
-------\Legacy_ATI64SI
-------\Legacy_KSI32SK
-------\Legacy_SECURENTM
-------\Legacy_SYSTEMNTMI
-------\Legacy_WS2_32SIK


((((((((((((((((((((((((( Files Created from 2010-01-05 to 2010-02-05 )))))))))))))))))))))))))))))))
.

2010-02-02 21:14 . 2010-02-02 21:14 -------- d-----w- c:\program files\trend micro
2010-02-02 21:14 . 2010-02-02 21:14 -------- d-----w- C:\rsit
2010-02-01 23:28 . 2010-02-01 23:28 -------- d-----w- c:\windows\system32\KB905474
2010-02-01 23:28 . 2009-03-10 21:26 1403264 ----a-w- c:\windows\system32\KB905474\wganotifypackageinner.exe
2010-02-01 23:28 . 2009-03-10 21:18 453512 ----a-w- c:\windows\system32\KB905474\wgasetup.exe
2010-02-01 23:26 . 2004-08-04 01:07 221184 ----a-w- c:\windows\system32\wmpns.dll
2010-02-01 23:22 . 2010-02-01 23:22 -------- d-----w- c:\windows\ServicePackFiles
2010-02-01 23:21 . 2010-02-01 23:21 -------- d-----w- c:\program files\MSXML 4.0
2010-02-01 21:55 . 2010-02-01 22:08 -------- d-----w- c:\windows\system32\CatRoot_bak
2010-02-01 21:49 . 2008-10-24 11:10 453632 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-02-01 21:48 . 2008-06-13 13:10 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-02-01 21:48 . 2008-06-13 13:10 272128 ------w- c:\windows\system32\drivers\bthport.sys
2010-02-01 21:45 . 2009-08-04 14:00 2180352 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-02-01 21:45 . 2009-08-04 13:58 2136064 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-02-01 21:45 . 2009-08-04 13:13 2015744 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-02-01 21:45 . 2009-08-04 13:13 2057728 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-02-01 21:31 . 2010-02-03 13:33 -------- d--h--w- c:\windows\$hf_mig$
2010-02-01 16:01 . 2010-02-01 16:01 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-02-01 16:01 . 2010-02-01 16:01 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-02-01 16:01 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-01 16:01 . 2010-02-01 16:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-01 16:01 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-01 16:01 . 2010-02-01 16:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-20 17:01 . 2010-01-20 17:01 -------- d-----w- c:\windows\system32\drivers\NSS
2010-01-20 17:01 . 2010-01-20 17:01 -------- d-----w- c:\program files\Norton Security Scan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-04 20:31 . 2009-12-27 19:06 -------- d-----w- c:\program files\Metin2_CZ
2010-02-04 14:21 . 2009-02-18 23:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-02-02 20:39 . 2008-04-18 20:06 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent
2010-01-30 17:25 . 2009-11-06 21:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\vlc
2010-01-27 16:12 . 2009-12-27 17:04 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-01-20 17:01 . 2009-12-22 14:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-01-20 17:01 . 2009-12-22 14:32 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-01-02 22:15 . 2009-11-06 21:16 -------- d-----w- c:\documents and settings\Administrator\Application Data\dvdcss
2009-12-27 22:17 . 2008-04-18 20:06 -------- d-----w- c:\program files\uTorrent
2009-12-22 21:27 . 2009-02-18 23:10 -------- d-----w- c:\program files\Google
2009-12-22 14:32 . 2009-12-22 14:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-12-22 14:32 . 2009-12-22 14:32 -------- d-----w- c:\program files\NortonInstaller
2009-12-22 11:33 . 2008-04-05 06:41 -------- d-----w- c:\program files\DivX
2009-12-22 11:32 . 2009-12-22 11:32 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-12-22 05:42 . 2004-08-04 01:07 662016 ----a-w- c:\windows\system32\wininet.dll
2009-12-22 05:42 . 2004-08-04 01:07 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-11-21 16:36 . 2004-08-04 01:07 470528 ----a-w- c:\windows\AppPatch\aclayers.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2008-07-21 2752512]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 1232896]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 1079808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-12-01 77824]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2004-08-27 1450096]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"VTTimer"="VTTimer.exe" [2004-01-15 49152]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-04-09 2029640]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-23 148888]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-10-04 198160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2.9.2008 21:00 717296]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [9.4.2009 14:18 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [9.4.2009 14:21 94360]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [9.4.2009 14:19 731840]
S2 gupdate1c9921e29e81748;Služba Google Update (gupdate1c9921e29e81748);c:\program files\Google\Update\GoogleUpdate.exe [19.2.2009 0:10 133104]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\x:\ntglm7x.sys --> x:\NTGLM7X.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2010-02-05 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-18 20:44]

2010-02-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-18 23:10]

2010-02-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-18 23:10]

2010-02-05 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-02-01 21:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.Google.com
uDefault_Search_URL = hxxp://www.Google.com
mStart Page = hxxp://home.sweetim.com
uSearchAssistant = hxxp://www.Google.com/
uCustomizeSearch = hxxp://www.Google.com/
IE: {{14CD42DD-ABCD-3586-DCAB-40E3693E3737} - c:\program files\Stylish Profile\ct.htm
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\6rtjdc6w.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search13.net/search.php?clid=486&q=
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://search13.net?clid=486
FF - prefs.js: keyword.URL - hxxp://search13.net/search.php?clid=486&q=
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{EEE6C35D-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
BHO-{EEE6C35C-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-05 13:02
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x857681F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf75c2fc3
\Driver\ACPI -> ACPI.sys @ 0xf740dcb8
\Driver\atapi -> 0x857d91f8
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x8059e1a2
ParseProcedure -> ntoskrnl.exe @ 0x8057c745
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x8059e1a2
ParseProcedure -> ntoskrnl.exe @ 0x8057c745
NDIS: VIA Compatable Fast Ethernet Adapter -> SendCompleteHandler -> NDIS.sys @ 0xf72acba0
PacketIndicateHandler -> NDIS.sys @ 0xf72b9b21
SendHandler -> NDIS.sys @ 0xf729787b
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-57989841-1303643608-839522115-500\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{8CB30A69-9C09-3FAC-4F2E-0CA497EEE5E2}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"gadhcpjeafhpfc"=hex:63,61,63,6c,6a,69,00,00

[HKEY_USERS\S-1-5-21-57989841-1303643608-839522115-500\Software\SecuROM\License information*]
"datasecu"=hex:ae,0c,b4,a2,c8,75,77,b8,10,47,c8,63,6a,57,ea,bc,46,4f,0e,35,fe,
0a,a4,40,b9,77,15,88,d8,6e,46,8f,96,ed,84,4f,db,26,6d,70,ef,f0,0a,fd,b3,e4,\
"rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(864)
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Ahead\InCD\InCDsrv.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\VTTimer.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\Common Files\Nokia\MPAPI\MPAPI3s.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-02-05 13:06:23 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-05 12:06

Pre-Run: 19 401 117 696 bytes free
Post-Run: 13 adresárov, 19 470 663 680 voľných bajtov

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 044304F8ACB1373B365FCBE1BFD362D3

[motji]

Používáte Daemon nebo aclohol?
Jak to ted vypadá s počítačem?

[ikra]

bol tu nejaky daemon ale ten som pred par dnami odinstalovala... a ta cierna obrazovka sa zjavila zas ked som hrala hru

[motji]

To by mohl být problém grafiky. Jindy než u her černou obrazovku nemáte?


odinstalujte všechny virtuální jednotky (Daemon nebo alcohol)

Stáhněte SPTD http://www.duplexsecure.com/en/downloads
-vyberte verzi podle svého operačního systému. SPTD for Windows (32 bit) nebo (64b)
-uložte na plochu a spusťte
- zvolte možnost Uninstall
- restart PC


stáhněte MBR
http://www2.gmer.net/mbr/mbr.exe
-uložte ho na plochu


start-spustit
do okénka zkopírujte

Kód: Vybrat vše

"%userprofile%\plocha\mbr" -t

ok

vytvoří se log s názvem mbr.log, vložte ho zde [/quote]

[ikra]

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

do akeho okienka som mala dat ten kod?
a stava sa to pri hrach a pri videach

[motji]

dáte start - spustit - ukáže se okénko a vložíte ho do něj

[ikra]

no prave, ziadme okienko sa mi nezobrazilo, len sa hned urobil ten log