preventivka

[Caroprd111]

OK

[stancoj]

kde je ta schranka kde sa to ulozi ked dam copy?

[Caroprd111]

To je schránka ve Windows. Obsah vložte do příspěvku pomocí Ctrl + V.

[stancoj]

a ta schranka je kde?

[Caroprd111]

Ta je pro uživatele skrytá. Proč to potřebujete vědět?

[stancoj]

tak odkial mam sem skopirovat log ci co

[Caroprd111]

Do třetice a naposledy klikněte pravým tlačítkem do tabulky s výsledky a vyberte položku Copy - tohle všechny události zkopíruje do schránky:
Zkopírovaný log vložte do svého threadu na forum (stiskněte kombinaci kláves CTRL+V pro vložení logu do vašeho příspěvku).

[stancoj]

Autoscan: malfunction (events: 3, objects: 0, time: Unknown)
2.7.2010 17:11:45 Task started
2.7.2010 17:21:47 Detected: Trojan.Win32.Agent.eegj C:\Documents and Settings\hp\Desktop\mix\convertor.exe
2.7.2010 17:22:12 Deleted: Trojan.Win32.Agent.eegj C:\Documents and Settings\hp\Desktop\mix\convertor.exe
Autoscan: completed 24 minutes ago (events: 2, objects: 378490, time: 01:05:51)

[Caroprd111]

Stáhněte a uložte, nejlépe na plochu http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypněte všechny rezidentní bezpečnostní programy - firewally, antiviry, antispywary
• Vložte do PC všechny flash disky, které používáte.
• Spusťte aplikaci pod účtem s oprávněním Administrátora (Správce), ihned po startu se zobrazí stránka s licenčními podmínkami, pokračujte stisknutím tlačítka "Ano"
• Dále postupujte dle pokynů, během scanu nespouštějte jiné aplikace a neklikejte do zobrazujícího se okna
• Scan by měl trvat okolo 5 - 10 minut, po dokončení Combofix zobrazí log C:\ComboFix.txt , který sem vložte.
• Během skenování může být počítač restartován.

[stancoj]

nech sa páči

ComboFix 10-07-01.02 - hp 02.07.2010 21:25:53.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.2046.1301 [GMT 2:00]
Spuštěný z: c:\users\hp\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\My.ini

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-06-02 do 2010-07-02 )))))))))))))))))))))))))))))))
.

2010-07-02 19:32 . 2010-07-02 19:32 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-07-02 19:32 . 2010-07-02 19:32 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-07-02 19:32 . 2010-07-02 19:32 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2010-07-02 17:38 . 2009-10-22 11:54 37392 ----a-w- c:\windows\system32\drivers\93964732.sys
2010-07-02 17:38 . 2009-10-09 21:31 311312 ----a-w- c:\windows\system32\drivers\9396473.sys
2010-07-02 17:38 . 2009-09-25 15:59 128016 ----a-w- c:\windows\system32\drivers\93964731.sys
2010-07-02 15:05 . 2010-07-02 17:39 -------- d-----w- c:\programdata\Kaspersky Lab
2010-07-01 17:10 . 2010-07-01 17:10 -------- d-----w- C:\_OTL
2010-06-24 08:58 . 2010-06-24 08:58 -------- d-----w- c:\windows\system32\Samsung_USB_Drivers
2010-06-24 08:58 . 2008-02-22 13:33 94336 ----a-w- c:\windows\system32\drivers\sscdserd.sys
2010-06-24 08:58 . 2008-02-22 13:33 14976 ----a-w- c:\windows\system32\drivers\sscdmdfl.sys
2010-06-24 08:58 . 2008-02-22 13:33 12160 ----a-w- c:\windows\system32\drivers\sscdwhnt.sys
2010-06-24 08:58 . 2008-02-22 13:33 12160 ----a-w- c:\windows\system32\drivers\sscdwh.sys
2010-06-24 08:58 . 2008-02-22 13:33 114304 ----a-w- c:\windows\system32\drivers\sscdmdm.sys
2010-06-24 08:58 . 2008-02-22 13:33 87936 ----a-w- c:\windows\system32\drivers\sscdbus.sys
2010-06-24 08:58 . 2008-02-22 13:33 12160 ----a-w- c:\windows\system32\drivers\sscdcmnt.sys
2010-06-24 08:58 . 2008-02-22 13:33 12160 ----a-w- c:\windows\system32\drivers\sscdcm.sys
2010-06-23 12:41 . 2009-11-08 08:55 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-06-23 12:41 . 2009-11-08 08:55 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-06-23 12:41 . 2009-11-08 08:55 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-06-23 12:41 . 2009-11-08 08:55 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-06-23 12:41 . 2009-11-08 08:55 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-06-22 20:41 . 2010-06-22 20:41 -------- d-----w- c:\users\hp\AppData\Local\Blizzard Entertainment
2010-06-22 11:54 . 2009-07-14 17:45 445008 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2010-06-22 11:54 . 2009-07-14 17:45 38480 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2010-06-22 11:37 . 2010-04-05 17:01 67072 ----a-w- c:\windows\system32\asycfilt.dll
2010-06-22 11:37 . 2010-05-26 14:47 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-06-22 11:37 . 2010-05-26 17:06 34304 ----a-w- c:\windows\system32\atmlib.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-02 19:25 . 2007-01-08 21:09 598838 ----a-w- c:\windows\system32\perfh005.dat
2010-07-02 19:25 . 2007-01-08 21:09 115014 ----a-w- c:\windows\system32\perfc005.dat
2010-07-02 19:22 . 2009-10-09 18:02 70610 ----a-w- c:\programdata\nvModes.dat
2010-07-02 19:16 . 2009-02-16 23:13 12 ----a-w- c:\windows\bthservsdp.dat
2010-06-28 18:38 . 2010-01-15 14:54 -------- d-----w- c:\users\hp\AppData\Roaming\Skype
2010-06-28 15:55 . 2010-01-15 14:56 -------- d-----w- c:\users\hp\AppData\Roaming\skypePM
2010-06-26 16:29 . 2009-03-30 14:05 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-06-26 16:29 . 2009-03-30 14:05 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-06-24 14:16 . 2007-06-20 09:41 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-22 11:54 . 2010-06-22 11:54 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_SynTP_01009.Wdf
2010-06-22 11:54 . 2010-06-22 11:54 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2010-06-22 11:48 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-06-01 16:51 . 2009-10-18 09:05 -------- d-----w- c:\users\hp\AppData\Roaming\HpUpdate
2010-05-28 14:13 . 2009-07-09 21:09 -------- d-----w- c:\users\hp\AppData\Roaming\dvdcss
2010-05-27 20:32 . 2010-05-27 20:32 245936 ----a-w- c:\windows\system32\drivers\SynTP.sys
2010-05-27 20:31 . 2008-03-28 01:04 120104 ----a-w- c:\windows\system32\SynTPCo4.dll
2010-05-27 20:31 . 2008-03-28 00:27 165160 ----a-w- c:\windows\system32\SynTPAPI.dll
2010-05-27 20:31 . 2010-05-27 20:31 210216 ----a-w- c:\windows\system32\SynCtrl.dll
2010-05-27 20:31 . 2008-03-28 00:15 173352 ----a-w- c:\windows\system32\SynCOM.dll
2010-05-21 12:14 . 2009-10-03 12:27 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-05 18:47 . 2010-05-05 18:39 -------- d-----w- c:\users\hp\AppData\Roaming\Ventrilo
2010-05-05 18:35 . 2010-02-12 19:12 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-05-04 05:59 . 2010-06-22 11:36 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 05:55 . 2010-06-22 11:36 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-05-04 05:55 . 2010-06-22 11:36 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-05-04 04:31 . 2010-06-22 11:36 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-05-01 14:13 . 2010-06-22 11:36 2037248 ----a-w- c:\windows\system32\win32k.sys
2010-04-29 10:19 . 2010-01-15 15:04 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 10:19 . 2010-01-15 15:04 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-23 14:13 . 2010-05-27 12:28 2048 ----a-w- c:\windows\system32\tzres.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"RocketDock"="d:\rocketdock\RocketDock.exe" [2007-09-02 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-05-27 1721640]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-04-23 176128]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"CognizanceTS"="c:\progra~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll" [2003-12-22 17920]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-03-19 2029640]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\APSHook.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HP Health Check Scheduler"=c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):28,64,86,51,a5,28,ca,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1772001885-842767137-95017056-1000]
"EnableNotificationsRef"=dword:00000001

R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [x]
S0 93964732;93964732 Boot Guard Driver;c:\windows\system32\DRIVERS\93964732.sys [2009-10-22 37392]
S1 93964731;93964731;c:\windows\system32\DRIVERS\93964731.sys [2009-09-25 128016]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-03-19 107256]
S2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe [2008-01-19 21504]
S2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe [2008-01-19 21504]
S2 DfSdkS;Defragmentation-Service;d:\ashampoo winoptimizer 2010 advanced\DfsdkS.exe [2009-08-24 406016]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2009-03-19 731840]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2009-03-19 38240]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
Cognizance REG_MULTI_SZ ASBroker ASChannel
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.sk/
uDefault_Search_URL =
uSearchAssistant =
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\users\hp\AppData\Roaming\Mozilla\Firefox\Profiles\1lvz6amk.default\
FF - prefs.js: browser.search.selectedEngine -
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\users\hp\AppData\Roaming\Mozilla\Firefox\Profiles\1lvz6amk.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-02 21:32
Windows 6.0.6002 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1772001885-842767137-95017056-1000\Software\SecuROM\License information*]
"datasecu"=hex:ad,75,1f,e0,d6,c8,c6,8f,22,08,e2,1d,3f,81,df,94,ee,e8,61,4a,1c,
96,15,8b,b6,f5,4e,9a,2d,30,1a,58,84,10,5f,ff,5e,87,58,63,2b,46,45,8f,dc,b3,\
"rkeysecu"=hex:7f,a9,1b,21,6d,25,15,2b,aa,98,7b,fb,70,e7,ed,c7

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2010-07-02 21:35:38
ComboFix-quarantined-files.txt 2010-07-02 19:35

Před spuštěním: 137 748 480
Po spuštění: 412 069 888

- - End Of File - - 731BBA4D2B265522682CE27A5BDDCD53

[Caroprd111]

Jak se chová PC

[stancoj]

to este nvm, zajtra napisem. zatial nazdar

[Caroprd111]

OK

[stancoj]

teraz my zamrzol

[Caroprd111]

Stáhněte MBR na plochu http://www2.gmer.net/mbr/mbr.exe

• Klikněte pravým tl. myši na ikonu MBR a zvolte vlastnosti. Zaškrtněte okénko "Spustit tento program jako správce" a potvrďte kliknutím na tlačítko "OK".
• Start > Spustit (nebo použijte klávesovou zkratku Win + R)

• Vyskočí okénko, zkopírujte do něj:

Kód: Vybrat vše

"%userprofile%\desktop\mbr" -t

• Klikněte na OK

• Vytvoří se log s názvem mbr.log, vložte ho sem.