Pomalý net

[riffman]

ach jo...

hele, pujdeme na to od lesa...vydrzte chvili, jdu pachat

[riffman]

tak jedem, budeme pachat harakiri...

stahnete si nasledujici archiv http://riffman.ic.cz/files/Sys/WinXPSP3/beep.zip ; stazeny soubor rozbalte na disk C tak, aby cesta k nemu byla C:\beep.sys

otevrete si poznamkovy blok, do nejz zkopirujte nasledujici text:

Kód: Vybrat vše

FCopy::
c:\beep.sys | c:\windows\system32\drivers\beep.sys
c:\windows\system32\dllcache\atapi.sys | c:\windows\system32\drivers\atapi.sys

ulozte vami vytvoreny textovy soubor jako CFScript.txt na plochu

po ulozeni uchopte vami vytvoreny skript levym tlacitkem mysi a presunte jej nad ikonu Combofixu, nad niz skript upustte:



po aplikaci by na vas mel vybafnout dalsi log, vlozte jej sem

Upozorneni: je mozne, ze po aplikaci skriptu a restartu nenabehnou Windows, v takovem pripade znovu restartujte, po restartu mackejte F8 a zvolte Posledni znamou fukncni konfiguraci


paklize jste verici, modlete se, paklize nejste, modlete se taky

[Titon]

ComboFix 10-07-10.02 - Lynx 11.07.2010 20:55:48.8.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.3071.2541 [GMT 2:00]
Spuštěný z: c:\documents and settings\Lynx\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Lynx\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100711-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
--------------- FCopy ---------------

c:\beep.sys --> c:\windows\system32\drivers\beep.sys
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-06-11 do 2010-07-11 )))))))))))))))))))))))))))))))
.

2010-07-11 18:40 . 2006-03-02 12:00 4224 ------w- C:\beep.sys
2010-07-11 14:16 . 2010-06-30 15:25 1013584 ----a-w- c:\windows\system32\drivers\TDSSKiller.exe
2010-07-11 12:42 . 2010-07-11 12:42 -------- d-----w- C:\rsit
2010-07-11 12:42 . 2010-07-11 12:42 -------- d-----w- c:\program files\trend micro
2010-07-03 16:59 . 2010-07-03 16:59 -------- d-----w- c:\program files\NVIDIA Corporation
2010-06-30 17:34 . 2010-06-30 17:34 -------- d-----w- c:\program files\Common Files\Sony Shared
2010-06-30 15:12 . 2010-06-30 17:33 -------- d-----w- c:\program files\Sony
2010-06-30 15:11 . 2010-06-30 15:11 -------- d-----w- c:\program files\Apple Software Update
2010-06-24 11:58 . 2010-06-24 12:02 3 ----a-w- c:\windows\treeskp.sys
2010-06-24 11:58 . 2010-06-24 12:02 3 ----a-w- c:\windows\sbacknt.bin
2010-06-24 11:58 . 2010-06-25 05:20 -------- d-----w- c:\program files\vghd
2010-06-24 11:58 . 2010-06-24 11:58 152904 ----a-w- c:\windows\system32\vghd.scr
2010-06-20 14:50 . 2010-06-20 15:18 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-06-14 14:12 . 2010-02-04 08:01 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2010-06-14 14:12 . 2010-02-04 08:01 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2010-06-14 14:12 . 2010-02-04 08:01 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2010-06-14 14:12 . 2010-02-04 08:01 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
2010-06-14 13:58 . 2010-07-03 19:56 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-06-12 08:42 . 2010-06-12 08:42 -------- d-----w- c:\program files\Psygnosis
2010-06-12 08:36 . 2010-06-12 08:36 -------- d-----w- c:\program files\directx
2010-06-12 08:31 . 2010-06-12 08:31 -------- d-----w- c:\documents and settings\Lynx\WINDOWS

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-11 12:32 . 2009-02-06 09:51 219128 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-07-11 12:23 . 2009-02-06 09:52 138592 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-07-06 21:35 . 2009-02-05 11:46 -------- d-----w- c:\program files\Wotlk
2010-07-03 16:57 . 2009-11-14 19:53 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-07-03 16:56 . 2009-01-15 12:15 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-03 16:49 . 2009-02-06 10:01 -------- d-----w- c:\program files\Activision
2010-06-30 15:11 . 2009-02-04 14:43 -------- d-----w- c:\program files\QuickTime
2010-06-26 16:56 . 2009-02-05 11:44 -------- d-----w- c:\program files\Warcraft III
2010-06-26 15:31 . 2009-02-07 14:01 -------- d-----w- c:\program files\ICQ6Toolbar
2010-06-24 20:12 . 2009-02-07 14:00 -------- d-----w- c:\program files\ICQ6.5
2010-06-23 21:45 . 2009-01-15 12:23 82734 ----a-w- c:\windows\system32\perfc005.dat
2010-06-23 21:45 . 2009-01-15 12:23 437940 ----a-w- c:\windows\system32\perfh005.dat
2010-06-20 15:18 . 2009-02-25 06:23 -------- d-----w- c:\program files\Norton Security Scan
2010-06-20 11:34 . 2009-02-24 14:11 -------- d-----w- c:\program files\Google
2010-06-14 14:06 . 2009-09-01 09:23 -------- d-----w- c:\program files\Ubisoft
2010-06-14 13:58 . 2009-06-16 20:55 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-05-26 17:17 . 2010-05-21 20:43 -------- d-----w- c:\program files\VideoLAN
2010-05-17 14:15 . 2010-07-11 14:16 2258 ----a-w- c:\windows\system32\drivers\eula.txt
2010-05-08 08:14 . 2010-05-08 08:14 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-05-04 17:18 . 2009-01-15 12:22 832512 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 17:18 . 2009-01-15 12:22 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-05-04 17:18 . 2009-01-15 12:22 17408 ----a-w- c:\windows\system32\corpol.dll
2010-05-02 08:09 . 2009-01-15 12:22 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-04-20 05:32 . 2009-01-15 12:22 285696 ----a-w- c:\windows\system32\atmfd.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-07-11_13.15.32 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-07-11 18:54 . 2010-07-11 18:54 16384 c:\windows\Temp\Perflib_Perfdata_674.dat
+ 2010-07-11 17:12 . 2010-07-11 17:12 16384 c:\windows\Temp\Perflib_Perfdata_5a8.dat
+ 2009-01-15 12:22 . 2006-03-02 12:00 4224 c:\windows\system32\dllcache\beep.sys
- 2009-01-15 12:22 . 2008-04-14 12:00 4224 c:\windows\system32\dllcache\beep.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3CF7606-E683-4375-A372-96B75DA0AEF7}]
2010-02-11 07:58 185856 ----a-w- c:\program files\Get Styles\enlbrdr.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2010-01-31 2356088]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-06-20 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-12-09 18063872]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-18 98304]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"TO2SSM_McciTrayApp"="c:\program files\TO2SSM\McciTrayApp.exe" [2008-08-15 1473536]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-03-24 1983816]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Lynx\Nabˇdka Start\Programy\Po spuçtŘnˇ\
CurseClientStartup.ccip [2010-7-5 0]
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\ICQ7.0\\ICQ.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed II\\AssassinsCreedIIGame.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed II\\AssassinsCreedII.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed II\\UPlayBrowser.exe"=
"c:\\Program Files\\Codemasters\\DiRT2\\dirt2_game.exe"=
"c:\\Program Files\\KONAMI\\Pro Evolution Soccer 2010\\pes2010.exe"=
"c:\\Documents and Settings\\Lynx\\Plocha\\offlineserver-v0.31\\server.exe"=
"c:\\Program Files\\Ubisoft\\Tom Clancy's Splinter Cell Conviction\\src\\system\\conviction_game.exe"=
"c:\\Program Files\\Ubisoft\\Tom Clancy's Splinter Cell Conviction\\src\\system\\gu.exe"=
"c:\\Program Files\\Ubisoft\\Prince of Persia Zapomenuté písky\\Prince of Persia.exe"=
"c:\\Program Files\\Ubisoft\\Prince of Persia Zapomenuté písky\\GameSettings.exe"=
"c:\\Program Files\\Ubisoft\\Prince of Persia Zapomenuté písky\\gu.exe"=
"c:\\Program Files\\Ubisoft\\Prince of Persia Zapomenuté písky\\UPlayBrowser.exe"=
"c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [5.7.2006 14:46 63352]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [4.2.2009 16:44 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [4.2.2009 16:44 20560]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [7.2.2009 16:01 246520]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [25.2.2010 21:21 135664]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [13.9.2009 13:49 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [13.9.2009 13:49 8320]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [16.6.2009 22:55 691696]
.
Obsah adresáře 'Naplánované úlohy'

2010-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-25 19:21]

2010-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-25 19:21]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Save YouTube Video as MP3
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {{14CD42DD-ABCD-3586-DCAB-40E3693E3737} - c:\program files\Get Styles\ct.htm
FF - ProfilePath - c:\documents and settings\Lynx\Data aplikací\Mozilla\Firefox\Profiles\2ijkhx1c.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1755576&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - hxxp://ahoolly.com
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1755576&SearchSource=2&q=
FF - plugin: c:\program files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Opera\program\plugins\np-mswmp.dll
FF - plugin: c:\program files\Opera\program\plugins\nppl3260.dll
FF - plugin: c:\program files\Opera\program\plugins\nprpjplug.dll
FF - plugin: c:\program files\Sony\Media Go\npmediago.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-11 21:00
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8AC7F9B0]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf74cbf28
\Driver\ACPI -> ACPI.sys @ 0xf735ecb8
\Driver\atapi -> 0x8ac7f9b0
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xf71fcbb0
PacketIndicateHandler -> NDIS.sys @ 0xf7209a21
SendHandler -> NDIS.sys @ 0xf71e787b
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(700)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2010-07-11 21:02:00
ComboFix-quarantined-files.txt 2010-07-11 19:01
ComboFix2.txt 2010-07-11 17:38
ComboFix3.txt 2010-07-11 14:44
ComboFix4.txt 2010-07-11 13:16

Před spuštěním: Volných bajtů: 128 275 021 824
Po spuštění: Volných bajtů: 128 267 964 416

- - End Of File - - E5E5C28D953EDC845BC40E091DD4D314

[riffman]

fajn

http://ad13.geekstogo.com/MBRCheck.exe

stahnout, spustit, potvrdit Enterem, udelat Printscreen, sem s nim

[Titon]

doufam ze to takhle staci
http://yfrog.com/mcbeznzvuop

[riffman]

stahnete MBR

presunte mbr.exe do adresare C:\Windows

dalsi postup jest nasledujici:

Start/Spustit a do chlivecku napiste cmd a stisk Enter.

vybafne na vas okenko prikazoveho radku; vy nadatlujte rucne prikaz:

mbr.exe -f

a stisknete Enter

Po provedeni operace restartujte a spustte mbr jeste jednou, jiz normalne a vlozte sem log

[Titon]

je to ono?
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

[riffman]

jo, je to presne ono, svinstvo zmizelo...

jak se ted tvari pocitac?

[Titon]

Prijde mi to rychlejsi i net.to je všechno?

[riffman]

jo, jeste po mne uklidte

http://sweb.cz/Marinus/T-Cleaner.exe

stahnout, spustit, v okne potvrdit klepnutim na klavesu A vykonani akce, nechat probehnout

[Titon]

.... diky moc

[riffman]

nemate zac