Zavirovana stranka

[Thrall]

A co je toto:Win32:Crypt-HQP [Drp] za haveť?

To je to, co zablokoval Avast, ne? Tedy MBAM.

MBAM našel Avast! zablkoval (krásná spolupráce ) Co to je z haveť?

Teď se stalo to stejné . Win32: Adware-HT [PUP]. A k tomu jsem to měl ve složce se zálohou. Poslal jsme to do virové laboratoře. Mám teda to co Avast! přesunul do truhli pro jistotu vymazat nebo vypustit na svobodu?

[Rudy]

Zkuste ještě jeden sken CF.

[Thrall]

Zkuste ještě jeden sken CF.

Udeal jsem to hned potom:

ComboFix 10-09-25.07 - Uživatel 26.09.2010 12:55:26.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1511 [GMT 2:00]
Spuštěný z: c:\documents and settings\Uživatel\Plocha\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-08-26 do 2010-09-26 )))))))))))))))))))))))))))))))
.

2010-09-07 15:38 . 2010-09-07 15:38 -------- d-----w- c:\windows\Internet Logs
2010-09-05 17:14 . 2010-09-05 17:14 -------- d-----w- c:\program files\Conduit
2010-09-05 17:12 . 2010-09-05 17:12 -------- d-----w- c:\program files\CheckPoint
2010-09-05 17:10 . 2010-09-05 17:10 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2010-09-05 16:55 . 2010-09-05 16:55 -------- d-----w- c:\program files\Crawler
2010-09-05 16:55 . 2010-09-05 16:55 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-09-05 16:55 . 2010-09-22 19:29 -------- d-----w- c:\program files\Spyware Terminator
2010-09-05 16:37 . 2010-09-07 14:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-05 16:37 . 2010-09-07 14:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-05 16:37 . 2010-09-07 14:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-05 16:37 . 2010-09-07 14:47 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-05 16:37 . 2010-09-07 14:47 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-05 16:37 . 2010-09-07 14:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-05 16:37 . 2010-09-07 14:46 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-09-05 16:37 . 2010-09-07 15:12 38848 ----a-w- c:\windows\avastSS.scr
2010-09-05 16:37 . 2010-09-07 15:11 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-05 16:37 . 2010-09-05 16:37 -------- d-----w- c:\program files\Alwil Software
2010-09-05 16:22 . 2010-09-05 16:22 -------- d-----w- c:\windows\system32\NtmsData
2010-09-04 13:58 . 2010-09-04 14:15 84618 ----a-w- c:\windows\War3Unin.dat
2010-09-04 13:58 . 2010-09-04 14:11 2829 ----a-w- c:\windows\War3Unin.pif
2010-09-04 13:58 . 2010-09-04 14:11 139264 ----a-w- c:\windows\War3Unin.exe
2010-09-04 13:56 . 2010-09-25 18:46 -------- d-----w- c:\program files\Warcraft III
2010-08-31 06:41 . 2010-08-31 06:42 -------- d-----w- c:\program files\Common Files\Adobe
2010-08-27 12:06 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-27 12:06 . 2010-08-27 13:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-27 12:06 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-27 11:11 . 2010-09-26 09:24 -------- d-----w- c:\program files\trend micro
2010-08-27 11:11 . 2010-08-27 11:33 -------- d-----w- C:\rsit

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-26 09:56 . 2010-06-18 14:21 -------- d-----w- c:\program files\Counter-Strike Source
2010-09-25 18:49 . 2009-07-02 10:26 -------- d-----w- c:\program files\Google
2010-09-25 17:37 . 2010-08-26 15:22 -------- d-----w- c:\program files\Garena
2010-09-05 17:12 . 2010-09-05 17:12 -------- d-----w- c:\program files\CheckPoint
2010-08-30 16:30 . 2010-06-29 11:13 -------- d-----w- c:\program files\World of Warcraft Model Viewer
2010-08-27 14:10 . 2010-08-26 14:53 -------- d-----w- c:\program files\Starcraft
2010-08-23 13:21 . 2009-08-27 19:31 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-08-17 13:17 . 2008-04-14 12:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-12 20:25 . 2008-04-14 12:00 85312 ----a-w- c:\windows\system32\perfc005.dat
2010-08-12 20:25 . 2008-04-14 12:00 442984 ----a-w- c:\windows\system32\perfh005.dat
2010-07-22 15:46 . 2008-04-14 12:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 06:19 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-06-30 12:33 . 2008-04-14 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2009-01-15 17:47 . 2009-01-15 17:47 112634569 ----a-w- c:\program files\openofficeorg1.cab
2009-01-15 17:43 . 2009-01-15 17:43 1821008 ----a-w- c:\program files\instmsiw.exe
2009-01-15 17:43 . 2009-01-15 17:43 1707856 ----a-w- c:\program files\instmsia.exe
2009-01-15 17:43 . 2009-01-15 17:43 9296384 ----a-w- c:\program files\openofficeorg30.msi
2009-01-15 17:43 . 2009-01-15 17:43 336 ----a-w- c:\program files\setup.ini
.

------- Sigcheck -------

[-] 2009-08-10 18:22 . C3A2915C71AE6F225EB906C25CCD29B5 . 24064 . . [1.0.0.5] . . c:\windows\system32\dllcache\ctfmon.exe
[-] 2009-08-10 18:22 . C3A2915C71AE6F225EB906C25CCD29B5 . 24064 . . [1.0.0.5] . . c:\windows\system32\ctfmon.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-09-05 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2010-09-20 2183680]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2009-08-10 24064]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2009-08-10 18:22 24064 ----a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2007-01-08 20:17 52256 ----a-w- c:\program files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU]
2007-02-26 08:40 249856 ----a-w- c:\program files\lg_fwupdate\fwupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2008-01-24 10:32 2289664 ----a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 06:52 1695232 ------w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2008-02-27 11:03 570664 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2007-03-14 19:01 71216 ------w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2008-01-21 10:17 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-07-02 10:26 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NMIndexingService"=3 (0x3)
"IDriverT"=3 (0x3)
"gusvc"=2 (0x2)
"gupdate1c9faffc1c539a5"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"\\\\macek\\storage\\Instalace\\!predinstalace\\Nero CZ a Power DVD\\CDS\\Nero\\Installation\\SetupX.exe"=
"c:\\Program Files\\SEGA\\SEGA Rally\\SEGA Rally.exe"=
"c:\\Program Files\\SEGA\\SEGA Rally\\SEGA Rally_SSE1.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\ProgramData\\World of Warcraft\\Repair.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Counter-Strike Source\\hl2.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"c:\\Program Files\\Alwil Software\\Avast5\\AvastUI.exe"=
"c:\\Program Files\\Spyware Terminator\\SpyWareTerminator.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [5.9.2010 18:37 165584]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [5.9.2010 18:55 142592]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5.9.2010 18:37 17744]
S2 gupdate1c9faffc1c539a5;Služba Google Update (gupdate1c9faffc1c539a5);c:\program files\Google\Update\GoogleUpdate.exe [2.7.2009 12:27 133104]
S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\Garena\plugins\UI\safedrv.sys --> c:\program files\Garena\plugins\UI\safedrv.sys [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [24.8.2009 14:19 721904]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-01-24 10:30 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'

2010-09-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-02 10:27]

2010-09-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-02 10:27]

2010-09-25 c:\windows\Tasks\User_Feed_Synchronization-{A2061C48-FAE3-4493-BA3C-D293A9690810}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://puvodni.centrum.cz/
IE: &Download All by FlashGet - c:\program files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm
IE: &Download by FlashGet - c:\program files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm
IE: Crawler Search - tbr:iemenu
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\documents and settings\Uživatel\Data aplikací\Mozilla\Firefox\Profiles\bmnurbgq.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.crawler.com/homepage.aspx?tbid=60347
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx? ... 60347&qkw=
FF - component: c:\documents and settings\Uživatel\Data aplikací\Mozilla\Firefox\Profiles\bmnurbgq.default\extensions\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Uživatel\Data aplikací\Mozilla\Firefox\Profiles\bmnurbgq.default\extensions\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}\components\RadioWMPCore.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xcomm.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xshared.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xsupport.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xwsg.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-26 12:58
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(624)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1016)
c:\windows\system32\webcheck.dll
.
Celkový čas: 2010-09-26 13:00:31
ComboFix-quarantined-files.txt 2010-09-26 11:00
ComboFix2.txt 2010-09-25 22:42
ComboFix3.txt 2010-09-05 10:24

Před spuštěním: Volných bajtů: 49 646 288 896
Po spuštění: Volných bajtů: 49 635 233 792

- - End Of File - - 296CED4A28C5C6EEA3D4F88DE221BA88

[Rudy]

Log vypadá čistý.

[Thrall]

Log vypadá čistý.

A co s tim co zablokova Avast! ? Byly to nejake instalacky atd..co jsem mel na zalohovane ploše..když je vyhodim z trezoru nemuže mi to vymazat ještě něco ze zálohy?

[Rudy]

Avast blokuje přístup viru do PC. Zálohy to nesmaže.

[Thrall]

Avast blokuje přístup viru do PC. Zálohy to nesmaže.

Ale vy jste rikal ze to viry nebyli ze to byl MBAM . Tak asi pro jistotu to mam z truhly smazat, ne?
Viz.:

Ale to není havěť. Avast si pouze zablokoval svého "konkurenta" a takto ho označil.

[Thrall]

Avast blokuje přístup viru do PC. Zálohy to nesmaže.

Ale vy jste rikal ze to viry nebyli ze to byl MBAM . Tak asi pro jistotu to mam z truhly smazat, ne?
Viz.:

Ale to není havěť. Avast si pouze zablokoval svého "konkurenta" a takto ho označil.

Mám to teda pro jistotu z truhly smazat ?

[Rudy]

Truhlu smažte, i když virus je v ní neškodný.

[Thrall]

Truhlu smažte, i když virus je v ní neškodný.

Tak a to asi bude všechno.
Chtěl bych vám poděkovat za ochotu.
Velmi jste mi pomohl.


Ještě jednou děkuji a naschledanou.

[Rudy]

Rádo se stalo!