fraudpack.kva.39 - sshnas21.dll

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
kotelna15
Návštěvník
Návštěvník
Příspěvky: 24
Registrován: 16 Led 2008 14:31
Kontaktovat uživatele:
Kontaktovat uživatele kotelna15

fraudpack.kva.39 - sshnas21.dll

#1 Příspěvek od kotelna15 »

Ahoj.
Mám antivir Avira a ten mi dnes nahlásil vir v názvu tématu umístěný v system32. Tak jsem dal přesun do karantény a tak bych se chtěl poradit co bych stím měl dělat? NTB jsem od uzamčení viru do karantény nerestartoval.
Děkuji za pomoc.
Přikládám Vám zde log z RSIT - HJT:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Administrator at 2010-10-05 22:38:18
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 23 GB (34%) free of 68 GB
Total RAM: 991 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:38:27, on 5.10.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\Program Files\Acronis\DiskDirector\OSS\reinstall_svc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ATK0100\HControl.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Hard Disk Sentinel\HDSentinel.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ACEngSvr.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\avira\antivir desktop\avcenter.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Administrator\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/skins7/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [ACMON] "C:\Program Files\ASUS\Splendid\ACMON.exe"
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Hard Disk Sentinel] "C:\Program Files\Hard Disk Sentinel\HDSentinel.exe" /AUTORUN
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: Aktivátor Správce výběru OS Acronis (Správce výběru OS) - Unknown owner - C:\Program Files\Acronis\DiskDirector\OSS\reinstall_svc.exe

--
End of file - 8166 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AWC Update.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-839522115-1326574676-1417001333-500Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-839522115-1326574676-1417001333-500UA.job
C:\WINDOWS\tasks\SmartDefrag.job
C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08 804136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-07-22 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-07-22 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-04-13 1018616]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"HControl"=C:\WINDOWS\ATK0100\HControl.exe [2006-10-14 110592]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2006-11-10 90112]
"ACMON"=C:\Program Files\ASUS\Splendid\ACMON.exe [2007-01-16 843776]
"Power_Gear"=C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe [2006-07-26 90112]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2010-03-02 282792]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-08-10 421888]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2010-09-01 421160]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Hard Disk Sentinel"=C:\Program Files\Hard Disk Sentinel\HDSentinel.exe [2010-09-11 3850752]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Google Update"=C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2010-09-06 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-07-04 161064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2007-07-04 118784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoResolveSearch"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\ICQ7.2\ICQ.exe"="C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2"
"C:\Program Files\ICQ7.2\aolload.exe"="C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\totalcmd\TOTALCMD.EXE"="C:\Program Files\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Documents and Settings\Administrator\Plocha\Hack WI-FI\aircrack-ng-1.1-win\bin\buddy-ng.exe"="C:\Documents and Settings\Administrator\Plocha\Hack WI-FI\aircrack-ng-1.1-win\bin\buddy-ng.exe:*:Enabled:buddy-ng"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Documents and Settings\Administrator\Plocha\uConfig.exe"="C:\Documents and Settings\Administrator\Plocha\uConfig.exe:*:Enabled:uConfig"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Firefox"
"C:\Program Files\FlatOut2\FlatOut2.exe"="C:\Program Files\FlatOut2\FlatOut2.exe:*:Enabled:FlatOut2"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.2\ICQ.exe"="C:\Program Files\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2"
"C:\Program Files\ICQ7.2\aolload.exe"="C:\Program Files\ICQ7.2\aolload.exe:*:Enabled:aolload.exe"

======List of files/folders created in the last 1 months======

2010-10-05 22:38:19 ----D---- C:\Program Files\trend micro
2010-10-05 22:38:18 ----D---- C:\rsit
2010-10-05 07:41:09 ----A---- C:\wepkeys.txt
2010-10-03 23:30:53 ----D---- C:\Documents and Settings\Administrator\Data aplikací\HD Tune Pro
2010-10-03 23:29:27 ----D---- C:\Program Files\Xenocode
2010-10-03 23:28:48 ----D---- C:\Program Files\HD Tune Pro
2010-10-03 23:25:37 ----A---- C:\WINDOWS\Ipytia.exe
2010-09-30 22:53:39 ----D---- C:\WINDOWS\Acronis
2010-09-29 18:00:21 ----HDC---- C:\WINDOWS\$NtUninstallKB2158563$
2010-09-28 22:09:23 ----D---- C:\Program Files\FlatOut2
2010-09-26 10:05:01 ----D---- C:\Documents and Settings\All Users\Data aplikací\Acronis
2010-09-25 18:58:36 ----A---- C:\WINDOWS\system32\drivers\snapman.sys
2010-09-25 18:57:52 ----D---- C:\Program Files\Acronis
2010-09-25 18:57:48 ----D---- C:\Program Files\Common Files\Acronis
2010-09-15 22:32:08 ----D---- C:\WINDOWS\Performance
2010-09-15 22:31:41 ----D---- C:\Program Files\Microsoft Windows 7 Upgrade Advisor
2010-09-15 18:14:07 ----HDC---- C:\WINDOWS\$NtUninstallKB2124261$
2010-09-15 18:13:32 ----HDC---- C:\WINDOWS\$NtUninstallKB2259922$
2010-09-15 18:13:03 ----HDC---- C:\WINDOWS\$NtUninstallKB975558_WM8$
2010-09-15 18:12:44 ----HDC---- C:\WINDOWS\$NtUninstallKB2347290$
2010-09-15 18:12:19 ----HDC---- C:\WINDOWS\$NtUninstallKB2121546$
2010-09-15 18:11:50 ----HDC---- C:\WINDOWS\$NtUninstallKB982802$
2010-09-15 18:11:13 ----HDC---- C:\WINDOWS\$NtUninstallKB2290570$
2010-09-15 18:10:46 ----HDC---- C:\WINDOWS\$NtUninstallKB981322$
2010-09-15 18:02:25 ----HDC---- C:\WINDOWS\$NtUninstallKB2141007$
2010-09-11 19:44:08 ----D---- C:\Program Files\Hard Disk Sentinel
2010-09-10 12:24:08 ----HDC---- C:\WINDOWS\$NtUninstallWdf01005$

======List of files/folders modified in the last 1 months======

2010-10-05 22:38:28 ----D---- C:\WINDOWS\Prefetch
2010-10-05 22:38:19 ----RD---- C:\Program Files
2010-10-05 22:20:25 ----D---- C:\Documents and Settings\Administrator\Data aplikací\uTorrent
2010-10-05 22:18:33 ----D---- C:\WINDOWS\Temp
2010-10-05 22:18:24 ----D---- C:\WINDOWS\system32\NtmsData
2010-10-05 22:18:08 ----AD---- C:\WINDOWS\system32
2010-10-05 22:17:14 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-10-05 22:17:08 ----D---- C:\WINDOWS\system32\inetsrv
2010-10-05 07:42:10 ----SD---- C:\WINDOWS\Tasks
2010-10-04 19:48:21 ----D---- C:\Documents and Settings\Administrator\Data aplikací\ICQ
2010-10-03 23:30:06 ----SHD---- C:\System Volume Information
2010-10-03 23:29:53 ----D---- C:\WINDOWS\Registration
2010-10-03 23:25:37 ----D---- C:\WINDOWS
2010-10-03 22:50:47 ----A---- C:\WINDOWS\NeroDigital.ini
2010-10-03 17:28:15 ----A---- C:\moduleName.txt
2010-10-03 11:35:36 ----D---- C:\WINDOWS\system32\CatRoot2
2010-10-01 18:35:41 ----D---- C:\WINDOWS\Microsoft.NET
2010-10-01 18:35:30 ----RSD---- C:\WINDOWS\assembly
2010-10-01 18:10:38 ----SHD---- C:\WINDOWS\Installer
2010-10-01 18:06:13 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-10-01 18:03:44 ----D---- C:\WINDOWS\WinSxS
2010-09-29 23:19:33 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Skype
2010-09-29 18:00:28 ----HD---- C:\WINDOWS\inf
2010-09-29 16:00:30 ----D---- C:\Documents and Settings\Administrator\Data aplikací\skypePM
2010-09-28 22:45:14 ----D---- C:\WINDOWS\system32\DirectX
2010-09-27 14:10:07 ----D---- C:\Documents and Settings\Administrator\Data aplikací\dvdcss
2010-09-27 13:00:47 ----D---- C:\Program Files\uTorrent
2010-09-25 18:58:43 ----D---- C:\WINDOWS\system32\drivers
2010-09-25 18:57:48 ----D---- C:\Program Files\Common Files
2010-09-24 21:02:08 ----SHD---- C:\WINDOWS\CSC
2010-09-23 23:39:49 ----A---- C:\LOGFILE.TXT
2010-09-17 21:30:34 ----D---- C:\Program Files\Mozilla Firefox
2010-09-15 22:25:23 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-09-15 18:14:23 ----A---- C:\WINDOWS\imsins.BAK
2010-09-15 18:14:13 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-09-15 18:13:26 ----HD---- C:\WINDOWS\$hf_mig$
2010-09-15 18:03:45 ----A---- C:\WINDOWS\system32\MRT.exe
2010-09-07 22:44:24 ----D---- C:\Documents and Settings\Administrator\Data aplikací\IObit
2010-09-07 22:44:23 ----D---- C:\Program Files\IObit

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 risdptsk;risdptsk; C:\WINDOWS\system32\DRIVERS\risdptsk.sys [2005-07-14 27904]
R0 snapman;Acronis Snapshots Manager; C:\WINDOWS\system32\DRIVERS\snapman.sys [2010-09-25 170080]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-07-22 691696]
R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2010-03-01 124784]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R1 Tcpip6;Ovladač protokolu Microsoft IPv6; C:\WINDOWS\system32\DRIVERS\tcpip6.sys [2010-02-11 226880]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2010-02-16 60936]
R2 ghaio;ghaio; \??\C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys []
R3 ASNDIS5;ASNDIS5 Protocol Driver; \??\C:\WINDOWS\ATK0100\ASNDIS5.SYS []
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2007-07-04 2304000]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ATKACPI.sys [2007-08-28 5760]
R3 rimsptsk;rimsptsk; C:\WINDOWS\system32\DRIVERS\rimsptsk.sys [2005-07-12 51328]
R3 TS_AR5416;[CommView] Atheros AR5008 Wireless Network Adapter Service 7.7; C:\WINDOWS\system32\DRIVERS\ts_athw.sys [2010-03-02 1605864]
R3 tunmp;Microsoft Tun Miniport Adapter Driver; C:\WINDOWS\system32\DRIVERS\tunmp.sys [2008-04-14 12288]
S0 BTHidMgr;Bluetooth HID Manager Service; C:\WINDOWS\System32\Drivers\BTHidMgr.sys []
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 AR5211;Atheros Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2006-07-17 494080]
S3 aylp8nhr;aylp8nhr; C:\WINDOWS\system32\drivers\aylp8nhr.sys []
S3 BlueletAudio;Bluetooth Audio Service; C:\WINDOWS\system32\DRIVERS\blueletaudio.sys []
S3 BlueletSCOAudio;Bluetooth SCO Audio Service; C:\WINDOWS\system32\DRIVERS\BlueletSCOAudio.sys []
S3 BT;Bluetooth PAN Network Adapter; C:\WINDOWS\system32\DRIVERS\btnetdrv.sys []
S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:\WINDOWS\System32\Drivers\btcusb.sys []
S3 BTHidEnum;Bluetooth HID Enumerator; C:\WINDOWS\system32\DRIVERS\vbtenum.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 CV2K1;CommView Network Monitor; C:\WINDOWS\system32\DRIVERS\cv2k1.sys []
S3 ggflt;SEMC USB Flash Driver Filter; C:\WINDOWS\system32\DRIVERS\ggflt.sys [2007-09-25 13352]
S3 ggsemc;SEMC USB Flash Driver; C:\WINDOWS\system32\DRIVERS\ggsemc.sys [2007-09-25 20520]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-10-25 5888]
S3 RT61;Hawking HWPG1 Wireless Driver; C:\WINDOWS\system32\DRIVERS\RT61.sys [2005-10-27 356096]
S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-14 79232]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 VComm;Virtual Serial port driver; C:\WINDOWS\system32\DRIVERS\VComm.sys []
S3 VcommMgr;Bluetooth VComm Manager Service; C:\WINDOWS\System32\Drivers\VcommMgr.sys []
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 wlags48d;Agere Wireless PCCard Service; C:\WINDOWS\system32\DRIVERS\wlags48d.sys [2003-09-22 154624]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2010-07-22 267432]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-08-13 144672]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2007-07-04 483328]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2010-07-27 345376]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-04-13 246520]
R2 IISADMIN;Správa služby IIS; C:\WINDOWS\system32\inetsrv\inetinfo.exe [2008-04-14 15872]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-07-22 153376]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-06-28 79136]
R2 spmgr;spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [2006-12-28 123248]
R2 Správce výběru OS;Aktivátor Správce výběru OS Acronis; C:\Program Files\Acronis\DiskDirector\OSS\reinstall_svc.exe [2010-07-07 2156952]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
R2 W3SVC;Publikování na webu; C:\WINDOWS\system32\inetsrv\inetinfo.exe [2008-04-14 15872]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2010-09-01 820008]
S2 6to4;Pomocná služba protokolu IPv6; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 SSHNAS;SSHNAS; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-07-04 779560]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-07-04 267560]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: fraudpack.kva.39 - sshnas21.dll

#2 Příspěvek od vyosek »

Zdravim a pekny den preji :)

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
:arrow: Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
  • Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
  • Vložte do PC vsechny USB klice (flash disky, ext.disky apod.)
  • Pokud mate Win XP spustte pod uctem Spravce\Administratora
  • Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
  • Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
  • Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
  • Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
  • Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
  • Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
  • Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
kotelna15
Návštěvník
Návštěvník
Příspěvky: 24
Registrován: 16 Led 2008 14:31
Kontaktovat uživatele:
Kontaktovat uživatele kotelna15

Re: fraudpack.kva.39 - sshnas21.dll

#3 Příspěvek od kotelna15 »

Ahoj.
Tady je log:

ComboFix 10-10-05.06 - Administrator 06.10.2010 22:17:45.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.991.634 [GMT 3:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Cache
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SSHNAS
-------\Service_SSHNAS


((((((((((((((((((((((((( Soubory vytvořené od 2010-09-06 do 2010-10-06 )))))))))))))))))))))))))))))))
.

2010-10-05 19:38 . 2010-10-05 19:38 -------- d-----w- c:\program files\trend micro
2010-10-05 19:38 . 2010-10-05 19:38 -------- d-----w- C:\rsit
2010-10-03 20:29 . 2010-10-03 20:29 -------- d-----w- c:\program files\Xenocode
2010-10-03 20:28 . 2010-10-03 20:28 -------- d-----w- c:\program files\HD Tune Pro
2010-10-03 20:25 . 2010-10-03 20:25 201728 ----a-w- c:\windows\Ipytia.exe
2010-09-30 19:53 . 2010-09-30 21:01 -------- d-----w- c:\windows\Acronis
2010-09-28 19:09 . 2010-09-28 19:39 -------- d-----w- c:\program files\FlatOut2
2010-09-25 15:58 . 2010-09-25 15:58 170080 ----a-w- c:\windows\system32\drivers\snapman.sys
2010-09-25 15:57 . 2010-09-25 15:57 -------- d-----w- c:\program files\Acronis
2010-09-25 15:57 . 2010-09-25 15:58 -------- d-----w- c:\program files\Common Files\Acronis
2010-09-18 14:56 . 2010-06-29 21:13 52224 ----a-w- c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
2010-09-18 14:56 . 2010-06-29 21:13 101376 ----a-w- c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
2010-09-15 19:32 . 2010-09-15 19:32 -------- d-----w- c:\windows\Performance
2010-09-15 19:31 . 2010-09-15 19:31 -------- d-----w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2010-09-11 16:44 . 2010-10-06 11:53 -------- d-----w- c:\program files\Hard Disk Sentinel

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-05 20:45 . 2010-07-22 20:39 1 ----a-w- c:\documents and settings\Administrator\Data aplikací\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-10-01 15:06 . 2001-10-25 14:00 94564 ----a-w- c:\windows\system32\perfc005.dat
2010-10-01 15:06 . 2001-10-25 14:00 483846 ----a-w- c:\windows\system32\perfh005.dat
2010-09-27 10:00 . 2010-07-22 20:24 -------- d-----w- c:\program files\uTorrent
2010-09-10 09:24 . 2010-09-10 09:24 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf
2010-09-10 09:24 . 2010-09-10 09:24 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-09-07 19:44 . 2010-07-29 20:03 -------- d-----w- c:\program files\IObit
2010-09-05 09:19 . 2010-08-21 20:00 -------- d-----w- c:\program files\Safari
2010-09-05 09:18 . 2010-09-05 09:18 72488 ----a-w- c:\documents and settings\All Users\Data aplikací\Apple Computer\Installer Cache\Safari 5.33.17.8\SetupAdmin.exe
2010-09-05 09:18 . 2010-09-05 09:16 -------- d-----w- c:\program files\iTunes
2010-09-05 09:16 . 2010-09-05 09:16 -------- d-----w- c:\program files\iPod
2010-09-05 09:16 . 2010-08-17 18:55 -------- d-----w- c:\program files\Common Files\Apple
2010-09-05 09:13 . 2010-09-05 09:12 -------- d-----w- c:\program files\QuickTime
2010-09-05 09:09 . 2010-09-05 09:09 -------- d-----w- c:\program files\Bonjour
2010-09-05 09:07 . 2010-09-05 09:07 73000 ----a-w- c:\documents and settings\All Users\Data aplikací\Apple Computer\Installer Cache\iTunes 10.0.0.68\SetupAdmin.exe
2010-08-25 09:49 . 2010-07-22 16:23 -------- d-----w- c:\program files\ICQ7.2
2010-08-25 09:06 . 2010-08-25 09:06 17020 ---ha-w- c:\windows\system32\mlfcache.dat
2010-08-20 18:37 . 2010-08-02 08:52 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-08-17 18:56 . 2010-08-17 18:56 -------- d-----w- c:\program files\Apple Software Update
2010-08-17 13:17 . 2008-04-14 06:52 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-07-29 08:59 . 2010-07-29 08:59 299008 ----a-w- c:\documents and settings\All Users\Data aplikací\LangSoft\TrnWord.dll
2010-07-29 08:59 . 2010-07-29 08:59 798771 ----a-w- c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
2010-07-29 08:59 . 2010-07-29 08:59 356352 ----a-w- c:\documents and settings\All Users\Data aplikací\LangSoft\TrnOutl.dll
2010-07-28 21:49 . 2010-07-22 12:23 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-07-28 21:49 . 2010-07-22 12:23 2426 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-07-28 21:45 . 2010-07-22 12:23 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-07-27 15:44 . 2010-07-27 15:44 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-07-27 15:44 . 2010-07-27 15:44 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-07-22 16:03 . 2010-07-22 16:03 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-07-22 16:00 . 2010-07-22 16:00 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-07-22 15:50 . 2010-07-22 15:50 737280 ----a-w- c:\windows\iun6002.exe
2010-07-22 15:46 . 2008-04-14 06:51 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 14:02 . 2010-07-22 14:02 0 ----a-w- c:\windows\nsreg.dat
2010-07-22 13:35 . 2010-07-22 13:35 503808 ----a-w- c:\documents and settings\Administrator\Data aplikací\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6c19f930-n\msvcp71.dll
2010-07-22 13:35 . 2010-07-22 13:35 499712 ----a-w- c:\documents and settings\Administrator\Data aplikací\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6c19f930-n\jmc.dll
2010-07-22 13:35 . 2010-07-22 13:35 348160 ----a-w- c:\documents and settings\Administrator\Data aplikací\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6c19f930-n\msvcr71.dll
2010-07-22 13:35 . 2010-07-22 13:35 61440 ----a-w- c:\documents and settings\Administrator\Data aplikací\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7fcc0a27-n\decora-sse.dll
2010-07-22 13:35 . 2010-07-22 13:35 12800 ----a-w- c:\documents and settings\Administrator\Data aplikací\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7fcc0a27-n\decora-d3d.dll
2010-07-22 13:34 . 2010-07-22 13:34 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{2D50DC1F-FCEC-D970-1DFB-E73CF2404451}\ARPPRODUCTICON.exe
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{97F5E039-D2F5-18C0-F0C9-6981F73514CC}\ARPPRODUCTICON.exe
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{5B464CAC-76BD-BDBB-8066-318D05D171DF}\ARPPRODUCTICON.exe
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{2C6D0ACD-DD2B-BFE5-A005-53AFD4AA3175}\ARPPRODUCTICON.exe
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{84C89CF4-F64E-6820-375C-24963DDF99C9}\ARPPRODUCTICON.exe
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{0AD37499-3D5D-12F0-EBEA-46EE9AD02DBF}\ARPPRODUCTICON.exe
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{4B50D80D-A482-DECD-B584-EB054EBA878A}\ARPPRODUCTICON.exe
2010-07-22 12:20 . 2010-07-22 12:20 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-07-22 06:19 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
.

------- Sigcheck -------

[-] 2009-08-31 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Administrator\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2010-09-06 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="c:\windows\ATK0100\HControl.exe" [2006-10-14 110592]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2007-01-16 843776]
"Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2006-07-26 90112]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Hard Disk Sentinel"="c:\program files\Hard Disk Sentinel\HDSentinel.exe" [2010-09-11 3850752]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 06:52 1695232 ------w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-07-04 12:20 161064 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"c:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Documents and Settings\\Administrator\\Plocha\\Hack WI-FI\\aircrack-ng-1.1-win\\bin\\buddy-ng.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Administrator\\Plocha\\uConfig.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\FlatOut2\\FlatOut2.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [22.7.2010 21:05 135336]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [22.7.2010 19:32 246520]
R2 Správce výběru OS;Aktivátor Správce výběru OS Acronis;c:\program files\Acronis\DiskDirector\OSS\reinstall_svc.exe [7.7.2010 16:17 2156952]
R3 TS_AR5416;[CommView] Atheros AR5008 Wireless Network Adapter Service 7.7;c:\windows\system32\drivers\ts_athw.sys [1.8.2010 17:30 1605864]
S3 CV2K1;CommView Network Monitor;c:\windows\system32\DRIVERS\cv2k1.sys --> c:\windows\system32\DRIVERS\cv2k1.sys [?]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [23.7.2010 22:04 13352]
S3 wlags48d;Agere Wireless PCCard Service;c:\windows\system32\drivers\wlags48d.sys [31.7.2010 15:13 154624]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [22.7.2010 19:00 691696]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-06-20 10:47 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'

2010-10-04 c:\windows\Tasks\AWC Update.job
- c:\program files\IObit\Advanced SystemCare 3\IObitUpdate.exe [2010-07-29 08:08]

2010-09-27 c:\windows\Tasks\SmartDefrag.job
- c:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2010-09-07 15:08]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/skins7/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=skins7&tb_ver=2.0.0.2&q=
FF - component: c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\extensions\{003D3EDC-99B9-4a34-9C20-60CB94F7E829}\components\nsWebFF15.dll
FF - component: c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-839522115-1326574676-1417001333-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,dd,bd,66,19,ae,57,87,40,87,22,c4,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,dd,bd,66,19,ae,57,87,40,87,22,c4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(668)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2564)
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\windows\system32\ACEngSvr.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\ASUS\NB Probe\SPM\spmgr.exe
c:\windows\system32\wdfmgr.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\ATK0100\ATKOSD.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Celkový čas: 2010-10-06 22:28:19 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-10-06 19:28

Před spuštěním: Volných bajtů: 24 394 420 224
Po spuštění: Volných bajtů: 24 616 468 480

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 9E0B96D461C5C719D84E6A85F9DCD6CF
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: fraudpack.kva.39 - sshnas21.dll

#4 Příspěvek od vyosek »

Co je prosim tohle "c:\\Documents and Settings\\Administrator\\Plocha\\Hack WI-FI\\aircrack-ng-1.1-win\\bin\\buddy-ng.exe"=

:arrow: Pokud nemate, tak presunte Combofix na plochu
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    Folder::
C:\Program Files\ICQ6Toolbar

Driver::
ICQ Service

File::
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-839522115-1326574676-1417001333-500Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-839522115-1326574676-1417001333-500UA.job
C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{855F3B16-6D32-4FE6-8A56-BBB695989046}"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=-
"iTunesHelper"=-
"Adobe Reader Speed Launcher"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

DDS::
uStart Page = hxxp://start.icq.com/skins7/

FireFox::
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... 2.0.0.2&q=

RegLock::
[HKEY_USERS\S-1-5-21-839522115-1326574676-1417001333-500\Software\Microsoft\Internet Explorer\User Preferences]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
  • Ulozte vytvoreny TXT jako CFScript.txt
  • Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
    Obrázek
  • Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte
:arrow: Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
kotelna15
Návštěvník
Návštěvník
Příspěvky: 24
Registrován: 16 Led 2008 14:31
Kontaktovat uživatele:
Kontaktovat uživatele kotelna15

Re: fraudpack.kva.39 - sshnas21.dll

#5 Příspěvek od kotelna15 »

Co je to za program to nevím ale je to součástí balíku na unpacking paket z mé WI-FI sítě.
Přikládám log:

ComboFix 10-10-05.06 - Administrator 06.10.2010 22:50:51.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.991.477 [GMT 3:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job"
"c:\windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job"
"c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-839522115-1326574676-1417001333-500Core.job"
"c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-839522115-1326574676-1417001333-500UA.job"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\ICQ6Toolbar
c:\program files\ICQ6Toolbar\config.xml
c:\program files\ICQ6Toolbar\Icons.bmp
c:\program files\ICQ6Toolbar\ICQ Service.exe
c:\program files\ICQ6Toolbar\icq6Toolbar.ico
c:\program files\ICQ6Toolbar\ICQToolBar.dll
c:\program files\ICQ6Toolbar\ICQUnToolbar.exe
c:\program files\ICQ6Toolbar\logo_small.gif
c:\program files\ICQ6Toolbar\ServiceStarter.exe
c:\program files\ICQ6Toolbar\short.wav
c:\program files\ICQ6Toolbar\Version.txt

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ICQ_SERVICE
-------\Service_ICQ Service


((((((((((((((((((((((((( Soubory vytvořené od 2010-09-06 do 2010-10-06 )))))))))))))))))))))))))))))))
.

2010-10-05 19:38 . 2010-10-05 19:38 -------- d-----w- c:\program files\trend micro
2010-10-05 19:38 . 2010-10-05 19:38 -------- d-----w- C:\rsit
2010-10-03 20:29 . 2010-10-03 20:29 -------- d-----w- c:\program files\Xenocode
2010-10-03 20:28 . 2010-10-03 20:28 -------- d-----w- c:\program files\HD Tune Pro
2010-10-03 20:25 . 2010-10-03 20:25 201728 ----a-w- c:\windows\Ipytia.exe
2010-09-30 19:53 . 2010-09-30 21:01 -------- d-----w- c:\windows\Acronis
2010-09-28 19:09 . 2010-09-28 19:39 -------- d-----w- c:\program files\FlatOut2
2010-09-25 15:58 . 2010-09-25 15:58 170080 ----a-w- c:\windows\system32\drivers\snapman.sys
2010-09-25 15:57 . 2010-09-25 15:57 -------- d-----w- c:\program files\Acronis
2010-09-25 15:57 . 2010-09-25 15:58 -------- d-----w- c:\program files\Common Files\Acronis
2010-09-18 14:56 . 2010-06-29 21:13 52224 ----a-w- c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
2010-09-18 14:56 . 2010-06-29 21:13 101376 ----a-w- c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
2010-09-15 19:32 . 2010-09-15 19:32 -------- d-----w- c:\windows\Performance
2010-09-15 19:31 . 2010-09-15 19:31 -------- d-----w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2010-09-11 16:44 . 2010-10-06 11:53 -------- d-----w- c:\program files\Hard Disk Sentinel

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-05 20:45 . 2010-07-22 20:39 1 ----a-w- c:\documents and settings\Administrator\Data aplikací\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-10-01 15:06 . 2001-10-25 14:00 94564 ----a-w- c:\windows\system32\perfc005.dat
2010-10-01 15:06 . 2001-10-25 14:00 483846 ----a-w- c:\windows\system32\perfh005.dat
2010-09-27 10:00 . 2010-07-22 20:24 -------- d-----w- c:\program files\uTorrent
2010-09-10 09:24 . 2010-09-10 09:24 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf
2010-09-10 09:24 . 2010-09-10 09:24 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-09-07 19:44 . 2010-07-29 20:03 -------- d-----w- c:\program files\IObit
2010-09-05 09:19 . 2010-08-21 20:00 -------- d-----w- c:\program files\Safari
2010-09-05 09:18 . 2010-09-05 09:18 72488 ----a-w- c:\documents and settings\All Users\Data aplikací\Apple Computer\Installer Cache\Safari 5.33.17.8\SetupAdmin.exe
2010-09-05 09:18 . 2010-09-05 09:16 -------- d-----w- c:\program files\iTunes
2010-09-05 09:16 . 2010-09-05 09:16 -------- d-----w- c:\program files\iPod
2010-09-05 09:16 . 2010-08-17 18:55 -------- d-----w- c:\program files\Common Files\Apple
2010-09-05 09:13 . 2010-09-05 09:12 -------- d-----w- c:\program files\QuickTime
2010-09-05 09:09 . 2010-09-05 09:09 -------- d-----w- c:\program files\Bonjour
2010-09-05 09:07 . 2010-09-05 09:07 73000 ----a-w- c:\documents and settings\All Users\Data aplikací\Apple Computer\Installer Cache\iTunes 10.0.0.68\SetupAdmin.exe
2010-08-25 09:49 . 2010-07-22 16:23 -------- d-----w- c:\program files\ICQ7.2
2010-08-25 09:06 . 2010-08-25 09:06 17020 ---ha-w- c:\windows\system32\mlfcache.dat
2010-08-20 18:37 . 2010-08-02 08:52 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-08-17 18:56 . 2010-08-17 18:56 -------- d-----w- c:\program files\Apple Software Update
2010-08-17 13:17 . 2008-04-14 06:52 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-07-29 08:59 . 2010-07-29 08:59 299008 ----a-w- c:\documents and settings\All Users\Data aplikací\LangSoft\TrnWord.dll
2010-07-29 08:59 . 2010-07-29 08:59 798771 ----a-w- c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
2010-07-29 08:59 . 2010-07-29 08:59 356352 ----a-w- c:\documents and settings\All Users\Data aplikací\LangSoft\TrnOutl.dll
2010-07-28 21:49 . 2010-07-22 12:23 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-07-28 21:49 . 2010-07-22 12:23 2426 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-07-28 21:45 . 2010-07-22 12:23 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-07-27 15:44 . 2010-07-27 15:44 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-07-27 15:44 . 2010-07-27 15:44 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-07-22 16:03 . 2010-07-22 16:03 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-07-22 16:00 . 2010-07-22 16:00 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-07-22 15:50 . 2010-07-22 15:50 737280 ----a-w- c:\windows\iun6002.exe
2010-07-22 15:46 . 2008-04-14 06:51 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 14:02 . 2010-07-22 14:02 0 ----a-w- c:\windows\nsreg.dat
2010-07-22 13:35 . 2010-07-22 13:35 503808 ----a-w- c:\documents and settings\Administrator\Data aplikací\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6c19f930-n\msvcp71.dll
2010-07-22 13:35 . 2010-07-22 13:35 499712 ----a-w- c:\documents and settings\Administrator\Data aplikací\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6c19f930-n\jmc.dll
2010-07-22 13:35 . 2010-07-22 13:35 348160 ----a-w- c:\documents and settings\Administrator\Data aplikací\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6c19f930-n\msvcr71.dll
2010-07-22 13:35 . 2010-07-22 13:35 61440 ----a-w- c:\documents and settings\Administrator\Data aplikací\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7fcc0a27-n\decora-sse.dll
2010-07-22 13:35 . 2010-07-22 13:35 12800 ----a-w- c:\documents and settings\Administrator\Data aplikací\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7fcc0a27-n\decora-d3d.dll
2010-07-22 13:34 . 2010-07-22 13:34 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{2D50DC1F-FCEC-D970-1DFB-E73CF2404451}\ARPPRODUCTICON.exe
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{97F5E039-D2F5-18C0-F0C9-6981F73514CC}\ARPPRODUCTICON.exe
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{5B464CAC-76BD-BDBB-8066-318D05D171DF}\ARPPRODUCTICON.exe
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{2C6D0ACD-DD2B-BFE5-A005-53AFD4AA3175}\ARPPRODUCTICON.exe
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{84C89CF4-F64E-6820-375C-24963DDF99C9}\ARPPRODUCTICON.exe
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{0AD37499-3D5D-12F0-EBEA-46EE9AD02DBF}\ARPPRODUCTICON.exe
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{4B50D80D-A482-DECD-B584-EB054EBA878A}\ARPPRODUCTICON.exe
2010-07-22 12:20 . 2010-07-22 12:20 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-07-22 06:19 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
.

------- Sigcheck -------

[-] 2009-08-31 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-10-06_19.23.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-10-06 19:57 . 2010-10-06 19:57 16384 c:\windows\Temp\Perflib_Perfdata_228.dat
+ 2010-07-22 12:19 . 2010-10-06 19:57 211845 c:\windows\system32\inetsrv\MetaBase.bin
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="c:\windows\ATK0100\HControl.exe" [2006-10-14 110592]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2007-01-16 843776]
"Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2006-07-26 90112]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"Hard Disk Sentinel"="c:\program files\Hard Disk Sentinel\HDSentinel.exe" [2010-09-11 3850752]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"c:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Documents and Settings\\Administrator\\Plocha\\Hack WI-FI\\aircrack-ng-1.1-win\\bin\\buddy-ng.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Administrator\\Plocha\\uConfig.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\FlatOut2\\FlatOut2.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [22.7.2010 21:05 135336]
R2 Správce výběru OS;Aktivátor Správce výběru OS Acronis;c:\program files\Acronis\DiskDirector\OSS\reinstall_svc.exe [7.7.2010 16:17 2156952]
R3 TS_AR5416;[CommView] Atheros AR5008 Wireless Network Adapter Service 7.7;c:\windows\system32\drivers\ts_athw.sys [1.8.2010 17:30 1605864]
S3 CV2K1;CommView Network Monitor;c:\windows\system32\DRIVERS\cv2k1.sys --> c:\windows\system32\DRIVERS\cv2k1.sys [?]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [23.7.2010 22:04 13352]
S3 wlags48d;Agere Wireless PCCard Service;c:\windows\system32\drivers\wlags48d.sys [31.7.2010 15:13 154624]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [22.7.2010 19:00 691696]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-06-20 10:47 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - component: c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\extensions\{003D3EDC-99B9-4a34-9C20-60CB94F7E829}\components\nsWebFF15.dll
FF - component: c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-ICQToolbar - c:\program files\ICQ6Toolbar\ICQUnToolbar.exe


.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(668)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2180)
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\ASUS\NB Probe\SPM\spmgr.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\ACEngSvr.exe
c:\windows\ATK0100\ATKOSD.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Celkový čas: 2010-10-06 23:01:25 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-10-06 20:01
ComboFix2.txt 2010-10-06 19:28

Před spuštěním: Volných bajtů: 24 625 393 664
Po spuštění: Volných bajtů: 24 611 954 688

- - End Of File - - 8256DB9585DD647D27C9DE6FB8936C2D
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: fraudpack.kva.39 - sshnas21.dll

#6 Příspěvek od vyosek »

:arrow: Nasledujici soubory otestujte na VirusTotalu (viz muj podpis)
  • c:\windows\system32\sfcfiles.dll
  • Kliknete na Prochazet
  • Soubor nehledejte, jen vlozte cestu souboru, ktery chci otestovat
  • Pokud napise Soubor byl jiz testovan, dejte otestovat znovu
  • Kliknete na Otestovat soubor
  • Vysledek analyzy sem vlozte (jako odkaz)
vyosek napsal:Co je prosim tohle "c:\\Documents and Settings\\Administrator\\Plocha\\Hack WI-FI\\aircrack-ng-1.1-win\\bin\\buddy-ng.exe"=
:arrow: Jak se chova PC :???:
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
kotelna15
Návštěvník
Návštěvník
Příspěvky: 24
Registrován: 16 Led 2008 14:31
Kontaktovat uživatele:
Kontaktovat uživatele kotelna15

Re: fraudpack.kva.39 - sshnas21.dll

#7 Příspěvek od kotelna15 »

Tak test proběhl úspěšně.
http://www.virustotal.com/file-scan/rep ... 1286399922
Jinak na Vaši otázku ohledně toho programu jsem Vám již psal že nevím co je to zač jen vím že je to součástí programu na monitoring WI-FI.
Jinak při hledání toho souboru na otestování mi Avira začala hláásit vir ve Windows, přiložím pbrázek.
Naposledy upravil(a) kotelna15 dne 06 Říj 2010 22:26, celkem upraveno 1 x.
Nahoru
kotelna15
Návštěvník
Návštěvník
Příspěvky: 24
Registrován: 16 Led 2008 14:31
Kontaktovat uživatele:
Kontaktovat uživatele kotelna15

Re: fraudpack.kva.39 - sshnas21.dll

#8 Příspěvek od kotelna15 »

Obrázek hlášení.
Přílohy
Bez názvu.JPG
(28.26 KiB) Staženo 192 x
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: fraudpack.kva.39 - sshnas21.dll

#9 Příspěvek od vyosek »

:arrow: Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) (viz muj podpis)
  • Provedte aktualizaci - treti zalozka
  • Provedte uplny sken - nic nemazte :!:
  • MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
kotelna15
Návštěvník
Návštěvník
Příspěvky: 24
Registrován: 16 Led 2008 14:31
Kontaktovat uživatele:
Kontaktovat uživatele kotelna15

Re: fraudpack.kva.39 - sshnas21.dll

#10 Příspěvek od kotelna15 »

Tak sken proveden.
Jinak mi MBAM nenašel ten vir ve windows na který jsem Vám posílal obrázek.
Zde přikládám výpis z MBAM:

Malwarebytes' Anti-Malware 1.46
http://www.malwarebytes.org

Verze databáze: 4759

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

7.10.2010 0:28:04
mbam-log-2010-10-07 (00-28-04).txt

Typ skenu: Úplný sken (C:\|)
Skenované objekty: 185262
Uplynulý čas: 54 minuta(y), 11 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 2
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 3

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
HKEY_CURRENT_USER\SOFTWARE\JCFSE7V7Z1 (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\SMH2B46TDP (Trojan.FakeAlert) -> No action taken.

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Xenocode\Sandbox\1.0.0.0\2010.05.27T15.45\Virtual\STUBEXE\8.0.1112\@PROFILE@\Local Settings\Temp\Rar$EX06.265\khota.exe (Backdoor.Bifrose) -> No action taken.
C:\Documents and Settings\Administrator\Plocha\For mobile\FAR+JDF\Plugins\jdflasher\2020_52\qamaker.exe (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\Administrator\Data aplikací\chrtmp (Malware.Trace) -> No action taken.
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: fraudpack.kva.39 - sshnas21.dll

#11 Příspěvek od vyosek »

:arrow: Vse co nasel MBAM smazte

:arrow: TFC http://oldtimer.geekstogo.com/TFC.exe
  • Stahnete a spustte
  • Kliknete na Start a potvrdte OK
  • Program uklidi a restartuje pc
  • Po pouziti utilitu smazte
:arrow: Nasledujici soubory otestujte na VirusTotalu (viz muj podpis)
  • c:\windows\lpytia.exe
  • Kliknete na Prochazet
  • Soubor nehledejte, jen vlozte cestu souboru, ktery chci otestovat
  • Pokud napise Soubor byl jiz testovan, dejte otestovat znovu
  • Kliknete na Otestovat soubor
  • Vysledek analyzy sem vlozte (jako odkaz)
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
kotelna15
Návštěvník
Návštěvník
Příspěvky: 24
Registrován: 16 Led 2008 14:31
Kontaktovat uživatele:
Kontaktovat uživatele kotelna15

Re: fraudpack.kva.39 - sshnas21.dll

#12 Příspěvek od kotelna15 »

Vše provedeno. Virustotal hlásí 30/43.
http://www.virustotal.com/file-scan/rep ... 1286429357
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: fraudpack.kva.39 - sshnas21.dll

#13 Příspěvek od vyosek »

:arrow: Pokud nemate, tak presunte Combofix na plochu
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    Collect::
c:\windows\lpytia.exe
  • Ulozte vytvoreny TXT jako CFScript.txt
  • Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
    Obrázek
  • Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte
:arrow: Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
kotelna15
Návštěvník
Návštěvník
Příspěvky: 24
Registrován: 16 Led 2008 14:31
Kontaktovat uživatele:
Kontaktovat uživatele kotelna15

Re: fraudpack.kva.39 - sshnas21.dll

#14 Příspěvek od kotelna15 »

Provedeno.
Přikládám log:

ComboFix 10-10-06.02 - Administrator 07.10.2010 14:54:45.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.991.534 [GMT 3:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\hcdby.sys

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_kcnbiies


((((((((((((((((((((((((( Soubory vytvořené od 2010-09-07 do 2010-10-07 )))))))))))))))))))))))))))))))
.

2010-10-06 20:32 . 2010-04-29 12:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-06 20:32 . 2010-10-06 20:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-06 20:32 . 2010-04-29 12:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-05 19:38 . 2010-10-05 19:38 -------- d-----w- c:\program files\trend micro
2010-10-05 19:38 . 2010-10-05 19:38 -------- d-----w- C:\rsit
2010-10-03 20:29 . 2010-10-03 20:29 -------- d-----w- c:\program files\Xenocode
2010-10-03 20:28 . 2010-10-03 20:28 -------- d-----w- c:\program files\HD Tune Pro
2010-10-03 20:25 . 2010-10-03 20:25 201728 ----a-w- c:\windows\Ipytia.exe
2010-09-30 19:53 . 2010-09-30 21:01 -------- d-----w- c:\windows\Acronis
2010-09-28 19:09 . 2010-09-28 19:39 -------- d-----w- c:\program files\FlatOut2
2010-09-25 15:58 . 2010-09-25 15:58 170080 ----a-w- c:\windows\system32\drivers\snapman.sys
2010-09-25 15:57 . 2010-09-25 15:57 -------- d-----w- c:\program files\Acronis
2010-09-25 15:57 . 2010-09-25 15:58 -------- d-----w- c:\program files\Common Files\Acronis
2010-09-18 14:56 . 2010-06-29 21:13 52224 ----a-w- c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
2010-09-18 14:56 . 2010-06-29 21:13 101376 ----a-w- c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
2010-09-15 19:32 . 2010-09-15 19:32 -------- d-----w- c:\windows\Performance
2010-09-15 19:31 . 2010-09-15 19:31 -------- d-----w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2010-09-11 16:44 . 2010-10-06 11:53 -------- d-----w- c:\program files\Hard Disk Sentinel

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-05 20:45 . 2010-07-22 20:39 1 ----a-w- c:\documents and settings\Administrator\Data aplikací\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-10-01 15:06 . 2001-10-25 14:00 94564 ----a-w- c:\windows\system32\perfc005.dat
2010-10-01 15:06 . 2001-10-25 14:00 483846 ----a-w- c:\windows\system32\perfh005.dat
2010-09-27 10:00 . 2010-07-22 20:24 -------- d-----w- c:\program files\uTorrent
2010-09-10 09:24 . 2010-09-10 09:24 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf
2010-09-10 09:24 . 2010-09-10 09:24 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-09-07 19:44 . 2010-07-29 20:03 -------- d-----w- c:\program files\IObit
2010-09-05 09:19 . 2010-08-21 20:00 -------- d-----w- c:\program files\Safari
2010-09-05 09:18 . 2010-09-05 09:18 72488 ----a-w- c:\documents and settings\All Users\Data aplikací\Apple Computer\Installer Cache\Safari 5.33.17.8\SetupAdmin.exe
2010-09-05 09:18 . 2010-09-05 09:16 -------- d-----w- c:\program files\iTunes
2010-09-05 09:16 . 2010-09-05 09:16 -------- d-----w- c:\program files\iPod
2010-09-05 09:16 . 2010-08-17 18:55 -------- d-----w- c:\program files\Common Files\Apple
2010-09-05 09:13 . 2010-09-05 09:12 -------- d-----w- c:\program files\QuickTime
2010-09-05 09:09 . 2010-09-05 09:09 -------- d-----w- c:\program files\Bonjour
2010-09-05 09:07 . 2010-09-05 09:07 73000 ----a-w- c:\documents and settings\All Users\Data aplikací\Apple Computer\Installer Cache\iTunes 10.0.0.68\SetupAdmin.exe
2010-08-25 09:49 . 2010-07-22 16:23 -------- d-----w- c:\program files\ICQ7.2
2010-08-25 09:06 . 2010-08-25 09:06 17020 ---ha-w- c:\windows\system32\mlfcache.dat
2010-08-20 18:37 . 2010-08-02 08:52 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-08-17 18:56 . 2010-08-17 18:56 -------- d-----w- c:\program files\Apple Software Update
2010-08-17 13:17 . 2008-04-14 06:52 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-07-29 08:59 . 2010-07-29 08:59 299008 ----a-w- c:\documents and settings\All Users\Data aplikací\LangSoft\TrnWord.dll
2010-07-29 08:59 . 2010-07-29 08:59 798771 ----a-w- c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
2010-07-29 08:59 . 2010-07-29 08:59 356352 ----a-w- c:\documents and settings\All Users\Data aplikací\LangSoft\TrnOutl.dll
2010-07-28 21:49 . 2010-07-22 12:23 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-07-28 21:49 . 2010-07-22 12:23 2426 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-07-28 21:45 . 2010-07-22 12:23 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-07-27 15:44 . 2010-07-27 15:44 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-07-27 15:44 . 2010-07-27 15:44 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-07-22 16:03 . 2010-07-22 16:03 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-07-22 16:00 . 2010-07-22 16:00 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-07-22 15:50 . 2010-07-22 15:50 737280 ----a-w- c:\windows\iun6002.exe
2010-07-22 15:46 . 2008-04-14 06:51 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 14:02 . 2010-07-22 14:02 0 ----a-w- c:\windows\nsreg.dat
2010-07-22 13:35 . 2010-07-22 13:35 503808 ----a-w- c:\documents and settings\Administrator\Data aplikací\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6c19f930-n\msvcp71.dll
2010-07-22 13:35 . 2010-07-22 13:35 499712 ----a-w- c:\documents and settings\Administrator\Data aplikací\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6c19f930-n\jmc.dll
2010-07-22 13:35 . 2010-07-22 13:35 348160 ----a-w- c:\documents and settings\Administrator\Data aplikací\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6c19f930-n\msvcr71.dll
2010-07-22 13:35 . 2010-07-22 13:35 61440 ----a-w- c:\documents and settings\Administrator\Data aplikací\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7fcc0a27-n\decora-sse.dll
2010-07-22 13:35 . 2010-07-22 13:35 12800 ----a-w- c:\documents and settings\Administrator\Data aplikací\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-7fcc0a27-n\decora-d3d.dll
2010-07-22 13:34 . 2010-07-22 13:34 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{2D50DC1F-FCEC-D970-1DFB-E73CF2404451}\ARPPRODUCTICON.exe
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{97F5E039-D2F5-18C0-F0C9-6981F73514CC}\ARPPRODUCTICON.exe
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{5B464CAC-76BD-BDBB-8066-318D05D171DF}\ARPPRODUCTICON.exe
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{2C6D0ACD-DD2B-BFE5-A005-53AFD4AA3175}\ARPPRODUCTICON.exe
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{84C89CF4-F64E-6820-375C-24963DDF99C9}\ARPPRODUCTICON.exe
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{0AD37499-3D5D-12F0-EBEA-46EE9AD02DBF}\ARPPRODUCTICON.exe
2010-07-22 13:17 . 2010-07-22 13:17 10134 ----a-r- c:\documents and settings\Administrator\Data aplikací\Microsoft\Installer\{4B50D80D-A482-DECD-B584-EB054EBA878A}\ARPPRODUCTICON.exe
2010-07-22 12:20 . 2010-07-22 12:20 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-07-22 06:19 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
.

------- Sigcheck -------

[-] 2009-08-31 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-10-06_19.23.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-10-07 12:00 . 2010-10-07 12:00 16384 c:\windows\temp\Perflib_Perfdata_434.dat
+ 2010-07-22 12:19 . 2010-10-07 12:01 211844 c:\windows\system32\inetsrv\MetaBase.bin
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="c:\windows\ATK0100\HControl.exe" [2006-10-14 110592]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2007-01-16 843776]
"Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2006-07-26 90112]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"Hard Disk Sentinel"="c:\program files\Hard Disk Sentinel\HDSentinel.exe" [2010-09-11 3850752]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"c:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Documents and Settings\\Administrator\\Plocha\\Hack WI-FI\\aircrack-ng-1.1-win\\bin\\buddy-ng.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Administrator\\Plocha\\uConfig.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\FlatOut2\\FlatOut2.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [22.7.2010 21:05 135336]
R2 Správce výběru OS;Aktivátor Správce výběru OS Acronis;c:\program files\Acronis\DiskDirector\OSS\reinstall_svc.exe [7.7.2010 16:17 2156952]
R3 TS_AR5416;[CommView] Atheros AR5008 Wireless Network Adapter Service 7.7;c:\windows\system32\drivers\ts_athw.sys [1.8.2010 17:30 1605864]
S3 CV2K1;CommView Network Monitor;c:\windows\system32\DRIVERS\cv2k1.sys --> c:\windows\system32\DRIVERS\cv2k1.sys [?]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [23.7.2010 22:04 13352]
S3 wlags48d;Agere Wireless PCCard Service;c:\windows\system32\drivers\wlags48d.sys [31.7.2010 15:13 154624]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [22.7.2010 19:00 691696]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-06-20 10:47 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=skins7&tb_ver=2.0.0.2&q=
FF - component: c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\extensions\{003D3EDC-99B9-4a34-9C20-60CB94F7E829}\components\nsWebFF15.dll
FF - component: c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\g7hxvhnb.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(664)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3204)
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
c:\windows\system32\ACEngSvr.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\ASUS\NB Probe\SPM\spmgr.exe
c:\windows\system32\wdfmgr.exe
c:\windows\ATK0100\ATKOSD.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Celkový čas: 2010-10-07 15:04:40 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-10-07 12:04
ComboFix2.txt 2010-10-06 20:01
ComboFix3.txt 2010-10-06 19:28

Před spuštěním: Volných bajtů: 24 889 278 464
Po spuštění: Volných bajtů: 24 876 888 064

- - End Of File - - 4E1D14217FF8EDB8C5C304D75B31CCAA
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: fraudpack.kva.39 - sshnas21.dll

#15 Příspěvek od vyosek »

:o CFko ten soubor nenaslo :?: Nesmazla ho avira ci Vy :???:

:arrow: Stahnete SytemLook (viz muj podpis) a ulozte jej na plochu
  • Do okna vlozte skript nize

  • Kód: Vybrat vše

    :filefind
*lpytia*.exe
  • Kliknete na Look
  • Tlacitko Look se zmeni na Scanning a zsedne
  • Pockejte pokud se tlacitko Scanning opet nezmeni na Look - tak poznate ze SystemLook dokoncil svou praci
  • Vyskoci na Vas log s nazvem SystemLook (pripadne bude ulozen na plose), jeho obsah mi sem vlozte
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Odpovědět

Vrátit se na „Řešení problémů, logy“