Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

DesktopLayer

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
Dotard
2. Stupeň Varování
Příspěvky: 86
Registrován: 21 led 2009 20:41

Re: DesktopLayer

#16 Příspěvek od Dotard »

  • ComboFix 10-11-03.04 - Oto 12.11.2010 12:20:23.3.2 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1462 [GMT 1:00]
    Running from: c:\documents and settings\Oto\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Oto\Desktop\CFScript.txt
    AV: ESET Smart Security 4.2 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
    FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
    * Created a new restore point
    * Resident AV is active

    .
    - REDUCED FUNCTIONALITY MODE -

    file zipped: c:\program files\microsoft\desktoplayer.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\program files\Internet Explorer\dmlconf.dat
    c:\program files\microsoft\desktoplayer.exe

    .
    ((((((((((((((((((((((((( Files Created from 2010-10-12 to 2010-11-12 )))))))))))))))))))))))))))))))
    .

    2074-05-07 16:38 . 2006-11-21 18:48 203576 ------w- c:\program files\Microsoft Games\Age of Empires III\autopatcher2.exe
    2010-11-11 12:01 . 2010-11-11 12:01 -------- d-----w- c:\documents and settings\Oto\Application Data\Malwarebytes
    2010-11-11 12:01 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-11-11 12:01 . 2010-11-11 12:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-11-11 12:00 . 2010-11-11 12:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-11-11 12:00 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-11-10 16:07 . 2010-11-10 16:07 -------- d-----w- c:\windows\system32\wbem\Repository
    2010-11-10 09:26 . 2010-11-12 11:22 -------- d-----w- c:\program files\Microsoft
    2010-11-06 15:51 . 2010-11-06 15:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Trymedia
    2010-11-06 15:15 . 2010-11-06 15:15 -------- d-----w- c:\program files\Sierra
    2010-11-05 13:20 . 2010-09-18 06:53 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
    2010-11-05 13:19 . 2010-09-18 06:53 974848 -c----w- c:\windows\system32\dllcache\mfc42.dll
    2010-11-05 13:18 . 2010-08-23 16:12 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll
    2010-11-05 13:11 . 2010-11-05 13:11 -------- d-----w- c:\program files\ESET
    2010-11-05 13:11 . 2010-11-05 13:11 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
    2010-10-27 16:05 . 2010-10-27 16:05 -------- d-----w- c:\program files\Skype
    2010-10-27 15:50 . 2010-11-05 13:49 -------- d-----w- c:\documents and settings\Oto\Application Data\sorrypeople
    2010-10-22 13:30 . 2010-11-10 16:39 -------- d-----w- c:\program files\World of Warcraft
    2010-10-21 16:08 . 2010-11-05 13:45 -------- d-----w- c:\documents and settings\Oto\Application Data\updates
    2010-10-18 11:24 . 2010-11-05 13:49 -------- d-----w- c:\documents and settings\Oto\Application Data\rapports2
    2010-10-15 13:31 . 2010-10-15 13:31 20480 ----a-w- c:\windows\system32\drivers\ndisrd.sys
    2010-10-13 17:54 . 2010-11-05 13:48 -------- d-----w- c:\documents and settings\Oto\Application Data\download

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-11-12 08:15 . 2009-10-29 13:59 119296 ----a-w- c:\windows\system32\zlib.dll
    2010-11-06 15:46 . 2009-02-15 19:43 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
    2010-10-24 18:04 . 2009-04-15 17:18 21840 ----atw- c:\windows\system32\SIntfNT.dll
    2010-10-24 18:04 . 2009-04-15 17:18 17212 ----atw- c:\windows\system32\SIntf32.dll
    2010-10-24 18:04 . 2009-04-15 17:18 12067 ----atw- c:\windows\system32\SIntf16.dll
    2010-10-18 15:35 . 2009-02-17 10:12 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
    2010-10-18 15:33 . 2009-06-20 16:00 214520 ----a-w- c:\windows\system32\PnkBstrB.xtr
    2010-10-18 15:33 . 2009-02-17 10:11 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
    2010-10-04 23:30 . 2009-02-17 10:12 138056 ----a-w- c:\documents and settings\Oto\Application Data\PnkBstrK.sys
    2010-09-22 15:54 . 2009-02-17 10:11 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
    2010-09-22 15:54 . 2009-02-17 10:11 2373712 ----a-w- c:\windows\system32\pbsvc.exe
    2010-09-18 11:23 . 2006-02-28 12:00 974848 ----a-w- c:\windows\system32\mfc42u.dll
    2010-09-18 06:53 . 2006-02-28 12:00 974848 ----a-w- c:\windows\system32\mfc42.dll
    2010-09-18 06:53 . 2006-02-28 12:00 954368 ----a-w- c:\windows\system32\mfc40.dll
    2010-09-18 06:53 . 2006-02-28 12:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
    2010-09-16 13:28 . 2010-09-16 13:28 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
    2010-09-16 13:28 . 2003-03-18 21:20 1060864 ----a-w- c:\windows\system32\mfc71.dll
    2010-09-16 13:28 . 2010-09-16 13:16 90112 ----a-w- c:\windows\system32\dotnetlib.dll
    2010-09-16 13:28 . 2009-02-16 02:15 499712 ----a-w- c:\windows\system32\msvcp71.dll
    2010-09-16 13:28 . 2009-02-16 02:15 348160 ----a-w- c:\windows\system32\msvcr71.dll
    2010-09-16 13:28 . 2010-09-16 13:16 184320 ----a-w- c:\windows\system32\font.dll
    2010-09-15 15:18 . 2010-10-04 23:30 2601752 ----a-w- c:\windows\system32\pbsvc_moh.exe
    2010-09-10 05:58 . 2006-02-28 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-09-10 05:58 . 2006-02-28 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2010-09-10 05:58 . 2006-02-28 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
    2010-09-01 11:51 . 2006-02-28 12:00 285824 ----a-w- c:\windows\system32\atmfd.dll
    2010-08-31 13:42 . 2006-02-28 12:00 1852800 ----a-w- c:\windows\system32\win32k.sys
    2010-08-29 22:16 . 2010-08-29 22:16 249856 ------w- c:\windows\Setup1.exe
    2010-08-29 22:15 . 2010-08-29 22:15 73216 ----a-w- c:\windows\ST6UNST.EXE
    2010-08-29 20:44 . 2010-08-29 20:44 94208 ----a-w- c:\windows\DIIUnin.exe
    2010-08-29 20:44 . 2010-08-29 20:44 2829 ----a-w- c:\windows\DIIUnin.pif
    2010-08-27 08:02 . 2006-02-28 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
    2010-08-27 05:57 . 2006-02-28 12:00 99840 ----a-w- c:\windows\system32\srvsvc.dll
    2010-08-26 13:39 . 2006-02-28 12:00 357248 ----a-w- c:\windows\system32\drivers\srv.sys
    2010-08-26 12:52 . 2009-04-16 05:28 5120 ----a-w- c:\windows\system32\xpsp4res.dll
    2010-08-24 22:20 . 2010-08-24 22:20 152904 ----a-w- c:\windows\system32\vghd.scr
    2010-08-23 16:12 . 2006-02-28 12:00 617472 ----a-w- c:\windows\system32\comctl32.dll
    2010-08-17 13:17 . 2006-02-28 12:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
    2010-08-16 08:45 . 2006-02-28 12:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RTHDCPL"="RTHDCPL.EXE" [2007-09-27 16844800]
    "SkyTel"="SkyTel.EXE" [2007-08-03 1826816]
    "Gainward"="c:\program files\XpertVision\TBPanel.exe" [2007-11-27 2169352]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
    "XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-09-30 718688]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-04-10 202256]
    "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-11-11 1468256]
    "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
    "nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-07 1753192]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
    "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-08-12 2215064]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "RunNarrator"="Narrator.exe" [2008-04-14 53760]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
    "Userinit"="c:\windows\system32\userinit.exe,c:\program files\microsoft\desktoplayer.exe,"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\\Program Files\\Garena\\Garena.exe"=
    "c:\\Program Files\\Tremulous\\tremulous.exe"=
    "c:\\Program Files\\ICQ6.5\\ICQ.exe"=
    "c:\\Program Files\\Warcraft III\\ghost.exe"=
    "c:\\Program Files\\Warcraft III\\GarenaHostBot.exe"=
    "c:\\Program Files\\HLSW\\hlsw.exe"=
    "c:\\Program Files\\World of Warcraft\\Repair.exe"=
    "c:\\Documents and Settings\\Oto\\Games\\Unreal Tournament 2004\\System\\UT2004.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
    "c:\\Program Files\\World of Warcraft\\Launcher.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "c:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
    "c:\\Program Files\\Sierra\\FEAR\\FEARMP.exe"=

    R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [28.2.2009 10:50 691696]
    R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [29.7.2010 13:31 115008]
    R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [12.8.2010 14:16 810144]
    R3 ndisrd;WinpkFilter Service;c:\windows\system32\drivers\ndisrd.sys [15.10.2010 14:31 20480]
    S0 khqlmxop;khqlmxop;c:\windows\system32\drivers\oopuhnpkpjv.sys --> c:\windows\system32\drivers\oopuhnpkpjv.sys [?]
    S2 gupdate1c99b0d83017c04;Google Update Service (gupdate1c99b0d83017c04);c:\program files\Google\Update\GoogleUpdate.exe [2.3.2009 9:04 133104]
    S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\Oto\LOCALS~1\Temp\CSA225.tmp --> c:\docume~1\Oto\LOCALS~1\Temp\CSA225.tmp [?]
    S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\Garena\safedrv.sys --> c:\program files\Garena\safedrv.sys [?]
    S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d486d1da-be4a-11de-984a-001e8c20e9e6}]
    \Shell\AutoRun\command - D:\autorun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d486d1de-be4a-11de-984a-001e8c20e9e6}]
    \Shell\AutoRun\command - D:\autorun.exe
    .
    Contents of the 'Scheduled Tasks' folder

    2010-11-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-02 08:04]

    2010-11-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-02 08:04]

    2010-11-12 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-515967899-492894223-839522115-1004.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 20:09]

    2010-11-07 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-515967899-492894223-839522115-1004.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 20:09]

    2010-11-12 c:\windows\Tasks\User_Feed_Synchronization-{C489D38D-6DD6-4D45-B72A-A4CBC01B1288}.job
    - c:\windows\system32\msfeedssync.exe [2007-08-14 02:31]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.sk/
    uInternet Settings,ProxyOverride = *.local
    DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.3.1.0.cab
    FF - ProfilePath - c:\documents and settings\Oto\Application Data\Mozilla\Firefox\Profiles\4r7gaonp.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/
    FF - plugin: c:\documents and settings\All Users\Application Data\id Software\QuakeLive\npquakezero.dll
    FF - plugin: c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
    FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
    FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
    c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
    .
    - - - - ORPHANS REMOVED - - - -

    Toolbar-Locked - (no file)
    WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - c:\program files\AskBarDis\bar\bin\askBar.dll
    WebBrowser-{4AEDC842-A65F-4A46-BEC8-53A080EAAC27} - (no file)
    HKCU-Run-GameTracker - c:\program files\GameTracker\GTLite.exe
    HKCU-Run-Configuring - c:\docume~1\Oto\LOCALS~1\Temp\22704062.txt
    SharedTaskScheduler-{0A4AD42B-9847-4A48-B239-D3D6A1BA4962} - (no file)
    AddRemove-3gpConverter - c:\program files\3GP Converter\uninst.exe
    AddRemove-53F13DB4D9611FD63BE580F06F0729BF236ABE68 - c:\progra~1\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\DPInst.exe
    AddRemove-Emote-Launcher - c:\program files\emote\launcher\Emote-Launcher-uninst.exe
    AddRemove-Free 3GP Video Converter_is1 - c:\program files\DVDVideoSoft\Free 3GP Video Converter\unins000.exe
    AddRemove-{7353BAE6-5E49-46C4-A9B5-8A269A313789} - c:\documents and settings\All Users\Application Data\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}\setup.exe
    AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-11-12 12:23
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
    "ImagePath"="\??\c:\docume~1\Oto\LOCALS~1\Temp\CSA225.tmp"

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
    "ImagePath"="c:\windows\system32\GameMon.des -service"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(3808)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\mshtml.dll
    c:\windows\system32\msls31.dll
    c:\program files\Bonjour\mdnsNSP.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\nvsvc32.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\windows\RTHDCPL.EXE
    c:\program files\Bonjour\mDNSResponder.exe
    c:\windows\system32\RUNDLL32.EXE
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Internet Explorer\IEXPLORE.EXE
    c:\windows\system32\PnkBstrA.exe
    c:\windows\system32\PnkBstrB.exe
    c:\windows\System32\snmp.exe
    c:\program files\iPod\bin\iPodService.exe
    .
    **************************************************************************
    .
    Completion time: 2010-11-12 12:28:12 - machine was rebooted
    ComboFix-quarantined-files.txt 2010-11-12 11:28

    Pre-Run: 20 888 240 128 bytes free
    Post-Run: 20 887 158 784 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer

    - - End Of File - - 4505A98DB27633DEDB28C50EDDB0835F
    Upload was successful
Nahoru
Dotard
2. Stupeň Varování
Příspěvky: 86
Registrován: 21 led 2009 20:41

Re: DesktopLayer

#17 Příspěvek od Dotard »

http://www.virustotal.com/file-scan/rep ... 1289562193
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: DesktopLayer

#18 Příspěvek od motji »

:o mě to vyhodilo, že je bez viru :o .


:arrow: Stahněte si nový combofix
http://www.bleepingcomputer.com/combofi ... t-combofix


:arrow: Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

KillAll::

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000000
[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

Driver::
khqlmxop

Rootkit::
c:\program files\microsoft\desktoplayer.exe
c:\windows\system32\drivers\oopuhnpkpjv.sys
-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:

Obrázek


-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Dotard
2. Stupeň Varování
Příspěvky: 86
Registrován: 21 led 2009 20:41

Re: DesktopLayer

#19 Příspěvek od Dotard »

  • ComboFix 10-11-11.02 - Oto 12.11.2010 16:09:08.4.2 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1295 [GMT 1:00]
    Running from: c:\documents and settings\Oto\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Oto\Desktop\CFScript.txt
    AV: ESET Smart Security 4.2 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
    FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
    * Resident AV is active

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\program files\Internet Explorer\dmlconf.dat
    c:\program files\Microsoft\DesktopLayer.exe

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_SSHNAS
    -------\Service_khqlmxop
    -------\Service_ndisrd


    ((((((((((((((((((((((((( Files Created from 2010-10-12 to 2010-11-12 )))))))))))))))))))))))))))))))
    .

    2074-05-07 16:38 . 2006-11-21 18:48 203576 ------w- c:\program files\Microsoft Games\Age of Empires III\autopatcher2.exe
    2010-11-11 12:01 . 2010-11-11 12:01 -------- d-----w- c:\documents and settings\Oto\Application Data\Malwarebytes
    2010-11-11 12:01 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-11-11 12:01 . 2010-11-11 12:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-11-11 12:00 . 2010-11-11 12:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-11-11 12:00 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-11-10 16:07 . 2010-11-10 16:07 -------- d-----w- c:\windows\system32\wbem\Repository
    2010-11-10 09:26 . 2010-11-12 15:14 -------- d-----w- c:\program files\Microsoft
    2010-11-06 15:51 . 2010-11-06 15:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Trymedia
    2010-11-06 15:15 . 2010-11-06 15:15 -------- d-----w- c:\program files\Sierra
    2010-11-05 13:20 . 2010-09-18 06:53 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
    2010-11-05 13:19 . 2010-09-18 06:53 974848 -c----w- c:\windows\system32\dllcache\mfc42.dll
    2010-11-05 13:18 . 2010-08-23 16:12 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll
    2010-11-05 13:11 . 2010-11-05 13:11 -------- d-----w- c:\program files\ESET
    2010-11-05 13:11 . 2010-11-05 13:11 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
    2010-10-27 16:05 . 2010-10-27 16:05 -------- d-----w- c:\program files\Skype
    2010-10-27 15:50 . 2010-11-05 13:49 -------- d-----w- c:\documents and settings\Oto\Application Data\sorrypeople
    2010-10-22 13:30 . 2010-11-12 11:40 -------- d-----w- c:\program files\World of Warcraft
    2010-10-21 16:08 . 2010-11-05 13:45 -------- d-----w- c:\documents and settings\Oto\Application Data\updates
    2010-10-18 11:24 . 2010-11-05 13:49 -------- d-----w- c:\documents and settings\Oto\Application Data\rapports2
    2010-10-15 13:31 . 2010-10-15 13:31 20480 ----a-w- c:\windows\system32\drivers\ndisrd.sys
    2010-10-13 17:54 . 2010-11-05 13:48 -------- d-----w- c:\documents and settings\Oto\Application Data\download

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-11-12 08:15 . 2009-10-29 13:59 119296 ----a-w- c:\windows\system32\zlib.dll
    2010-11-06 15:46 . 2009-02-15 19:43 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
    2010-10-24 18:04 . 2009-04-15 17:18 21840 ----atw- c:\windows\system32\SIntfNT.dll
    2010-10-24 18:04 . 2009-04-15 17:18 17212 ----atw- c:\windows\system32\SIntf32.dll
    2010-10-24 18:04 . 2009-04-15 17:18 12067 ----atw- c:\windows\system32\SIntf16.dll
    2010-10-18 15:35 . 2009-02-17 10:12 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
    2010-10-18 15:33 . 2009-06-20 16:00 214520 ----a-w- c:\windows\system32\PnkBstrB.xtr
    2010-10-18 15:33 . 2009-02-17 10:11 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
    2010-10-04 23:30 . 2009-02-17 10:12 138056 ----a-w- c:\documents and settings\Oto\Application Data\PnkBstrK.sys
    2010-09-22 15:54 . 2009-02-17 10:11 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
    2010-09-22 15:54 . 2009-02-17 10:11 2373712 ----a-w- c:\windows\system32\pbsvc.exe
    2010-09-18 11:23 . 2006-02-28 12:00 974848 ----a-w- c:\windows\system32\mfc42u.dll
    2010-09-18 06:53 . 2006-02-28 12:00 974848 ----a-w- c:\windows\system32\mfc42.dll
    2010-09-18 06:53 . 2006-02-28 12:00 954368 ----a-w- c:\windows\system32\mfc40.dll
    2010-09-18 06:53 . 2006-02-28 12:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
    2010-09-16 13:28 . 2010-09-16 13:28 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
    2010-09-16 13:28 . 2003-03-18 21:20 1060864 ----a-w- c:\windows\system32\mfc71.dll
    2010-09-16 13:28 . 2010-09-16 13:16 90112 ----a-w- c:\windows\system32\dotnetlib.dll
    2010-09-16 13:28 . 2009-02-16 02:15 499712 ----a-w- c:\windows\system32\msvcp71.dll
    2010-09-16 13:28 . 2009-02-16 02:15 348160 ----a-w- c:\windows\system32\msvcr71.dll
    2010-09-16 13:28 . 2010-09-16 13:16 184320 ----a-w- c:\windows\system32\font.dll
    2010-09-15 15:18 . 2010-10-04 23:30 2601752 ----a-w- c:\windows\system32\pbsvc_moh.exe
    2010-09-10 05:58 . 2006-02-28 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-09-10 05:58 . 2006-02-28 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2010-09-10 05:58 . 2006-02-28 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
    2010-09-01 11:51 . 2006-02-28 12:00 285824 ----a-w- c:\windows\system32\atmfd.dll
    2010-08-31 13:42 . 2006-02-28 12:00 1852800 ----a-w- c:\windows\system32\win32k.sys
    2010-08-29 22:16 . 2010-08-29 22:16 249856 ------w- c:\windows\Setup1.exe
    2010-08-29 22:15 . 2010-08-29 22:15 73216 ----a-w- c:\windows\ST6UNST.EXE
    2010-08-29 20:44 . 2010-08-29 20:44 94208 ----a-w- c:\windows\DIIUnin.exe
    2010-08-29 20:44 . 2010-08-29 20:44 2829 ----a-w- c:\windows\DIIUnin.pif
    2010-08-27 08:02 . 2006-02-28 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
    2010-08-27 05:57 . 2006-02-28 12:00 99840 ----a-w- c:\windows\system32\srvsvc.dll
    2010-08-26 13:39 . 2006-02-28 12:00 357248 ----a-w- c:\windows\system32\drivers\srv.sys
    2010-08-26 12:52 . 2009-04-16 05:28 5120 ----a-w- c:\windows\system32\xpsp4res.dll
    2010-08-24 22:20 . 2010-08-24 22:20 152904 ----a-w- c:\windows\system32\vghd.scr
    2010-08-23 16:12 . 2006-02-28 12:00 617472 ----a-w- c:\windows\system32\comctl32.dll
    2010-08-17 13:17 . 2006-02-28 12:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
    2010-08-16 08:45 . 2006-02-28 12:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RTHDCPL"="RTHDCPL.EXE" [2007-09-27 16844800]
    "SkyTel"="SkyTel.EXE" [2007-08-03 1826816]
    "Gainward"="c:\program files\XpertVision\TBPanel.exe" [2007-11-27 2169352]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
    "XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-09-30 718688]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-04-10 202256]
    "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-11-11 1468256]
    "DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
    "nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-07 1753192]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
    "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-08-12 2215064]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "RunNarrator"="Narrator.exe" [2008-04-14 53760]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
    "Userinit"="c:\windows\system32\userinit.exe,,c:\program files\microsoft\desktoplayer.exe"

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\\Program Files\\Garena\\Garena.exe"=
    "c:\\Program Files\\Tremulous\\tremulous.exe"=
    "c:\\Program Files\\ICQ6.5\\ICQ.exe"=
    "c:\\Program Files\\Warcraft III\\ghost.exe"=
    "c:\\Program Files\\Warcraft III\\GarenaHostBot.exe"=
    "c:\\Program Files\\HLSW\\hlsw.exe"=
    "c:\\Program Files\\World of Warcraft\\Repair.exe"=
    "c:\\Documents and Settings\\Oto\\Games\\Unreal Tournament 2004\\System\\UT2004.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
    "c:\\Program Files\\World of Warcraft\\Launcher.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "c:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
    "c:\\Program Files\\Sierra\\FEAR\\FEARMP.exe"=

    R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [28.2.2009 10:50 691696]
    R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [29.7.2010 13:31 115008]
    R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [12.8.2010 14:16 810144]
    S2 gupdate1c99b0d83017c04;Google Update Service (gupdate1c99b0d83017c04);c:\program files\Google\Update\GoogleUpdate.exe [2.3.2009 9:04 133104]
    S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\Oto\LOCALS~1\Temp\CSA225.tmp --> c:\docume~1\Oto\LOCALS~1\Temp\CSA225.tmp [?]
    S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\Garena\safedrv.sys --> c:\program files\Garena\safedrv.sys [?]
    S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
    .
    Contents of the 'Scheduled Tasks' folder

    2010-11-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-02 08:04]

    2010-11-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-02 08:04]

    2010-11-12 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-515967899-492894223-839522115-1004.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 20:09]

    2010-11-07 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-515967899-492894223-839522115-1004.job
    - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 20:09]

    2010-11-12 c:\windows\Tasks\User_Feed_Synchronization-{C489D38D-6DD6-4D45-B72A-A4CBC01B1288}.job
    - c:\windows\system32\msfeedssync.exe [2007-08-14 02:31]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.sk/
    uInternet Settings,ProxyOverride = *.local
    DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.3.1.0.cab
    FF - ProfilePath - c:\documents and settings\Oto\Application Data\Mozilla\Firefox\Profiles\epxbhai9.default\
    FF - plugin: c:\documents and settings\All Users\Application Data\id Software\QuakeLive\npquakezero.dll
    FF - plugin: c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
    FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
    FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
    c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-11-12 16:15
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
    "ImagePath"="\??\c:\docume~1\Oto\LOCALS~1\Temp\CSA225.tmp"

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
    "ImagePath"="c:\windows\system32\GameMon.des -service"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(3468)
    c:\windows\system32\WININET.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\IEFRAME.dll
    c:\windows\system32\mshtml.dll
    c:\windows\system32\msls31.dll
    c:\program files\Bonjour\mdnsNSP.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\nvsvc32.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\system32\PnkBstrA.exe
    c:\program files\Internet Explorer\iexplore.exe
    c:\windows\system32\PnkBstrB.exe
    c:\windows\System32\snmp.exe
    c:\windows\RTHDCPL.EXE
    c:\windows\system32\RUNDLL32.EXE
    c:\program files\iPod\bin\iPodService.exe
    .
    **************************************************************************
    .
    Completion time: 2010-11-12 16:19:55 - machine was rebooted
    ComboFix-quarantined-files.txt 2010-11-12 15:19

    Pre-Run: 20 815 806 464 bytes free
    Post-Run: 20 889 337 856 bytes free

    - - End Of File - - ACE0E3276E380E61239DF9A67030997D
Nahoru
Dotard
2. Stupeň Varování
Příspěvky: 86
Registrován: 21 led 2009 20:41

Re: DesktopLayer

#20 Příspěvek od Dotard »

Vzdy sa ta potvora vrati ...
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: DesktopLayer

#21 Příspěvek od motji »

Bude mít někde domeček :evil: , mějte trpělivost, přijdeme na to :)

:arrow: Stahněte z mého podpisu AVPTOOl http://www.viry.cz/forum/viewtopic.php?f=29&t=58179

-Podle návodu nainstalujte a proveďte sken
-co najde nechejte léčit, mazat
-sken může trvat několik hodin
-vložte zde log z výsledky
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: DesktopLayer

#22 Příspěvek od motji »

Chytl jste pěknou mršku, která mimo jiné infikuje i různé soubory, pokusíme se nad ní vyzrát, bude to však chtít čas a trpělivost. Budu tu večer asi mezi 20-24. hodinou, pokud budete mít čas, zkusíme to dát pořádně dohromady.

Po Avptoolu udělejte ještě tohle.

:arrow: Stahněte OTL http://oldtimer.geekstogo.com/OTL.exe
-uložte ho na plochu a spustte soubor OTL.exe.
-do bílého okna dole skopírujte tento skript:

Kód: Vybrat vše

netsvcs
drivers32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
c:\windows\*.* /U
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
nvraid.sys
ndis.sys
winlogon.exe
explorer.exe
userinit.exe
lsass.exe
svchost.exe
smss.exe
hal.dll
ws2_32.dll
tcpip.sys
cryptsvc.dll
Changer.sys
JakNDis.sys
isapnp.sys
cdrom.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
CREATERESTOREPOINT
- zaškrtněte okénko Pro všechny uživatele.
-označte okénka Kontrola na havěť "LOP" a Kontrola na havěť "Purity"
- Klikněte na tlačítko Prohledat
-po dokončení skenu se objeví logy OTL.Txt a Extras.txt, vložte je zde :)




:arrow: Otestujte na www.virustotal.com
c:\program files\Microsoft Games\Age of Empires III\autopatcher2.exe
c:\windows\system32\dllcache\mfc40u.dll
c:\windows\system32\dllcache\mfc42.dll
c:\windows\system32\dllcache\comctl32.dll
c:\windows\system32\userinit.exe
c:\program files\microsoft\desktoplayer.exe


:arrow: Použijte tentio program od kolegy
stell píše:Stiahnite si prosím TDSSKiller a uložte ho na plochu.

2x-klik na TDSSKiller.exe- spustiť aplikáciu, potom na Spustiť kontrolu-klik- Start Scan.
Ak je infikovaný súbor detekovaný, bude predvolená akcia Cure, kliknite na tlačidlo Continue.
Ak podozrivý[suspicious] súbor je detekovaný, bude predvolená akcia Skip, kliknite na Continue.
Môže vás požiadať, aby ste reštartovali počítač na dokončenie procesu. Kliknite na Reboot Now.
Ak nevyžaduje reštart, kliknite na tlačidlo Report. Log súbor by sa mal objaviť. Prosím, skopírujte a vložte obsah súboru tu.
Ak je vyžadované reštartovanie počítača, správa je k dispozícii vo vašom koreňovom adresári (zvyčajne C:\ zložka) vo forme "TDSSKiller. _log.txt". Prosím, skopírujte a vložte obsah súboru tu.

:arrow: Stahněte si firewall Zone Alarm, až Vám řeknu, nainstalujete ho .
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“