prosím o pomoc s problémem při odstraňování viru z webových stránek, na kterých je provozován eshop. Vir se na web dostal s největší pravděpodobností za pomoci trojana, který odposlouchal uložené heslo v TC. Tento vir upravil veškeré index.php a vytvořil složku .log, do které nasypal veškeré stránky s různým smetím (porno apod.) Veškeré indexy jsem samozřejmě obnovil ze zálohy, ale řeším problém se složkou .log, kterou nelze odstranit, jelikož se sama obnovuje. S existencí virů je spojena samozřejmě vyšší náročnost na provoz webu s ohledem na vysoké návštěvy.
Níže přikládám dle návodu výpis logu z RITS + hlášení Nortona při přístupu na stránky:
Log
Logfile of random's system information tool 1.08 (written by random/random)
Run by Lubomír Jungwirth at 2011-02-08 00:01:46
Microsoft Windows 7 Professional
System drive C: has 7 GB (7%) free of 105 GB
Total RAM: 3063 MB (50% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 0:02:12, on 8.2.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\DNsoft.be\Shutdown Scheduler\PC Shutdown.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Miranda IM KP v5.0.8.5\miranda32.exe
C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Lubomír Jungwirth\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Lubomír Jungwirth\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Lubomír Jungwirth\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0VPAUGG1\RSIT[1].exe
C:\Program Files\trend micro\Lubomír Jungwirth.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files\Google\Chrome Frame\Application\9.0.597.84\npchrome_frame.dll
O2 - BHO: DownloadHelper Class - {FF2573AE-E1ED-40e1-83BA-F544CB2EE135} - C:\Program Files\Common Files\Download Helper\DownloadHelper.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Miranda IM] C:\Program Files\Miranda IM KP v5.0.8.5\launcher.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [NokiaOviSuite2] C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Google Update] "C:\Users\Lubomír Jungwirth\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Shutdown_Manager] C:\Program Files\DNsoft.be\Shutdown Scheduler\PC Shutdown.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O15 - Trusted Zone: http://www.quakelive.com
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... ader55.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files\Google\Chrome Frame\Application\9.0.597.84\npchrome_frame.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
--
End of file - 7514 bytes
======Scheduled tasks folder======
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2742644661-1443261293-2840709020-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2742644661-1443261293-2840709020-1000UA.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-09-15 41760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7}]
ChromeFrame BHO - C:\Program Files\Google\Chrome Frame\Application\9.0.597.84\npchrome_frame.dll [2011-01-29 4423224]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FF2573AE-E1ED-40e1-83BA-F544CB2EE135}]
DownloadHelper Class - C:\Program Files\Common Files\Download Helper\DownloadHelper.dll [2009-12-03 592896]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2010-11-06 281768]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-09-23 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 173592]
"Persistence"=C:\Windows\system32\igfxpers.exe [2009-09-23 150552]
"NokiaMServer"=C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Miranda IM"=C:\Program Files\Miranda IM KP v5.0.8.5\launcher.exe [2009-03-22 258048]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]
"NokiaOviSuite2"=C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [2010-09-02 672632]
""= []
"SpywareTerminatorUpdate"=C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2010-09-30 3037696]
"PC Suite Tray"=C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2009-06-12 1414144]
"Google Update"=C:\Users\Lubomír [2011-02-06 67410]
"Shutdown_Manager"=C:\Program Files\DNsoft.be\Shutdown Scheduler\PC Shutdown.exe [2007-03-23 1081344]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shutdown_Manager]
C:\Program Files\DNsoft.be\Shutdown Scheduler\PC Shutdown.exe [2007-03-23 1081344]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoipCheapCom]
C:\Program Files\VoipCheapCom.com\VoipCheapCom\VoipCheapCom.exe -nosplash -minimized []
C:\Users\Lubomír Jungwirth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 218112]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
======List of files/folders created in the last 3 months======
2011-02-08 00:01:46 ----D---- C:\rsit
2011-02-08 00:01:46 ----D---- C:\Program Files\trend micro
2011-02-05 04:02:44 ----D---- C:\ProgramData\NortonInstaller
2011-02-05 04:02:44 ----D---- C:\Program Files\NortonInstaller
2011-02-02 11:16:35 ----D---- C:\Users\Lubomír Jungwirth\AppData\Roaming\Nokia Ovi Suite
2011-01-24 22:18:03 ----D---- C:\PFiles
2011-01-17 01:08:21 ----D---- C:\Program Files\CCleaner
2011-01-12 11:01:01 ----A---- C:\Windows\system32\odbc32.dll
2011-01-12 11:00:56 ----A---- C:\Windows\system32\mf.dll
2011-01-12 11:00:56 ----A---- C:\Windows\system32\DWrite.dll
2011-01-12 11:00:56 ----A---- C:\Windows\system32\d3d10warp.dll
2011-01-12 11:00:56 ----A---- C:\Windows\system32\d2d1.dll
2011-01-12 11:00:55 ----A---- C:\Windows\system32\XpsPrint.dll
2011-01-12 11:00:55 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2011-01-12 11:00:55 ----A---- C:\Windows\system32\WMVDECOD.DLL
2011-01-12 11:00:55 ----A---- C:\Windows\system32\FntCache.dll
2011-01-12 11:00:55 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2011-01-12 11:00:55 ----A---- C:\Windows\system32\d3d10_1core.dll
2011-01-12 11:00:55 ----A---- C:\Windows\system32\cdd.dll
2011-01-12 11:00:54 ----A---- C:\Windows\system32\XpsRasterService.dll
2011-01-12 11:00:54 ----A---- C:\Windows\system32\mfreadwrite.dll
2011-01-12 11:00:54 ----A---- C:\Windows\system32\ExplorerFrame.dll
2011-01-12 11:00:54 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2011-01-12 11:00:54 ----A---- C:\Windows\system32\d3d10_1.dll
2010-12-18 00:16:25 ----D---- C:\7886549936a5c9cca8
2010-12-15 11:27:49 ----A---- C:\Windows\system32\tzres.dll
2010-12-15 11:27:38 ----A---- C:\Windows\system32\iertutil.dll
2010-12-15 11:27:37 ----A---- C:\Windows\system32\mstime.dll
2010-12-15 11:27:37 ----A---- C:\Windows\system32\mshtml.dll
2010-12-15 11:27:36 ----A---- C:\Windows\system32\ieframe.dll
2010-12-15 11:27:35 ----A---- C:\Windows\system32\wininet.dll
2010-12-15 11:27:35 ----A---- C:\Windows\system32\urlmon.dll
2010-12-15 11:27:35 ----A---- C:\Windows\system32\msfeeds.dll
2010-12-15 11:27:34 ----A---- C:\Windows\system32\mshtmled.dll
2010-12-15 11:27:34 ----A---- C:\Windows\system32\msfeedssync.exe
2010-12-15 11:27:34 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-12-15 11:27:34 ----A---- C:\Windows\system32\licmgr10.dll
2010-12-15 11:27:34 ----A---- C:\Windows\system32\jsproxy.dll
2010-12-15 11:27:34 ----A---- C:\Windows\system32\ieui.dll
2010-12-15 11:27:34 ----A---- C:\Windows\system32\iepeers.dll
2010-12-15 11:27:34 ----A---- C:\Windows\system32\iedkcs32.dll
2010-12-15 11:27:29 ----A---- C:\Windows\system32\wmicmiplugin.dll
2010-12-15 11:27:29 ----A---- C:\Windows\system32\taskschd.dll
2010-12-15 11:27:29 ----A---- C:\Windows\system32\taskeng.exe
2010-12-15 11:27:29 ----A---- C:\Windows\system32\schedsvc.dll
2010-12-15 11:27:28 ----A---- C:\Windows\system32\taskcomp.dll
2010-12-15 11:27:28 ----A---- C:\Windows\system32\schtasks.exe
2010-12-15 11:27:25 ----A---- C:\Windows\system32\webio.dll
2010-12-15 11:27:24 ----A---- C:\Windows\system32\atmfd.dll
2010-12-15 11:27:23 ----A---- C:\Windows\system32\atmlib.dll
2010-12-15 11:27:20 ----A---- C:\Windows\system32\consent.exe
2010-12-15 11:26:43 ----A---- C:\Windows\system32\win32k.sys
2010-11-16 12:13:09 ----D---- C:\dd15e9bd8af7a8e2cef7f887bba7
======List of files/folders modified in the last 3 months======
2011-02-08 00:01:58 ----D---- C:\Windows\Prefetch
2011-02-08 00:01:54 ----D---- C:\Windows\Temp
2011-02-08 00:01:46 ----RD---- C:\Program Files
2011-02-07 23:55:32 ----D---- C:\Windows\Tasks
2011-02-07 23:13:48 ----D---- C:\Windows\system32\config
2011-02-07 22:57:00 ----D---- C:\ProgramData\Spyware Terminator
2011-02-06 16:35:16 ----D---- C:\Windows\debug
2011-02-06 15:43:16 ----D---- C:\Windows\system32\NDF
2011-02-06 14:05:26 ----D---- C:\Windows\System32
2011-02-06 14:05:26 ----D---- C:\Windows\inf
2011-02-06 14:05:26 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-02-05 17:50:50 ----SHD---- C:\System Volume Information
2011-02-05 04:02:44 ----HD---- C:\ProgramData
2011-02-04 23:57:18 ----D---- C:\Users\Lubomír Jungwirth\AppData\Roaming\Spyware Terminator
2011-02-03 17:27:44 ----D---- C:\Windows\system32\catroot2
2011-02-02 11:16:33 ----D---- C:\Users\Lubomír Jungwirth\AppData\Roaming\Nokia
2011-01-24 22:18:04 ----SHD---- C:\Windows\Installer
2011-01-24 22:18:04 ----SHD---- C:\Config.Msi
2011-01-14 23:35:26 ----D---- C:\Windows\winsxs
2011-01-14 16:32:38 ----D---- C:\Windows\system32\drivers
2011-01-13 10:16:46 ----A---- C:\Windows\system32\MRT.exe
2011-01-13 10:16:20 ----D---- C:\ProgramData\Microsoft Help
2011-01-12 21:21:49 ----D---- C:\Windows\system32\catroot
2011-01-04 12:53:17 ----D---- C:\Windows\Microsoft.NET
2011-01-04 12:53:14 ----RSD---- C:\Windows\assembly
2011-01-04 00:23:59 ----D---- C:\Program Files\Common Files\microsoft shared
2010-12-24 20:24:07 ----D---- C:\Program Files\Starcraft
2010-12-18 00:18:01 ----D---- C:\Windows\system32\en-US
2010-12-18 00:18:01 ----D---- C:\Program Files\Microsoft.NET
2010-12-15 21:06:05 ----D---- C:\Windows\rescache
2010-12-15 20:14:38 ----D---- C:\Windows\system32\cs-CZ
2010-12-15 20:14:38 ----D---- C:\Program Files\Windows Mail
2010-12-15 20:14:37 ----D---- C:\Windows\system32\migration
2010-12-15 20:14:37 ----D---- C:\Program Files\Internet Explorer
2010-11-30 00:43:42 ----SD---- C:\Users\Lubomír Jungwirth\AppData\Roaming\Microsoft
2010-11-11 19:06:47 ----A---- C:\Windows\ODBC.INI
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2009-11-14 691696]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2010-12-22 135096]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2010-11-22 61960]
R3 E100B;Intel(R) PRO Adapter Driver; C:\Windows\system32\DRIVERS\e100b325.sys [2009-07-13 159232]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 32bitový systém Windows Vista; C:\Windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 agzv7hxz;agzv7hxz; C:\Windows\system32\drivers\agzv7hxz.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 JL2005C;Dual Mode Camera; C:\Windows\System32\Drivers\jl2005c.sys [2008-03-11 68762]
S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmb.sys [2010-02-26 18176]
S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbo.sys [2010-02-26 22528]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2010-02-26 8192]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2009-07-14 27648]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2010-02-26 8192]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2010-12-15 267944]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2010-11-06 135336]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2010-08-28 75064]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2010-09-30 488960]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-06-14 615936]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-30 135664]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2009-06-10 31064]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-29 1343400]
-----------------EOF-----------------
[/code]
Hlášení Nortona:
Kód: Vybrat vše
Trojan.Malscript!html is a detection name used by Symantec to identify HTML files that contain malicious JavaScript.
HTML files may contain malicious content for a number of reasons. The files may have been specially crafted to be intrinsically malicious, or they may be legitimate HTML files that have been infected by threats such as W32.Ramnit or W32.Fujacks.CE. The files may be downloaded on to the computer during Web browsing, by other malware, inside archive files, and through various other methods.
With the Web browser now used for online shopping, banking, social networking, and entertainment, it has become one of the most popular targets for attackers. The attack surface is large, with third-party plugins and extensions that extend browser capabilities also being vulnerable to attack. Browser compromise can therefore be the cause of some of the most significant security breaches and hence can cause a great deal of harm to compromised computers and the victims of the attacks.
Authors of malicious JavaScript may go to lengths to ensure that their code is obfuscated so that its functionality is hidden from casual observers and to complicate the task of analysis. Obfuscation may also be used in an attempt to create code that is able to circumvent security software.
When injected into an HTML file, malicious JavaScript can:
Exploit browser and plugin vulnerabilities to run arbitrary code
Display fake antivirus scans and other fraudulent information
Download JavaScript, HTML, and other files
Hijack browsing sessions
Redirect users to malicious websites
Steal information
Trojan už byl z počítače odstraněn, ale stále si nevím rady s odstraněním složky .log. Předpokládám, že zatím bude asi jakýsi skript, který zajišťuje automatické generování složky. Díky za každou radu při řešení tohoto problému.
Stahněte MBAM z mého podpisu
Přispějete na provoz fóra?