MBR.EXE kontrola ve Vistách x64

[petr0266]

Dobrý den,

Začal jsem používat windows vista, protože mi doma ležela nepoužitá krabicová verze a já měl XP. Když jsem zkoušel po tom kontrolu mbr přes mbr.exe od gmeru ukázalo mi to tohle. Bootkit remover ukazoval všechno správně (ok code found), před instalací Vist jsem provedl přes záchranou konzoli z windows xp CD FIXMBR a FIXBOOT, následně optimální nastavení biosu a samotná instalace VIst. Děkuji

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.0.6000

device: opened successfully
user: error reading MBR
error: Read Neplatný popisovač.
kernel: error reading MBR

[Rudy]

Dejte nejprve log z RSIT: http://www.viry.cz/forum/viewtopic.php?f=13&t=105895 .

[petr0266]

Logfile of random's system information tool 1.08 (written by random/random)
Run by Lukáš at 2011-04-23 20:19:22
Microsoft® Windows Vista™ Home Basic
System drive C: has 131 GB (86%) free of 153 GB
Total RAM: 2046 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:19:25, on 23.4.2011
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:\Windows\SysWOW64\conime.exe
C:\Program Files (x86)\Internet Explorer\ieuser.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10p_ActiveX.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files\trend micro\Lukáš.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD33FCDE-55D9-495C-B557-F0E1305B633E}: NameServer = 192.168.10.1
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 4617 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
wininit.exe
C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
atieclxx
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Windows Defender\MSASCui.exe" -hide
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b434c158-0c5d-4485-89f0-0f8230fc0505 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c5c01b5d-f78f-444c-8d38-4125e2fa7d2b -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-4ce26847-c286-4ff2-9e13-cb771be1d6f3 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:d9db0c39-3d67-4555-9b02-5f3b0180630f
taskeng.exe {0AA9EDE5-BC1B-44D8-A3D8-640C02AE751B}
taskeng.exe {FE7A3A5A-E166-48E1-8FB7-1E4B71A3A915}
C:\Windows\system32\conime.exe
"C:\Program Files (x86)\Internet Explorer\ieuser.exe" -Embedding
C:\Windows\System32\mobsync.exe -Embedding
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10p_ActiveX.exe -Embedding
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"C:\Users\Lukáš\Desktop\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2006-11-02 1579624]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2011-03-28 11786344]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2006-11-02 1513984]
"WindowsWelcomeCenter"=oobefldr.dll,ShowWelcomeCenter []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-03-09 336384]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2011-04-23 20:19:22 ----D---- C:\Program Files\trend micro
2011-04-23 20:17:11 ----D---- C:\rsit
2011-04-23 20:17:11 ----D---- C:\Program Files (x86)\trend micro
2011-04-23 19:18:50 ----D---- C:\Users\Lukáš\AppData\Roaming\WinRAR
2011-04-23 19:18:49 ----D---- C:\Program Files\WinRAR
2011-04-23 18:57:32 ----D---- C:\Users\Lukáš\AppData\Roaming\Macromedia
2011-04-23 18:57:32 ----D---- C:\Users\Lukáš\AppData\Roaming\Adobe
2011-04-23 18:57:28 ----D---- C:\Windows\SYSWOW64\Macromed
2011-04-23 18:23:53 ----A---- C:\Windows\system32\wups2.dll
2011-04-23 18:23:53 ----A---- C:\Windows\system32\wucltux.dll
2011-04-23 18:23:53 ----A---- C:\Windows\system32\wuaueng.dll
2011-04-23 18:23:53 ----A---- C:\Windows\system32\wuauclt.exe
2011-04-23 18:23:03 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2011-04-23 18:23:03 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2011-04-23 18:23:03 ----A---- C:\Windows\system32\wuwebv.dll
2011-04-23 18:23:03 ----A---- C:\Windows\system32\wuapp.exe
2011-04-23 18:07:07 ----ASH---- C:\hiberfil.sys
2011-04-23 18:06:08 ----D---- C:\Program Files (x86)\AMD APP
2011-04-23 18:04:23 ----D---- C:\Program Files (x86)\ATI Technologies
2011-04-23 18:04:17 ----SHD---- C:\Windows\Installer
2011-04-23 18:04:03 ----D---- C:\Program Files\ATI Technologies
2011-04-23 18:04:01 ----D---- C:\Program Files\ATI
2011-04-23 18:03:31 ----D---- C:\ATI
2011-04-23 18:00:16 ----A---- C:\Windows\system32\RTNUninst64.dll
2011-04-23 18:00:16 ----A---- C:\Windows\system32\RtNicProp64.dll
2011-04-23 18:00:16 ----A---- C:\Windows\system32\drivers\Rtlh64.sys
2011-04-23 17:56:47 ----D---- C:\Program Files\Realtek
2011-04-23 17:56:46 ----D---- C:\Windows\SYSWOW64\RTCOM
2011-04-23 17:56:01 ----A---- C:\Windows\DIFxAPI.dll
2011-04-23 17:56:00 ----A---- C:\Windows\system32\WavesGUILib.dll
2011-04-23 17:56:00 ----A---- C:\Windows\system32\SRSWOW64.dll
2011-04-23 17:56:00 ----A---- C:\Windows\system32\SRSTSX64.dll
2011-04-23 17:56:00 ----A---- C:\Windows\system32\SRSTSH64.dll
2011-04-23 17:56:00 ----A---- C:\Windows\system32\SRSHP64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\SYSWOW64\MBAPO32.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RtPgEx64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RtlCPAPI64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RtkCfg64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RtkAPO64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RtkApi64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RTEEP64A.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RTEEL64A.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RTEEG64A.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RTEED64A.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RTCOM64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RP3DHT64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RP3DAA64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RCoInst64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\MBWrp64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\MBppld64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\MBPPCn64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\MBAPO64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\MaxxAudioEQ.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\MaxxAudioAPO20.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\drivers\RTKVHD64.sys
2011-04-23 17:55:58 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-04-23 17:55:58 ----D---- C:\Program Files (x86)\Realtek
2011-04-23 17:55:58 ----A---- C:\Windows\system32\FMAPO64.dll
2011-04-23 17:55:58 ----A---- C:\Windows\system32\AERTAR64.dll
2011-04-23 17:55:58 ----A---- C:\Windows\system32\AERTAC64.dll
2011-04-23 17:55:53 ----HD---- C:\Program Files (x86)\Temp
2011-04-23 17:55:53 ----A---- C:\Windows\RtlExUpd.dll
2011-04-23 17:49:48 ----D---- C:\Program Files (x86)\Intel
2011-04-23 17:49:48 ----A---- C:\Windows\SYSWOW64\CSVer.dll
2011-04-23 17:49:32 ----D---- C:\Intel
2011-04-23 16:42:59 ----D---- C:\Windows\Panther
2011-04-23 16:42:47 ----RAS---- C:\BOOTSECT.BAK
2011-04-23 16:42:46 ----SHD---- C:\Boot
2011-04-23 16:37:09 ----D---- C:\Windows\ConfigSetRoot
2011-04-23 15:55:22 ----D---- C:\Users\Lukáš\AppData\Roaming\Identities
2011-04-23 15:55:14 ----SD---- C:\Users\Lukáš\AppData\Roaming\Microsoft
2011-04-23 15:53:20 ----SHD---- C:\ProgramData\Šablony
2011-04-23 15:53:20 ----SHD---- C:\ProgramData\Plocha
2011-04-23 15:53:20 ----SHD---- C:\ProgramData\Oblíbené položky
2011-04-23 15:53:20 ----SHD---- C:\ProgramData\Nabídka Start
2011-04-23 15:53:20 ----SHD---- C:\ProgramData\Dokumenty
2011-04-23 15:53:20 ----SHD---- C:\ProgramData\Data aplikací
2011-04-23 15:47:07 ----D---- C:\Windows\SoftwareDistribution
2011-04-23 15:45:57 ----D---- C:\Windows\system32\catroot2
2011-04-23 15:45:46 ----D---- C:\Windows\Debug
2011-04-23 15:43:56 ----D---- C:\Windows\Prefetch
2011-04-23 15:43:44 ----ASH---- C:\pagefile.sys
2011-04-23 15:43:43 ----SHD---- C:\System Volume Information

======List of files/folders modified in the last 1 months======

2011-04-23 20:19:24 ----D---- C:\Windows\Temp
2011-04-23 20:19:22 ----RD---- C:\Program Files
2011-04-23 20:17:11 ----RD---- C:\Program Files (x86)
2011-04-23 19:06:15 ----D---- C:\Windows\system32\catroot
2011-04-23 19:06:13 ----D---- C:\Windows\winsxs
2011-04-23 18:57:31 ----SD---- C:\Windows\Downloaded Program Files
2011-04-23 18:57:28 ----D---- C:\Windows\SysWOW64
2011-04-23 18:47:33 ----D---- C:\Windows\System32
2011-04-23 18:47:33 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-04-23 18:47:32 ----D---- C:\Windows\inf
2011-04-23 18:39:47 ----D---- C:\Windows\system32\WDI
2011-04-23 18:30:19 ----D---- C:\Windows\Logs
2011-04-23 18:27:28 ----SD---- C:\ProgramData\Microsoft
2011-04-23 18:24:30 ----D---- C:\Windows\rescache
2011-04-23 18:24:23 ----D---- C:\Windows\system32\cs-CZ
2011-04-23 18:17:05 ----D---- C:\Windows
2011-04-23 18:09:16 ----D---- C:\Windows\system32\drivers
2011-04-23 18:04:21 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-04-23 17:55:49 ----D---- C:\Program Files (x86)\Common Files
2011-04-23 17:49:49 ----D---- C:\Windows\system32\restore
2011-04-23 15:55:36 ----SHD---- C:\$Recycle.Bin
2011-04-23 15:55:14 ----RD---- C:\Users
2011-04-23 15:53:20 ----HD---- C:\ProgramData
2011-04-23 15:53:20 ----D---- C:\Program Files\Windows NT
2011-04-23 15:47:43 ----D---- C:\Windows\system32\drivers\UMDF

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-03-09 9258496]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-03-09 300544]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdLH6.sys [2010-11-17 111120]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2011-04-06 2826984]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh64.sys [2011-02-22 404584]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 108032]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 6144]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 273920]
S3 mbr;mbr; \??\C:\Users\LUK~1\AppData\Local\Temp\mbr.sys []
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 11008]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 7040]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 6656]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 7936]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-03-09 203776]

-----------------EOF-----------------

[vyosek]

Zdravim a pekny vecer preji

Omlouvam se kolego za vstup, pisu na zadost uzivatele pres PMku

Kliknete pravym tlacitkem na mbr, dejte Vlastnosti, zalozka Kompatibilita, zaskrtnete Spoustet jako spravce - mbr vsak nespoustejte

Stahnete SPTD http://www.duplexsecure.com/en/downloads

• Vyberte z uvedene stranky verzi dle sveho operacniho systemu (32(x86)bit ci 64(x64)bit)
• Ulozte na plochu a spustte
• Zvolte moznost Uninstall a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte

Stahnete Defogger http://www.jpshortstuff.247fixes.com/Defogger.exe

• Ulozte na plochu a spustte
• Kliknete na Disable a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte

Stahnete MBR na plochu http://www2.gmer.net/mbr/mbr.exe ale nespoustejte

Kliknete na Start a pote Spustit, pripadne pouzijte klavesou zkratku Win+R

• Vyskoci na Vas okenko, do ktereho zkopirujte text nize

• Kód: Vybrat vše

  "%userprofile%\Desktop\mbr" -t -s

• Kliknete na OK
• Na plose se Vam vytvori log s nazvem mbr.txt, jeho obsah mi sem vlozte

[petr0266]

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.0.6000

device: opened successfully
user: error reading MBR

Disk trace:
error: Read Neplatný popisovač.
kernel: error reading MBR

Ale bootkit remover ukazuje v pořádku... nechápu, před instalací vist jsem ještě kontroloval mbr.exe a vše v pořádku.

[petr0266]

je vůbec ten prográmek kompaktibilní s X64 architekturou?

[vyosek]

Spoustel jste mbr jak jsem psal? pres Start-Spustit

Ono visty jsou k mbr sektoru docela nesetrne, pisi tam i nejake dalsi informace, to XPecka nedelali...

Ano, mbr je kompatibilni, ovsem muze to nej mit vliv...Souhra Visty, x64 OS a muze to byt to co to dela...

[vyosek]

Jeste nazor kolegyne

myslím že je to nějakej bug mbr.exe na 64b vistách. on přímo neukazuje že by byl na disku rootkit, pouze ti píše, že to nemůže zkontrolovat.