VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Win32:MalOb-CE(Cryp)

https://forum.viry.cz:443/viewtopic.php?t=105311

Stránka 2 z 3

Re: Win32:MalOb-CE(Cryp)

Napsal: 07 říj 2010 20:59
od kart
CD Romka pořád nejede...:(

Re: Win32:MalOb-CE(Cryp)

Napsal: 07 říj 2010 21:00
od stell
a rucne vidis??cez tento pocitac, vies otvorit??

Re: Win32:MalOb-CE(Cryp)

Napsal: 07 říj 2010 21:04
od kart
To právě taky nejde, to cd se mi vůbec nenačte, jako bych tam žádný nevložil...zkouším jich víc, ale vůbec nic...tak třeba to bude ještě v něčem jiném...

Re: Win32:MalOb-CE(Cryp)

Napsal: 07 říj 2010 21:06
od stell
no dobre, ale stale neviem, ked otvoris tento pocitac ,a ci vidis tam jednotku CD/DVD, a ak ano ci sa dostanes na Cd.

Re: Win32:MalOb-CE(Cryp)

Napsal: 07 říj 2010 21:11
od kart
Ne, to cd se vůbec nenačte. Když se to pokusím otevřít, cd romka se otevře a napíše mi to vložte disk do jednotky...

Re: Win32:MalOb-CE(Cryp)

Napsal: 07 říj 2010 21:12
od stell
Klik, start-klikni na Tento pocitac, a pozri sa ci je tam jednotka CD/DVD,

Re: Win32:MalOb-CE(Cryp)

Napsal: 07 říj 2010 21:14
od kart
Je tam jednotka DVD RW.

:)

Re: Win32:MalOb-CE(Cryp)

Napsal: 07 říj 2010 21:15
od stell
PROSIM CITAJTE POZORNE NAVOD!!!,

Použij ComboFix podle tohoto návodu: http://www.bleepingcomputer.com/combofi ... t-combofix
Log znej vloz sem.

Re: Win32:MalOb-CE(Cryp)

Napsal: 07 říj 2010 22:11
od kart
Ok tak tady to je:

ComboFix 10-10-07.01 - Cart 07.10.2010 22:41:40.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.3583.2858 [GMT 2:00]
Spuštěný z: c:\users\Cart\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Install.exe
c:\windows\7Loader.TAG

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-09-07 do 2010-10-07 )))))))))))))))))))))))))))))))
.

2010-10-07 20:47 . 2010-10-07 20:47 -------- d-----w- c:\users\Cart\AppData\Local\temp
2010-10-07 20:47 . 2010-10-07 20:47 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-07 20:36 . 2010-10-07 20:37 -------- d-----w- C:\32788R22FWJFW
2010-10-07 18:22 . 2010-10-07 18:22 -------- d-----w- c:\users\Cart\AppData\Roaming\Malwarebytes
2010-10-07 18:22 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-07 18:22 . 2010-10-07 18:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-07 18:22 . 2010-10-07 18:22 -------- d-----w- c:\programdata\Malwarebytes
2010-10-07 18:22 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-07 17:37 . 2010-10-07 19:26 -------- d-----w- c:\program files\trend micro
2010-10-07 17:37 . 2010-10-07 17:37 -------- d-----w- C:\rsit
2010-10-03 13:22 . 2010-10-03 13:22 484160 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-10-03 12:21 . 2010-10-03 12:21 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-07 20:39 . 2010-02-25 11:59 17408 ----a-w- c:\windows\system32\rpcnetp.exe
2010-10-07 20:39 . 2010-02-25 12:32 56680 ----a-w- c:\windows\system32\rpcnet.dll
2010-10-07 18:20 . 2010-04-13 14:25 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-10-07 17:23 . 2010-02-25 13:42 45056 ----a-w- c:\windows\system32\acovcnt.exe
2010-10-07 17:23 . 2010-02-25 12:00 17408 ----a-w- c:\windows\system32\rpcnetp.dll
2010-10-07 16:54 . 2010-03-01 15:36 -------- d-----w- c:\programdata\McAfee Security Scan
2010-10-07 16:54 . 2010-02-24 18:12 -------- d-----w- c:\programdata\P4G
2010-10-06 11:30 . 2010-10-06 11:30 12 ----a-w- c:\users\Cart\AppData\Roaming\cnmkat.dat
2010-09-19 11:42 . 2009-09-04 05:55 675958 ----a-w- c:\windows\system32\perfh019.dat
2010-09-19 11:42 . 2009-09-04 05:55 132516 ----a-w- c:\windows\system32\perfc019.dat
2010-09-19 11:42 . 2009-09-04 05:44 689726 ----a-w- c:\windows\system32\perfh015.dat
2010-09-19 11:42 . 2009-09-04 05:44 134840 ----a-w- c:\windows\system32\perfc015.dat
2010-09-19 11:42 . 2009-09-04 05:34 632180 ----a-w- c:\windows\system32\perfh00E.dat
2010-09-19 11:42 . 2009-09-04 05:34 148310 ----a-w- c:\windows\system32\perfc00E.dat
2010-09-19 11:42 . 2009-09-04 05:25 631292 ----a-w- c:\windows\system32\perfh005.dat
2010-09-19 11:42 . 2009-09-04 05:25 121914 ----a-w- c:\windows\system32\perfc005.dat
2010-09-18 18:19 . 2007-09-05 07:43 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-08-27 18:25 . 2010-08-27 18:25 -------- d-----w- c:\users\Cart\AppData\Roaming\FLEXnet
2010-08-27 18:17 . 2010-08-27 18:17 -------- d-----w- c:\users\Cart\AppData\Roaming\Vodafone
2010-08-27 18:16 . 2010-08-27 18:16 -------- d-----w- c:\programdata\Vodafone
2010-08-27 18:16 . 2010-08-27 18:16 -------- d-----w- c:\programdata\FLEXnet
2010-08-27 18:16 . 2010-08-27 18:16 -------- d-----w- c:\program files\Vodafone
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GAINWARD"="c:\program files\EXPERTool\TBPanel.exe" [2009-10-05 2174976]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-02-27 39408]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-03-24 7289376]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2008-09-30 851968]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-12-03 35184]
"AmIcoSinglun"="c:\program files\AmIcoSingLun\AmIcoSinglun.exe" [2008-09-30 237568]
"ASUS Camera ScreenSaver"="c:\windows\AsScrProlog.exe" [2010-02-24 47672]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMedia.exe" [2009-04-07 159744]
"ATKOSD2"="c:\program files\ASUS\ATKOSD2\ATKOSD2.exe" [2009-03-04 8392704]
"Wireless Console 3"="c:\program files\ASUS\Wireless Console 3\wcourier.exe" [2009-02-06 1593344]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-02 13789728]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-05-06 2815192]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2009-09-18 2412032]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
FancyStart daemon.lnk - c:\windows\Installer\{A9FEB6D7-9C52-49FC-B956-7AB275B78890}\_5598CE641C54B66A23693F.exe [2010-2-24 12862]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-27 135664]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2009-07-23 112128]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [2009-07-23 100736]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-23 1343400]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-04-13 691696]
S1 aswSP;aswSP; [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-05-06 51792]
S2 SRS_VolSync_Service;SRS Volume Sync Service;c:\program files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe [2009-04-07 70880]
S2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2009-09-18 9216]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-03-01 139776]

.
Obsah adresáře 'Naplánované úlohy'

2010-10-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-27 17:42]

2010-10-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-27 17:42]

2010-10-05 c:\windows\Tasks\Norton Security Scan for Cart.job
- c:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-06-10 07:48]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {{76577871-04EC-495E-A12B-91F7C3600AFA} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url2.pl?CZ
IE: {{8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.co.uk/exec/obidos/red ... &site=home
FF - ProfilePath - c:\users\Cart\AppData\Roaming\Mozilla\Firefox\Profiles\8kc7is63.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.0&q=
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava11.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava12.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava13.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava14.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava32.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npoji610.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2010-10-07 22:49:30
ComboFix-quarantined-files.txt 2010-10-07 20:49

Před spuštěním: Volných bajtů: 354 523 021 312
Po spuštění: Volných bajtů: 355 269 644 288

- - End Of File - - 315BD9D41653352517CF4AC181BAC3ED

Re: Win32:MalOb-CE(Cryp)

Napsal: 08 říj 2010 07:58
od stell
Otvor Notepad (Poznámkový blok) a zkopíruj do neho celý zeleny tex:

Kód: Vybrat vše

KILLALL::
c:\windows\Tasks\Norton Security Scan for Cart.job
RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
Potom klik na Subor -> Uložiť ako.. .. -> Ako je Názov souboru tak do toho riadku napiš:CFScript.txt
Typ súboru tak tam vyberies *všetky súbory
A ulož ho na plochu.> Pozor CFScript.txt>Neotvarat a nemoze byt ani>CFScript.txt.txt A Urobis Toto :
Obrázek

Po skonceni skenu vlož log čo ComboFix vytvorí

Re: Win32:MalOb-CE(Cryp)

Napsal: 08 říj 2010 13:39
od kart
Tak tady to je...

ComboFix 10-10-07.01 - Cart 08.10.2010 14:21:53.2.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.3583.2562 [GMT 2:00]
Spuštěný z: c:\users\Cart\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Cart\Desktop\CFScript.txt
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-09-08 do 2010-10-08 )))))))))))))))))))))))))))))))
.

2010-10-08 12:26 . 2010-10-08 12:26 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-10-08 12:26 . 2010-10-08 12:26 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-08 12:20 . 2010-10-08 12:20 -------- d-----w- C:\32788R22FWJFW
2010-10-07 20:49 . 2010-10-08 12:27 -------- d-----w- c:\users\Cart\AppData\Local\temp
2010-10-07 18:22 . 2010-10-07 18:22 -------- d-----w- c:\users\Cart\AppData\Roaming\Malwarebytes
2010-10-07 18:22 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-07 18:22 . 2010-10-07 18:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-07 18:22 . 2010-10-07 18:22 -------- d-----w- c:\programdata\Malwarebytes
2010-10-07 18:22 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-07 17:37 . 2010-10-07 19:26 -------- d-----w- c:\program files\trend micro
2010-10-07 17:37 . 2010-10-07 17:37 -------- d-----w- C:\rsit
2010-10-03 13:22 . 2010-10-03 13:22 484160 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-10-03 12:21 . 2010-10-03 12:21 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-08 12:27 . 2010-02-25 11:59 17408 ----a-w- c:\windows\system32\rpcnetp.exe
2010-10-08 12:27 . 2010-02-25 12:32 56680 ----a-w- c:\windows\system32\rpcnet.dll
2010-10-07 18:20 . 2010-04-13 14:25 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-10-07 17:23 . 2010-02-25 13:42 45056 ----a-w- c:\windows\system32\acovcnt.exe
2010-10-07 17:23 . 2010-02-25 12:00 17408 ----a-w- c:\windows\system32\rpcnetp.dll
2010-10-07 16:54 . 2010-03-01 15:36 -------- d-----w- c:\programdata\McAfee Security Scan
2010-10-07 16:54 . 2010-02-24 18:12 -------- d-----w- c:\programdata\P4G
2010-10-06 11:30 . 2010-10-06 11:30 12 ----a-w- c:\users\Cart\AppData\Roaming\cnmkat.dat
2010-09-19 11:42 . 2009-09-04 05:55 675958 ----a-w- c:\windows\system32\perfh019.dat
2010-09-19 11:42 . 2009-09-04 05:55 132516 ----a-w- c:\windows\system32\perfc019.dat
2010-09-19 11:42 . 2009-09-04 05:44 689726 ----a-w- c:\windows\system32\perfh015.dat
2010-09-19 11:42 . 2009-09-04 05:44 134840 ----a-w- c:\windows\system32\perfc015.dat
2010-09-19 11:42 . 2009-09-04 05:34 632180 ----a-w- c:\windows\system32\perfh00E.dat
2010-09-19 11:42 . 2009-09-04 05:34 148310 ----a-w- c:\windows\system32\perfc00E.dat
2010-09-19 11:42 . 2009-09-04 05:25 631292 ----a-w- c:\windows\system32\perfh005.dat
2010-09-19 11:42 . 2009-09-04 05:25 121914 ----a-w- c:\windows\system32\perfc005.dat
2010-09-18 18:19 . 2007-09-05 07:43 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-08-27 18:25 . 2010-08-27 18:25 -------- d-----w- c:\users\Cart\AppData\Roaming\FLEXnet
2010-08-27 18:17 . 2010-08-27 18:17 -------- d-----w- c:\users\Cart\AppData\Roaming\Vodafone
2010-08-27 18:16 . 2010-08-27 18:16 -------- d-----w- c:\programdata\Vodafone
2010-08-27 18:16 . 2010-08-27 18:16 -------- d-----w- c:\programdata\FLEXnet
2010-08-27 18:16 . 2010-08-27 18:16 -------- d-----w- c:\program files\Vodafone
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GAINWARD"="c:\program files\EXPERTool\TBPanel.exe" [2009-10-05 2174976]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-02-27 39408]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-03-24 7289376]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2008-09-30 851968]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-12-03 35184]
"AmIcoSinglun"="c:\program files\AmIcoSingLun\AmIcoSinglun.exe" [2008-09-30 237568]
"ASUS Camera ScreenSaver"="c:\windows\AsScrProlog.exe" [2010-02-24 47672]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMedia.exe" [2009-04-07 159744]
"ATKOSD2"="c:\program files\ASUS\ATKOSD2\ATKOSD2.exe" [2009-03-04 8392704]
"Wireless Console 3"="c:\program files\ASUS\Wireless Console 3\wcourier.exe" [2009-02-06 1593344]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-02 13789728]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-05-06 2815192]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2009-09-18 2412032]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
FancyStart daemon.lnk - c:\windows\Installer\{A9FEB6D7-9C52-49FC-B956-7AB275B78890}\_5598CE641C54B66A23693F.exe [2010-2-24 12862]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-27 135664]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2009-07-23 112128]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [2009-07-23 100736]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-23 1343400]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-04-13 691696]
S1 aswSP;aswSP; [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-05-06 51792]
S2 SRS_VolSync_Service;SRS Volume Sync Service;c:\program files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe [2009-04-07 70880]
S2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2009-09-18 9216]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-03-01 139776]

.
Obsah adresáře 'Naplánované úlohy'

2010-10-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-27 17:42]

2010-10-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-27 17:42]

2010-10-05 c:\windows\Tasks\Norton Security Scan for Cart.job
- c:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-06-10 07:48]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {{76577871-04EC-495E-A12B-91F7C3600AFA} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url2.pl?CZ
IE: {{8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.co.uk/exec/obidos/red ... &site=home
FF - ProfilePath - c:\users\Cart\AppData\Roaming\Mozilla\Firefox\Profiles\8kc7is63.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.0&q=
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava11.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava12.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava13.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava14.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava32.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npoji610.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\program files\ATKGFNEX\GFNEXSrv.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\rpcnet.exe
c:\program files\ASUS\NB Probe\SPM\spmgr.exe
c:\windows\system32\conhost.exe
c:\program files\P4G\BatteryLife.exe
c:\program files\ASUS\SmartLogon\sensorsrv.exe
c:\windows\system32\taskhost.exe
c:\windows\System32\ACEngSvr.exe
c:\program files\Alwil Software\Avast5\AvastUI.exe
c:\windows\ehome\mcupdate.EXE
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\ehome\ehsched.exe
c:\windows\eHome\EhTray.exe
c:\windows\ehome\ehRecvr.exe
c:\windows\system32\makecab.exe
c:\windows\ehome\ehPrivJob.exe
c:\windows\system32\conhost.exe
.
**************************************************************************
.
Celkový čas: 2010-10-08 14:31:47 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-10-08 12:31
ComboFix2.txt 2010-10-07 20:49

Před spuštěním: Volných bajtů: 352 886 181 888
Po spuštění: Volných bajtů: 352 809 222 144

- - End Of File - - BA4C5B5C4D3CA19FA45EEE2DE6D888B8

Re: Win32:MalOb-CE(Cryp)

Napsal: 08 říj 2010 13:42
od stell
Avast treba preinstalovat. ma poskodene ovladace.
CD/DVD- ak este stale neide treba vyskusat . vlozit, original CD/DVD, nie palene.

Re: Win32:MalOb-CE(Cryp)

Napsal: 08 říj 2010 14:39
od kart
Zkouším jenom originální dvd, pořád se nic nenačítá, asi bude nějak poškozená cd romka. Díky za ten avast, přeinstaluju :))

Re: Win32:MalOb-CE(Cryp)

Napsal: 08 říj 2010 14:42
od stell
no, skus este odinstalovat CD/DVD-v spravce zarizeni-a restart, a uvidis.

Re: Win32:MalOb-CE(Cryp)

Napsal: 08 říj 2010 18:24
od kart
/Tak to taky nepomohlo...tak už nevím :-(
Všechny časy jsou v UTC+01:00
Stránka 2 z 3

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz