Avira mi hlasi 2 skryte soubory

Zpráva

#16 Příspěvek od **vyosek** » 22 Lis 2011 22:10

Pokracujte gmerem

Davidov · #17 Příspěvek od **Davidov** » 22 Lis 2011 22:14

Nejdou mi v gmeru zaskrtnout vsechny polozky spusteno jako spravce http://postimage.org/image/wldxp4y5j/ jsou zasedle windows 7 64 mam jestli to nedela neplechu.

mali log: je prazdny

velky log:GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-11-22 22:13:29
Windows 6.1.7601 Service Pack 1
Running: gmer.exe

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\

---- EOF - GMER 1.0.15 ----

#18 Příspěvek od **vyosek** » 22 Lis 2011 22:14

Stahnete aswMBR http://public.avast.com/%7Egmerek/aswMBR.exe a ulozte jej na plochu.

Utilitu spustte a prikazte ji, at skenuje - klik na Scan
Kliknutim na Save log ulozte log aswMBR na plochu
Obsah logu aswMBR mi sem vlozte

Davidov · #19 Příspěvek od **Davidov** » 22 Lis 2011 22:20

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-11-22 22:16:50
-----------------------------
22:16:50.544 OS Version: Windows x64 6.1.7601 Service Pack 1
22:16:50.544 Number of processors: 4 586 0x403
22:16:50.559 ComputerName: DADA-PC UserName: Dada
22:16:50.965 Initialize success
22:18:08.279 AVAST engine defs: 11112201
22:18:16.547 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-6
22:18:16.562 Disk 0 Vendor: ADATA_S596_Turbo 100730 Size: 30533MB BusType: 11
22:18:16.562 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T0L0-5
22:18:16.562 Disk 1 Vendor: ST3500418AS CC38 Size: 476938MB BusType: 11
22:18:18.840 Disk 0 MBR read successfully
22:18:18.856 Disk 0 MBR scan
22:18:18.856 Disk 0 Windows 7 default MBR code
22:18:18.871 Service scanning
22:18:22.038 Modules scanning
22:18:22.038 Disk 0 trace - called modules:
22:18:22.054 ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
22:18:22.054 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007b23060]
22:18:22.069 3 CLASSPNP.SYS[fffff8800165143f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP4T0L0-6[0xfffffa800786f060]
22:18:22.303 AVAST engine scan C:\Windows
22:18:29.682 AVAST engine scan C:\Windows\system32
22:19:20.008 AVAST engine scan C:\Windows\system32\drivers
22:19:23.268 AVAST engine scan C:\Users\Dada
22:19:32.004 AVAST engine scan C:\ProgramData
22:19:34.485 Scan finished successfully
22:19:46.403 Disk 0 MBR has been saved successfully to "C:\Users\Dada\Desktop\MBR.dat"
22:19:46.419 The log file has been saved successfully to "C:\Users\Dada\Desktop\aswMBR.txt"

#20 Příspěvek od **vyosek** » 22 Lis 2011 22:22

Nasledujici soubory otestujte na VirusTotalu (viz muj podpis)

C:\Users\Dada\Desktop\MBR.dat
Kliknete na Prochazet
Soubor nehledejte, jen vlozte cestu souboru, ktery chci otestovat
Kliknete na Send File
Pokud na Vas vyskoci obrazovka jako je nize, tak kliknete na ReAnalyse
Vysledek analyzy sem vlozte (jako odkaz)

Davidov · #21 Příspěvek od **Davidov** » 22 Lis 2011 22:27

http://www.virustotal.com/file-scan/rep ... 1321996883

Davidov · #22 Příspěvek od **Davidov** » 22 Lis 2011 22:47

Avira uz hlasi jenom jeden skrity obekt myslite ze to muze byt daemontols (virtualni mechanika nebo nejaky skudce?) odinstaloval jsem advanced system care.

#23 Příspěvek od **vyosek** » 22 Lis 2011 22:47

Ano, DT to muze byt...udelejte kompletni sken avirou a dejte pripadne nalezy

Davidov · #24 Příspěvek od **Davidov** » 22 Lis 2011 22:50

Pra jsem udelal a nenaslo nic akorad jeden hiden soubor ale tabulka nevyskocila sken pokracoval az do konce.Takze to je vse pocitac cistej?Muzu ho zazalohovat?Dekuju.

#25 Příspěvek od **vyosek** » 22 Lis 2011 22:52

Odinstalujte Combofix

Prejmenujte ComboFix na Uninstall
Spustte jej
Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

Stahnete a spustte
Pro potvrzeni volby mackejte A, Enter
Po pouziti utilitu smazte
Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

Stahnete a spustte
Kliknete na CleanUp a potvrdte YES
Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis)
Panel čistič

Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

dejte Hledej problémy
nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

Doporucuji provest defragmentaci disku

Nejjednodussi (ale nejmene ucinny) zpusob je pomoci utility ve windowsech
- Kliknete na Tento pocitac, dale na disk kliknete pravym tlacitkem, vyberte Vlastnosti
- prepnete se do zalozky Nastroje
- Nyni vidite pomucky Defragmentace - spustte ji kliknutim na Defragmentovat
- Toto provedte se vsemi disky
Dalsi moznosti (a mnou doporucenou) je pres programek Defraggler http://www.stahuj.centrum.cz/utility_a_ ... efraggler/
- Program stahnete, nainstalujte (dejte fajfku pryc u yahoo toolbaru) a spustte
- Kliknete na Analyzovat
- Pokud je ve sloupci Fragmentováno vice jak 5%, doporucuji provest defragmentaci (klik na Defragmentovat)
- Postup provedte se vsemi disky
Posledni moznost je pres jednoduchy programek JKDefrag http://www.stahuj.centrum.cz/utility_a_ ... /jkdefrag/
- Vyhodou programku je, ze se neinstaluje
- Staci tedy jen stahnout dle verze vaseho OS a rozbalit
- Nasledne spustit pomoci souboru JKDefrag pripadne JKDefrag64
- Probehne analyza disku a nasledne i defragmentace

A melo by byt cisto

Davidov · #26 Příspěvek od **Davidov** » 22 Lis 2011 23:04

Dekuju moc a co ten jeden srity soubor vir to asi neni ne to by sme na to prisli ze

moc moc dekuju.Neda se nejak zjistit co to je?

#27 Příspěvek od **vyosek** » 22 Lis 2011 23:12

Tak Avira by mela napsat kde jej nasla

Jinak si myslim ale ze je to sptd.sys, ovlada DT

Davidov · #28 Příspěvek od **Davidov** » 22 Lis 2011 23:20

prave ze nic nenapise ale diky zkusim odinstalovat DT a pak uvidime to bude nejlesi asi:-) Diky a uz bezte spat at muzete radit zitra v plne sile:-)

Davidov · #29 Příspěvek od **Davidov** » 22 Lis 2011 23:24

log avira jestli vyctete co to je ten skrity obekt

Avira Free Antivirus
Report file date: 22. listopadu 2011 22:33

Scanning for 3587536 virus strains and unwanted programs.

The program is running as an unrestricted full version.
Online services are available:

Licensee : Avira AntiVir Personal - Free Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows 7 x64
Windows version : (Service Pack 1) [6.1.7601]
Boot mode : Normally booted
Username : Dada
Computer name : DADA-PC

Version information:
BUILD.DAT : 12.0.0.861 41826 Bytes 19.10.2011 19:24:00
AVSCAN.EXE : 12.1.0.18 490448 Bytes 19.10.2011 15:56:25
AVSCAN.DLL : 12.1.0.17 54224 Bytes 19.10.2011 15:56:46
LUKE.DLL : 12.1.0.17 68304 Bytes 19.10.2011 15:56:34
AVSCPLR.DLL : 12.1.0.19 99536 Bytes 19.10.2011 15:56:25
AVREG.DLL : 12.1.0.22 226512 Bytes 19.10.2011 15:56:24
VBASE000.VDF : 7.10.0.0 19875328 Bytes 6.11.2009 19:18:34
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 10:07:39
VBASE002.VDF : 7.11.3.0 1950720 Bytes 9.2.2011 16:08:51
VBASE003.VDF : 7.11.5.225 1980416 Bytes 7.4.2011 11:00:55
VBASE004.VDF : 7.11.8.178 2354176 Bytes 31.5.2011 11:18:22
VBASE005.VDF : 7.11.10.251 1788416 Bytes 7.7.2011 13:12:53
VBASE006.VDF : 7.11.13.60 6411776 Bytes 16.8.2011 08:26:09
VBASE007.VDF : 7.11.15.106 2389504 Bytes 5.10.2011 15:56:40
VBASE008.VDF : 7.11.15.107 2048 Bytes 5.10.2011 15:56:40
VBASE009.VDF : 7.11.15.108 2048 Bytes 5.10.2011 15:56:40
VBASE010.VDF : 7.11.15.109 2048 Bytes 5.10.2011 15:56:40
VBASE011.VDF : 7.11.15.110 2048 Bytes 5.10.2011 15:56:40
VBASE012.VDF : 7.11.15.111 2048 Bytes 5.10.2011 15:56:40
VBASE013.VDF : 7.11.15.144 161792 Bytes 7.10.2011 15:56:40
VBASE014.VDF : 7.11.15.177 130048 Bytes 10.10.2011 15:56:41
VBASE015.VDF : 7.11.15.213 113664 Bytes 11.10.2011 15:56:41
VBASE016.VDF : 7.11.16.1 163328 Bytes 14.10.2011 15:56:41
VBASE017.VDF : 7.11.16.34 187904 Bytes 18.10.2011 15:56:41
VBASE018.VDF : 7.11.16.77 139264 Bytes 20.10.2011 20:03:01
VBASE019.VDF : 7.11.16.112 162816 Bytes 24.10.2011 20:03:02
VBASE020.VDF : 7.11.16.150 167424 Bytes 26.10.2011 20:03:02
VBASE021.VDF : 7.11.16.187 171520 Bytes 28.10.2011 20:03:03
VBASE022.VDF : 7.11.16.209 190976 Bytes 31.10.2011 20:03:04
VBASE023.VDF : 7.11.16.243 158208 Bytes 2.11.2011 20:03:04
VBASE024.VDF : 7.11.17.21 194560 Bytes 6.11.2011 20:03:05
VBASE025.VDF : 7.11.17.101 202752 Bytes 9.11.2011 20:03:05
VBASE026.VDF : 7.11.17.137 214528 Bytes 11.11.2011 20:03:05
VBASE027.VDF : 7.11.17.154 278528 Bytes 14.11.2011 20:03:06
VBASE028.VDF : 7.11.17.197 175616 Bytes 16.11.2011 20:03:07
VBASE029.VDF : 7.11.17.233 281088 Bytes 20.11.2011 20:03:08
VBASE030.VDF : 7.11.17.234 2048 Bytes 20.11.2011 20:03:08
VBASE031.VDF : 7.11.18.8 221184 Bytes 22.11.2011 18:08:19
Engineversion : 8.2.6.116
AEVDF.DLL : 8.1.2.2 106868 Bytes 21.11.2011 20:20:27
AESCRIPT.DLL : 8.1.3.86 471420 Bytes 21.11.2011 20:20:27
AESCN.DLL : 8.1.7.2 127349 Bytes 1.9.2011 22:46:02
AESBX.DLL : 8.2.1.34 323957 Bytes 1.9.2011 22:46:02
AERDL.DLL : 8.1.9.15 639348 Bytes 8.9.2011 22:16:06
AEPACK.DLL : 8.2.13.4 684406 Bytes 21.11.2011 20:20:27
AEOFFICE.DLL : 8.1.2.20 201083 Bytes 21.11.2011 20:20:27
AEHEUR.DLL : 8.1.2.192 3838328 Bytes 21.11.2011 20:20:27
AEHELP.DLL : 8.1.18.0 254327 Bytes 21.11.2011 20:20:27
AEGEN.DLL : 8.1.5.14 405877 Bytes 21.11.2011 20:20:27
AEEMU.DLL : 8.1.3.0 393589 Bytes 1.9.2011 22:46:01
AECORE.DLL : 8.1.24.0 196983 Bytes 21.11.2011 20:20:27
AEBB.DLL : 8.1.1.0 53618 Bytes 1.9.2011 22:46:01
AVWINLL.DLL : 12.1.0.17 27344 Bytes 19.10.2011 15:56:27
AVPREF.DLL : 12.1.0.17 51920 Bytes 19.10.2011 15:56:24
AVREP.DLL : 12.1.0.17 179408 Bytes 19.10.2011 15:56:24
AVARKT.DLL : 12.1.0.17 223184 Bytes 19.10.2011 15:56:22
AVEVTLOG.DLL : 12.1.0.17 169168 Bytes 19.10.2011 15:56:23
SQLITE3.DLL : 3.7.0.0 398288 Bytes 19.10.2011 15:56:38
AVSMTP.DLL : 12.1.0.17 62928 Bytes 19.10.2011 15:56:25
NETNT.DLL : 12.1.0.17 17104 Bytes 19.10.2011 15:56:34
RCIMAGE.DLL : 12.1.0.17 4450000 Bytes 19.10.2011 15:56:49
RCTEXT.DLL : 12.1.0.16 96208 Bytes 19.10.2011 15:56:49

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: C:\program files (x86)\avira\antivir desktop\sysscan.avp
Logging.............................: default
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, E:,
Process scan........................: on
Extended process scan...............: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: on
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: extended

Start of the scan: 22. listopadu 2011 22:33

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'E:\'
[INFO] No virus was found!

Starting search for hidden objects.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Applets\SysTray\BattMeter\Flyout\381b4222-f694-41f0-9685-ff5bb260df2e
[NOTE] The registry entry is invisible.

The scan of running processes will be started
Scan process 'avscan.exe' - '77' Module(s) have been scanned
Scan process 'avcenter.exe' - '108' Module(s) have been scanned
Scan process 'mscorsvw.exe' - '34' Module(s) have been scanned
Scan process 'firefox.exe' - '147' Module(s) have been scanned
Scan process 'avgnt.exe' - '77' Module(s) have been scanned
Scan process 'TBPANEL.exe' - '31' Module(s) have been scanned
Scan process 'PnkBstrA.exe' - '30' Module(s) have been scanned
Scan process 'sched.exe' - '42' Module(s) have been scanned
Scan process 'CTAudSvc.exe' - '33' Module(s) have been scanned
Scan process 'avguard.exe' - '70' Module(s) have been scanned

Initiating scan of system files:
Signed -> 'C:\Windows\system32\svchost.exe'
Signed -> 'C:\Windows\system32\winlogon.exe'
Signed -> 'C:\Windows\explorer.exe'
Signed -> 'C:\Windows\system32\smss.exe'
Signed -> 'C:\Windows\system32\wininet.DLL'
Signed -> 'C:\Windows\system32\wsock32.DLL'
Signed -> 'C:\Windows\system32\ws2_32.DLL'
Signed -> 'C:\Windows\system32\services.exe'
Signed -> 'C:\Windows\system32\lsass.exe'
Signed -> 'C:\Windows\system32\csrss.exe'
Signed -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signed -> 'C:\Windows\system32\spoolsv.exe'
Signed -> 'C:\Windows\system32\alg.exe'
Signed -> 'C:\Windows\system32\wuauclt.exe'
Signed -> 'C:\Windows\system32\advapi32.DLL'
Signed -> 'C:\Windows\system32\user32.DLL'
Signed -> 'C:\Windows\system32\gdi32.DLL'
Signed -> 'C:\Windows\system32\kernel32.DLL'
Signed -> 'C:\Windows\system32\ntdll.DLL'
Signed -> 'C:\Windows\system32\ntoskrnl.exe'
Signed -> 'C:\Windows\system32\ctfmon.exe'
The system files were scanned ('21' files)

Starting to scan executable files (registry).
The registry was scanned ( '1189' files ).

Starting the file scan:

Begin scan in 'C:\'

End of the scan: 22. listopadu 2011 22:34
Used time: 01:00 Minute(s)

The scan has been canceled!

555 Scanned directories
15197 Files were scanned
0 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 Files were deleted
0 Viruses and unwanted programs were repaired
0 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
15197 Files not concerned
139 Archives were scanned
0 Warnings
1 Notes
417858 Objects were scanned with rootkit scan
1 Hidden objects were found

#30 Příspěvek od **vyosek** » 22 Lis 2011 23:26

On ten sptd.sys je obecne ovladac pro virtualni mechaniky, takze mozna odinstalace DT nepomuze...

Na kute se uz pomalu chystam

//EDIT: takze je to jen zamknuty skryty klic registru, nic nebezpecneho

VIRY.CZ

Avira mi hlasi 2 skryte soubory

Re: Avira mi hlasi 2 skryte soubory

Re: Avira mi hlasi 2 skryte soubory

Re: Avira mi hlasi 2 skryte soubory

Re: Avira mi hlasi 2 skryte soubory

Re: Avira mi hlasi 2 skryte soubory

Re: Avira mi hlasi 2 skryte soubory

Re: Avira mi hlasi 2 skryte soubory

Re: Avira mi hlasi 2 skryte soubory

Re: Avira mi hlasi 2 skryte soubory

Re: Avira mi hlasi 2 skryte soubory

Re: Avira mi hlasi 2 skryte soubory

Re: Avira mi hlasi 2 skryte soubory

Re: Avira mi hlasi 2 skryte soubory

Re: Avira mi hlasi 2 skryte soubory

Re: Avira mi hlasi 2 skryte soubory