VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Pro vyosek, prosím o preventivku-děkuji

https://forum.viry.cz:443/viewtopic.php?t=120588

Stránka 2 z 2

Re: Pro vyosek, prosím o preventivku-děkuji

Napsal: 24 bře 2012 08:25
od vyosek
Kuk do soukrome zpravy :)

Re: Pro vyosek, prosím o preventivku-děkuji

Napsal: 24 bře 2012 08:29
od jaruneczka
http://imageshack.us/photo/my-images/40/screentsu.jpg/

Re: Pro vyosek, prosím o preventivku-děkuji

Napsal: 24 bře 2012 09:06
od vyosek
Pustime tam tedy ComboFix, kdyz to i kluci z ESETu chteji :)
Navod mam ve vykani, tak se nediv, je pro bezne uzivatele, prepisovat se mi nechce :oops: :lol:

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
:arrow: Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
  • Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
  • Pokud mate Win XP spustte pod uctem Spravce\Administratora
  • Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
  • Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
  • Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
  • Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
  • Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
  • Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
  • Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

Re: Pro vyosek, prosím o preventivku-děkuji

Napsal: 24 bře 2012 09:20
od jaruneczka
ComboFix 12-03-22.01 - Jaroslava 24.03.2012 9:11.3.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4087.2689 [GMT 1:00]
Spuštěný z: c:\users\Jaroslava\Desktop\ComboFix.exe
AV: ESET Smart Security 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Disabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-02-24 do 2012-03-24 )))))))))))))))))))))))))))))))
.
.
2012-03-24 08:14 . 2012-03-24 08:14 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-03-24 08:14 . 2012-03-24 08:14 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-03-20 06:08 . 2012-02-08 07:13 8643640 ------w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{57B744D7-10C8-47EE-80A5-4BDE4DF4EA45}\mpengine.dll
2012-03-15 12:37 . 2012-03-15 12:37 -------- d-----w- c:\users\Jaroslava\AppData\Roaming\Camel101
2012-03-15 12:35 . 2012-03-15 12:40 -------- d-----w- c:\programdata\Big Fish Games
2012-03-15 12:34 . 2012-03-15 12:40 -------- d-----w- C:\BigFishGamesCache
2012-03-14 06:24 . 2012-03-14 06:24 592824 ----a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll
2012-03-14 06:24 . 2012-03-14 06:24 44472 ----a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll
2012-03-14 05:22 . 2011-11-19 15:20 5559152 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-14 05:22 . 2011-11-19 14:50 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-03-14 05:22 . 2011-11-19 14:50 3913584 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-03-14 05:20 . 2012-02-03 04:34 3145728 ----a-w- c:\windows\system32\win32k.sys
2012-03-14 05:20 . 2012-02-10 06:36 1544192 ----a-w- c:\windows\system32\DWrite.dll
2012-03-14 05:20 . 2012-02-10 05:38 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-03-14 05:20 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-03-14 05:20 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-03-14 05:20 . 2012-02-17 04:58 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-14 05:20 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-03-14 05:20 . 2012-01-25 06:38 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-03-14 05:20 . 2012-01-25 06:38 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-03-14 05:20 . 2012-01-25 06:33 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-03-04 09:22 . 2012-03-04 09:22 -------- d-----w- c:\programdata\T1 Games
2012-02-29 09:49 . 2012-02-29 09:50 -------- d-----w- c:\users\Jaroslava\AppData\Roaming\SprillEng
2012-02-27 07:23 . 2012-02-27 07:23 -------- d-----w- c:\program files\Java
2012-02-27 07:17 . 2012-02-27 07:23 525544 ----a-w- c:\windows\system32\deployJava1.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-24 08:16 . 2012-01-08 12:58 25640 ----a-w- c:\windows\gdrv.sys
2012-02-27 07:16 . 2012-01-08 13:59 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-23 08:18 . 2012-01-08 12:51 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-02-07 10:04 . 2012-02-07 09:35 45056 ----a-w- c:\windows\NCUNINST.EXE
2012-01-08 14:37 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2012-01-08 14:37 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2012-01-08 13:52 . 2012-01-08 12:59 30528 ----a-w- c:\windows\GVTDrv64.sys
2012-01-08 13:05 . 2012-01-08 13:05 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-01-08 13:05 . 2012-01-08 13:05 161792 ----a-w- c:\windows\SysWow64\msls31.dll
2012-01-08 13:05 . 2012-01-08 13:05 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
2012-01-08 13:05 . 2012-01-08 13:05 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2012-01-08 13:05 . 2012-01-08 13:05 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
2012-01-08 13:05 . 2012-01-08 13:05 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
2012-01-08 13:05 . 2012-01-08 13:05 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2012-01-08 13:05 . 2012-01-08 13:05 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2012-01-08 13:05 . 2012-01-08 13:05 367104 ----a-w- c:\windows\SysWow64\html.iec
2012-01-08 13:05 . 2012-01-08 13:05 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
2012-01-08 13:05 . 2012-01-08 13:05 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
2012-01-08 13:05 . 2012-01-08 13:05 152064 ----a-w- c:\windows\SysWow64\wextract.exe
2012-01-08 13:05 . 2012-01-08 13:05 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2012-01-08 13:05 . 2012-01-08 13:05 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2012-01-08 13:05 . 2012-01-08 13:05 11776 ----a-w- c:\windows\SysWow64\mshta.exe
2012-01-08 13:05 . 2012-01-08 13:05 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2012-01-08 13:05 . 2012-01-08 13:05 101888 ----a-w- c:\windows\SysWow64\admparse.dll
2012-01-08 13:05 . 2012-01-08 13:05 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-01-08 13:05 . 2012-01-08 13:05 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-01-08 13:05 . 2012-01-08 13:05 85504 ----a-w- c:\windows\system32\iesetup.dll
2012-01-08 13:05 . 2012-01-08 13:05 76800 ----a-w- c:\windows\system32\tdc.ocx
2012-01-08 13:05 . 2012-01-08 13:05 603648 ----a-w- c:\windows\system32\vbscript.dll
2012-01-08 13:05 . 2012-01-08 13:05 49664 ----a-w- c:\windows\system32\imgutil.dll
2012-01-08 13:05 . 2012-01-08 13:05 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-01-08 13:05 . 2012-01-08 13:05 448512 ----a-w- c:\windows\system32\html.iec
2012-01-08 13:05 . 2012-01-08 13:05 30720 ----a-w- c:\windows\system32\licmgr10.dll
2012-01-08 13:05 . 2012-01-08 13:05 222208 ----a-w- c:\windows\system32\msls31.dll
2012-01-08 13:05 . 2012-01-08 13:05 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2012-01-08 13:05 . 2012-01-08 13:05 165888 ----a-w- c:\windows\system32\iexpress.exe
2012-01-08 13:05 . 2012-01-08 13:05 160256 ----a-w- c:\windows\system32\wextract.exe
2012-01-08 13:05 . 2012-01-08 13:05 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-01-08 13:05 . 2012-01-08 13:05 12288 ----a-w- c:\windows\system32\mshta.exe
2012-01-08 13:05 . 2012-01-08 13:05 114176 ----a-w- c:\windows\system32\admparse.dll
2012-01-08 13:05 . 2012-01-08 13:05 111616 ----a-w- c:\windows\system32\iesysprep.dll
2012-01-04 10:44 . 2012-02-15 06:23 509952 ----a-w- c:\windows\system32\ntshrui.dll
2012-01-04 08:58 . 2012-02-15 06:23 442880 ----a-w- c:\windows\SysWow64\ntshrui.dll
2011-12-30 16:02 . 2012-01-08 17:13 23896 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe
2011-12-30 06:26 . 2012-02-15 06:23 515584 ----a-w- c:\windows\system32\timedate.cpl
2011-12-30 05:27 . 2012-02-15 06:23 478720 ----a-w- c:\windows\SysWow64\timedate.cpl
2011-12-28 03:59 . 2012-02-15 06:23 498688 ----a-w- c:\windows\system32\drivers\afd.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-17 221184]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-15 375000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-21 2214504]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2012-01-08 30528]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [x]
R4 Guard.Mail.ru;Guard.Mail.ru;c:\program files (x86)\Guard-ICQ\GuardICQ.exe [2012-01-08 1564368]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-15 223464]
S2 DES2 Service;DES2 Service for Energy Saving.;c:\program files (x86)\GIGABYTE\EnergySaver2\des2svr.exe [2009-06-17 68136]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2011-09-22 974944]
S2 IAStorDataMgrSvc;Úložná technologie Intel(R) Rapid;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-10-02 13336]
S2 JMB36X;JMB36X;c:\windows\SysWOW64\XSrvSetup.exe [2010-09-07 72280]
S2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-01-31 158856]
S2 Smart TimeLock;Smart TimeLock Service;c:\program files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe [2009-10-13 114688]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-09-22 4035152]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.centrum.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: {{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - c:\program files (x86)\ICQ7.7\ICQ.exe
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\users\Jaroslava\AppData\Roaming\Mozilla\Firefox\Profiles\1mla55pj.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.centrum.cz
FF - prefs.js: network.proxy.type - 4
pref('extensions.shownSelectionUI',true);
pref('extensions.autoDisableScopes',0);
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\GIGABYTE\Smart6\Timelock\AlarmClock.exe
.
**************************************************************************
.
Celkový čas: 2012-03-24 09:18:34 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-03-24 08:18
.
Před spuštěním: Volných bajtů: 947 381 272 576
Po spuštění: Volných bajtů: 946 958 725 120
.
- - End Of File - - 849067F013070C7AD39D780F7EF49567

Re: Pro vyosek, prosím o preventivku-děkuji

Napsal: 25 bře 2012 09:22
od vyosek
Ahoj,

promin za zdrzeni ale byl jsem v praci a pak jsem odpadl

:arrow: Pokud nemate, tak presunte Combofix na plochu
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    KillAll::

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

ClearJavaCache::

Reboot::
  • Ulozte vytvoreny TXT jako CFScript.txt
  • Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
    Obrázek
  • Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte
:arrow: Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

Re: Pro vyosek, prosím o preventivku-děkuji

Napsal: 25 bře 2012 09:38
od jaruneczka
ComboFix 12-03-22.01 - Jaroslava 25.03.2012 10:29:33.4.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4087.2782 [GMT 2:00]
Spuštěný z: c:\users\Jaroslava\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Jaroslava\Desktop\CFScript.txt
AV: ESET Smart Security 5.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 5.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Rezidentní štít AV je zapnutý
.
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-02-25 do 2012-03-25 )))))))))))))))))))))))))))))))
.
.
2012-03-25 08:32 . 2012-03-25 08:32 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2012-03-25 08:32 . 2012-03-25 08:32 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-03-25 08:32 . 2012-03-25 08:32 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-03-24 18:14 . 2012-03-24 18:14 -------- d-----w- c:\users\Jaroslava\AppData\Roaming\Alawar
2012-03-24 08:39 . 2012-03-20 02:51 8669240 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BD5AAD53-2BAD-4D10-865B-73C91D3A5340}\mpengine.dll
2012-03-23 19:49 . 2012-03-23 19:49 -------- d-----w- c:\users\Jaroslava\AppData\Roaming\OpenCandy
2012-03-15 12:37 . 2012-03-15 12:37 -------- d-----w- c:\users\Jaroslava\AppData\Roaming\Camel101
2012-03-15 12:35 . 2012-03-15 12:40 -------- d-----w- c:\programdata\Big Fish Games
2012-03-15 12:34 . 2012-03-15 12:40 -------- d-----w- C:\BigFishGamesCache
2012-03-14 06:24 . 2012-03-14 06:24 592824 ----a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll
2012-03-14 06:24 . 2012-03-14 06:24 44472 ----a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll
2012-03-14 05:22 . 2011-11-19 15:20 5559152 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-14 05:22 . 2011-11-19 14:50 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-03-14 05:22 . 2011-11-19 14:50 3913584 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-03-14 05:20 . 2012-02-03 04:34 3145728 ----a-w- c:\windows\system32\win32k.sys
2012-03-14 05:20 . 2012-02-10 06:36 1544192 ----a-w- c:\windows\system32\DWrite.dll
2012-03-14 05:20 . 2012-02-10 05:38 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-03-14 05:20 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-03-14 05:20 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-03-14 05:20 . 2012-02-17 04:58 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-14 05:20 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-03-14 05:20 . 2012-01-25 06:38 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-03-14 05:20 . 2012-01-25 06:38 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-03-14 05:20 . 2012-01-25 06:33 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-03-04 09:22 . 2012-03-04 09:22 -------- d-----w- c:\programdata\T1 Games
2012-02-29 09:49 . 2012-02-29 09:50 -------- d-----w- c:\users\Jaroslava\AppData\Roaming\SprillEng
2012-02-27 07:23 . 2012-02-27 07:23 -------- d-----w- c:\program files\Java
2012-02-27 07:17 . 2012-02-27 07:23 525544 ----a-w- c:\windows\system32\deployJava1.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-25 08:34 . 2012-01-08 12:58 25640 ----a-w- c:\windows\gdrv.sys
2012-02-27 07:16 . 2012-01-08 13:59 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-23 08:18 . 2012-01-08 12:51 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-02-07 10:04 . 2012-02-07 09:35 45056 ----a-w- c:\windows\NCUNINST.EXE
2012-01-08 14:37 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2012-01-08 14:37 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2012-01-08 13:52 . 2012-01-08 12:59 30528 ----a-w- c:\windows\GVTDrv64.sys
2012-01-08 13:05 . 2012-01-08 13:05 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-01-08 13:05 . 2012-01-08 13:05 161792 ----a-w- c:\windows\SysWow64\msls31.dll
2012-01-08 13:05 . 2012-01-08 13:05 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
2012-01-08 13:05 . 2012-01-08 13:05 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2012-01-08 13:05 . 2012-01-08 13:05 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
2012-01-08 13:05 . 2012-01-08 13:05 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
2012-01-08 13:05 . 2012-01-08 13:05 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2012-01-08 13:05 . 2012-01-08 13:05 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2012-01-08 13:05 . 2012-01-08 13:05 367104 ----a-w- c:\windows\SysWow64\html.iec
2012-01-08 13:05 . 2012-01-08 13:05 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
2012-01-08 13:05 . 2012-01-08 13:05 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
2012-01-08 13:05 . 2012-01-08 13:05 152064 ----a-w- c:\windows\SysWow64\wextract.exe
2012-01-08 13:05 . 2012-01-08 13:05 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2012-01-08 13:05 . 2012-01-08 13:05 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2012-01-08 13:05 . 2012-01-08 13:05 11776 ----a-w- c:\windows\SysWow64\mshta.exe
2012-01-08 13:05 . 2012-01-08 13:05 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2012-01-08 13:05 . 2012-01-08 13:05 101888 ----a-w- c:\windows\SysWow64\admparse.dll
2012-01-08 13:05 . 2012-01-08 13:05 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-01-08 13:05 . 2012-01-08 13:05 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-01-08 13:05 . 2012-01-08 13:05 85504 ----a-w- c:\windows\system32\iesetup.dll
2012-01-08 13:05 . 2012-01-08 13:05 76800 ----a-w- c:\windows\system32\tdc.ocx
2012-01-08 13:05 . 2012-01-08 13:05 603648 ----a-w- c:\windows\system32\vbscript.dll
2012-01-08 13:05 . 2012-01-08 13:05 49664 ----a-w- c:\windows\system32\imgutil.dll
2012-01-08 13:05 . 2012-01-08 13:05 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-01-08 13:05 . 2012-01-08 13:05 448512 ----a-w- c:\windows\system32\html.iec
2012-01-08 13:05 . 2012-01-08 13:05 30720 ----a-w- c:\windows\system32\licmgr10.dll
2012-01-08 13:05 . 2012-01-08 13:05 222208 ----a-w- c:\windows\system32\msls31.dll
2012-01-08 13:05 . 2012-01-08 13:05 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2012-01-08 13:05 . 2012-01-08 13:05 165888 ----a-w- c:\windows\system32\iexpress.exe
2012-01-08 13:05 . 2012-01-08 13:05 160256 ----a-w- c:\windows\system32\wextract.exe
2012-01-08 13:05 . 2012-01-08 13:05 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-01-08 13:05 . 2012-01-08 13:05 12288 ----a-w- c:\windows\system32\mshta.exe
2012-01-08 13:05 . 2012-01-08 13:05 114176 ----a-w- c:\windows\system32\admparse.dll
2012-01-08 13:05 . 2012-01-08 13:05 111616 ----a-w- c:\windows\system32\iesysprep.dll
2012-01-04 10:44 . 2012-02-15 06:23 509952 ----a-w- c:\windows\system32\ntshrui.dll
2012-01-04 08:58 . 2012-02-15 06:23 442880 ----a-w- c:\windows\SysWow64\ntshrui.dll
2011-12-30 16:02 . 2012-01-08 17:13 23896 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe
2011-12-30 06:26 . 2012-02-15 06:23 515584 ----a-w- c:\windows\system32\timedate.cpl
2011-12-30 05:27 . 2012-02-15 06:23 478720 ----a-w- c:\windows\SysWow64\timedate.cpl
2011-12-28 03:59 . 2012-02-15 06:23 498688 ----a-w- c:\windows\system32\drivers\afd.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-17 221184]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-15 375000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"BCU"="c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-05-21 2214504]
R3 GVTDrv64;GVTDrv64;c:\windows\GVTDrv64.sys [2012-01-08 30528]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [x]
R4 Guard.Mail.ru;Guard.Mail.ru;c:\program files (x86)\Guard-ICQ\GuardICQ.exe [2012-01-08 1564368]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-15 223464]
S2 DES2 Service;DES2 Service for Energy Saving.;c:\program files (x86)\GIGABYTE\EnergySaver2\des2svr.exe [2009-06-17 68136]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [2011-09-22 974944]
S2 IAStorDataMgrSvc;Úložná technologie Intel(R) Rapid;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-10-02 13336]
S2 JMB36X;JMB36X;c:\windows\SysWOW64\XSrvSetup.exe [2010-09-07 72280]
S2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-01-31 158856]
S2 Smart TimeLock;Smart TimeLock Service;c:\program files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe [2009-10-13 114688]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-09-22 4035152]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.centrum.cz/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: {{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - c:\program files (x86)\ICQ7.7\ICQ.exe
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\users\Jaroslava\AppData\Roaming\Mozilla\Firefox\Profiles\1mla55pj.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.centrum.cz
FF - prefs.js: network.proxy.type - 4
pref('extensions.shownSelectionUI',true);
pref('extensions.autoDisableScopes',0);
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\GIGABYTE\Smart6\Timelock\AlarmClock.exe
.
**************************************************************************
.
Celkový čas: 2012-03-25 10:36:44 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-03-25 08:36
.
Před spuštěním: Volných bajtů: 946 956 566 528
Po spuštění: Volných bajtů: 946 689 093 632
.
- - End Of File - - 75A6B6AFBF59B686E5D3E88FBE9F53C8

Re: Pro vyosek, prosím o preventivku-děkuji

Napsal: 25 bře 2012 09:44
od vyosek
:arrow: Odinstalujte Combofix
  • Prejmenujte ComboFix na Uninstall
  • Spustte jej
  • Tohle smaze Combofix a jeho slozky
:arrow: T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe
  • Stahnete a spustte
  • Pro potvrzeni volby mackejte A, Enter
  • Po pouziti utilitu smazte
  • Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)
:arrow: Napis co nas pacient

Re: Pro vyosek, prosím o preventivku-děkuji

Napsal: 25 bře 2012 10:01
od jaruneczka
spuštění systému se zrychlilo, děkuji pěkně za pomoc, krásný den :139:

Re: Pro vyosek, prosím o preventivku-děkuji

Napsal: 25 bře 2012 10:16
od vyosek
Neni zac, pekny den i Tobe :worship:
Všechny časy jsou v UTC+01:00
Stránka 2 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz