VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Security tool

https://forum.viry.cz:443/viewtopic.php?t=104852

Stránka 1 z 3

Security tool

Napsal: 22 zář 2010 16:45
od Flashka
Zdravím, mam v pocitaci Security tool vir a potreboval bych se ho nejak zbavit. Stahnul jsem RSIT abych mohl postnout log, jenze ten me Security tool zablokoval, mohl by ste me nekdo zkuseny s timhle problemem poradit? Zatim diky za precteni.

edit: Windows XP

Re: Security tool

Napsal: 22 zář 2010 17:01
od Rudy
Přejmenujte RSIT třeba na cokoli.com a zkuste spustit.

Re: Security tool

Napsal: 22 zář 2010 17:07
od Flashka
Bohuzel, porad stejny problem. :( i kdyz sem prejmenoval

Re: Security tool

Napsal: 22 zář 2010 17:09
od Rudy
OK. Zkuste AVPTool: http://www.viry.cz/forum/viewtopic.php?f=29&t=58179 .

Re: Security tool

Napsal: 22 zář 2010 17:28
od Flashka
Dostahoval sem, zkousim spustit a zase stejny problem s tim, ze soubor je vir.

Re: Security tool

Napsal: 22 zář 2010 18:03
od stell
Zaskok za kolegu:

Restart do nudzoveho rezimu, s pracou v sieti:
Stiahnes rkill
na plochu-spustis, ak dostanes hlasku ze je to vir, ignorovat je to falosna hlaska od malware, takto sa brani, cakat aby ukoncil Malware procesy.
Ked program prebehne otvori sa notepad, ze ukoncil malware procesy, mozes notepad zatvorit ,odteraz nesmies restartovat pocitac, nakolko malware procesy sa obnovia.
Ak program neprebehne, nechat hlasku na ploche a spusti RKILL-znova, cakat na ukoncenie Malware procesov.
Stiahnes>>mbam-setup
Nainstalovat, aktualizovat, a spustit skan.
Spravit RYCHLY, skan co najde daj zmazat, ak bude treba restart uz mozes povolit.
Log vloz sem.
Podrobny Navod:
http://www.viry.cz/forum/viewtopic.php?f=29&t=67229

Re: Security tool

Napsal: 22 zář 2010 18:29
od Flashka
Vsechno sem udelal, ale ten log je celkem narez :) Kazdopadne moc diky za rady, ste tu super tym. Ted uz jdu jen restartovat, snad to pojede.
Jinak, jestli potrebujete vedet, kde sem k viru prisel, tak to bylo na strance www.showbiz.cz, kamos mi poslal odkaz a v tu chvili me vyskocilo okno s "ST" poprve. Zajimavy lae je, ze jemu to nic neudelalo.

LOG:

Malwarebytes' Anti-Malware 1.46
http://www.malwarebytes.org

Verze databáze: 4672

Windows 5.1.2600 Service Pack 2 (Safe Mode)
Internet Explorer 7.0.5730.11

22.9.2010 19:25:51
mbam-log-2010-09-22 (19-25-51).txt

Typ skenu: Rychlý sken
Skenované objekty: 162160
Uplynulý čas: 7 minuta(y), 24 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 3
Infikované hodnoty registru: 1
Infikované datové položky registru: 3
Infikované složky: 5
Infikované soubory: 260

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> Quarantined and deleted successfully.

Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\26083656 (Rogue.SecurityTool) -> Quarantined and deleted successfully.

Infikované datové položky registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BITS\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemRoot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemroot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully.

Infikované složky:
C:\Program Files\bbbbbbbbb (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\FirefoxDTT (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\FirefoxDTT\chrome (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\FirefoxDTT\components (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources (Backdoor.Bifrose) -> Quarantined and deleted successfully.

Infikované soubory:
C:\Documents and Settings\uzivatel\Local Settings\Data aplikací\26083656.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\uzivatel\Local Settings\Temporary Internet Files\Content.IE5\IJGZAUBF\update[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\DTToolbar.dll (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\uninst.exe (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\_DTLite.xml (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\FirefoxDTT\chrome.manifest (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\FirefoxDTT\install.rdf (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\FirefoxDTT\chrome\dttoolbar.jar (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\FirefoxDTT\components\DTToolbarFF.dll (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\FirefoxDTT\components\DTToolbarFF.xpt (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\about.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\AboutWindow.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\as.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\as.png (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\astro.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\b1.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\b1.png (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\BurnImage.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\buy.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond000.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond001.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond003.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond004.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond005.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond006.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond007.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond008.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond009.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond010.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond011.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond019.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond020.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond021.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond022.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond023.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond024.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond025.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond026.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond037.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond038.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond039.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond040.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond041.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond046.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond048.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond050.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond051.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond052.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond053.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond054.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond055.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond056.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond057.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond058.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond059.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond060.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond061.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond062.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond063.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond064.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond065.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond066.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond067.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond068.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond069.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond075.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond076.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond077.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond078.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond079.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond080.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond084.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond085.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond086.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond087.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond088.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond089.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond090.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond091.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond092.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond093.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond094.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond095.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond108.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond109.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond110.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond111.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond112.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond113.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond120.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond121.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond122.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond126.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond127.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond128.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond129.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond130.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond131.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond132.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond133.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond134.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond135.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond136.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond137.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond138.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond140.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond141.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond142.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond143.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond148.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond149.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond152.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond154.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond155.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond156.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\cond157.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\Config.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\d.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\d2.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\daemon.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\ds.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\dsearch.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\dt.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\DTPro.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\Dwnl.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\emulation.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\features.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\gd.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\genre.xml (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\globe.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\GrabImage.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\hb.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\hb.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\help.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\ip.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\lang.xml (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\lingvo.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\m.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\mail.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\mailc.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\mailc_disable.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\mailc_down.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\mailc_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\mailc_under.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\mail_disable.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\mail_down.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\mail_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\mail_under.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\MenuRadioConfig.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\MenuRadioStation.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\MenuTr.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\next.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\next_down.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\next_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\next_under.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\none.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\none_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\noW.gif (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\op.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\play.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\play.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\play_down.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\play_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\play_under.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\pragma.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\prev.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\prev_down.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\prev_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\prev_under.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\prod.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\Radio.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioBg.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioBgMask.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioDisp.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioDisp_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioDown.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioDown.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioDown_down.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioDown_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioDown_under.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioError.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioError_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioSmallDisp.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioSmallDisp_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioVolume.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioVolume_down.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioVolume_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioVolume_under.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioWait.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\RadioWait_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\refresh.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\refresh_down.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\refresh_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\refresh_under.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\Rss.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\Rss1.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\rssClose.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\rssL.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\rssOpen.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\size.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\size_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\skins.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\spt.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\stop.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\stop.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\stop_down.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\stop_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\stop_under.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\SupportRequest.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\time.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\TitleIcon.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\toolbar.xml (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\trans.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\Trash.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\Trash_disable.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\Trash_down.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\Trash_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\Trash_under.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\u.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\vol.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\vol.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\vol_back.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\vol_dott.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\vol_dott_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\vol_down.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\vol_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\vol_under.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wb.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wBtClose.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wBtClose_down.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wBtClose_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wBtClose_under.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wBtText.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wBtText_down.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wBtText_m.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wBtText_under.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\Weather_m42.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\Weather_m43.bmp (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wi.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wi0.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wi1.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wi10.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wi11.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wi12.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wi13.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wi2.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wi3.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wi4.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wi5.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wi6.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wi7.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wi8.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Program Files\bbbbbbbbb\Resources\wi9.ico (Backdoor.Bifrose) -> Quarantined and deleted successfully.
C:\Documents and Settings\uzivatel\Data aplikací\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Data aplikací\fvgqad.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Data aplikací\fvgqad.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\config\systemprofile\Data aplikací\fvgqad.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\uzivatel\Data aplikací\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\uzivatel\Nabídka Start\Programy\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winlogon.Del (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

Re: Security tool

Napsal: 22 zář 2010 18:43
od stell
Dobre, teraz start-spustit-napis regedit a oprav tieto reg kluce:
ernohous13 píše:
Tak se budeš muset proklikat ručně, ať vidíme co tam opravdu je.
Postupně budeš v levém okně křížkem před "složkou" otvírat:
+ HKEY_LOCAL_MACHINE
+ System
+ CurrentControlSet
+ Services

vyhledáš BITS -> klik pravým -> Oprávnění... -> Povolit vše



v pravém okně budeš mít označenu hodnotu "ImagePath" s vadným údajem hodnoty
dvojklikem na červené ab před hodnotou otevřeš okno "Upravit řetězec" a %fystemRoot% změníš na %SystemRoot% -> OK



Následně sjedeš v levém okně dolů na wuauserv a postup zopakuješ.

:wink: při této činnosti raději třikrát měř než řízneš!
ak to budes mat napis, a budeme pokracovat.

Re: Security tool

Napsal: 22 zář 2010 18:52
od Flashka
U wuauserv mi to pise chybu: Imagepath nelze upravit: Pri zapisu obsahu hodnoty doslo k cyhbe. pritom to delam jako u BITS

Re: Security tool

Napsal: 22 zář 2010 19:00
od stell
start spustit, skopiruj prikaz do okna, klik ok
net stop wuauserv

a vyskusaj opravu.
Ak pojde potom vloz tento prikaz do okna.
net start wuauserv
a napis.

Re: Security tool

Napsal: 22 zář 2010 19:04
od Flashka
Bohuzel, zase stejna chyba i po napsani toho prikazu do "Spustit"

Re: Security tool

Napsal: 22 zář 2010 19:06
od stell
ok, daj
net start wuauserv
ok
a este skus,
v regedit-zalozka-úpravy-oprávnění-dat fajku-uplné řízení a číst-pouzit-ok.a skusit opravit.
ak nepojde pojdeme dalej nakolko mozno ze to blokuje rootkit.. ale napis.

Re: Security tool

Napsal: 22 zář 2010 19:11
od Flashka
To uz sem zaskrtnuty mel, takze to nepomohlo - porad stejny problem.

Re: Security tool

Napsal: 22 zář 2010 19:14
od stell
ok, to pocka,
pokracujes:
Stiahni si OTL na plochu.
Dvakrát klikni na OTL.
Keď sa zobrazí okno, nastavenie zmeniť tak, aby výstup Minimal.
Standard registra zmeniť na All.
do okna, Vlastné skenovanie a vlož zeleny text.

Kód: Vybrat vše

reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c
netsvcs
% Systemdrive%\*.*
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\drivers\*.sys /90
% Systemroot%\System32\Spool\prtprocs\w32x86\*. dll
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
nvraid.sys
/md5stop
Klikni na tlačidlo Skenovať.Nemeň žiadne nastavenia,
scan trva [10-15 min]>.potom vloz sem
-OTL.txt (bude na ploche).
vloz sem.

Re: Security tool

Napsal: 22 zář 2010 19:21
od Flashka
stell píše:Standard registra zmeniť na All.
Sry, tohle nechapu a nechci s tim nijak experimentovat, zadny okynko Standart registru proste nevidim :( a nechapu co bys tim mohl myslet
Všechny časy jsou v UTC+01:00
Stránka 1 z 3

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz