VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

vir z facebooku

https://forum.viry.cz:443/viewtopic.php?t=105966

Stránka 1 z 2

vir z facebooku

Napsal: 27 říj 2010 13:11
od Bigmen01
Byl jsem na facebooku a přišel mi odkaz od kamarádky. Klikl jsem na něj a stahnul sme něco. Ted vím že to byla chyba. Mam občas nějake problemy na PC po tomto třeba se mi sam resetl a poslalo tookamžitě všem kontaktum online. Už jsem se tady o něčem dočetl tak vkladam log z Combofix.

ComboFix 10-10-26.03 - admin 27.10.2010 13:58:28.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1791.1326 [GMT 2:00]
Spuštěný z: c:\documents and settings\admin\Plocha\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\admin\Data aplikací\Dealio
c:\documents and settings\admin\Data aplikací\Dealio\res\widgets.xml
c:\documents and settings\admin\Data aplikací\Dealio\temp\http___www_dealio_com_rss_coupons-deals_dotd_.xml
c:\documents and settings\admin\Data aplikací\Desktopicon
c:\documents and settings\admin\Data aplikací\Desktopicon\eBay.ico
c:\documents and settings\admin\Data aplikací\Desktopicon\uninst.exe
c:\program files\Dealio Toolbar
c:\program files\Dealio Toolbar\IE\4.0.2\config.ini
c:\program files\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll
c:\program files\Dealio Toolbar\Res\amazon.gif
c:\program files\Dealio Toolbar\Res\apple.gif
c:\program files\Dealio Toolbar\Res\barnes.gif
c:\program files\Dealio Toolbar\Res\bestbuy.gif
c:\program files\Dealio Toolbar\Res\dealio_logo.gif
c:\program files\Dealio Toolbar\Res\dealio_logo_hover.gif
c:\program files\Dealio Toolbar\Res\ebay.gif
c:\program files\Dealio Toolbar\Res\icon_settings.gif
c:\program files\Dealio Toolbar\Res\macys.gif
c:\program files\Dealio Toolbar\Res\newegg.gif
c:\program files\Dealio Toolbar\Res\overstock.gif
c:\program files\Dealio Toolbar\Res\search-button-hover.gif
c:\program files\Dealio Toolbar\Res\search-button.gif
c:\program files\Dealio Toolbar\Res\search-chevron-hover.gif
c:\program files\Dealio Toolbar\Res\search-chevron.gif
c:\program files\Dealio Toolbar\Res\search_amazon.gif
c:\program files\Dealio Toolbar\Res\search_dealio.gif
c:\program files\Dealio Toolbar\Res\search_ebay.gif
c:\program files\Dealio Toolbar\Res\search_yahoo.gif
c:\program files\Dealio Toolbar\Res\target.gif
c:\program files\Dealio Toolbar\Res\walmart.gif
c:\program files\Dealio Toolbar\Res\widgets.xml
c:\program files\Dealio Toolbar\WidgiHelper.exe
c:\program files\Search Settings
c:\program files\Search Settings\SearchSettings.dll
c:\program files\Search Settings\SearchSettings.exe
c:\program files\Search Settings\SearchSettingsRes409.dll
c:\windows\nvsvc32.exe
c:\windows\system32\config\systemprofile\GLB1A2B.EXE
c:\windows\system32\vbzlib1.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-09-27 do 2010-10-27 )))))))))))))))))))))))))))))))
.

2010-10-23 18:10 . 2010-10-23 18:10 -------- d-----w- c:\program files\Microsoft.NET
2010-10-17 08:57 . 2010-10-17 08:57 -------- d-----w- c:\program files\Cenega Czech
2010-10-11 15:34 . 2010-10-26 17:40 -------- d-----w- c:\program files\Garena
2010-10-08 17:45 . 2010-10-26 21:12 -------- d-----w- c:\program files\Warcraft III
2010-10-06 17:07 . 2010-10-17 08:57 -------- d-----w- c:\program files\Mafia
2010-10-06 12:23 . 2010-10-10 08:47 21840 ----atw- c:\windows\system32\SIntfNT.dll
2010-10-06 12:23 . 2010-10-10 08:47 17212 ----atw- c:\windows\system32\SIntf32.dll
2010-10-06 12:23 . 2010-10-10 08:47 12067 ----atw- c:\windows\system32\SIntf16.dll
2010-10-06 12:22 . 2010-10-06 12:22 94208 ----a-w- c:\windows\DIIUnin.exe
2010-10-06 12:22 . 2010-10-06 12:22 2829 ----a-w- c:\windows\DIIUnin.pif
2010-10-06 12:20 . 2010-10-10 08:47 -------- d-----w- c:\program files\Diablo II
2010-10-05 18:14 . 2010-02-24 13:49 -------- d-----w- c:\program files\Mafia 1 – Plna Verze Hry – CZ
2010-10-05 15:41 . 1999-05-29 08:08 45568 ----a-w- c:\windows\UniFish3.exe
2010-10-05 15:41 . 2010-10-05 15:41 -------- d-----w- c:\program files\Hasbro Interactive
2010-10-05 15:38 . 2010-10-05 15:39 -------- d-----w- c:\program files\Lunapark
2010-10-05 14:41 . 2010-10-05 14:41 -------- d-----w- c:\program files\Common Files\Skype
2010-10-05 14:32 . 2010-10-06 17:17 -------- d-----w- c:\program files\Enlight
2010-09-30 19:00 . 2005-05-26 13:34 2297552 ----a-w- c:\windows\system32\d3dx9_26.dll
2010-09-30 19:00 . 2008-10-14 10:01 14608 ----a-w- c:\windows\system32\iviaspi.sys
2010-09-30 19:00 . 2010-09-30 19:00 -------- d-----w- c:\program files\SanDisk
2010-09-30 18:55 . 2006-05-16 16:11 22752 ----a-w- c:\windows\system32\spupdsvc.exe
2010-09-30 18:55 . 2000-01-04 04:39 212992 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\ILog.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-08 17:54 . 2009-12-17 10:29 2829 ----a-w- c:\windows\War3Unin.pif
2010-10-08 17:54 . 2009-12-17 10:29 139264 ----a-w- c:\windows\War3Unin.exe
2010-09-11 10:15 . 2010-09-11 10:15 34064 ----a-w- c:\windows\system32\lhacm.acm
.

------- Sigcheck -------


[-] 2008-07-23 . 68F06FE0021B01E670AF37B8C5964FDF . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\tcpip.sys

[-] 2008-07-23 . 90B62A1E333091954D55105B2262BC4F . 3480576 . . [7.00.5730.13] . . c:\windows\system32\mshtml.dll

[-] 2008-04-14 . B6B7176FD7DF35682C929D842282B3F9 . 952320 . . [6.00.2900.5512] . . c:\windows\explorer.exe


[-] 2008-07-23 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

[-] 2008-04-14 . 9064261EFF6CE2F5FF1C5E4C41FE8A50 . 30208 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe



c:\windows\System32\drivers\beep.sys ... chybí !!
c:\windows\System32\wscntfy.exe ... chybí !!
c:\windows\System32\regsvc.dll ... chybí !!
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2009-10-19 187192]

[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-05-06 16:11 1145736 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2009-10-19 15:15 1345336 ----a-w- c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2009-10-19 1345336]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-05-06 1145736]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2009-10-19 1345336]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-05-06 1145736]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-07 39408]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-09-02 13351304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"nwiz"="nwiz.exe" [2007-12-05 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2009-06-01 33624064]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2009-10-20 111928]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 30208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2008-07-23 123904]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2010-9-9 113664]
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):58,50,69,7a,65,5f,4c,6f,67,6f,6e,2e,65,78,65,00

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\ICQ7.0\\ICQ.exe"=
"c:\\Program Files\\ICQ7.0\\aolload.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Documents and Settings\\admin\\Data aplikací\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=
"c:\\Program Files\\Nival Interactive\\Etherlords II\\Etherlords2.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [18.8.2009 19:39 78416]
R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [8.1.2010 0:51 380928]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [18.8.2009 19:39 20560]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2.3.2010 20:52 246520]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [16.11.2009 18:33 50704]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [18.8.2009 20:57 1358720]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [30.1.2010 0:06 135664]
S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\Garena\plugins\UI\safedrv.sys --> c:\program files\Garena\plugins\UI\safedrv.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - SRSERVICE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2010-10-27 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-04-16 07:59]

2010-10-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 22:06]

2010-10-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 22:06]

2010-10-24 c:\windows\Tasks\Norton Security Scan for admin.job
- c:\program files\Norton Security Scan\Engine\2.3.0.44\Nss.exe [2009-12-08 11:48]

2010-10-27 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-05-06 16:11]

2010-10-27 c:\windows\Tasks\Úklid 1 kliknutím.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-04-16 07:59]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.humlak.cz/
mStart Page = hxxp://home.sweetim.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
TCP: {50D07A97-7596-4CD2-8DA9-2261E7FCEAE9} = 1.1.1.1,1.1.1.254
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

BHO-{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - c:\program files\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll
Toolbar-{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - c:\program files\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll
HKLM-Run-SearchSettings - c:\program files\Search Settings\SearchSettings.exe
AddRemove-eBay Icon - c:\documents and settings\admin\Data aplikací\Desktopicon\uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-27 14:01
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(724)
c:\windows\system32\cscui.dll
.
Celkový čas: 2010-10-27 14:02:20
ComboFix-quarantined-files.txt 2010-10-27 12:02

Před spuštěním: Volných bajtů: 63 170 478 080
Po spuštění: Volných bajtů: 63 857 025 024

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /noexecute=alwaysoff /noguiboot /bootlogo

- - End Of File - - 59D57DA2CDD882C86239E75E67B457C4

Re: vir z facebooku

Napsal: 27 říj 2010 14:41
od vyosek
Zdravim a pekny den preji :)

:arrow: A cetl jste taky pravidla fora :???:

:arrow: Cetl jste podminky pouziti ComboFixu :???:

Re: vir z facebooku

Napsal: 27 říj 2010 15:16
od Bigmen01
Pravidla fora jsem čelt. Pravidla Combofixu jsem nenašel. Kde je problem? Našel jsem tu par temat a tam vždy bylo napsáno,že viry byly odstraněny tak jsem doufal, že se u mě stane to samé.

Re: vir z facebooku

Napsal: 27 říj 2010 15:38
od vyosek
:arrow: Problemy vyreseny pres PM, takze jdeme mazat dal

:arrow: Vytvorte si na disku C:\ slozku nahrada

:arrow: Stahnete si tento rar soubor http://leteckaposta.cz/786141356 a rozbalte jej do slozky C:\nahrada

:arrow: Zkontrolujte, zda-li mate soubory rozbaleny ve slozce C:\nahrada - pozor na mala a velka pismena atd. a at nejsou soubory ve slozce C:\nahrada\soubory

:arrow: Pokud nemate, tak presunte Combofix na plochu
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    SRPeek::
c:\windows\system32\drivers\tcpip.sys
c:\windows\system32\mshtml.dll
c:\windows\explorer.exe
c:\windows\system32\sfcfiles.dll
c:\windows\system32\ctfmon.exe

FCopy::
C:\nahrada\regsvc.dll | c:\windows\System32\regsvc.dll
C:\nahrada\wscntfy.exe | c:\windows\System32\wscntfy.exe
C:\nahrada\beep.sys | c:\windows\System32\drivers\beep.sys

Folder::
c:\program files\SweetIM
c:\program files\Ask.com
c:\program files\ICQ6Toolbar

Driver::
ICQ Service

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"=-
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"=-
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"=-
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[-HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[-HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[-HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"=-
"Skype"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
"SweetIM"=-
"DivXUpdate"=-

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\Tasks\Norton Security Scan for admin.job
c:\windows\Tasks\Scheduled Update for Ask Toolbar.job

DDS::
mStart Page = hxxp://home.sweetim.com

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
  • Ulozte vytvoreny TXT jako CFScript.txt
  • Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
    Obrázek
  • Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte
:arrow: Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

:arrow: Stahnete SytemLook (viz muj podpis) a ulozte jej na plochu
  • Do okna vlozte skript nize

  • Kód: Vybrat vše

    :filefind
XPize_Logon.exe
  • Kliknete na Look
  • Tlacitko Look se zmeni na Scanning a zsedne
  • Pockejte pokud se tlacitko Scanning opet nezmeni na Look - tak poznate ze SystemLook dokoncil svou praci
  • Vyskoci na Vas log s nazvem SystemLook (pripadne bude ulozen na plose), jeho obsah mi sem vlozte

Re: vir z facebooku

Napsal: 27 říj 2010 16:54
od Bigmen01
To to je log ted eště provedu poslední bod jen ho sem davam abych nezapoměl.
ComboFix 10-10-26.03 - admin 27.10.2010 17:45:02.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1791.1237 [GMT 2:00]
Spuštěný z: c:\documents and settings\admin\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\admin\Plocha\CFScript.txt

FILE ::
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
"c:\windows\Tasks\Norton Security Scan for admin.job"
"c:\windows\Tasks\Scheduled Update for Ask Toolbar.job"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Ask.com
c:\program files\Ask.com\config.xml
c:\program files\Ask.com\GenericAskToolbar.dll
c:\program files\Ask.com\mupcfg.xml
c:\program files\Ask.com\SaUpdate.exe
c:\program files\Ask.com\UpdateTask.exe
c:\program files\ICQ6Toolbar
c:\program files\ICQ6Toolbar\config.xml
c:\program files\ICQ6Toolbar\Icons.bmp
c:\program files\ICQ6Toolbar\ICQ Service.exe
c:\program files\ICQ6Toolbar\icq6Toolbar.ico
c:\program files\ICQ6Toolbar\ICQToolBar.dll
c:\program files\ICQ6Toolbar\ICQUnToolbar.exe
c:\program files\ICQ6Toolbar\logo_small.gif
c:\program files\ICQ6Toolbar\ServiceStarter.exe
c:\program files\ICQ6Toolbar\short.wav
c:\program files\ICQ6Toolbar\Version.txt
c:\program files\SweetIM
c:\program files\SweetIM\Messenger\default.xml
c:\program files\SweetIM\Messenger\mgAdaptersProxy.dll
c:\program files\SweetIM\Messenger\mgAIMAuto.dll
c:\program files\SweetIM\Messenger\mgAIMMessengerAdapter.dll
c:\program files\SweetIM\Messenger\mgArchive.dll
c:\program files\SweetIM\Messenger\mgcommon.dll
c:\program files\SweetIM\Messenger\mgcommunication.dll
c:\program files\SweetIM\Messenger\mgconfig.dll
c:\program files\SweetIM\Messenger\mgFlashPlayer.dll
c:\program files\SweetIM\Messenger\mghooking.dll
c:\program files\SweetIM\Messenger\mgICQAuto.dll
c:\program files\SweetIM\Messenger\mgICQMessengerAdapter.dll
c:\program files\SweetIM\Messenger\mgIEPlayer.dll
c:\program files\SweetIM\Messenger\mglogger.dll
c:\program files\SweetIM\Messenger\mgMediaPlayer.dll
c:\program files\SweetIM\Messenger\mgMsnAuto.dll
c:\program files\SweetIM\Messenger\mgMsnMessengerAdapter.dll
c:\program files\SweetIM\Messenger\mgsimcommon.dll
c:\program files\SweetIM\Messenger\mgSweetIM.dll
c:\program files\SweetIM\Messenger\mgUpdateSupport.dll
c:\program files\SweetIM\Messenger\mgxml_wrapper.dll
c:\program files\SweetIM\Messenger\mgYahooAuto.dll
c:\program files\SweetIM\Messenger\mgYahooMessengerAdapter.dll
c:\program files\SweetIM\Messenger\msvcp71.dll
c:\program files\SweetIM\Messenger\msvcr71.dll
c:\program files\SweetIM\Messenger\resources\images\AudibleButton.png
c:\program files\SweetIM\Messenger\resources\images\DisplayPicturesButton.png
c:\program files\SweetIM\Messenger\resources\images\EmoticonButton.png
c:\program files\SweetIM\Messenger\resources\images\GamesButton.png
c:\program files\SweetIM\Messenger\resources\images\NudgeButton.png
c:\program files\SweetIM\Messenger\resources\images\SoundFxButton.png
c:\program files\SweetIM\Messenger\resources\images\WinksButton.png
c:\program files\SweetIM\Messenger\SweetIM.exe
c:\program files\SweetIM\Toolbars\Internet Explorer\ClearHist.exe
c:\program files\SweetIM\Toolbars\Internet Explorer\conf\logger.xml
c:\program files\SweetIM\Toolbars\Internet Explorer\default.xml
c:\program files\SweetIM\Toolbars\Internet Explorer\mgcommon.dll
c:\program files\SweetIM\Toolbars\Internet Explorer\mgconfig.dll
c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
c:\program files\SweetIM\Toolbars\Internet Explorer\mghooking.dll
c:\program files\SweetIM\Toolbars\Internet Explorer\mglogger.dll
c:\program files\SweetIM\Toolbars\Internet Explorer\mgsimcommon.dll
c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
c:\program files\SweetIM\Toolbars\Internet Explorer\mgxml_wrapper.dll
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\about.html
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\affid.dat
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\basis.xml
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\bing.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\clear-history.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\content-notifier-anim-over.gif
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\content-notifier-anim.gif
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\content-notifier.js
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\dating.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\dictionary.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\e_cards.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\eye_icon.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\eye_icon_over.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\find.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\free_stuff.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\games.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\glitter.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\google.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\help.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\highlight.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\locales.xml
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\logo_16x16.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\logo_21x18.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\logo_32x32.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\logo_about.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\more-search-providers.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\music.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\news.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\options.html
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\photos.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\search-current-site.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\shopping.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\SmileySmile.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\SmileyWink.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\sweetim_text.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\Thumbs.db
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\toolbar.xml
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\version.txt
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\video.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\web-search.png
c:\program files\SweetIM\Toolbars\Internet Explorer\resources\yahoo.png
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\Tasks\Norton Security Scan for admin.job
c:\windows\Tasks\Scheduled Update for Ask Toolbar.job

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ICQ_SERVICE
-------\Service_ICQ Service


((((((((((((((((((((((((( Soubory vytvořené od 2010-09-27 do 2010-10-27 )))))))))))))))))))))))))))))))
.

2010-10-27 15:48 . 2010-10-27 15:48 -------- d-----w- c:\windows\system32\xircom
2010-10-27 15:48 . 2010-10-27 15:48 -------- d-----w- c:\windows\system32\wbem\snmp
2010-10-27 15:48 . 2010-10-27 15:48 -------- d-----w- c:\windows\system32\oobe
2010-10-27 15:48 . 2010-10-27 15:48 -------- d-----w- c:\windows\srchasst
2010-10-27 15:48 . 2010-10-27 15:48 -------- d-----w- c:\windows\msagent
2010-10-27 15:48 . 2010-10-27 15:48 -------- d-----w- c:\program files\microsoft frontpage
2010-10-27 15:40 . 2010-10-27 15:41 -------- d-----w- C:\náhrada
2010-10-23 18:10 . 2010-10-23 18:10 -------- d-----w- c:\program files\Microsoft.NET
2010-10-17 08:57 . 2010-10-17 08:57 -------- d-----w- c:\program files\Cenega Czech
2010-10-11 15:34 . 2010-10-27 15:06 -------- d-----w- c:\program files\Garena
2010-10-08 17:45 . 2010-10-27 15:31 -------- d-----w- c:\program files\Warcraft III
2010-10-06 17:07 . 2010-10-17 08:57 -------- d-----w- c:\program files\Mafia
2010-10-06 12:23 . 2010-10-10 08:47 21840 ----atw- c:\windows\system32\SIntfNT.dll
2010-10-06 12:23 . 2010-10-10 08:47 17212 ----atw- c:\windows\system32\SIntf32.dll
2010-10-06 12:23 . 2010-10-10 08:47 12067 ----atw- c:\windows\system32\SIntf16.dll
2010-10-06 12:22 . 2010-10-06 12:22 94208 ----a-w- c:\windows\DIIUnin.exe
2010-10-06 12:22 . 2010-10-06 12:22 2829 ----a-w- c:\windows\DIIUnin.pif
2010-10-06 12:20 . 2010-10-10 08:47 -------- d-----w- c:\program files\Diablo II
2010-10-05 18:14 . 2010-02-24 13:49 -------- d-----w- c:\program files\Mafia 1 – Plna Verze Hry – CZ
2010-10-05 15:41 . 1999-05-29 08:08 45568 ----a-w- c:\windows\UniFish3.exe
2010-10-05 15:41 . 2010-10-05 15:41 -------- d-----w- c:\program files\Hasbro Interactive
2010-10-05 15:38 . 2010-10-05 15:39 -------- d-----w- c:\program files\Lunapark
2010-10-05 14:41 . 2010-10-05 14:41 -------- d-----w- c:\program files\Common Files\Skype
2010-10-05 14:32 . 2010-10-06 17:17 -------- d-----w- c:\program files\Enlight
2010-09-30 19:00 . 2005-05-26 13:34 2297552 ----a-w- c:\windows\system32\d3dx9_26.dll
2010-09-30 19:00 . 2008-10-14 10:01 14608 ----a-w- c:\windows\system32\iviaspi.sys
2010-09-30 19:00 . 2010-09-30 19:00 -------- d-----w- c:\program files\SanDisk
2010-09-30 18:55 . 2006-05-16 16:11 22752 ----a-w- c:\windows\system32\spupdsvc.exe
2010-09-30 18:55 . 2000-01-04 04:39 212992 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\ILog.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-08 17:54 . 2009-12-17 10:29 2829 ----a-w- c:\windows\War3Unin.pif
2010-10-08 17:54 . 2009-12-17 10:29 139264 ----a-w- c:\windows\War3Unin.exe
2010-09-11 10:15 . 2010-09-11 10:15 34064 ----a-w- c:\windows\system32\lhacm.acm
.

(((((((((((((((((((((((((((((((((((((((((( SR_Search ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
------- Sigcheck -------


[-] 2008-07-23 . 68F06FE0021B01E670AF37B8C5964FDF . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\tcpip.sys

[-] 2008-07-23 . 90B62A1E333091954D55105B2262BC4F . 3480576 . . [7.00.5730.13] . . c:\windows\system32\mshtml.dll

[-] 2008-04-14 . B6B7176FD7DF35682C929D842282B3F9 . 952320 . . [6.00.2900.5512] . . c:\windows\explorer.exe


[-] 2008-07-23 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

[-] 2008-04-14 . 9064261EFF6CE2F5FF1C5E4C41FE8A50 . 30208 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe



c:\windows\System32\drivers\beep.sys ... chybí !!
c:\windows\System32\wscntfy.exe ... chybí !!
c:\windows\System32\regsvc.dll ... chybí !!
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"nwiz"="nwiz.exe" [2007-12-05 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2009-06-01 33624064]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 30208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2008-07-23 123904]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2010-9-9 113664]
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):58,50,69,7a,65,5f,4c,6f,67,6f,6e,2e,65,78,65,00

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\ICQ7.0\\ICQ.exe"=
"c:\\Program Files\\ICQ7.0\\aolload.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Documents and Settings\\admin\\Data aplikací\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=
"c:\\Program Files\\Nival Interactive\\Etherlords II\\Etherlords2.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [18.8.2009 19:39 78416]
R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [8.1.2010 0:51 380928]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [18.8.2009 19:39 20560]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [16.11.2009 18:33 50704]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [18.8.2009 20:57 1358720]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [30.1.2010 0:06 135664]
S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\Garena\plugins\UI\safedrv.sys --> c:\program files\Garena\plugins\UI\safedrv.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2010-10-27 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-04-16 07:59]

2010-10-27 c:\windows\Tasks\Úklid 1 kliknutím.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-04-16 07:59]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.humlak.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
TCP: {50D07A97-7596-4CD2-8DA9-2261E7FCEAE9} = 1.1.1.1,1.1.1.254
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-ICQToolbar - c:\program files\ICQ6Toolbar\ICQUnToolbar.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-27 17:49
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(724)
c:\windows\system32\cscui.dll

- - - - - - - > 'explorer.exe'(2180)
c:\windows\system32\SHDOCVW.dll
c:\windows\System32\cscui.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\nvsvc32.exe
.
**************************************************************************
.
Celkový čas: 2010-10-27 17:51:13 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-10-27 15:51
ComboFix2.txt 2010-10-27 12:02

Před spuštěním: Volných bajtů: 63 848 357 888
Po spuštění: Volných bajtů: 63 793 172 480

- - End Of File - - 33C79194990170AB4619B9D88ABA8291

Re: vir z facebooku

Napsal: 27 říj 2010 16:56
od Bigmen01
a log ze systemlooku
SystemLook 04.09.10 by jpshortstuff
Log created at 17:55 on 27/10/2010 by admin
Administrator - Elevation successful

========== filefind ==========

Searching for "XPize_Logon.exe"
C:\WINDOWS\system32\XPize_Logon.exe --a---- 2789888 bytes [16:42 18/08/2009] [06:52 14/04/2008] 55C37C2F4678138B2BE7F22BEBB3EFF7

-= EOF =-

Re: vir z facebooku

Napsal: 27 říj 2010 17:02
od vyosek
:arrow: CF nic nekopiroval, bud je slaby na tohle a nebo asi byly soubory nekde jinde, no nevadi, podivame se po nich a jeste po nejakych dalsich

:arrow: Dalsi skript pro SystemLook

Kód: Vybrat vše

:filefind
tcpip.sys
mshtml.dll
explorer.exe
sfcfiles.dll
ctfmon.exe
beep.sys
wscntfy.exe
regsvc.dll
:arrow: Nasledujici soubory otestujte na VirusTotalu (viz muj podpis)
  • C:\WINDOWS\system32\XPize_Logon.exe
  • Kliknete na Prochazet
  • Soubor nehledejte, jen vlozte cestu souboru, ktery chci otestovat
  • Pokud na Vas vyskoci obrazovka jako je nize, tak kliknete na ReAnalyse
    Obrázek
  • Kliknete na Otestovat soubor
  • Vysledek analyzy sem vlozte (jako odkaz)

Re: vir z facebooku

Napsal: 27 říj 2010 17:04
od Bigmen01
SystemLook a du provést poslední bod.

SystemLook 04.09.10 by jpshortstuff
Log created at 18:03 on 27/10/2010 by admin
Administrator - Elevation successful

========== filefind ==========

Searching for "tcpip.sys"
C:\WINDOWS\system32\drivers\tcpip.sys --a---- 361344 bytes [19:11 23/07/2008] [19:11 23/07/2008] 68F06FE0021B01E670AF37B8C5964FDF

Searching for "mshtml.dll"
C:\WINDOWS\system32\mshtml.dll --a---- 3480576 bytes [14:40 23/07/2008] [14:40 23/07/2008] 90B62A1E333091954D55105B2262BC4F

Searching for "explorer.exe"
C:\WINDOWS\explorer.exe --a---- 952320 bytes [06:52 14/04/2008] [06:52 14/04/2008] B6B7176FD7DF35682C929D842282B3F9

Searching for "sfcfiles.dll"
C:\WINDOWS\system32\sfcfiles.dll --a---- 1571840 bytes [14:40 23/07/2008] [14:40 23/07/2008] 1E603EA2A3FDBAE9E5B88A8CB3C03124

Searching for "ctfmon.exe"
C:\WINDOWS\system32\ctfmon.exe --a---- 30208 bytes [06:52 14/04/2008] [06:52 14/04/2008] 9064261EFF6CE2F5FF1C5E4C41FE8A50

Searching for "beep.sys"
C:\náhrada\beep.sys --a---- 4224 bytes [15:41 27/10/2010] [13:26 17/08/2009] DA1F27D85E0D1525F6621372E7B685E9

Searching for "wscntfy.exe"
C:\náhrada\wscntfy.exe --a---- 13824 bytes [15:41 27/10/2010] [13:27 17/08/2009] 278A14BEDEF58687EAF8BEC056A78D8B

Searching for "regsvc.dll"
C:\náhrada\regsvc.dll --a---- 51712 bytes [15:41 27/10/2010] [15:19 13/05/2004] 9DF4527D53613601D3F79946EAA1DCB1

-= EOF =-

Re: vir z facebooku

Napsal: 27 říj 2010 17:10
od Bigmen01
poslední bod: vložím C:\WINDOWS\system32\XPize_Logon.exe a nic dalšího se mi neukaže.

Re: vir z facebooku

Napsal: 27 říj 2010 17:12
od vyosek
:arrow: Dal jste otestovat soubor :???:

Re: vir z facebooku

Napsal: 27 říj 2010 17:22
od Bigmen01
prave že to tam nikde neni

Re: vir z facebooku

Napsal: 27 říj 2010 17:23
od vyosek
Omlouvam se, jeste nam to nepocestili, dejte Send File

Re: vir z facebooku

Napsal: 27 říj 2010 17:28
od Bigmen01
http://www.virustotal.com/file-scan/rep ... 1288196742

Re: vir z facebooku

Napsal: 27 říj 2010 17:31
od vyosek
:arrow: Mel jsem jinak pojemenouvanou slozku, ja psal nahrada, vy jste dal náhrada - nechte ji tak

:arrow: Stahnete jeste tenhle rar http://leteckaposta.cz/819628949 a rozbalte do te slozky C:\náhrada

:arrow: Novy skript pro ComboFix - postup je stejny jako minule

Kód: Vybrat vše

FCopy::
C:\náhrada\regsvc.dll | c:\windows\System32\regsvc.dll
C:\náhrada\wscntfy.exe | c:\windows\System32\wscntfy.exe
C:\náhrada\beep.sys | c:\windows\System32\drivers\beep.sys
C:\náhrada\ctfmon.exe | C:\WINDOWS\system32\ctfmon.exe
C:\náhrada\sfcfiles.dll | C:\WINDOWS\system32\sfcfiles.dll
C:\náhrada\explorer.exe | C:\WINDOWS\explorer.exe
C:\náhrada\mshtml.dll | C:\WINDOWS\system32\mshtml.dll
C:\náhrada\tcpip.sys |C:\WINDOWS\system32\drivers\tcpip.sys

Re: vir z facebooku

Napsal: 27 říj 2010 17:46
od Bigmen01
ComboFix 10-10-26.03 - admin 27.10.2010 18:38:45.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1791.1401 [GMT 2:00]
Spuštěný z: c:\documents and settings\admin\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\admin\Plocha\CFScript.txt.txt
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
--------------- FCopy ---------------

c:\náhrada\regsvc.dll --> c:\windows\System32\regsvc.dll
c:\náhrada\wscntfy.exe --> c:\windows\System32\wscntfy.exe
c:\náhrada\beep.sys --> c:\windows\System32\drivers\beep.sys
c:\náhrada\ctfmon.exe --> c:\windows\system32\ctfmon.exe
c:\náhrada\sfcfiles.dll --> c:\windows\system32\sfcfiles.dll
c:\náhrada\explorer.exe --> c:\windows\explorer.exe
c:\náhrada\mshtml.dll --> c:\windows\system32\mshtml.dll
c:\náhrada\tcpip.sys --> c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-09-27 do 2010-10-27 )))))))))))))))))))))))))))))))
.

2010-10-27 16:38 . 2009-08-17 13:27 13824 ----a-w- c:\windows\system32\wscntfy.exe
2010-10-27 16:38 . 2009-08-17 13:27 13824 ----a-w- c:\windows\system32\dllcache\wscntfy.exe
2010-10-27 16:38 . 2009-08-17 13:26 4224 ----a-w- c:\windows\system32\drivers\beep.sys
2010-10-27 16:38 . 2009-08-17 13:26 4224 ----a-w- c:\windows\system32\dllcache\beep.sys
2010-10-27 16:38 . 2004-05-13 15:19 51712 ----a-w- c:\windows\system32\regsvc.dll
2010-10-27 15:48 . 2010-10-27 15:48 -------- d-----w- c:\windows\system32\xircom
2010-10-27 15:48 . 2010-10-27 15:48 -------- d-----w- c:\windows\system32\wbem\snmp
2010-10-27 15:48 . 2010-10-27 15:48 -------- d-----w- c:\windows\system32\oobe
2010-10-27 15:48 . 2010-10-27 15:48 -------- d-----w- c:\windows\srchasst
2010-10-27 15:48 . 2010-10-27 15:48 -------- d-----w- c:\windows\msagent
2010-10-27 15:48 . 2010-10-27 15:48 -------- d-----w- c:\program files\microsoft frontpage
2010-10-27 15:40 . 2010-10-27 16:36 -------- d-----w- C:\náhrada
2010-10-23 18:10 . 2010-10-23 18:10 -------- d-----w- c:\program files\Microsoft.NET
2010-10-17 08:57 . 2010-10-17 08:57 -------- d-----w- c:\program files\Cenega Czech
2010-10-11 15:34 . 2010-10-27 15:06 -------- d-----w- c:\program files\Garena
2010-10-08 17:45 . 2010-10-27 15:31 -------- d-----w- c:\program files\Warcraft III
2010-10-06 17:07 . 2010-10-17 08:57 -------- d-----w- c:\program files\Mafia
2010-10-06 12:23 . 2010-10-10 08:47 21840 ----atw- c:\windows\system32\SIntfNT.dll
2010-10-06 12:23 . 2010-10-10 08:47 17212 ----atw- c:\windows\system32\SIntf32.dll
2010-10-06 12:23 . 2010-10-10 08:47 12067 ----atw- c:\windows\system32\SIntf16.dll
2010-10-06 12:22 . 2010-10-06 12:22 94208 ----a-w- c:\windows\DIIUnin.exe
2010-10-06 12:22 . 2010-10-06 12:22 2829 ----a-w- c:\windows\DIIUnin.pif
2010-10-06 12:20 . 2010-10-10 08:47 -------- d-----w- c:\program files\Diablo II
2010-10-05 18:14 . 2010-02-24 13:49 -------- d-----w- c:\program files\Mafia 1 – Plna Verze Hry – CZ
2010-10-05 15:41 . 1999-05-29 08:08 45568 ----a-w- c:\windows\UniFish3.exe
2010-10-05 15:41 . 2010-10-05 15:41 -------- d-----w- c:\program files\Hasbro Interactive
2010-10-05 15:38 . 2010-10-05 15:39 -------- d-----w- c:\program files\Lunapark
2010-10-05 14:41 . 2010-10-05 14:41 -------- d-----w- c:\program files\Common Files\Skype
2010-10-05 14:32 . 2010-10-06 17:17 -------- d-----w- c:\program files\Enlight
2010-09-30 19:00 . 2005-05-26 13:34 2297552 ----a-w- c:\windows\system32\d3dx9_26.dll
2010-09-30 19:00 . 2008-10-14 10:01 14608 ----a-w- c:\windows\system32\iviaspi.sys
2010-09-30 19:00 . 2010-09-30 19:00 -------- d-----w- c:\program files\SanDisk
2010-09-30 18:55 . 2006-05-16 16:11 22752 ----a-w- c:\windows\system32\spupdsvc.exe
2010-09-30 18:55 . 2000-01-04 04:39 212992 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\ILog.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-08 17:54 . 2009-12-17 10:29 2829 ----a-w- c:\windows\War3Unin.pif
2010-10-08 17:54 . 2009-12-17 10:29 139264 ----a-w- c:\windows\War3Unin.exe
2010-09-11 10:15 . 2010-09-11 10:15 34064 ----a-w- c:\windows\system32\lhacm.acm
.

------- Sigcheck -------

[-] 2009-08-17 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys

[-] 2009-08-17 . D6DA6137433E02999C1229DC692250CD . 5937152 . . [8.00.6001.18812] . . c:\windows\system32\mshtml.dll

[-] 2004-05-13 . 9DF4527D53613601D3F79946EAA1DCB1 . 51712 . . [5.1.2600.0] . . c:\windows\system32\regsvc.dll

.
((((((((((((((((((((((((((((( SnapShot@2010-10-27_12.01.10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-14 06:52 . 2009-08-17 13:26 15360 c:\windows\system32\dllcache\ctfmon.exe
+ 2008-04-14 06:52 . 2009-08-17 13:26 1034240 c:\windows\system32\dllcache\explorer.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-07 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"nwiz"="nwiz.exe" [2007-12-05 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2009-06-01 33624064]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2009-08-17 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2008-07-23 123904]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2010-9-9 113664]
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):58,50,69,7a,65,5f,4c,6f,67,6f,6e,2e,65,78,65,00

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\ICQ7.0\\ICQ.exe"=
"c:\\Program Files\\ICQ7.0\\aolload.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Documents and Settings\\admin\\Data aplikací\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=
"c:\\Program Files\\Nival Interactive\\Etherlords II\\Etherlords2.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [18.8.2009 19:39 78416]
R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [8.1.2010 0:51 380928]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [18.8.2009 19:39 20560]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [16.11.2009 18:33 50704]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [18.8.2009 20:57 1358720]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [30.1.2010 0:06 135664]
S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\Garena\plugins\UI\safedrv.sys --> c:\program files\Garena\plugins\UI\safedrv.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2010-10-27 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-04-16 07:59]

2010-10-27 c:\windows\Tasks\Úklid 1 kliknutím.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-04-16 07:59]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.humlak.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
TCP: {50D07A97-7596-4CD2-8DA9-2261E7FCEAE9} = 1.1.1.1,1.1.1.254
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-27 18:41
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(724)
c:\windows\system32\cscui.dll
.
Celkový čas: 2010-10-27 18:41:53
ComboFix-quarantined-files.txt 2010-10-27 16:41
ComboFix2.txt 2010-10-27 15:51
ComboFix3.txt 2010-10-27 12:02

Před spuštěním: Volných bajtů: 63 782 592 512
Po spuštění: Volných bajtů: 63 761 612 800

- - End Of File - - C20C89448F49DBC169E746621E7C4238
Všechny časy jsou v UTC+01:00
Stránka 1 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz