VIRY.CZ

Dobrý večer všem,

prosím o pomoc s problémem při odstraňování viru z webových stránek, na kterých je provozován eshop. Vir se na web dostal s největší pravděpodobností za pomoci trojana, který odposlouchal uložené heslo v TC. Tento vir upravil veškeré index.php a vytvořil složku .log, do které nasypal veškeré stránky s různým smetím (porno apod.) Veškeré indexy jsem samozřejmě obnovil ze zálohy, ale řeším problém se složkou .log, kterou nelze odstranit, jelikož se sama obnovuje. S existencí virů je spojena samozřejmě vyšší náročnost na provoz webu s ohledem na vysoké návštěvy.

Níže přikládám dle návodu výpis logu z RITS + hlášení Nortona při přístupu na stránky:

Log

Logfile of random's system information tool 1.08 (written by random/random)
Run by Lubomír Jungwirth at 2011-02-08 00:01:46
Microsoft Windows 7 Professional
System drive C: has 7 GB (7%) free of 105 GB
Total RAM: 3063 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 0:02:12, on 8.2.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\DNsoft.be\Shutdown Scheduler\PC Shutdown.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Miranda IM KP v5.0.8.5\miranda32.exe
C:\Program Files\Common Files\Nokia\NoA\nokiaaserver.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Lubomír Jungwirth\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Lubomír Jungwirth\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Lubomír Jungwirth\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0VPAUGG1\RSIT[1].exe
C:\Program Files\trend micro\Lubomír Jungwirth.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files\Google\Chrome Frame\Application\9.0.597.84\npchrome_frame.dll
O2 - BHO: DownloadHelper Class - {FF2573AE-E1ED-40e1-83BA-F544CB2EE135} - C:\Program Files\Common Files\Download Helper\DownloadHelper.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Miranda IM] C:\Program Files\Miranda IM KP v5.0.8.5\launcher.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [NokiaOviSuite2] C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Google Update] "C:\Users\Lubomír Jungwirth\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Shutdown_Manager] C:\Program Files\DNsoft.be\Shutdown Scheduler\PC Shutdown.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O15 - Trusted Zone: http://www.quakelive.com
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... ader55.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files\Google\Chrome Frame\Application\9.0.597.84\npchrome_frame.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 7514 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2742644661-1443261293-2840709020-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2742644661-1443261293-2840709020-1000UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-09-15 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7}]
ChromeFrame BHO - C:\Program Files\Google\Chrome Frame\Application\9.0.597.84\npchrome_frame.dll [2011-01-29 4423224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FF2573AE-E1ED-40e1-83BA-F544CB2EE135}]
DownloadHelper Class - C:\Program Files\Common Files\Download Helper\DownloadHelper.dll [2009-12-03 592896]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2010-11-06 281768]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-09-23 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 173592]
"Persistence"=C:\Windows\system32\igfxpers.exe [2009-09-23 150552]
"NokiaMServer"=C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup []
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Miranda IM"=C:\Program Files\Miranda IM KP v5.0.8.5\launcher.exe [2009-03-22 258048]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]
"NokiaOviSuite2"=C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [2010-09-02 672632]
""= []
"SpywareTerminatorUpdate"=C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2010-09-30 3037696]
"PC Suite Tray"=C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2009-06-12 1414144]
"Google Update"=C:\Users\Lubomír [2011-02-06 67410]
"Shutdown_Manager"=C:\Program Files\DNsoft.be\Shutdown Scheduler\PC Shutdown.exe [2007-03-23 1081344]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shutdown_Manager]
C:\Program Files\DNsoft.be\Shutdown Scheduler\PC Shutdown.exe [2007-03-23 1081344]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoipCheapCom]
C:\Program Files\VoipCheapCom.com\VoipCheapCom\VoipCheapCom.exe -nosplash -minimized []

C:\Users\Lubomír Jungwirth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 218112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 3 months======

2011-02-08 00:01:46 ----D---- C:\rsit
2011-02-08 00:01:46 ----D---- C:\Program Files\trend micro
2011-02-05 04:02:44 ----D---- C:\ProgramData\NortonInstaller
2011-02-05 04:02:44 ----D---- C:\Program Files\NortonInstaller
2011-02-02 11:16:35 ----D---- C:\Users\Lubomír Jungwirth\AppData\Roaming\Nokia Ovi Suite
2011-01-24 22:18:03 ----D---- C:\PFiles
2011-01-17 01:08:21 ----D---- C:\Program Files\CCleaner
2011-01-12 11:01:01 ----A---- C:\Windows\system32\odbc32.dll
2011-01-12 11:00:56 ----A---- C:\Windows\system32\mf.dll
2011-01-12 11:00:56 ----A---- C:\Windows\system32\DWrite.dll
2011-01-12 11:00:56 ----A---- C:\Windows\system32\d3d10warp.dll
2011-01-12 11:00:56 ----A---- C:\Windows\system32\d2d1.dll
2011-01-12 11:00:55 ----A---- C:\Windows\system32\XpsPrint.dll
2011-01-12 11:00:55 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2011-01-12 11:00:55 ----A---- C:\Windows\system32\WMVDECOD.DLL
2011-01-12 11:00:55 ----A---- C:\Windows\system32\FntCache.dll
2011-01-12 11:00:55 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2011-01-12 11:00:55 ----A---- C:\Windows\system32\d3d10_1core.dll
2011-01-12 11:00:55 ----A---- C:\Windows\system32\cdd.dll
2011-01-12 11:00:54 ----A---- C:\Windows\system32\XpsRasterService.dll
2011-01-12 11:00:54 ----A---- C:\Windows\system32\mfreadwrite.dll
2011-01-12 11:00:54 ----A---- C:\Windows\system32\ExplorerFrame.dll
2011-01-12 11:00:54 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2011-01-12 11:00:54 ----A---- C:\Windows\system32\d3d10_1.dll
2010-12-18 00:16:25 ----D---- C:\7886549936a5c9cca8
2010-12-15 11:27:49 ----A---- C:\Windows\system32\tzres.dll
2010-12-15 11:27:38 ----A---- C:\Windows\system32\iertutil.dll
2010-12-15 11:27:37 ----A---- C:\Windows\system32\mstime.dll
2010-12-15 11:27:37 ----A---- C:\Windows\system32\mshtml.dll
2010-12-15 11:27:36 ----A---- C:\Windows\system32\ieframe.dll
2010-12-15 11:27:35 ----A---- C:\Windows\system32\wininet.dll
2010-12-15 11:27:35 ----A---- C:\Windows\system32\urlmon.dll
2010-12-15 11:27:35 ----A---- C:\Windows\system32\msfeeds.dll
2010-12-15 11:27:34 ----A---- C:\Windows\system32\mshtmled.dll
2010-12-15 11:27:34 ----A---- C:\Windows\system32\msfeedssync.exe
2010-12-15 11:27:34 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-12-15 11:27:34 ----A---- C:\Windows\system32\licmgr10.dll
2010-12-15 11:27:34 ----A---- C:\Windows\system32\jsproxy.dll
2010-12-15 11:27:34 ----A---- C:\Windows\system32\ieui.dll
2010-12-15 11:27:34 ----A---- C:\Windows\system32\iepeers.dll
2010-12-15 11:27:34 ----A---- C:\Windows\system32\iedkcs32.dll
2010-12-15 11:27:29 ----A---- C:\Windows\system32\wmicmiplugin.dll
2010-12-15 11:27:29 ----A---- C:\Windows\system32\taskschd.dll
2010-12-15 11:27:29 ----A---- C:\Windows\system32\taskeng.exe
2010-12-15 11:27:29 ----A---- C:\Windows\system32\schedsvc.dll
2010-12-15 11:27:28 ----A---- C:\Windows\system32\taskcomp.dll
2010-12-15 11:27:28 ----A---- C:\Windows\system32\schtasks.exe
2010-12-15 11:27:25 ----A---- C:\Windows\system32\webio.dll
2010-12-15 11:27:24 ----A---- C:\Windows\system32\atmfd.dll
2010-12-15 11:27:23 ----A---- C:\Windows\system32\atmlib.dll
2010-12-15 11:27:20 ----A---- C:\Windows\system32\consent.exe
2010-12-15 11:26:43 ----A---- C:\Windows\system32\win32k.sys
2010-11-16 12:13:09 ----D---- C:\dd15e9bd8af7a8e2cef7f887bba7

======List of files/folders modified in the last 3 months======

2011-02-08 00:01:58 ----D---- C:\Windows\Prefetch
2011-02-08 00:01:54 ----D---- C:\Windows\Temp
2011-02-08 00:01:46 ----RD---- C:\Program Files
2011-02-07 23:55:32 ----D---- C:\Windows\Tasks
2011-02-07 23:13:48 ----D---- C:\Windows\system32\config
2011-02-07 22:57:00 ----D---- C:\ProgramData\Spyware Terminator
2011-02-06 16:35:16 ----D---- C:\Windows\debug
2011-02-06 15:43:16 ----D---- C:\Windows\system32\NDF
2011-02-06 14:05:26 ----D---- C:\Windows\System32
2011-02-06 14:05:26 ----D---- C:\Windows\inf
2011-02-06 14:05:26 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-02-05 17:50:50 ----SHD---- C:\System Volume Information
2011-02-05 04:02:44 ----HD---- C:\ProgramData
2011-02-04 23:57:18 ----D---- C:\Users\Lubomír Jungwirth\AppData\Roaming\Spyware Terminator
2011-02-03 17:27:44 ----D---- C:\Windows\system32\catroot2
2011-02-02 11:16:33 ----D---- C:\Users\Lubomír Jungwirth\AppData\Roaming\Nokia
2011-01-24 22:18:04 ----SHD---- C:\Windows\Installer
2011-01-24 22:18:04 ----SHD---- C:\Config.Msi
2011-01-14 23:35:26 ----D---- C:\Windows\winsxs
2011-01-14 16:32:38 ----D---- C:\Windows\system32\drivers
2011-01-13 10:16:46 ----A---- C:\Windows\system32\MRT.exe
2011-01-13 10:16:20 ----D---- C:\ProgramData\Microsoft Help
2011-01-12 21:21:49 ----D---- C:\Windows\system32\catroot
2011-01-04 12:53:17 ----D---- C:\Windows\Microsoft.NET
2011-01-04 12:53:14 ----RSD---- C:\Windows\assembly
2011-01-04 00:23:59 ----D---- C:\Program Files\Common Files\microsoft shared
2010-12-24 20:24:07 ----D---- C:\Program Files\Starcraft
2010-12-18 00:18:01 ----D---- C:\Windows\system32\en-US
2010-12-18 00:18:01 ----D---- C:\Program Files\Microsoft.NET
2010-12-15 21:06:05 ----D---- C:\Windows\rescache
2010-12-15 20:14:38 ----D---- C:\Windows\system32\cs-CZ
2010-12-15 20:14:38 ----D---- C:\Program Files\Windows Mail
2010-12-15 20:14:37 ----D---- C:\Windows\system32\migration
2010-12-15 20:14:37 ----D---- C:\Program Files\Internet Explorer
2010-11-30 00:43:42 ----SD---- C:\Users\Lubomír Jungwirth\AppData\Roaming\Microsoft
2010-11-11 19:06:47 ----A---- C:\Windows\ODBC.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2009-11-14 691696]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2010-12-22 135096]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2010-11-22 61960]
R3 E100B;Intel(R) PRO Adapter Driver; C:\Windows\system32\DRIVERS\e100b325.sys [2009-07-13 159232]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 32bitový systém Windows Vista; C:\Windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 agzv7hxz;agzv7hxz; C:\Windows\system32\drivers\agzv7hxz.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 JL2005C;Dual Mode Camera; C:\Windows\System32\Drivers\jl2005c.sys [2008-03-11 68762]
S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmb.sys [2010-02-26 18176]
S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbo.sys [2010-02-26 22528]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2010-02-26 8192]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2009-07-14 27648]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2010-02-26 8192]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2010-12-15 267944]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2010-11-06 135336]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2010-08-28 75064]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2010-09-30 488960]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-06-14 615936]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-30 135664]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2009-06-10 31064]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-29 1343400]

-----------------EOF-----------------
[/code]

Hlášení Nortona:

Kód: Vybrat vše

Trojan.Malscript!html is a detection name used by Symantec to identify HTML files that contain malicious JavaScript. 
 
HTML files may contain malicious content for a number of reasons. The files may have been specially crafted to be intrinsically malicious, or they may be legitimate HTML files that have been infected by threats such as W32.Ramnit or W32.Fujacks.CE. The files may be downloaded on to the computer during Web browsing, by other malware, inside archive files, and through various other methods.
 
With the Web browser now used for online shopping, banking, social networking, and entertainment, it has become one of the most popular targets for attackers. The attack surface is large, with third-party plugins and extensions that extend browser capabilities also being vulnerable to attack. Browser compromise can therefore be the cause of some of the most significant security breaches and hence can cause a great deal of harm to compromised computers and the victims of the attacks.
 
Authors of malicious JavaScript may go to lengths to ensure that their code is obfuscated so that its functionality is hidden from casual observers and to complicate the task of analysis. Obfuscation may also be used in an attempt to create code that is able to circumvent security software.
 
When injected into an HTML file, malicious JavaScript can:
 
Exploit browser and plugin vulnerabilities to run arbitrary code
Display fake antivirus scans and other fraudulent information
Download JavaScript, HTML, and other files
Hijack browsing sessions
Redirect users to malicious websites
 
Steal information

Trojan už byl z počítače odstraněn, ale stále si nevím rady s odstraněním složky .log. Předpokládám, že zatím bude asi jakýsi skript, který zajišťuje automatické generování složky. Díky za každou radu při řešení tohoto problému.

Dobrý večer

Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT

-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.

Děkuji za odpověď. Program jsem stáhl, nainstaloval a provedl kontrolu, ale nic nežádoucího nebylo nalezeno, viz. níže uvedený report. Je to možná dáno i tím, že ještě předtím jsem umístil pomocí Avira antivirusu jednoho trojana do karantény.

Kód: Vybrat vše

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verze databáze: 5718

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

9.2.2011 13:44:38
mbam-log-2011-02-09 (13-44-38).txt

Typ kontroly: Rychlý test
Testované objekty: 180999
Uplynulý čas: 11 minut, 58 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

Děkuji za pomoc.

Jaký trojan, jaký soubor je v karanténě aviry?

Děkuji za rychlou reakci a níže přikládám exportovaný výpis karantený Aviry.

Type: File
Source: C:\Users\...\Downloads\lindo_systems_lingo_11.0(vseborec.cz-75n8y).rar
Status: Infected
Quarantine object: 48d31d30.qua
Restored: NO
Uploaded to Avira: NO
Operating System: Windows 2000/XP/VISTA Workstation
Search engine: 8.02.04.150
Virus definition file: 7.11.02.31
Detection: Is the TR/Crypt.XPACK.Gen Trojan
Date/Time: 5.2.2011, 3:42

Type: File
Source: C:\Users\...\AppData\Local\Temp\jar_cache4064511186811110683.tmp
Status: Infected
Quarantine object: 5040329f.qua
Restored: NO
Uploaded to Avira: NO
Operating System: Windows 2000/XP/VISTA Workstation
Search engine: 8.02.04.150
Virus definition file: 7.11.02.31
Detection: Contains recognition pattern of the JAVA/Agent.DE.1 Java virus
Date/Time: 5.2.2011, 3:42

Type: File
Source: C:\Users\...\AppData\Local\Microsoft\Windows\Burn\Burn\Downloads\lindo_systems_lingo_11.0(vseborec.cz-75n8y).rar
Status: Infected
Quarantine object: 021b687f.qua
Restored: NO
Uploaded to Avira: NO
Operating System: Windows 2000/XP/VISTA Workstation
Search engine: 8.02.04.150
Virus definition file: 7.11.02.31
Detection: Is the TR/Crypt.XPACK.Gen Trojan
Date/Time: 5.2.2011, 3:42

Type: File
Source: C:\Users\...\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VONNJHCS\1125357739-navod-google-talk-a-miranda-im[1].htm
Status: Infected
Quarantine object: 50fe84f4.qua
Restored: NO
Uploaded to Avira: NO
Operating System: Windows 2000/XP/VISTA Workstation
Search engine: 8.02.04.72
Virus definition file: 7.10.12.140
Detection: Contains recognition pattern of the HTML/Infected.WebPage.Gen HTML script virus
Date/Time: 7.10.2010, 19:13

Type: File
Source: C:\Users\...\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VONNJHCS\1125357739-navod-google-talk-a-miranda-im[1].htm
Status: Infected
Quarantine object: 4869a13f.qua
Restored: NO
Uploaded to Avira: NO
Operating System: Windows 2000/XP/VISTA Workstation
Search engine: 8.02.04.72
Virus definition file: 7.10.12.140
Detection: Contains recognition pattern of the HTML/Infected.WebPage.Gen HTML script virus
Date/Time: 7.10.2010, 19:13

Stahněte OTL http://oldtimer.geekstogo.com/OTL.exe
-uložte ho na plochu a spustte soubor OTL.exe.
-do bílého okna dole skopírujte tento skript:

Kód: Vybrat vše

netsvcs
drivers32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
c:\windows\*.* /U
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
nvraid.sys
ndis.sys
winlogon.exe
explorer.exe
userinit.exe
lsass.exe
svchost.exe
smss.exe
hal.dll
ws2_32.dll
tcpip.sys
cryptsvc.dll
Changer.sys
JakNDis.sys
isapnp.sys
cdrom.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
CREATERESTOREPOINT

- zaškrtněte okénko Pro všechny uživatele.
-označte okénka Kontrola na havěť "LOP" a Kontrola na havěť "Purity"
- Klikněte na tlačítko Prohledat
-po dokončení skenu se objeví logy OTL.Txt a Extras.txt, vložte je zde

Dobrý den, OTL jsem stáhnul a spustil podle návodu, ale nějak se mu nechce test dokončit. Skončí u Manual File Scan - Getting folder structure...

Zkuste v nouzovém režimu.

Dobrý večer, zkusil jsem asi všechny možnosti, ale bohužel beze změny.

Zazálohujte si důležitá data, pro jistotu

Spusťte combofix podle tohoto návodu
http://www.bleepingcomputer.com/combofi ... t-combofix

VIRY.CZ

Vir na webu

Vir na webu

Re: Vir na webu

Re: Vir na webu

Re: Vir na webu

Re: Vir na webu

Re: Vir na webu

Re: Vir na webu

Re: Vir na webu

Re: Vir na webu

Re: Vir na webu