VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

MBR.EXE kontrola ve Vistách x64

https://forum.viry.cz:443/viewtopic.php?t=111303

Stránka 1 z 1

MBR.EXE kontrola ve Vistách x64

Napsal: 23 dub 2011 18:48
od petr0266
Dobrý den,

Začal jsem používat windows vista, protože mi doma ležela nepoužitá krabicová verze a já měl XP. Když jsem zkoušel po tom kontrolu mbr přes mbr.exe od gmeru ukázalo mi to tohle. Bootkit remover ukazoval všechno správně (ok code found), před instalací Vist jsem provedl přes záchranou konzoli z windows xp CD FIXMBR a FIXBOOT, následně optimální nastavení biosu a samotná instalace VIst. Děkuji

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.0.6000

device: opened successfully
user: error reading MBR
error: Read Neplatný popisovač.
kernel: error reading MBR

Re: MBR.EXE kontrola ve Vistách x64

Napsal: 23 dub 2011 19:12
od Rudy
Dejte nejprve log z RSIT: http://www.viry.cz/forum/viewtopic.php?f=13&t=105895 .

Re: MBR.EXE kontrola ve Vistách x64

Napsal: 23 dub 2011 19:20
od petr0266
Logfile of random's system information tool 1.08 (written by random/random)
Run by Lukáš at 2011-04-23 20:19:22
Microsoft® Windows Vista™ Home Basic
System drive C: has 131 GB (86%) free of 153 GB
Total RAM: 2046 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:19:25, on 23.4.2011
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:\Windows\SysWOW64\conime.exe
C:\Program Files (x86)\Internet Explorer\ieuser.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10p_ActiveX.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files\trend micro\Lukáš.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD33FCDE-55D9-495C-B557-F0E1305B633E}: NameServer = 192.168.10.1
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 4617 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
wininit.exe
C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
atieclxx
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Windows Defender\MSASCui.exe" -hide
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b434c158-0c5d-4485-89f0-0f8230fc0505 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c5c01b5d-f78f-444c-8d38-4125e2fa7d2b -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-4ce26847-c286-4ff2-9e13-cb771be1d6f3 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:d9db0c39-3d67-4555-9b02-5f3b0180630f
taskeng.exe {0AA9EDE5-BC1B-44D8-A3D8-640C02AE751B}
taskeng.exe {FE7A3A5A-E166-48E1-8FB7-1E4B71A3A915}
C:\Windows\system32\conime.exe
"C:\Program Files (x86)\Internet Explorer\ieuser.exe" -Embedding
C:\Windows\System32\mobsync.exe -Embedding
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10p_ActiveX.exe -Embedding
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"C:\Users\Lukáš\Desktop\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2006-11-02 1579624]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2011-03-28 11786344]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2006-11-02 1513984]
"WindowsWelcomeCenter"=oobefldr.dll,ShowWelcomeCenter []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-03-09 336384]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2011-04-23 20:19:22 ----D---- C:\Program Files\trend micro
2011-04-23 20:17:11 ----D---- C:\rsit
2011-04-23 20:17:11 ----D---- C:\Program Files (x86)\trend micro
2011-04-23 19:18:50 ----D---- C:\Users\Lukáš\AppData\Roaming\WinRAR
2011-04-23 19:18:49 ----D---- C:\Program Files\WinRAR
2011-04-23 18:57:32 ----D---- C:\Users\Lukáš\AppData\Roaming\Macromedia
2011-04-23 18:57:32 ----D---- C:\Users\Lukáš\AppData\Roaming\Adobe
2011-04-23 18:57:28 ----D---- C:\Windows\SYSWOW64\Macromed
2011-04-23 18:23:53 ----A---- C:\Windows\system32\wups2.dll
2011-04-23 18:23:53 ----A---- C:\Windows\system32\wucltux.dll
2011-04-23 18:23:53 ----A---- C:\Windows\system32\wuaueng.dll
2011-04-23 18:23:53 ----A---- C:\Windows\system32\wuauclt.exe
2011-04-23 18:23:03 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2011-04-23 18:23:03 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2011-04-23 18:23:03 ----A---- C:\Windows\system32\wuwebv.dll
2011-04-23 18:23:03 ----A---- C:\Windows\system32\wuapp.exe
2011-04-23 18:07:07 ----ASH---- C:\hiberfil.sys
2011-04-23 18:06:08 ----D---- C:\Program Files (x86)\AMD APP
2011-04-23 18:04:23 ----D---- C:\Program Files (x86)\ATI Technologies
2011-04-23 18:04:17 ----SHD---- C:\Windows\Installer
2011-04-23 18:04:03 ----D---- C:\Program Files\ATI Technologies
2011-04-23 18:04:01 ----D---- C:\Program Files\ATI
2011-04-23 18:03:31 ----D---- C:\ATI
2011-04-23 18:00:16 ----A---- C:\Windows\system32\RTNUninst64.dll
2011-04-23 18:00:16 ----A---- C:\Windows\system32\RtNicProp64.dll
2011-04-23 18:00:16 ----A---- C:\Windows\system32\drivers\Rtlh64.sys
2011-04-23 17:56:47 ----D---- C:\Program Files\Realtek
2011-04-23 17:56:46 ----D---- C:\Windows\SYSWOW64\RTCOM
2011-04-23 17:56:01 ----A---- C:\Windows\DIFxAPI.dll
2011-04-23 17:56:00 ----A---- C:\Windows\system32\WavesGUILib.dll
2011-04-23 17:56:00 ----A---- C:\Windows\system32\SRSWOW64.dll
2011-04-23 17:56:00 ----A---- C:\Windows\system32\SRSTSX64.dll
2011-04-23 17:56:00 ----A---- C:\Windows\system32\SRSTSH64.dll
2011-04-23 17:56:00 ----A---- C:\Windows\system32\SRSHP64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\SYSWOW64\MBAPO32.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RtPgEx64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RtlCPAPI64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RtkCfg64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RtkAPO64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RtkApi64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RTEEP64A.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RTEEL64A.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RTEEG64A.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RTEED64A.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RTCOM64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RP3DHT64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RP3DAA64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\RCoInst64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\MBWrp64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\MBppld64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\MBPPCn64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\MBAPO64.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\MaxxAudioEQ.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\MaxxAudioAPO20.dll
2011-04-23 17:55:59 ----A---- C:\Windows\system32\drivers\RTKVHD64.sys
2011-04-23 17:55:58 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-04-23 17:55:58 ----D---- C:\Program Files (x86)\Realtek
2011-04-23 17:55:58 ----A---- C:\Windows\system32\FMAPO64.dll
2011-04-23 17:55:58 ----A---- C:\Windows\system32\AERTAR64.dll
2011-04-23 17:55:58 ----A---- C:\Windows\system32\AERTAC64.dll
2011-04-23 17:55:53 ----HD---- C:\Program Files (x86)\Temp
2011-04-23 17:55:53 ----A---- C:\Windows\RtlExUpd.dll
2011-04-23 17:49:48 ----D---- C:\Program Files (x86)\Intel
2011-04-23 17:49:48 ----A---- C:\Windows\SYSWOW64\CSVer.dll
2011-04-23 17:49:32 ----D---- C:\Intel
2011-04-23 16:42:59 ----D---- C:\Windows\Panther
2011-04-23 16:42:47 ----RAS---- C:\BOOTSECT.BAK
2011-04-23 16:42:46 ----SHD---- C:\Boot
2011-04-23 16:37:09 ----D---- C:\Windows\ConfigSetRoot
2011-04-23 15:55:22 ----D---- C:\Users\Lukáš\AppData\Roaming\Identities
2011-04-23 15:55:14 ----SD---- C:\Users\Lukáš\AppData\Roaming\Microsoft
2011-04-23 15:53:20 ----SHD---- C:\ProgramData\Šablony
2011-04-23 15:53:20 ----SHD---- C:\ProgramData\Plocha
2011-04-23 15:53:20 ----SHD---- C:\ProgramData\Oblíbené položky
2011-04-23 15:53:20 ----SHD---- C:\ProgramData\Nabídka Start
2011-04-23 15:53:20 ----SHD---- C:\ProgramData\Dokumenty
2011-04-23 15:53:20 ----SHD---- C:\ProgramData\Data aplikací
2011-04-23 15:47:07 ----D---- C:\Windows\SoftwareDistribution
2011-04-23 15:45:57 ----D---- C:\Windows\system32\catroot2
2011-04-23 15:45:46 ----D---- C:\Windows\Debug
2011-04-23 15:43:56 ----D---- C:\Windows\Prefetch
2011-04-23 15:43:44 ----ASH---- C:\pagefile.sys
2011-04-23 15:43:43 ----SHD---- C:\System Volume Information

======List of files/folders modified in the last 1 months======

2011-04-23 20:19:24 ----D---- C:\Windows\Temp
2011-04-23 20:19:22 ----RD---- C:\Program Files
2011-04-23 20:17:11 ----RD---- C:\Program Files (x86)
2011-04-23 19:06:15 ----D---- C:\Windows\system32\catroot
2011-04-23 19:06:13 ----D---- C:\Windows\winsxs
2011-04-23 18:57:31 ----SD---- C:\Windows\Downloaded Program Files
2011-04-23 18:57:28 ----D---- C:\Windows\SysWOW64
2011-04-23 18:47:33 ----D---- C:\Windows\System32
2011-04-23 18:47:33 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-04-23 18:47:32 ----D---- C:\Windows\inf
2011-04-23 18:39:47 ----D---- C:\Windows\system32\WDI
2011-04-23 18:30:19 ----D---- C:\Windows\Logs
2011-04-23 18:27:28 ----SD---- C:\ProgramData\Microsoft
2011-04-23 18:24:30 ----D---- C:\Windows\rescache
2011-04-23 18:24:23 ----D---- C:\Windows\system32\cs-CZ
2011-04-23 18:17:05 ----D---- C:\Windows
2011-04-23 18:09:16 ----D---- C:\Windows\system32\drivers
2011-04-23 18:04:21 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-04-23 17:55:49 ----D---- C:\Program Files (x86)\Common Files
2011-04-23 17:49:49 ----D---- C:\Windows\system32\restore
2011-04-23 15:55:36 ----SHD---- C:\$Recycle.Bin
2011-04-23 15:55:14 ----RD---- C:\Users
2011-04-23 15:53:20 ----HD---- C:\ProgramData
2011-04-23 15:53:20 ----D---- C:\Program Files\Windows NT
2011-04-23 15:47:43 ----D---- C:\Windows\system32\drivers\UMDF

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-03-09 9258496]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-03-09 300544]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdLH6.sys [2010-11-17 111120]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2011-04-06 2826984]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh64.sys [2011-02-22 404584]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 108032]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 6144]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 273920]
S3 mbr;mbr; \??\C:\Users\LUK~1\AppData\Local\Temp\mbr.sys []
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 11008]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 7040]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 6656]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 7936]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-03-09 203776]

-----------------EOF-----------------

Re: MBR.EXE kontrola ve Vistách x64

Napsal: 23 dub 2011 19:33
od vyosek
Zdravim a pekny vecer preji :)

:arrow: Omlouvam se kolego za vstup, pisu na zadost uzivatele pres PMku

:arrow: Kliknete pravym tlacitkem na mbr, dejte Vlastnosti, zalozka Kompatibilita, zaskrtnete Spoustet jako spravce - mbr vsak nespoustejte

:arrow: Stahnete SPTD http://www.duplexsecure.com/en/downloads
  • Vyberte z uvedene stranky verzi dle sveho operacniho systemu (32(x86)bit ci 64(x64)bit)
  • Ulozte na plochu a spustte
  • Zvolte moznost Uninstall a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte
:arrow: Stahnete Defogger http://www.jpshortstuff.247fixes.com/Defogger.exe
  • Ulozte na plochu a spustte
  • Kliknete na Disable a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte
:arrow: Stahnete MBR na plochu http://www2.gmer.net/mbr/mbr.exe ale nespoustejte

:arrow: Kliknete na Start a pote Spustit, pripadne pouzijte klavesou zkratku Win+R
  • Vyskoci na Vas okenko, do ktereho zkopirujte text nize

  • Kód: Vybrat vše

    "%userprofile%\Desktop\mbr" -t -s
  • Kliknete na OK
  • Na plose se Vam vytvori log s nazvem mbr.txt, jeho obsah mi sem vlozte

Re: MBR.EXE kontrola ve Vistách x64

Napsal: 23 dub 2011 19:36
od petr0266
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.0.6000

device: opened successfully
user: error reading MBR

Disk trace:
error: Read Neplatný popisovač.
kernel: error reading MBR

Ale bootkit remover ukazuje v pořádku... nechápu, před instalací vist jsem ještě kontroloval mbr.exe a vše v pořádku.

Re: MBR.EXE kontrola ve Vistách x64

Napsal: 23 dub 2011 19:37
od petr0266
je vůbec ten prográmek kompaktibilní s X64 architekturou?

Re: MBR.EXE kontrola ve Vistách x64

Napsal: 23 dub 2011 19:39
od vyosek
Spoustel jste mbr jak jsem psal? pres Start-Spustit :???:

Ono visty jsou k mbr sektoru docela nesetrne, pisi tam i nejake dalsi informace, to XPecka nedelali...

Ano, mbr je kompatibilni, ovsem muze to nej mit vliv...Souhra Visty, x64 OS a muze to byt to co to dela...

Re: MBR.EXE kontrola ve Vistách x64

Napsal: 24 dub 2011 07:10
od vyosek
Jeste nazor kolegyne
motji píše: myslím že je to nějakej bug mbr.exe na 64b vistách. on přímo neukazuje že by byl na disku rootkit, pouze ti píše, že to nemůže zkontrolovat.
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz