VIRY.CZ

kdyžtak už na to kašli, já to příští týden zformátuju a bude klid

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8A296008]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\atapi -> 0x8a296008 ...

log z mbr:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8A11FD08]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\atapi ...

při zadání příkazu mně to hodí control service Failed 1052

takže, šlo to tou druhou variantou, a tady je log:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8A11FD08]<<
kernel: MBR read successfully ...

vše jsem provedl podle vašeho popisu pane doktore, co teď? log z mbr -t?

log mbr :

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8A09FA50]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\atapi ...

Add-Remove Programs.txt :

Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8 - Czech
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Adobe SVG Viewer 3.0
ADSL USB MODEM
Aktualizace systému Windows XP (KB898461)
ALZip ...

ComboFix 10-01-20.05 - DK 22.01.2010 14:06:44.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.2046.1708 [GMT 1:00]
Spuštěný z: c:\documents and settings\DK\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0 ...

jj, po odinstalování spdt a restartu

log z mbr :
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: >>UNKNOWN [0x804D7000]<< >>UNKNOWN [0xBA908000]<< >>UNKNOWN [0xBA8F8000]<< >>UNKNOWN [0x8A089348]<<
kernel: MBR read successfully ...

pořád to atapi, že....

:-D to jsou věci, sektory 10,57,60,61 jsou přepsány (jsou nulové)
log z mr.txt:
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8A2256E8]<<
kernel ...

mám s tím něco udělat?

ok, provedu, ale tentokrát se mi zoprazily i jiný hodnoty než nuly v sektoru 0:
33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04 38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5 83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B F0 AC 3C 00 74 FC BB 07 00 ...