Nelze odstranit Backdoor (IRCBot)

[Milar]

Dobrý den,
prosím o radu, pomoc.
Mám operační systém windows Vista. Po úplné přeinstalaci systému jsem jej projížděl Avastem, Malwarebytes (nic nenašli), až MWAV mi našel výše zmínění vir, který nedokáže odstranit. Nevim, jestli se nejedná pouze o chybnou detekci - možná to má nějakou spojitost s Avastem??? Vkládám log z MWAV.

Moc děkuji

Milan

Object "Backdoor (IRCBot) Trojans Spyware/Adware" found in File System! Action Taken: Entries Removed.
Object "WORM_PALEVO.KK Worm" found in File System! Action Taken: Entries Removed.


14 VIII 2011 08:13:34 - **********************************************************
14 VIII 2011 08:13:34 - MWAV - eScanAV AntiVirus Toolkit.
14 VIII 2011 08:13:34 - Copyright © MicroWorld Technologies
14 VIII 2011 08:13:34 - **********************************************************
14 VIII 2011 08:13:34 - Source: C:\Users\Mila\Desktop\mwav.exe
14 VIII 2011 08:13:34 - Version 12.0.166 (C:\USERS\MILA\APPDATA\LOCAL\TEMP\MEXETMP.EX~)
14 VIII 2011 08:13:34 - Log File: C:\Users\Mila\AppData\Local\Temp\MWAV.LOG
14 VIII 2011 08:13:34 - MWAV Registered: TRUE
14 VIII 2011 08:13:34 - User Account: Mila (Administrator Mode)
14 VIII 2011 08:13:34 - OS Type: Windows Workstation
14 VIII 2011 08:13:34 - OS: Windows Vista [OS Install Date: 13 Aug 2011 20:57:11]
14 VIII 2011 08:13:34 - Ver: Personal (Build 6000)
14 VIII 2011 08:13:34 - System Up Time: 45 Minutes, 44 Seconds
14 VIII 2011 08:13:34 - Windows Root Folder: C:\Windows
14 VIII 2011 08:13:34 - Windows Sys32 Folder: C:\Windows\system32
14 VIII 2011 08:13:34 - DHCP NameServer:
14 VIII 2011 08:13:34 - Interface0 DHCPNameServer:
14 VIII 2011 08:13:34 - Local Fixed Drives: c:\,d:\
14 VIII 2011 08:13:34 - MWAV Mode: Scan and Clean files (for viruses, adware and spyware)
14 VIII 2011 08:13:34 - [CREATED ZIP FILE: C:\Users\Mila\AppData\Local\Temp\pinfect.zip]
14 VIII 2011 08:13:34 - ****** Files/Folders created/modified during last fortnight in Windows and ROOT Folder ******
14 VIII 2011 08:13:35 - C:\Windows\avastSS.scr (40112), 13-Aug-2011, AVAST Software, avast! Antivirus
14 VIII 2011 08:13:35 - C:\Windows\DIFxAPI.dll (319456), 13-Aug-2011, Microsoft Corporation, Driver Install Frameworks API (DIFxAPI)
14 VIII 2011 08:13:35 - C:\Windows\HideWin.exe (315392), 13-Aug-2011, Realtek Semiconductor Corp., HD Audio Hide windows program
14 VIII 2011 08:13:35 - C:\Windows\RtHDVCpl.exe (4431872), 13-Aug-2011, Realtek Semiconductor, HD Audio Control Panel
14 VIII 2011 08:13:35 - C:\Windows\RtlExUpd.dll (520192), 13-Aug-2011, Realtek Semiconductor Corp., RtlExUpd Dynamic Link Library
14 VIII 2011 08:13:35 - C:\Windows\RtlUpd.exe (1191936), 13-Aug-2011, Realtek Semiconductor Corp., Realtek AC'97 Update and remove driver Tool
14 VIII 2011 08:13:35 - C:\Windows\system32\aswBoot.exe (199304), 13-Aug-2011, AVAST Software, avast! Antivirus
14 VIII 2011 08:13:35 - C:\Windows\system32\cabview.dll (97792), 13-Aug-2011, Microsoft Corporation, Operační systém Microsoft® Windows®
14 VIII 2011 08:13:35 - C:\Windows\system32\eEmpty.exe (34048), 14-Aug-2011, MicroWorld Technologies Inc., eScan For Windows
14 VIII 2011 08:13:35 - C:\Windows\system32\Imsmudlg.exe (126976), 13-Aug-2011, Intel(R) Corporation, Uninstset Installation Utility
14 VIII 2011 08:13:35 - C:\Windows\system32\MSCOMCTL.OCX (1071088), 13-Aug-2011, Microsoft Corporation, MSCOMCTL
14 VIII 2011 08:13:35 - C:\Windows\system32\MSSTDFMT.DLL (118784), 13-Aug-2011, Microsoft Corporation, MSSTDFMT Object Library
14 VIII 2011 08:13:35 - C:\Windows\system32\RtkAPO.dll (1844224), 13-Aug-2011, Realtek Semiconductor Corp., Realtek(r) LFX/GFX DSP component
14 VIII 2011 08:13:35 - C:\Windows\system32\RtkApoApi.dll (266240), 13-Aug-2011, Realtek Semiconductor Corp., Realtek APO API
14 VIII 2011 08:13:35 - C:\Windows\system32\RtkCoInst.dll (18432), 13-Aug-2011, Realtek Semiconductor Corp., Realtek HD Audio Coinstaller
14 VIII 2011 08:13:35 - C:\Windows\system32\RtkPgExt.dll (495104), 13-Aug-2011, Realtek Semiconductor Corp., Realtek LFX/GFX DSP UI component
14 VIII 2011 08:13:35 - C:\Windows\system32\RTSndMgr.cpl (532480), 13-Aug-2011, Realtek Semiconductor Corp., Realtek HD Audio Sound Effect Manager
14 VIII 2011 08:13:37 - C:\Windows\system32\SmartDefragBootTime.exe (29520), 13-Aug-2011 [Added C:\Windows\system32\SmartDefragBootTime.exe to ZIP FILE]
14 VIII 2011 08:13:37 - C:\Windows\system32\SRSTSXT.dll (339968), 13-Aug-2011, SRS Labs, Inc., TruSurroundXT
14 VIII 2011 08:13:37 - C:\Windows\system32\SRSWOW.dll (135168), 13-Aug-2011, SRS Labs, Inc., WOW HD
14 VIII 2011 08:13:37 - C:\Windows\system32\wintrust.dll (171520), 13-Aug-2011, Microsoft Corporation, Microsoft® Windows® Operating System
14 VIII 2011 08:13:37 - C:\Windows\system32\wuapi.dll (575704), 13-Aug-2011, Microsoft Corporation, Microsoft® Windows® Operating System
14 VIII 2011 08:13:37 - C:\Windows\system32\wuapp.exe (33792), 13-Aug-2011, Microsoft Corporation, Microsoft® Windows® Operating System
14 VIII 2011 08:13:37 - C:\Windows\system32\wuauclt.exe (53472), 13-Aug-2011, Microsoft Corporation, Microsoft® Windows® Operating System
14 VIII 2011 08:13:37 - C:\Windows\system32\wuaueng.dll (1929952), 13-Aug-2011, Microsoft Corporation, Microsoft® Windows® Operating System
14 VIII 2011 08:13:37 - C:\Windows\system32\wucltux.dll (2421760), 13-Aug-2011, Microsoft Corporation, Microsoft® Windows® Operating System
14 VIII 2011 08:13:37 - C:\Windows\system32\wudriver.dll (87552), 13-Aug-2011, Microsoft Corporation, Microsoft® Windows® Operating System
14 VIII 2011 08:13:37 - C:\Windows\system32\wups.dll (35552), 13-Aug-2011, Microsoft Corporation, Microsoft® Windows® Operating System
14 VIII 2011 08:13:37 - C:\Windows\system32\wups2.dll (44768), 13-Aug-2011, Microsoft Corporation, Microsoft® Windows® Operating System
14 VIII 2011 08:13:37 - C:\Windows\system32\wuwebv.dll (171608), 13-Aug-2011, Microsoft Corporation, Microsoft® Windows® Operating System
14 VIII 2011 08:13:37 - C:\Windows\system32\XceedCry.dll (516784), 13-Aug-2011, Xceed Software Inc (450) 442-2626 support@xceedsoft.com http://www.xceedsoft.com, Xceed Encryption Library
14 VIII 2011 08:13:37 - C:\Windows\system32\drivers\aswFsBlk.sys (19544), 13-Aug-2011, AVAST Software, avast! Antivirus System
14 VIII 2011 08:13:37 - C:\Windows\system32\drivers\aswMonFlt.sys (54104), 13-Aug-2011, AVAST Software, avast! Antivirus System
14 VIII 2011 08:13:37 - C:\Windows\system32\drivers\aswRdr.sys (25432), 13-Aug-2011, AVAST Software, avast! Antivirus System
14 VIII 2011 08:13:37 - C:\Windows\system32\drivers\aswSnx.sys (441176), 13-Aug-2011, AVAST Software, avast! Antivirus System
14 VIII 2011 08:13:37 - C:\Windows\system32\drivers\aswSP.sys (309848), 13-Aug-2011, AVAST Software, avast! Antivirus System
14 VIII 2011 08:13:37 - C:\Windows\system32\drivers\aswTdi.sys (43608), 13-Aug-2011, AVAST Software, avast! Antivirus System
14 VIII 2011 08:13:37 - C:\Windows\system32\drivers\iaStor.sys (277784), 13-Aug-2011, Intel Corporation, Intel Matrix Storage Manager driver
14 VIII 2011 08:13:37 - C:\Windows\system32\drivers\mbam.sys (22712), 13-Aug-2011, Malwarebytes Corporation, Malwarebytes' Anti-Malware
14 VIII 2011 08:13:37 - C:\Windows\system32\drivers\mbamswissarmy.sys (41272), 13-Aug-2011, Malwarebytes Corporation, Malwarebytes' Anti-Malware
14 VIII 2011 08:13:37 - C:\Windows\system32\drivers\RTKVHDA.sys (1764960), 13-Aug-2011, Realtek Semiconductor Corp., Realtek(r) High Definition Audio Function Driver
14 VIII 2011 08:13:37 - C:\Windows\system32\drivers\Rtlh86.sys (70144), 13-Aug-2011, Realtek Corporation, Realtek 8101E/8168/8169 PCI/PCIe Adapters
14 VIII 2011 08:13:37 - C:\Windows\system32\drivers\SmartDefragDriver.sys (16184), 13-Aug-2011 [Added C:\Windows\system32\drivers\SmartDefragDriver.sys to ZIP FILE]
14 VIII 2011 08:13:37 - C:\Users\Mila\AppData\Local\Temp\BACKUP.46971447.mexe.com (2570824), 14-Aug-2011, MicroWorld Technologies Inc., MicroWorld AntiVirus Toolkit Utility (MWAV)
14 VIII 2011 08:13:37 - C:\Users\Mila\AppData\Local\Temp\bdc.exe (91904), 14-Aug-2011, MicroWorld Tech, eScan
14 VIII 2011 08:13:37 - C:\Users\Mila\AppData\Local\Temp\bdfltlib2k.dll (231944), 14-Aug-2011, MicroWorld Technologies Inc., eScan for Windows
14 VIII 2011 08:13:37 - C:\Users\Mila\AppData\Local\Temp\clean.bat (11), 14-Aug-2011 [Added C:\Users\Mila\AppData\Local\Temp\clean.bat to ZIP FILE]
14 VIII 2011 08:13:37 - C:\Users\Mila\AppData\Local\Temp\DEVCON.EXE (61184), 14-Aug-2011, Microsoft Corporation, Microsoft® Windows® Operating System
14 VIII 2011 08:13:37 - C:\Users\Mila\AppData\Local\Temp\eEmpty.exe (34048), 14-Aug-2011, MicroWorld Technologies Inc., eScan For Windows
14 VIII 2011 08:13:37 - C:\Users\Mila\AppData\Local\Temp\encdec.dll (182792), 14-Aug-2011, MicroWorld Technologies Inc., eScan/MailScan/eConceal
14 VIII 2011 08:13:37 - C:\Users\Mila\AppData\Local\Temp\erootdrv.sys (22920), 14-Aug-2011, MicroWorld Technologies Inc., eScan/MWAV
14 VIII 2011 08:13:37 - C:\Users\Mila\AppData\Local\Temp\mexe.com (2583112), 14-Aug-2011, MicroWorld Technologies Inc., MicroWorld AntiVirus Toolkit Utility (MWAV)14 VIII 2011 08:13:37 - C:\Users\Mila\AppData\Local\Temp\msvclnt.dll (240136), 14-Aug-2011, MicroWorld Technologies Inc., MailScan
14 VIII 2011 08:13:37 - C:\Users\Mila\AppData\Local\Temp\mwavdwnl.exe (839176), 14-Aug-2011, MicroWorld Technologies Inc., eScan
14 VIII 2011 08:13:37 - C:\Users\Mila\AppData\Local\Temp\MWAVSCAN.COM (2570824), 14-Aug-2011, MicroWorld Technologies Inc., MicroWorld AntiVirus Toolkit Utility (MWAV)
14 VIII 2011 08:13:37 - C:\Users\Mila\AppData\Local\Temp\red32.dll (10248), 14-Aug-2011, Microsoft Corporation, Microsoft® Windows® Operating System
14 VIII 2011 08:13:37 - C:\Users\Mila\AppData\Local\Temp\Reload.exe (375304), 14-Aug-2011, MicroWorld Technologies Inc., eScan for Windows
14 VIII 2011 08:13:37 - C:\Users\Mila\AppData\Local\Temp\setpriv.exe (67080), 14-Aug-2011, MicroWorld Technologies Inc., eScan AntiVirus Toolkit Utility
14 VIII 2011 08:13:37 - C:\Users\Mila\AppData\Local\Temp\unregx.exe (78856), 14-Aug-2011, MicroWorld Technologies Inc., MicroWorld AntiVirus Toolkit Utility
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Local\Temp\UPDLL10.DLL (904712), 09-Aug-2011, MicroWorld Technologies Inc., eScan/MailScan/MWAV
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Local\Temp\ViewTCP.exe (1680904), 14-Aug-2011, MicroWorld Technologies Inc., ViewTCP
14 VIII 2011 08:13:38 - C:\Windows\cs-CZ, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Windows\Debug, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Windows\Fonts, 02-Nov-2006 [SR] [Folder]
14 VIII 2011 08:13:38 - C:\Windows\logo_1.exe, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Windows\Media, 02-Nov-2006 [SR] [Folder]
14 VIII 2011 08:13:38 - C:\Windows\PANTHER, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Windows\RUNDL132.EXE, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Windows\SoftwareDistribution, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Windows\VDLL.DLL, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Windows\system32\cs, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Windows\system32\CSY, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Windows\system32\Microsoft, 02-Nov-2006 [S] [Folder]
14 VIII 2011 08:13:38 - C:\Windows\system32\OEM, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Windows\system32\RTCOM, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Windows\system32\runouce.exe, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\$$DeleteMe.$$DeleteMe.$$DeleteMe.$$DeleteMe.$$DeleteMe.$$DeleteMe.$$DeleteMe..01cc59eff917eda8.0000.01cc59f014cbd8a7.0000.01cc59f313d4afa2.0000.01cc59f4550e2517.0000.01cc59f5dd7548b7.0000.01cc59f5f931523e.0000.01cc5a42ef464b14.0000, 02-Nov-2006 [HR] [Folder]
14 VIII 2011 08:13:38 - C:\Boot, 14-Aug-2011 [HS] [Folder]
14 VIII 2011 08:13:38 - C:\Documents and Settings, 02-Nov-2006 [HS] [Folder]
14 VIII 2011 08:13:38 - C:\fsc.tmp, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Intel, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData, 02-Nov-2006 [H] [Folder]
14 VIII 2011 08:13:38 - C:\PROGRAMY, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Windows\system32\drivers\cs-CZ, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Local\Temp\AVCBack, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Local\Temp\Comodo, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Local\Temp\FtpTemp, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Local\Temp\FtpTempF, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Local\Temp\LOCK, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Local\Temp\Log, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Local\Temp\Low, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Local\Temp\plugins, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Local\Temp\TempBK, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Local\Temp\tmp00004347, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Roaming\Identities, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Roaming\InstallShield, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Roaming\IObit, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Roaming\Malwarebytes, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Roaming\Media Center Programs, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Roaming\Microsoft, 13-Aug-2011 [S] [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Roaming\Opera, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Roaming\vlc, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Roaming\..\Local, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Roaming\..\LocalLow, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Users\Mila\AppData\Roaming\..\Roaming, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\Application Data, 02-Nov-2006 [HS] [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\AVAST Software, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\Comodo, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\Data aplikací, 13-Aug-2011 [HS] [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\Desktop, 02-Nov-2006 [HS] [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\Documents, 02-Nov-2006 [HS] [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\Dokumenty, 13-Aug-2011 [HS] [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\Malwarebytes, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\Microsoft, 02-Nov-2006 [S] [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\MicroWorld, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\Nabídka Start, 13-Aug-2011 [HS] [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\Oblíbené položky, 13-Aug-2011 [HS] [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\Plocha, 13-Aug-2011 [HS] [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\Start Menu, 02-Nov-2006 [HS] [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\Templates, 02-Nov-2006 [HS] [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\Šablony, 13-Aug-2011 [HS] [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\..\$$DeleteMe.$$DeleteMe.$$DeleteMe.$$DeleteMe.$$DeleteMe.$$DeleteMe.$$DeleteMe..01cc59eff917eda8.0000.01cc59f014cbd8a7.0000.01cc59f313d4afa2.0000.01cc59f4550e2517.0000.01cc59f5dd7548b7.0000.01cc59f5f931523e.0000.01cc5a42ef464b14.0000, 02-Nov-2006 [HR] [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\..\Boot, 14-Aug-2011 [HS] [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\..\Documents and Settings, 02-Nov-2006 [HS] [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\..\fsc.tmp, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\..\Intel, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\..\ProgramData, 02-Nov-2006 [H] [Folder]
14 VIII 2011 08:13:38 - C:\ProgramData\..\PROGRAMY, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Program Files\ATI, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Program Files\ATI Technologies, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Program Files\Intel, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Program Files\Realtek, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Program Files\Common Files\InstallShield, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Program Files\Common Files\MicroWorld, 14-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - C:\Program Files\Common Files\Microsoft Shared\VC, 13-Aug-2011 [Folder]
14 VIII 2011 08:13:38 - *********************************************************************************************
14 VIII 2011 08:13:38 - Command Line Options Given: /xsign
14 VIII 2011 08:14:40 - Latest Date of files inside MWAV: Sun Aug 14 08:00:08 2011.
14 VIII 2011 08:14:40 - Plugins FileCount: 892 Sign Version: 7.38599
14 VIII 2011 08:14:40 - Loading/Creating FileScan Database C:\ProgramData\MicroWorld\MWAV\ESCANDBX.MDB [Log: C:\Users\Mila\AppData\Local\Temp\ESCANDB.LOG]
14 VIII 2011 08:14:41 - Loaded/Created FileScan Database...
14 VIII 2011 08:14:41 - Loading AV Library [DB]...
14 VIII 2011 08:14:54 - AV Library Loaded [DB-DIRECT].
14 VIII 2011 08:14:54 - MWAV doing self scanning...
14 VIII 2011 08:14:54 - MWAV files are clean.
14 VIII 2011 08:14:57 - Virus Database Date: 14 Aug 2011
14 VIII 2011 08:14:57 - Virus Database Count: 8925334

14 VIII 2011 08:15:03 - **********************************************************
14 VIII 2011 08:15:03 - MWAV - eScanAV AntiVirus Toolkit.
14 VIII 2011 08:15:03 - Copyright © MicroWorld Technologies
14 VIII 2011 08:15:03 -
14 VIII 2011 08:15:03 - Support: support@escanav.com
14 VIII 2011 08:15:03 - Web: http://www.escanav.com
14 VIII 2011 08:15:03 - **********************************************************
14 VIII 2011 08:15:03 - Version 12.0.166[DB] (C:\USERS\MILA\APPDATA\LOCAL\TEMP\MEXETMP.EX~)
14 VIII 2011 08:15:03 - Log File: C:\Users\Mila\AppData\Local\Temp\MWAV.LOG
14 VIII 2011 08:15:03 - User Account: Mila (Administrator Mode)
14 VIII 2011 08:15:03 - Windows Root Folder: C:\Windows
14 VIII 2011 08:15:03 - Windows Sys32 Folder: C:\Windows\system32
14 VIII 2011 08:15:03 - OS: Windows Vista [OS Install Date: 13 Aug 2011 20:57:11]
14 VIII 2011 08:15:03 - Ver: Personal (Build 6000)
14 VIII 2011 08:15:03 - Latest Date of files inside MWAV: Sun Aug 14 08:00:08 2011.
14 VIII 2011 08:15:03 - Plugins FileCount: 892 Sign Version: 7.38599

14 VIII 2011 08:15:04 - Options Selected by User:
14 VIII 2011 08:15:04 - Memory Check: Enabled
14 VIII 2011 08:15:04 - Registry Check: Enabled
14 VIII 2011 08:15:04 - StartUp Folder Check: Enabled
14 VIII 2011 08:15:04 - System Folder Check: Enabled
14 VIII 2011 08:15:04 - Services Check: Enabled
14 VIII 2011 08:15:04 - Scan Spyware: Enabled
14 VIII 2011 08:15:04 - Drive Check: Disabled
14 VIII 2011 08:15:04 - All Drive Check :Enabled
14 VIII 2011 08:15:04 - Folder Check: Disabled
14 VIII 2011 08:15:04 - SCAN: All_Files
14 VIII 2011 08:15:04 - MWAV Mode: Scan and Clean files (for viruses, adware and spyware)


14 VIII 2011 08:15:04 - ***** Scanning Memory Files *****

14 VIII 2011 08:15:14 - ***** Scanning Registry Files *****

14 VIII 2011 08:15:17 - ***** Scanning StartUp Folders *****

14 VIII 2011 08:15:19 - ***** Scanning Service Files *****
14 VIII 2011 08:15:19 - ERROR(2)!!! Invalid Entry \SystemRoot\system32\drivers\blbdrive.sys. Action Taken: Removing HKLM\SYSTEM\CurrentControlSet\Services\blbdrive.

14 VIII 2011 08:15:23 - ***** Scanning Registry and File system for Adware/Spyware *****
14 VIII 2011 08:15:25 - Loading Spyware Signatures from new External Database [Name: C:\Users\Mila\AppData\Local\Temp\spydb.avs, Size: 977911]...
14 VIII 2011 08:15:25 - Indexed Spyware Databases Successfully Created...

14 VIII 2011 08:15:25 - Unable to Delete RegValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run/avast! Reason: Přístup byl odepřen. (0x5)
14 VIII 2011 08:15:25 - Offending Registry Entry found: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run/avast
14 VIII 2011 08:15:25 - System found infected with Backdoor (IRCBot) Trojans Spyware/Adware (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run/avast)! Action taken: Entries Removed.
14 VIII 2011 08:15:25 - Object "Backdoor (IRCBot) Trojans Spyware/Adware" found in File System! Action Taken: Entries Removed.

14 VIII 2011 08:15:26 - Offending Registry Entry found: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon/Taskman
14 VIII 2011 08:15:26 - System found infected with WORM_PALEVO.KK Worm (HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon/Taskman)! Action taken: Entries Removed.
14 VIII 2011 08:15:26 - Object "WORM_PALEVO.KK Worm" found in File System! Action Taken: Entries Removed.


14 VIII 2011 08:15:26 - ***** Scanning Registry Files *****
14 VIII 2011 08:15:27 - Clearing Temporary sub-folders as Spyware/Adware found in system...
14 VIII 2011 08:15:28 - ** Value in HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\main/Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
14 VIII 2011 08:15:28 - ** Value in HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main/Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

14 VIII 2011 08:15:28 - ***** Scanning System32 Folders *****
14 VIII 2011 08:15:29 - C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 not Scanned. Possibly password protected...
14 VIII 2011 08:15:29 - C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 not Scanned. Possibly password protected...
14 VIII 2011 08:15:37 - ScanFile took 7098 ms

14 VIII 2011 08:16:11 - C:\Users\Mila\AppData\Local\Temp\bdcore.dll.70014109.mwt File already Scanned once... not able to clean.

14 VIII 2011 08:16:18 - ***** Scanning All Drives *****
14 VIII 2011 08:16:18 - Scanning C:\ Drive
14 VIII 2011 08:16:18 - C:\Boot\BCD not Scanned. Possibly password protected...
14 VIII 2011 08:16:41 - ScanFile took 7254 ms
14 VIII 2011 08:17:04 - C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb not Scanned. Possibly password protected...
14 VIII 2011 08:17:04 - C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb not Scanned. Possibly password protected...
14 VIII 2011 08:17:37 - C:\Users\Mila\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 not Scanned. Possibly password protected...
14 VIII 2011 08:17:38 - C:\Users\Mila\AppData\Local\Temp\bdcore.dll.70014109.mwt File already Scanned once... not able to clean.
14 VIII 2011 08:17:42 - C:\Users\Mila\ntuser.dat.LOG1 not Scanned. Possibly password protected...
14 VIII 2011 08:18:28 - C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat not Scanned. Possibly password protected...
14 VIII 2011 08:18:28 - C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat not Scanned. Possibly password protected...
14 VIII 2011 08:18:28 - C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 not Scanned. Possibly password protected...
14 VIII 2011 08:18:28 - C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 not Scanned. Possibly password protected...
14 VIII 2011 08:18:31 - C:\Windows\SoftwareDistribution\DataStore\DataStore.edb not Scanned. Possibly password protected...
14 VIII 2011 08:18:32 - C:\Windows\SoftwareDistribution\DataStore\Logs\tmp.edb not Scanned. Possibly password protected...
14 VIII 2011 08:18:48 - C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 not Scanned. Possibly password protected...
14 VIII 2011 08:18:48 - C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 not Scanned. Possibly password protected...
14 VIII 2011 08:18:52 - C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb not Scanned. Possibly password protected...
14 VIII 2011 08:18:52 - C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb not Scanned. Possibly password protected...
14 VIII 2011 08:18:53 - C:\Windows\System32\config\COMPONENTS not Scanned. Possibly password protected...
14 VIII 2011 08:18:53 - C:\Windows\System32\config\COMPONENTS.LOG1 not Scanned. Possibly password protected...
14 VIII 2011 08:18:53 - C:\Windows\System32\config\DEFAULT not Scanned. Possibly password protected...
14 VIII 2011 08:18:53 - C:\Windows\System32\config\DEFAULT.LOG1 not Scanned. Possibly password protected...
14 VIII 2011 08:18:53 - C:\Windows\System32\config\RegBack\COMPONENTS not Scanned. Possibly password protected...
14 VIII 2011 08:18:53 - C:\Windows\System32\config\RegBack\DEFAULT not Scanned. Possibly password protected...
14 VIII 2011 08:18:54 - C:\Windows\System32\config\RegBack\SAM not Scanned. Possibly password protected...
14 VIII 2011 08:18:54 - C:\Windows\System32\config\RegBack\SECURITY not Scanned. Possibly password protected...
14 VIII 2011 08:18:54 - C:\Windows\System32\config\RegBack\SOFTWARE not Scanned. Possibly password protected...
14 VIII 2011 08:18:54 - C:\Windows\System32\config\RegBack\SYSTEM not Scanned. Possibly password protected...
14 VIII 2011 08:18:54 - C:\Windows\System32\config\SAM not Scanned. Possibly password protected...
14 VIII 2011 08:18:54 - C:\Windows\System32\config\SAM.LOG1 not Scanned. Possibly password protected...
14 VIII 2011 08:18:54 - C:\Windows\System32\config\SECURITY not Scanned. Possibly password protected...
14 VIII 2011 08:18:54 - C:\Windows\System32\config\SECURITY.LOG1 not Scanned. Possibly password protected...
14 VIII 2011 08:18:54 - C:\Windows\System32\config\SOFTWARE not Scanned. Possibly password protected...
14 VIII 2011 08:18:54 - C:\Windows\System32\config\SOFTWARE.LOG1 not Scanned. Possibly password protected...
14 VIII 2011 08:18:54 - C:\Windows\System32\config\SYSTEM not Scanned. Possibly password protected...
14 VIII 2011 08:18:54 - C:\Windows\System32\config\SYSTEM.LOG1 not Scanned. Possibly password protected...
14 VIII 2011 08:19:26 - ScanFile took 7145 ms
14 VIII 2011 08:21:13 - Scanning File C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl
14 VIII 2011 08:21:13 - ERROR(3)!!! ScanFile fails for C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl
14 VIII 2011 08:21:13 - Scanning File C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl
14 VIII 2011 08:21:13 - ERROR(3)!!! ScanFile fails for C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl
14 VIII 2011 08:21:13 - Scanning File C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl
14 VIII 2011 08:21:13 - ERROR(3)!!! ScanFile fails for C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl
14 VIII 2011 08:21:13 - Scanning File C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl
14 VIII 2011 08:21:13 - ERROR(3)!!! ScanFile fails for C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl
14 VIII 2011 08:21:32 - C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT not Scanned. Possibly password protected...
14 VIII 2011 08:21:32 - C:\Windows\System32\SMI\Store\Machine\schema.dat.LOG1 not Scanned. Possibly password protected...
14 VIII 2011 08:25:38 - Scanning D:\ Drive

14 VIII 2011 08:25:39 - ***** Checking for specific ITW Viruses *****

14 VIII 2011 08:25:39 - ***** Scanning complete. *****

14 VIII 2011 08:25:39 - Total Objects Scanned: 122194
14 VIII 2011 08:25:39 - Total Critical Objects: 2
14 VIII 2011 08:25:39 - Total Disinfected Objects: 0
14 VIII 2011 08:25:39 - Total Objects Renamed: 0
14 VIII 2011 08:25:39 - Total Deleted Objects: 2
14 VIII 2011 08:25:39 - Total Errors: 1
14 VIII 2011 08:25:39 - Time Elapsed: 00:10:27
14 VIII 2011 08:25:39 - Virus Database Date: 14 Aug 2011
14 VIII 2011 08:25:39 - Virus Database Count: 8925334

14 VIII 2011 08:25:39 - Scan Completed.

[chodnik74]

Dobrý den

Malwarebytes' Anti-Malware

• Stáhneme,nainstalujeme a spustíme(pokud si nevíte rady jak,klikněte ZDE)
• Vybereme Úplná kontrola a klikneme na tlačítko Prohledat
• Program provede kontrolu počítače a na konci se vám objeví hláska,že bylo skenování dokončeno,tak potvrdíme tlačítkem OK
• Objeví se vám log,který mi sem vložte
• NIC NEMAZAT!!Program mívá občas falešné detekce,takže mazat budeme až po konzultaci

[Milar]

tak malwarebytes nic nenašel...

Malwarebytes' Anti-Malware 1.51.1.1800
http://www.malwarebytes.org

Verze databáze: 7463

Windows 6.0.6000
Internet Explorer 7.0.6000.16982

14.8.2011 12:09:46
mbam-log-2011-08-14 (12-09-46).txt

Typ: Úplná kontrola (C:\|D:\|)
Kontrolované objekty: 236063
Uplynulý čas: 39 minut, 48 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

[JaRon]

zaskocim:
hlasku MWAV ignoruj, zrejme ide o falosny poplach - do buducna radsej pouzi AVPTool ako MWAV

[chodnik74]

Jak psal kolega,vypadá to na falešný poplach

[Milar]

Děkuji za radu. Zkusim projet počítat ještě zmíněným AVPTool.

[chodnik74]

Poté sem vložte log

[Milar]

Omlouvám se za delší odmlku. AVP tool, také nic nenašel...

[chodnik74]

V tom případě je již vše v pořádku Přeji hezký zbytek dne a pěkný víkend

[Milar]

Vám také a moc děkuji za pomoc...

[chodnik74]

Rád jsem pomohl náš tým je tu pro vás i příště