prosím pomoc s virem 3x rootkit: hidden file

[denda79]

dobrý večer, avast mi našel 3x Rootkit: hidden file a nejde mi to odstanit. prosím o pomoc

[denda79]

Logfile of random's system information tool 1.08 (written by random/random)
Run by Denda at 2011-09-30 23:42:07
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 29 GB (31%) free of 92 GB
Total RAM: 3071 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:42:50, on 30.9.2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\MODPS2KEY.EXE
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Mouse Driver\StartAutorun.exe
C:\Windows\mHotkey.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Mouse Driver\KMConfig.exe
C:\Program Files\Mouse Driver\KMProcess.exe
C:\Windows\OSDShow.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
C:\Program Files\USB TV\EM28XX\BDARemote.exe
C:\PROGRA~1\WinTV\HCWCITray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\Denda\Desktop\RSIT.exe
C:\Program Files\trend micro\Denda.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=14597&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [KMCONFIG] C:\Program Files\Mouse Driver\StartAutorun.exe KMConfig.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ShowOSD] OSDShow.exe
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil10w_Plugin.exe -update plugin
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Registration Assassin.LNK = H:\Hry\assassin creed\Register\RegistrationReminder.exe
O4 - Startup: WinTV-CI CAM Menu.lnk = ?
O4 - Global Startup: BDARemote.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Mouse Driver\KMWDSrv.exe

--
End of file - 5907 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-08-04 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"KMCONFIG"=C:\Program Files\Mouse Driver\StartAutorun.exe [2008-05-30 212992]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-09-29 61440]
"CHotkey"=C:\Windows\mHotkey.exe [2007-01-15 550912]
"ShowOSD"=C:\Windows\OSDShow.exe [2007-01-15 28672]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2011-07-04 3493720]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-06-08 37296]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-30 937920]
"NPSStartup"= []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"EA Core"=C:\Program Files\Electronic Arts\EADM\Core.exe -silent []
"AutoStartNPSAgent"=C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [2010-07-04 95576]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"=C:\Windows\system32\Macromed\Flash\FlashUtil10w_Plugin.exe [2011-08-31 243360]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
BDARemote.lnk - C:\Program Files\USB TV\EM28XX\BDARemote.exe

C:\Users\Denda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Registration Assassin.LNK - H:\Hry\assassin creed\Register\RegistrationReminder.exe
WinTV-CI CAM Menu.lnk - C:\PROGRA~1\WinTV\HCWCITray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2011-09-18 08:25:39 ----D---- C:\Program Files\MSXML 4.0
2011-09-16 22:07:33 ----A---- C:\Windows\system32\drivers\ss_bwhnt.sys
2011-09-16 22:07:33 ----A---- C:\Windows\system32\drivers\ss_bwh.sys
2011-09-16 22:07:33 ----A---- C:\Windows\system32\drivers\ss_bmdm.sys
2011-09-16 22:07:32 ----A---- C:\Windows\system32\drivers\ss_bmdfl.sys
2011-09-16 22:07:32 ----A---- C:\Windows\system32\drivers\ss_bcmnt.sys
2011-09-16 22:07:32 ----A---- C:\Windows\system32\drivers\ss_bcm.sys
2011-09-16 22:07:32 ----A---- C:\Windows\system32\drivers\ss_bbus.sys
2011-09-16 22:06:04 ----D---- C:\ProgramData\Samsung
2011-09-16 22:04:55 ----A---- C:\Windows\system32\FsUsbExService.Exe
2011-09-16 22:04:55 ----A---- C:\Windows\system32\FsUsbExDisk.Sys
2011-09-16 22:04:55 ----A---- C:\Windows\system32\FsUsbExDevice.Dll
2011-09-16 22:04:03 ----D---- C:\Users\Denda\AppData\Roaming\Samsung
2011-09-16 22:03:00 ----D---- C:\Program Files\MarkAny
2011-09-16 22:02:08 ----D---- C:\Program Files\Samsung

======List of files/folders modified in the last 1 months======

2011-09-30 23:42:12 ----D---- C:\Program Files\trend micro
2011-09-30 23:41:50 ----D---- C:\Windows\Temp
2011-09-30 23:05:27 ----D---- C:\Windows\Prefetch
2011-09-30 21:03:50 ----SHD---- C:\System Volume Information
2011-09-30 19:18:51 ----RSD---- C:\Windows\assembly
2011-09-30 19:18:51 ----D---- C:\Windows\Microsoft.NET
2011-09-30 17:50:20 ----SHD---- C:\Windows\Installer
2011-09-30 17:50:11 ----SHD---- C:\Config.Msi
2011-09-30 17:48:04 ----A---- C:\Windows\system32\mrt.exe
2011-09-18 08:27:48 ----D---- C:\Windows\winsxs
2011-09-18 08:26:24 ----D---- C:\Windows
2011-09-18 08:25:39 ----D---- C:\Windows\System32
2011-09-18 08:25:39 ----D---- C:\Program Files
2011-09-17 18:37:44 ----D---- C:\Program Files\Mozilla Firefox
2011-09-17 08:27:49 ----D---- C:\Windows\system32\catroot
2011-09-17 08:27:45 ----D---- C:\Program Files\Windows Mail
2011-09-16 22:14:34 ----D---- C:\Windows\inf
2011-09-16 22:14:34 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-09-16 22:11:46 ----D---- C:\Windows\system32\drivers
2011-09-16 22:08:21 ----D---- C:\Windows\system32\catroot2
2011-09-16 22:06:04 ----HD---- C:\ProgramData
2011-09-16 22:03:25 ----HD---- C:\Program Files\InstallShield Installation Information
2011-09-06 22:45:29 ----A---- C:\Windows\system32\aswBoot.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2011-09-06 34392]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2011-09-06 442200]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2011-09-06 320856]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2011-09-06 52568]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2011-09-06 20568]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2011-09-06 54616]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-09-30 4450816]
R3 FsUsbExDisk;FsUsbExDisk; \??\C:\Windows\system32\FsUsbExDisk.SYS [2010-06-14 36608]
R3 HCW85BDA;Hauppauge WinTV 885 Video Capture; C:\Windows\system32\drivers\HCW85BDA.sys [2009-09-11 1440384]
R3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-04-11 236544]
R3 KMWDFILTERx86;HIDServiceDesc; C:\Windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-30 25088]
R3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-02 194048]
R3 ZY272NV32;ZyXEL 802.11n NWD272N Driver(vista); C:\Windows\system32\DRIVERS\WLANUHN.sys [2010-01-25 475136]
S3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-19 92160]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2011-04-21 508416]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-06-17 30208]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-09-30 4450816]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-04-11 148992]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM); C:\Windows\system32\DRIVERS\ss_bbus.sys [2010-04-27 98432]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter); C:\Windows\system32\DRIVERS\ss_bmdfl.sys [2010-04-27 14848]
S3 ss_bmdm;SAMSUNG USB Mobile Modem; C:\Windows\system32\DRIVERS\ss_bmdm.sys [2010-04-27 123648]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S3 ZY271NV32;ZyXEL 802.11n NWD271N Driver(vista); C:\Windows\system32\DRIVERS\WLANUHN.sys [2010-01-25 475136]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2009-09-30 733184]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2011-07-04 42184]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 FsUsbExService;FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [2010-07-04 238952]
R2 KMWDSERVICE;Keyboard And Mouse Communication Service; C:\Program Files\Mouse Driver\KMWDSrv.exe [2009-08-31 1821184]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-20 136120]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

-----------------EOF-----------------

[denda79]

Zdravím,

než začnu pátrat hlouběji, prosím zkus mi řící kde ho avast přesně hlásí:

avast mi našel 3x Rootkit: hidden file

také zdravím, vkládám print

[denda79]

Zdravím,

než začnu pátrat hlouběji, prosím zkus mi řící kde ho avast přesně hlásí:

avast mi našel 3x Rootkit: hidden file

vkládám ještě jeden print z toho to sand bude lépe k přečtení

[denda79]

Dobré ráno.

Dej ignorovat, planý poplach (pokud vidím dobře neb obrázek má deformovaný text ). Přesto vše nech alespoň jeden soubor otestovat na webové službě http://www.virustotal.com - výsledky prosím oznam.


Můžu pro klidné spaní ti napsat návod na dva nástroje k oveření pokud chceš.

alespoň jeden soubourů? z těch 3.?? "ohrožených" omlouvám se za tupé otázky

[denda79]

Nech přestovše otestovat na virustotal.com například první soubor, který zobrazuje avast. Ano, tady už lépe vidím, díky

jj, tak jsem to pochopila správně ..soubor NativeImage ve windows na "C" nemůžu najít

[denda79]

Prvně na chvíly vypni avast. Udělej mi printscreen složky assembly, ať vím co tam přesně je. Lepší se zeptat než něco zvorat

OK, je možné že se to "vyhodilo" ccleanerem, vera jsem to projela, složka je moc velká hodím sem jen část - jestli to tedy bude stačit..

[denda79]

:arrow:Stáhněte a uložte na plochu http://jpshortstuff.247fixes.com/SystemLook.exe nebo http://images.malwareremoval.com/jpshor ... emLook.exe

• Dvojklikem na ikonu program spusťte.
• Do bílého okénka zkopírujte text z následujícího bílého pole.

Kód: Vybrat vše

:dir
C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\

• Klikněte na Look, po dokončení skenu na Vás vyskočí log, zkopírujte ho sem.
• Log se také bude nacházet na ploše v souboru SystemLook.txt

SystemLook 30.07.11 by jpshortstuff
Log created at 10:30 on 01/10/2011 by Denda
Administrator - Elevation successful

No Context: C:\windows\assembly\NativeImages_v2.0.50727_32\

-= EOF =-
je to tak OK?

[denda79]

SystemLook 30.07.11 by jpshortstuff
Log created at 10:47 on 01/10/2011 by Denda
Administrator - Elevation successful

========== dir ==========

C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas# - Unable to find folder.

-= EOF =-

aha to mě nenapadlo, jsem studovala jak napsat odp. bez cit. a tlač. ODPOVĚDĚT jsem si nevšimla

[denda79]

SystemLook 30.07.11 by jpshortstuff
Log created at 11:00 on 01/10/2011 by Denda
Administrator - Elevation successful

========== dir ==========

C:\windows\assembly - Parameters: "(none)"

---Files---
Desktop.ini -rahs-- 227 bytes [12:54 02/11/2006] [12:54 02/11/2006]
PublisherPolicy.tme -rah--- 0 bytes [12:56 02/11/2006] [13:51 19/02/2010]
pubpol14.dat -r-h--- 0 bytes [13:51 19/02/2010] [13:51 19/02/2010]

---Folders---
GAC d------ [12:56 02/11/2006]
GAC_32 dr----- [11:18 02/11/2006]
GAC_MSIL dr----- [11:18 02/11/2006]
NativeImages_v2.0.50727_32 d------ [12:54 02/11/2006]
temp d------ [12:55 02/11/2006]
tmp d------ [12:56 02/11/2006]

-= EOF =-

[denda79]

promiň nějak nechápu mám stáhnout ten Combo.. nebo zas jen vložit do toho systemlook

[denda79]

SystemLook 30.07.11 by jpshortstuff
Log created at 11:23 on 01/10/2011 by Denda
Administrator - Elevation successful

========== dir ==========

C:\windows\assembly\NativeImages_v2.0.50727_32 - Parameters: "/s"

---Files---
index1753.dat -r-h--- 0 bytes [17:18 30/09/2011] [17:18 30/09/2011]
index1768.dat -r-h--- 0 bytes [01:03 01/10/2011] [01:03 01/10/2011]
index1769.dat -r-h--- 0 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\c8750ecd71abac98fb26b2f4bf3a031a d------ [01:03 01/10/2011]
Accessibility.ni.dll --a---- 25600 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\663468f78b0e270a28a420df672aa12f d------ [01:03 01/10/2011]
AspNetMMCExt.ni.dll --a---- 842240 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\BDATunePIA d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\BDATunePIA\c84d6c4ed00d343c479405682d5aa500 d------ [01:03 01/10/2011]
BDATunePIA.ni.dll --a---- 386560 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\147a04caf482e4d4082582a7698883e4 d------ [01:03 01/10/2011]
ComSvcConfig.ni.exe --a---- 410112 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng# d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\193706836ae3e6838aeafae6970ea722 d------ [01:03 01/10/2011]
Microsoft.Build.Engine.ni.dll --a---- 1888768 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra# d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\930a8016686cac1ed599031b1a3ad38f d------ [01:03 01/10/2011]
Microsoft.Build.Framework.ni.dll --a---- 74752 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\81bc126ce60194c5af7e6d4b1b03f6c1 d------ [01:03 01/10/2011]
Microsoft.VisualC.ni.dll --a---- 15872 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\MSBuild d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\MSBuild\940acf63f0f2e0d8d25c8e0c7c2962d2 d------ [01:03 01/10/2011]
MSBuild.ni.exe --a---- 133632 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f6deb187f24bb3185841092b89fbfdbb d------ [01:03 01/10/2011]
mscorlib.ni.dll --a---- 11490816 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System\b9ea0d414c4861120bfb7365d8ec0939 d------ [01:03 01/10/2011]
System.ni.dll --a---- 7950848 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\29c6ef7f07d89496c72a1bbf718aed5d d------ [01:03 01/10/2011]
System.Configuration.ni.dll --a---- 971264 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\d6ae6d71281689587705eaed351b01d4 d------ [01:03 01/10/2011]
System.Data.SqlXml.ni.dll --a---- 2510336 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer# d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\e7a30fe59a12045d837f4ebaf83fc222 d------ [01:03 01/10/2011]
System.DirectoryServices.ni.dll --a---- 1116672 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\d8d83838f9840bde901df516ba3de588 d------ [01:03 01/10/2011]
System.Drawing.ni.dll --a---- 1587200 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe# d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\f2d2ebc3015150594787564a55d5abe9 d------ [01:03 01/10/2011]
System.EnterpriseServices.ni.dll --a---- 627712 bytes [01:03 01/10/2011] [01:03 01/10/2011]
System.EnterpriseServices.Wrapper.dll --a---- 280064 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo# d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\a6d889aa69fd51c100352f23c7cebd22 d------ [01:03 01/10/2011]
System.Runtime.Remoting.ni.dll --a---- 771584 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.Security d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\ccd064df52eb5479bf745ec2a7b74952 d------ [01:03 01/10/2011]
System.Security.ni.dll --a---- 679936 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\5e58f10757c91da0ac05161ca8e11e8b d------ [01:03 01/10/2011]
System.Transactions.ni.dll --a---- 627200 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\5aa9131000876de66160ff713b543d99 d------ [01:03 01/10/2011]
System.Web.ni.dll --a---- 11804672 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\4c3cda96b8f12220da20f2f8d1b9439c d------ [01:03 01/10/2011]
System.Xml.ni.dll --a---- 5450752 bytes [01:03 01/10/2011] [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp d------ [12:54 02/11/2006]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1901.tmp d------ [11:02 17/09/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1AE6.tmp d------ [07:07 15/08/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP25B9.tmp d------ [07:42 28/09/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2DF2.tmp d------ [12:56 02/11/2006]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP40A8.tmp d------ [16:12 24/09/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4AC7.tmp d------ [14:18 22/09/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP542D.tmp d------ [13:42 23/09/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP57C4.tmp d------ [01:04 14/08/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP78A8.tmp d------ [11:16 19/09/2011]
Microsoft.Build.Tasks.v3.5.dll --a---- 1966080 bytes [11:16 19/09/2011] [11:16 19/09/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP790.tmp d------ [09:23 18/08/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP81A.tmp d------ [12:54 02/11/2006]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9AF7.tmp d------ [11:08 18/08/2010]
System.dll --a---- 7949824 bytes [11:09 18/08/2010] [11:09 18/08/2010]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9DF7.tmp d------ [01:03 01/10/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPAB33.tmp d------ [14:25 23/09/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPAEDA.tmp d------ [01:04 17/08/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPB571.tmp d------ [01:03 08/10/2010]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPB5E7.tmp d------ [06:59 17/09/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPB799.tmp d------ [01:04 20/08/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPBF08.tmp d------ [01:04 12/08/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPC625.tmp d------ [01:03 13/08/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPC9E3.tmp d------ [09:03 20/02/2010]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPCF9D.tmp d------ [01:03 15/08/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPCFFE.tmp d------ [01:03 19/08/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPD345.tmp d------ [06:28 31/08/2011]
ehExtHost.exe --a---- 243200 bytes [06:28 31/08/2011] [06:28 31/08/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPE0FB.tmp d------ [18:00 19/02/2010]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPE31.tmp d------ [06:46 08/10/2010]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPE736.tmp d------ [08:52 16/08/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPE752.tmp d------ [13:05 02/11/2006]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPE7E3.tmp d------ [11:09 21/08/2011]
ehshell.dll --a---- 11587584 bytes [11:09 21/08/2011] [19:07 21/08/2011]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPEEF0.tmp d------ [12:57 02/11/2006]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPFBBC.tmp d------ [16:12 19/02/2010]

C:\windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPFEA8.tmp d------ [11:09 18/08/2010]
System.dll --a---- 7949824 bytes [11:09 18/08/2010] [11:09 18/08/2010]

-= EOF =-

[denda79]

prosím o radu co vše mám pak v PC vypnout - tedy krom Avastu, nerada by jsem nechala běžet něco co nemám

[denda79]

už skoro 40min mám toto na ploše je to v pořádku?

[denda79]

tady je další, snad se dá přečíst