už do víkendu mě trápí tihle hajzlíci.
Comodo vždycky nahlasí složku x v system32 a pak už jenom za sebou odklikávám nákazy v dokumentech. Po restartu to tam je zas, takže předpokládám, že to je zažraný v mbrce. Bohužel k instalčkám xpéček se dostanu až v pátek.
tady je log události comoda antiviru
a tady přikládám log z combofixu, z kterýho nejsem vůbec chytrej.
ComboFix 11-10-04.04 - Longin 04.10.2011 17:11:23.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2031.1401 [GMT 2:00]
Spuštěný z: c:\documents and settings\Longin\Plocha\ComboFix.exe
AV: COMODO Antivirus *Disabled/Updated* {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
.
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\daemon.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-09-04 do 2011-10-04 )))))))))))))))))))))))))))))))
.
.
2011-10-03 19:58 . 2011-10-03 19:59 -------- d-----w- c:\documents and settings\Longin\.netbeans
2011-10-03 19:43 . 2011-10-03 19:58 -------- d-----w- c:\program files\NetBeans 7.0.1
2011-10-03 19:37 . 2011-10-03 19:37 -------- d-----w- c:\documents and settings\Longin\.nbi
2011-10-03 16:16 . 2011-10-03 16:16 -------- d-----w- c:\documents and settings\Longin\Local Settings\Data aplikací\COMODO
2011-10-01 16:47 . 2011-10-01 16:47 -------- d-----w- c:\documents and settings\All Users\Data aplikací\FLEXnet
2011-10-01 16:39 . 2011-10-01 16:44 -------- d-----w- c:\program files\AutoCAD 2010
2011-10-01 16:29 . 2011-10-01 16:29 -------- d-----w- C:\Autodesk
2011-10-01 14:38 . 2011-10-01 14:40 -------- d-----w- c:\program files\Scorpions WinCheater
2011-10-01 14:11 . 2011-10-01 14:11 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2011-10-01 14:10 . 2011-10-01 14:10 -------- d-----w- C:\UPI
2011-10-01 14:09 . 2011-10-01 16:51 -------- d-----w- c:\documents and settings\Longin\Data aplikací\Autodesk
2011-10-01 14:09 . 2011-10-01 16:44 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2011-10-01 14:09 . 2011-10-01 14:09 -------- d-----w- c:\documents and settings\Longin\Local Settings\Data aplikací\Autodesk
2011-10-01 14:09 . 2011-10-01 14:09 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Autodesk
2011-10-01 13:42 . 2011-10-01 13:42 -------- d-----w- C:\fd56c4d1b3b1f5a1b50b9e70efcb
2011-10-01 09:46 . 2011-10-01 09:46 -------- d-----w- c:\program files\Common Files\Java
2011-10-01 09:46 . 2011-10-01 09:45 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-10-01 09:46 . 2011-10-01 09:45 476904 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2011-10-01 09:46 . 2011-10-01 09:45 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-10-01 09:45 . 2011-10-03 19:42 -------- d-----w- c:\program files\Java
2011-09-26 20:37 . 2011-09-26 20:37 -------- d-----w- c:\documents and settings\Longin\Data aplikací\Miranda
2011-09-25 16:31 . 2011-09-25 16:31 -------- d-----w- c:\documents and settings\Longin\Data aplikací\Foxit Software
2011-09-21 17:22 . 2011-09-21 17:22 -------- d-----w- c:\documents and settings\Longin\Local Settings\Data aplikací\Google
2011-09-21 17:22 . 2011-09-22 07:00 -------- d-----w- c:\program files\Google
2011-09-21 16:05 . 2011-09-21 16:05 -------- d-----w- c:\documents and settings\Longin\Data aplikací\vlc
2011-09-21 16:04 . 2011-09-21 16:04 -------- d-----w- c:\program files\VideoLAN
2011-09-18 16:13 . 2011-09-19 15:35 -------- d-----w- c:\documents and settings\Longin\Data aplikací\TS3Client
2011-09-18 16:13 . 2011-09-18 16:13 -------- d-----w- c:\program files\TeamSpeak 3 Client
2011-09-12 18:22 . 2011-09-12 18:34 -------- d-----w- c:\documents and settings\Longin\Data aplikací\L4dOgerLauncher
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-01 13:57 . 2011-08-20 05:49 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-21 14:25 . 2011-08-21 14:20 2829 ----a-w- c:\windows\War3Unin.pif
2011-08-21 14:25 . 2011-08-21 14:20 139264 ----a-w- c:\windows\War3Unin.exe
2011-08-19 17:45 . 2011-08-19 17:45 57344 ----a-r- c:\documents and settings\Longin\Data aplikací\Microsoft\Installer\{7F362F06-A9A3-440F-8B19-6A01A72723C4}\ARPPRODUCTICON.exe
2011-10-01 08:39 . 2011-08-19 16:43 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2008-04-14 . DF7917138B80C79D15B3E8520D565311 . 111104 . . [5.4.3790.5512] . . c:\windows\system32\dllcache\wuauclt.exe
.
c:\windows\System32\wuauclt.exe ... chybí !!
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Longin\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Longin\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Longin\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Longin\Data aplikací\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-01-05 872448]
"WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-09-01 499768]
"atchk"="c:\program files\Intel\AMT\atchk.exe" [2007-11-09 408088]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2010-02-25 287800]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-25 61440]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-06-30 2554696]
"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 81920]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Longin\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Dropbox.lnk - c:\documents and settings\Longin\Data aplikacˇ\Dropbox\bin\Dropbox.exe [2011-8-18 24182160]
.
c:\documents and settings\Longin\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Dropbox.lnk - c:\documents and settings\Longin\Data aplikacˇ\Dropbox\bin\Dropbox.exe [2011-8-18 24182160]
.
c:\documents and settings\Longin\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Dropbox.lnk - c:\documents and settings\Longin\Data aplikacˇ\Dropbox\bin\Dropbox.exe [2011-8-18 24182160]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-12-6 576104]
.
c:\documents and settings\Longin\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Dropbox.lnk - c:\documents and settings\Longin\Data aplikacˇ\Dropbox\bin\Dropbox.exe [2011-8-18 24182160]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Documents and Settings\\Longin\\Data aplikací\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [21.8.2011 13:36 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [21.8.2011 13:36 5248]
R1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\drivers\cmderd.sys [30.6.2011 9:38 17416]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [30.6.2011 9:38 242600]
R2 atchksrv;Intel(R) Active Management Technology System Status Service;c:\program files\Intel\AMT\atchksrv.exe [19.8.2011 19:40 182808]
R2 UNS;Intel(R) Active Management Technology User Notification Service;c:\program files\Intel\AMT\UNS.exe [19.8.2011 19:40 1464856]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [30.3.2011 20:46 101392]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [19.8.2011 19:53 227896]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [23.7.2008 11:31 44800]
R3 NETwLx32; Ovladač adaptéru řady Intel(R) Wireless WiFi Link 5000 pro systém Windows XP 32 Bit;c:\windows\system32\drivers\NETwLx32.sys [19.8.2011 18:59 6609920]
R3 rismc32;RICOH Smart Card Reader;c:\windows\system32\drivers\rismc32.sys [19.8.2011 17:54 49152]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 cpuz130;cpuz130;\??\c:\docume~1\Longin\LOCALS~1\Temp\cpuz130\cpuz_x32.sys --> c:\docume~1\Longin\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]
S3 esihdrv;esihdrv;\??\c:\docume~1\Longin\LOCALS~1\Temp\esihdrv.sys --> c:\docume~1\Longin\LOCALS~1\Temp\esihdrv.sys [?]
S3 GGSAFERDriver;GGSAFER Driver;\??\c:\program files\Garena Classic\safedrv.sys --> c:\program files\Garena Classic\safedrv.sys [?]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [9.1.2010 21:37 4640000]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WUAUSERV
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 147.229.190.143 147.229.191.143
FF - ProfilePath - c:\documents and settings\Longin\Data aplikací\Mozilla\Firefox\Profiles\33qv6ex4.default\
.
.
------- Asociace souborů -------
.
.scr=AutoCADScriptFile
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-04 17:17
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwClose
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TlntSvr]
"ImagePath"=""
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(952)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'lsass.exe'(1012)
c:\windows\system32\MPR.dll
c:\windows\system32\guard32.dll
.
- - - - - - - > 'explorer.exe'(3296)
c:\windows\system32\guard32.dll
c:\documents and settings\Longin\Data aplikací\Dropbox\bin\DropboxExt.14.dll
c:\program files\Common Files\Autodesk Shared\AcSignCore16.dll
c:\windows\system32\btmmhook.dll
c:\windows\system32\msi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\documents and settings\Longin\Data aplikací\Dropbox\bin\Dropbox.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Intel\AMT\LMS.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Hewlett-Packard\Shared\hpqToaster.exe
c:\program files\Hewlett-Packard\Shared\hpCaslNotification.exe
.
**************************************************************************
.
Celkový čas: 2011-10-04 17:20:26 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-10-04 15:20
.
Před spuštěním: Volných bajtů: 15 675 830 272
Po spuštění: Volných bajtů: 15 790 219 264
.
- - End Of File - - 45C829FCA74AEE697D2FB3C8662CFB81
je to tu něco řešitelného?
Přispějete na provoz fóra?