Vir Policia SR-nefunkcny navod

[peter.kovacik.zvolen]

Dobry den, tak som aj ja dostal tento virus , chcel som pouzit tento navod
http://www.viruskasino.com/2012/12/vas- ... azany.html

ale obnova systemu cez prikazovy riadok v nudzovom rezime nefunguje, prikaz %Systemroot%/system32/restore/rstrui.exe
som napisal spravne ale obnova systemu nenabehla, predtym som skusal aj dat klasicky obnovu systemu v nudzovom rezime a vybral datum ale aj tak virus nabehol opat, ted som pouzil ten program Rkill v nudzovom rezime , prebehol scen a vysledok, potom som spravil aj scen RSIT taktiez v nudzovom rezime, vysledky prikladam a pisem z ineho PC, infikobvany PC je stale spusteny v nudzovom rezime. Neviem ci ho mam restartnut alebo ako dalej postupovat, Dakujem moc za Vasu pomoc.

LOG z Rkill

Rkill 2.4.7 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 03/30/2013 04:20:17 PM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 2

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
* HKLM\Software\Classes\.exe\shell found and deleted!


Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* Prostředí pro podporu sítě AFD (AFD) is not Running.
Startup Type set to: System

* Klient DHCP (Dhcp) is not Running.
Startup Type set to: Automatic

* Klient DNS (Dnscache) is not Running.
Startup Type set to: Automatic

* Systém událostí modelu COM+ (EventSystem) is not Running.
Startup Type set to: Manual

* Síťová připojení (Netman) is not Running.
Startup Type set to: Manual

* Služba WMI (winmgmt) is not Running.
Startup Type set to: Automatic

* Centrum zabezpečení (wscsvc) is not Running.
Startup Type set to: Automatic

* Automatické aktualizace (wuauserv) is not Running.
Startup Type set to: Automatic

* Prostředí pro podporu sítě AFD (AFD) is not Running.
Startup Type set to: System

* Ovladač IPSEC (IPSec) is not Running.
Startup Type set to: System

* NetBT (NetBT) is not Running.
Startup Type set to: System

* Ovladač protokolu TCP/IP (Tcpip) is not Running.
Startup Type set to: System

* winmgmt => C:\DOCUME~1\Patrik\LOCALS~1\Temp\wpbt0.dll [Incorrect ServiceDLL]

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost

Program finished at: 03/30/2013 04:21:37 PM
Execution time: 0 hours(s), 1 minute(s), and 20 seconds(s)



=================


LOG Z RSIT

Logfile of random's system information tool 1.09 (written by random/random)
Run by Administrator at 2013-03-30 16:25:39
WIN_XP Service Pack 2
System drive C: has 4 GB (38%) free of 10 GB
Total RAM: 511 MB (79% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job
C:\WINDOWS\tasks\avast! Emergency Update.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-448539723-1547161642-1801674531-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-448539723-1547161642-1801674531-1003UA.job
C:\WINDOWS\tasks\Symantec NetDetect.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\System32\NvCpl.dll [2003-10-06 5058560]
"Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd []
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2005-12-20 278528]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2012-08-21 4282728]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-03 843712]
"KeePass 2 PreLoad"=C:\Program Files\KeePass Password Safe 2\KeePass.exe [2012-05-01 1895424]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\System32\CTFMON.EXE [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccRegVfy]
C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GhostStartTrayApp]
C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2004-08-17 1667584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Trickler]
c:\program files\divx\divx pro codec\gain_trickler_3202a.exe [2006-09-01 200988]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe []

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
11bg Wireless LAN USB Utility.lnk - C:\Program Files\OEM\11bg Wireless LAN USB Utility\RtWLan.exe

C:\Documents and Settings\Administrator.GREGOR.000\Nabídka Start\Programy\Po spuštění
runctf.lnk - C:\WINDOWS\system32\rundll32.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\WINDOWS\system32\mmc.exe"="C:\WINDOWS\system32\mmc.exe:*:Enabled:Konzola Microsoft Management Console"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.l3acm"=C:\WINDOWS\System32\l3codeca.acm
"vidc.DIVX"=DivX.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"vidc.xvid"=xvid.dll
"VIDC.WMV3"=wmv9vcm.dll

======List of files/folders created in the last 1 month======

2013-03-30 16:26:10 ----D---- C:\Program Files\trend micro
2013-03-30 16:25:39 ----D---- C:\rsit
2013-03-28 16:43:43 ----D---- C:\Documents and Settings\Administrator.GREGOR.000\Data aplikací\Mozilla
2013-03-28 16:42:28 ----ASH---- C:\Documents and Settings\Administrator.GREGOR.000\Data aplikací\desktop.ini
2013-03-28 16:42:27 ----SD---- C:\Documents and Settings\Administrator.GREGOR.000\Data aplikací\Microsoft
2013-03-28 16:39:59 ----A---- C:\Documents and Settings\All Users\Data aplikací\0tbpw.js
2013-03-28 16:30:08 ----A---- C:\WINDOWS\RTacDbg.txt
2013-03-28 16:25:03 ----SHD---- C:\WINDOWS\CSC
2013-03-28 16:21:01 ----A---- C:\WINDOWS\ntbtlog.txt

======List of files/folders modified in the last 1 month======

2013-03-30 16:26:10 ----RD---- C:\Program Files
2013-03-30 16:20:18 ----D---- C:\WINDOWS\system32\CatRoot2
2013-03-28 16:42:27 ----D---- C:\Documents and Settings
2013-03-28 16:37:53 ----D---- C:\WINDOWS
2013-03-28 16:37:53 ----A---- C:\WINDOWS\win.ini
2013-03-28 16:37:51 ----D---- C:\WINDOWS\Temp
2013-03-28 16:11:02 ----A---- C:\WINDOWS\SchedLgU.Txt

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2006-05-16 46080]
R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2005-02-02 14408]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2012-08-21 25256]
S1 AswRdr;aswRdr; C:\WINDOWS\system32\drivers\AswRdr.sys [2012-08-21 35928]
S1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2012-08-21 355632]
S1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2012-08-21 54232]
S1 intelppm;Řadič procesoru Intel; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-17 39936]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\System32\DRIVERS\kbdhid.sys [2004-08-17 14848]
S1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
S2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.5.0; C:\WINDOWS\System32\DRIVERS\AegisP.sys [2010-04-01 21035]
S2 Aspi32;Aspi32; C:\WINDOWS\system32\drivers\Aspi32.sys [2002-08-14 17005]
S2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2012-08-21 97608]
S2 EAPPkt;Realtek EAPPkt Protocol; C:\WINDOWS\System32\DRIVERS\EAPPkt.sys [2007-10-09 38144]
S3 cmuda;C-Media WDM Audio Interface; C:\WINDOWS\system32\drivers\cmuda.sys [2003-11-06 755392]
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\System32\DRIVERS\fetnd5.sys [2001-08-17 27165]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2003-10-06 1550043]
S3 RTL8187B;Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter; C:\WINDOWS\System32\DRIVERS\RTL8187B.sys [2008-03-18 275968]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2004-08-03 15104]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-08-21 44808]
S2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\System32\nvsvc32.exe [2003-10-06 81920]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-26 253600]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376]
S3 iPodService;iPodService; C:\Program Files\iPod\bin\iPodService.exe [2005-12-20 323584]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880]

-----------------EOF-----------------

[Rudy]

Poprosím o log ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

[peter.kovacik.zvolen]

dakujem z pomoc, takze som pouzil combofix iba v nudzovom rezime a vybehol log a PC sa spital ci chcem pokracovat v nudzovom rezime dal som ano, nabehla opat obrazovka Policie SR, restartol som pc a nechcel nabehnut system a ani F8, musel som vypnut natvrdo a system spustil v normalnom rezime ale nabehla zas obrazovka policie SR, restartol zvolil F8 a dostal sa do nudzoveho rezimu, inetrenet tam nejde, z disku C dal na USB log z kombofixu a pisem z ineho PC, prikladam log:

ComboFix 13-03-30.01 - Administrator 30.03.2013 18:25:39.1.1 - x86 MINIMAL
Running from: c:\documents and settings\Administrator.GREGOR.000\Plocha\ComboFix.exe
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Patrik\WINDOWS
c:\program files\FunWebProducts
c:\program files\FunWebProducts\Installr\8.bin\F3EZSETP.DLL
c:\program files\FunWebProducts\Installr\8.bin\F3PLUGIN.DLL
c:\program files\FunWebProducts\Installr\8.bin\NPFUNWEB.DLL
c:\windows\iun6002.exe
c:\windows\system32\dllcache\wmpvis.dll
.
.
((((((((((((((((((((((((( Files Created from 2013-02-28 to 2013-03-30 )))))))))))))))))))))))))))))))
.
.
2013-03-30 15:26 . 2013-03-30 15:26 -------- d-----w- c:\program files\trend micro
2013-03-30 15:25 . 2013-03-30 15:26 -------- d-----w- C:\rsit
2013-03-28 15:39 . 2013-03-28 15:43 3126 ----a-w- c:\documents and settings\All Users\Data aplikací\0tbpw.js
2013-03-28 15:25 . 2013-03-28 15:25 -------- d-----w- c:\documents and settings\Administrator
2013-03-23 15:20 . 2013-03-23 15:20 -------- d-----w- c:\documents and settings\Patrik\Data aplikací\dvdcss
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-05 19:41 . 2013-01-05 19:41 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2005-12-20 278528]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-08-21 4282728]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"KeePass 2 PreLoad"="c:\program files\KeePass Password Safe 2\KeePass.exe" [2012-05-01 1895424]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]
.
c:\documents and settings\Patrik\Nabídka Start\Programy\Po spuštění\
Kalendár.lnk - c:\windows\MENINY.EXE [2006-9-1 49312]
runctf.lnk - c:\windows\system32\rundll32.exe [2001-10-25 33280]
.
c:\documents and settings\Administrator.GREGOR.000\Nabídka Start\Programy\Po spuštění\
runctf.lnk - c:\windows\system32\rundll32.exe [2001-10-25 33280]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
11bg Wireless LAN USB Utility.lnk - c:\program files\OEM\11bg Wireless LAN USB Utility\RtWLan.exe [2010-4-1 835584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-17 13:49 1667584 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2003-10-06 05:16 741376 ----a-r- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Trickler]
2006-09-01 15:21 200988 ----a-w- c:\program files\DivX\DivX Pro Codec\gain_trickler_3202a.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 aswSP;aswSP; [x]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\DRIVERS\EAPPkt.sys [x]
R2 nvspypnp;Installer Manager;c:\windows\system32\svchost.exe [x]
R3 RTL8187B;Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [x]
.
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
nvspypnp
.
Contents of the 'Scheduled Tasks' folder
.
2013-03-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-26 14:32]
.
2013-03-28 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-09-01 09:12]
.
2013-03-28 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2006-09-01 07:04]
.
.
------- Supplementary Scan -------
.
TCP: DhcpNameServer = 217.75.71.141 217.75.71.142
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Administrator.GREGOR.000\Data aplikací\Mozilla\Firefox\Profiles\s9tis2ez.default\
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-Cmaudio - cmicnfg.cpl
MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe
MSConfigStartUp-ccRegVfy - c:\program files\Common Files\Symantec Shared\ccRegVfy.exe
MSConfigStartUp-GhostStartTrayApp - c:\program files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe
AddRemove-Cool's_Codec_pack_4.12 - c:\windows\iun6002.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-03-30 18:34
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2013-03-30 18:36:54
ComboFix-quarantined-files.txt 2013-03-30 17:36
.
Pre-Run: 4 291 235 840
Post-Run: 4 259 024 896
.
- - End Of File - - C9800080329E9058E508F79A5AD18987

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Collect::
c:\documents and settings\All Users\Data aplikací\0tbpw.js
c:\documents and settings\Patrik\Nabídka Start\Programy\Po spuštění\runctf.lnk
c:\documents and settings\Administrator.GREGOR.000\Nabídka Start\Programy\Po spuštění\runctf.lnk

Driver::
nvspypnp

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[peter.kovacik.zvolen]

Takze PC uz je ok nabieha v normalnom rezime a ide aj internet, akurat hodi tuto hlasku:

C:/DOCUME 1 /Parik/LOCASL 1/Temp/wpbt0.dll
Uvedeny modul nebyl nalezen

Da sa to odstranit? vdaka
Prikladam log z Combofix:



ComboFix 13-03-30.01 - Administrator 30.03.2013 19:18:57.1.1 - x86 MINIMAL
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1029.18.511.410 [GMT 1:00]
Running from: c:\documents and settings\Administrator.GREGOR.000\Plocha\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator.GREGOR.000\Plocha\CFScript.txt
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
file zipped: c:\documents and settings\Administrator.GREGOR.000\Nabídka Start\Programy\Po spuštění\runctf.lnk
file zipped: c:\documents and settings\All Users\Data aplikací\0tbpw.js
file zipped: c:\documents and settings\Patrik\Nabídka Start\Programy\Po spuštění\runctf.lnk
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Data aplikací\0tbpw.js
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NVSPYPNP
-------\Service_nvspypnp
.
.
((((((((((((((((((((((((( Files Created from 2013-02-28 to 2013-03-30 )))))))))))))))))))))))))))))))
.
.
2013-03-30 15:26 . 2013-03-30 15:26 -------- d-----w- c:\program files\trend micro
2013-03-30 15:25 . 2013-03-30 15:26 -------- d-----w- C:\rsit
2013-03-28 15:25 . 2013-03-28 15:25 -------- d-----w- c:\documents and settings\Administrator
2013-03-23 15:20 . 2013-03-23 15:20 -------- d-----w- c:\documents and settings\Patrik\Data aplikací\dvdcss
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-05 19:41 . 2013-01-05 19:41 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\System32\NVMCTRAY.DLL" [2003-10-06 49152]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]
"Cmaudio"="cmicnfg.cpl" [BU]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2005-12-20 278528]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-08-21 4282728]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"KeePass 2 PreLoad"="c:\program files\KeePass Password Safe 2\KeePass.exe" [2012-05-01 1895424]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]
.
c:\documents and settings\Patrik\Nabídka Start\Programy\Po spuštění\
Kalendár.lnk - c:\windows\MENINY.EXE [2006-9-1 49312]
runctf.lnk - c:\windows\system32\rundll32.exe [2001-10-25 33280]
.
c:\documents and settings\Administrator.GREGOR.000\Nabídka Start\Programy\Po spuštění\
runctf.lnk - c:\windows\system32\rundll32.exe [2001-10-25 33280]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
11bg Wireless LAN USB Utility.lnk - c:\program files\OEM\11bg Wireless LAN USB Utility\RtWLan.exe [2010-4-1 835584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
c:\program files\Common Files\Symantec Shared\ccApp.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccRegVfy]
c:\program files\Common Files\Symantec Shared\ccRegVfy.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GhostStartTrayApp]
c:\program files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-17 13:49 1667584 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2003-10-06 05:16 741376 ----a-r- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Trickler]
2006-09-01 15:21 200988 ----a-w- c:\program files\DivX\DivX Pro Codec\gain_trickler_3202a.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
c:\program files\Winamp\winampa.exe [BU]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [1.9.2012 11:13 355632]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [1.4.2010 21:52 38144]
S3 CFcatchme;CFcatchme;\??\c:\docume~1\ADMINI~1.000\LOCALS~1\Temp\CFcatchme.sys --> c:\docume~1\ADMINI~1.000\LOCALS~1\Temp\CFcatchme.sys [?]
S3 RTL8187B;Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187B.sys [1.4.2010 21:53 275968]
.
Contents of the 'Scheduled Tasks' folder
.
2013-03-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-26 14:32]
.
2013-03-30 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-09-01 09:12]
.
2013-03-30 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2006-09-01 07:04]
.
.
------- Supplementary Scan -------
.
TCP: DhcpNameServer = 217.75.71.141 217.75.71.142
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Patrik\Data aplikací\Mozilla\Firefox\Profiles\7k36d1xt.default\
FF - prefs.js: browser.startup.homepage - www.google.sk
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-03-30 19:32
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1608)
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\System32\nvsvc32.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\AVAST Software\Avast\setup\avast.setup
.
**************************************************************************
.
Completion time: 2013-03-30 19:35:14 - machine was rebooted
ComboFix-quarantined-files.txt 2013-03-30 18:35
ComboFix2.txt 2013-03-30 17:36
.
Pre-Run: 4 263 686 144
Post-Run: 4 331 114 496
.
- - End Of File - - 759DF7308F437AF226C03CC02857BA92
Upload was successful

[Rudy]

Ještě je asi zbytek po tom viru v registry. Tohle je totiž ten šmejd. Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

[peter.kovacik.zvolen]

prikladam log

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware.) 1.70.0.1100
www.malwarebytes.org

Verze: v2013.03.30.05

Windows XP Service Pack 2 x86 NTFS
Internet Explorer 6.0.2900.2180
Patrik :: GREGOR [administrátor]

Ochrana: Povolena

30.3.2013 20:09:36
MBAM-log-2013-03-30 (20-52-54).txt

Typ: Kompletní kontrola (C:\|D:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 284108
Uplynulý čas: 42 minut, 29 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 6
c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\uv43mhkx\fvnnzlsl[1].bmp (Extension.Mismatch) -> Nebyla provedena žádná instrukce.
c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\uv43mhkx\hdzofa[1].bmp (Extension.Mismatch) -> Nebyla provedena žádná instrukce.
c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\uv43mhkx\hdzofa[1].gif (Extension.Mismatch) -> Nebyla provedena žádná instrukce.
C:\Documents and Settings\Administrator.GREGOR.000\Nabídka Start\Programy\Po spuštění\runctf.lnk (Trojan.Ransom.SUGen) -> Nebyla provedena žádná instrukce.
C:\Documents and Settings\Administrator.GREGOR\Nabídka Start\Programy\Po spuštění\runctf.lnk (Trojan.Ransom.SUGen) -> Nebyla provedena žádná instrukce.
C:\Documents and Settings\Patrik\Nabídka Start\Programy\Po spuštění\runctf.lnk (Trojan.Ransom.SUGen) -> Nebyla provedena žádná instrukce.

(konec)

[Rudy]

Vše, co MBAM nalezl, smažte.

[peter.kovacik.zvolen]

vsetko zmaazane hlaska uz nevyskakuje, PC sa chova dobre, ak je to vsetko pekne Vam dakujem, velmi ste mi pomohli este davam log po zmazani, prajem prijemny vecer.

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware.) 1.70.0.1100
www.malwarebytes.org

Verze: v2013.03.30.05

Windows XP Service Pack 2 x86 NTFS
Internet Explorer 6.0.2900.2180
Patrik :: GREGOR [administrátor]

Ochrana: Povolena

30.3.2013 20:09:36
mbam-log-2013-03-30 (20-09-36).txt

Typ: Kompletní kontrola (C:\|D:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 284108
Uplynulý čas: 42 minut, 29 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 6
c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\uv43mhkx\fvnnzlsl[1].bmp (Extension.Mismatch) -> Přesun do karantény a smazání se zdařilo.
c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\uv43mhkx\hdzofa[1].bmp (Extension.Mismatch) -> Přesun do karantény a smazání se zdařilo.
c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\uv43mhkx\hdzofa[1].gif (Extension.Mismatch) -> Přesun do karantény a smazání se zdařilo.
C:\Documents and Settings\Administrator.GREGOR.000\Nabídka Start\Programy\Po spuštění\runctf.lnk (Trojan.Ransom.SUGen) -> Přesun do karantény a smazání se zdařilo.
C:\Documents and Settings\Administrator.GREGOR\Nabídka Start\Programy\Po spuštění\runctf.lnk (Trojan.Ransom.SUGen) -> Přesun do karantény a smazání se zdařilo.
C:\Documents and Settings\Patrik\Nabídka Start\Programy\Po spuštění\runctf.lnk (Trojan.Ransom.SUGen) -> Přesun do karantény a smazání se zdařilo.

(konec)

[Rudy]

Log je OK. Hezký večer a nemáte zač! Doporučil bych nainstalovat SP3. S SP2 je systém neaktualizovaný.