win32/Kryptik/trojan.bcp

[motji]

Sleseleseleci
Než přijde kolega, vložte mu zde log ze Rsitu, viz můj podpis

[earl]

2Sleseleseleci:

Jak psala kolegyne +

:arrow:Otestujte na VIRUSTOTALu a JOTTISCANu

c:\windows\temp\rtdrvmon.exe

(navod prosty: po nacteni stranky kliknete na tlacitko Prochazet , najdete cestu k vyse zminenemu souboru a kliknete na tlacitko Odeslat soubor; dejte skenerum nejakych deset minut; vysledky sem vlozte)

Pokud skener napíše, že soubor již byl testován, dejte otestovat znovu.

[Sleseleseleci]

RSIT log:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Sele at 2010-01-21 18:21:50
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 7 GB (63%) free of 11 GB
Total RAM: 767 MB (65% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:22:01, on 21.1.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Sele\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Sele\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Sele\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Sele\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
D:\Láďa\Downloads\RSIT.exe
C:\Program Files\trend micro\Sele.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 0757301812
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 3726 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-16 13529088]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2003-08-15 57344]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2009-09-11 2054360]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ"
"C:\Program Files\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-01-21 18:21:50 ----D---- C:\rsit
2010-01-21 18:21:50 ----D---- C:\Program Files\trend micro
2010-01-20 04:08:11 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2010-01-20 04:08:02 ----D---- C:\Program Files\Common Files\Adobe
2010-01-20 04:08:02 ----D---- C:\Program Files\Adobe
2010-01-20 04:00:09 ----SHD---- C:\RECYCLER
2010-01-20 03:55:10 ----D---- C:\WINDOWS\temp
2010-01-20 03:55:08 ----A---- C:\ComboFix.txt
2010-01-17 00:07:25 ----A---- C:\Boot.bak
2010-01-17 00:07:17 ----RASHD---- C:\cmdcons
2010-01-17 00:06:24 ----A---- C:\WINDOWS\NIRCMD.exe
2010-01-17 00:06:24 ----A---- C:\WINDOWS\MBR.exe
2010-01-17 00:06:21 ----A---- C:\WINDOWS\PEV.exe
2010-01-17 00:06:20 ----A---- C:\WINDOWS\zip.exe
2010-01-17 00:06:20 ----A---- C:\WINDOWS\SWREG.exe
2010-01-17 00:06:20 ----A---- C:\WINDOWS\sed.exe
2010-01-17 00:06:20 ----A---- C:\WINDOWS\grep.exe
2010-01-17 00:06:19 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-01-17 00:06:19 ----A---- C:\WINDOWS\SWSC.exe
2010-01-17 00:05:38 ----D---- C:\WINDOWS\ERDNT
2010-01-17 00:03:13 ----D---- C:\Qoobox
2010-01-16 11:00:37 ----D---- C:\WINDOWS\Minidump
2010-01-16 10:36:09 ----A---- C:\dinu.exe
2010-01-06 00:53:51 ----D---- C:\Program Files\IrfanView
2010-01-06 00:48:07 ----A---- C:\WINDOWS\lexstat.ini
2010-01-06 00:46:56 ----A---- C:\WINDOWS\system32\lxbkvs.dll
2010-01-06 00:46:56 ----A---- C:\WINDOWS\system32\lxbkpwr.dll
2010-01-06 00:46:56 ----A---- C:\WINDOWS\system32\LXBKPMNT.DLL
2010-01-06 00:46:56 ----A---- C:\WINDOWS\system32\LXBKLSNT.EXE
2010-01-06 00:46:56 ----A---- C:\WINDOWS\system32\LXBKLCNT.DLL
2010-01-06 00:46:56 ----A---- C:\WINDOWS\system32\LXBKLCNP.DLL
2010-01-06 00:46:56 ----A---- C:\WINDOWS\system32\LXBKIH.EXE
2010-01-06 00:46:56 ----A---- C:\WINDOWS\system32\LXBKCU.DLL
2010-01-06 00:46:56 ----A---- C:\WINDOWS\system32\lxbkcomm.dll
2010-01-06 00:46:56 ----A---- C:\WINDOWS\system32\LXBKCFG.EXE
2010-01-06 00:46:56 ----A---- C:\WINDOWS\system32\LEXPPS.EXE
2010-01-06 00:46:56 ----A---- C:\WINDOWS\system32\LEXPING.EXE
2010-01-06 00:46:56 ----A---- C:\WINDOWS\system32\LEXP2P32.DLL
2010-01-06 00:46:56 ----A---- C:\WINDOWS\system32\LEXBCES.EXE
2010-01-06 00:46:56 ----A---- C:\WINDOWS\system32\LEXBCE.DLL
2010-01-06 00:46:56 ----A---- C:\WINDOWS\system32\LEX2KUSB.DLL
2010-01-06 00:46:56 ----A---- C:\WINDOWS\system32\INSTMON.EXE
2010-01-06 00:46:55 ----A---- C:\WINDOWS\system32\LXBKCUR.DLL
2010-01-06 00:46:55 ----A---- C:\WINDOWS\system32\LEXLMPM.DLL
2010-01-06 00:46:47 ----A---- C:\WINDOWS\system32\wiafbdrv.dll
2010-01-06 00:46:41 ----D---- C:\Program Files\Lexmark X1100 Series
2010-01-06 00:46:41 ----A---- C:\WINDOWS\system32\LXBKUTIL.DLL
2010-01-06 00:46:41 ----A---- C:\WINDOWS\system32\lxbkscin.dll
2010-01-06 00:46:41 ----A---- C:\WINDOWS\system32\LXBKJSWR.DLL
2010-01-06 00:46:41 ----A---- C:\WINDOWS\system32\LXBKGF.DLL
2010-01-06 00:46:41 ----A---- C:\WINDOWS\system32\lxbkcoin.ini
2010-01-06 00:46:41 ----A---- C:\WINDOWS\system32\lxbkcoin.dll
2010-01-06 00:46:41 ----A---- C:\WINDOWS\system32\lxbkcinf.dll
2010-01-06 00:46:22 ----A---- C:\WINDOWS\uninst.exe

======List of files/folders modified in the last 1 months======

2010-01-21 18:21:58 ----D---- C:\WINDOWS\Prefetch
2010-01-21 18:21:50 ----RD---- C:\Program Files
2010-01-21 09:43:35 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-01-21 09:05:37 ----D---- C:\WINDOWS\system32\CatRoot2
2010-01-20 20:31:17 ----D---- C:\Program Files\Mozilla Firefox
2010-01-20 04:12:20 ----D---- C:\WINDOWS\system32\config
2010-01-20 04:10:28 ----SHD---- C:\System Volume Information
2010-01-20 04:10:28 ----D---- C:\WINDOWS\system32\Restore
2010-01-20 04:10:27 ----D---- C:\WINDOWS
2010-01-20 04:08:34 ----D---- C:\Documents and Settings\Sele\Data aplikací\Adobe
2010-01-20 04:08:24 ----SHD---- C:\WINDOWS\Installer
2010-01-20 04:08:12 ----D---- C:\WINDOWS\WinSxS
2010-01-20 04:08:02 ----D---- C:\Program Files\Common Files
2010-01-20 04:07:57 ----D---- C:\WINDOWS\system32
2010-01-20 03:55:11 ----D---- C:\WINDOWS\system32\drivers
2010-01-20 03:53:56 ----A---- C:\WINDOWS\system.ini
2010-01-20 03:51:43 ----D---- C:\WINDOWS\AppPatch
2010-01-20 03:30:22 ----D---- C:\Program Files\uTorrent
2010-01-18 18:58:41 ----D---- C:\Documents and Settings\Sele\Data aplikací\ICQ
2010-01-17 00:16:07 ----SD---- C:\WINDOWS\Tasks
2010-01-17 00:11:18 ----D---- C:\Program Files\ICQ6.5
2010-01-17 00:07:25 ----RASH---- C:\boot.ini
2010-01-14 17:43:26 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-01-14 00:59:37 ----SD---- C:\Documents and Settings\Sele\Data aplikací\Microsoft
2010-01-11 16:14:11 ----RSD---- C:\WINDOWS\Fonts
2010-01-06 00:46:58 ----HD---- C:\WINDOWS\inf
2010-01-06 00:46:52 ----D---- C:\WINDOWS\twain_32

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK7;Ovladač procesoru AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2004-08-17 41216]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-09-11 108792]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2009-09-11 96408]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-09-11 116008]
R2 SetupNT;SetupNT; C:\WINDOWS\system32\SetupNT.sys [2000-10-25 3000]
R3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS [2003-08-14 404736]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2003-09-10 463932]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-16 6557408]
R3 NVENET;NVIDIA nForce MCP Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENET.sys [2002-11-27 80896]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024]
R3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856]
R3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys []
S3 catchme;catchme; \??\C:\grinder\catchme.sys []
S3 nvax;Service for NVIDIA(R) nForce(TM) Audio Enumerator; C:\WINDOWS\system32\drivers\nvax.sys [2002-12-05 13056]
S3 nvnforce;Service for NVIDIA(R) nForce(TM) Audio; C:\WINDOWS\system32\drivers\nvapu.sys [2002-12-05 241664]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2009-12-18 691696]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-09-11 735960]
R2 LexBceS;LexBce Server; C:\WINDOWS\system32\LEXBCES.EXE [2003-08-18 303104]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-16 159812]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2004-08-17 14336]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2009-09-11 20680]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\WINDOWS\System32\TuneUpDefragService.exe [2009-12-08 306432]

-----------------EOF-----------------

C:\Windows\temp\rtdrvmon.exe:
VirusTotal log:
Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.5.0.50 2010.01.21 -
AhnLab-V3 5.0.0.2 2010.01.21 -
AntiVir 7.9.1.146 2010.01.21 -
Antiy-AVL 2.0.3.7 2010.01.21 -
Authentium 5.2.0.5 2010.01.21 -
Avast 4.8.1351.0 2010.01.21 -
AVG 9.0.0.730 2010.01.21 -
BitDefender 7.2 2010.01.21 -
CAT-QuickHeal 10.00 2010.01.21 -
ClamAV 0.94.1 2010.01.21 -
Comodo 3659 2010.01.21 -
DrWeb 5.0.1.12222 2010.01.21 -
eSafe 7.0.17.0 2010.01.20 -
eTrust-Vet 35.2.7250 2010.01.21 -
F-Prot 4.5.1.85 2010.01.20 -
F-Secure 9.0.15370.0 2010.01.21 -
Fortinet 4.0.14.0 2010.01.21 -
GData 19 2010.01.21 -
Ikarus T3.1.1.80.0 2010.01.21 -
Jiangmin 13.0.900 2010.01.21 -
K7AntiVirus 7.10.951 2010.01.20 -
Kaspersky 7.0.0.125 2010.01.21 -
McAfee 5867 2010.01.20 -
McAfee+Artemis 5867 2010.01.20 -
McAfee-GW-Edition 6.8.5 2010.01.21 -
Microsoft 1.5302 2010.01.21 -
NOD32 4791 2010.01.20 -
Norman 6.04.03 2010.01.20 -
nProtect 2009.1.8.0 2010.01.21 -
Panda 10.0.2.2 2010.01.21 -
PCTools 7.0.3.5 2010.01.21 -
Rising 22.31.03.04 2010.01.21 -
Sophos 4.50.0 2010.01.21 -
Sunbelt 3.2.1858.2 2010.01.21 -
Symantec 20091.2.0.41 2010.01.21 -
TheHacker 6.5.0.8.157 2010.01.21 -
TrendMicro 9.120.0.1004 2010.01.21 -
VBA32 3.12.12.1 2010.01.20 -
ViRobot 2010.1.21.2148 2010.01.21 -
VirusBuster 5.0.21.0 2010.01.20 -
Rozšiřující informace
File size: 40960 bytes
MD5...: 945d09c0925f771f907dee3d0452ecf4
SHA1..: ff415844573771abfe90ee7b5639ac033b319df3
SHA256: d1474290ca3f07d43c65d7d79d70816b3a60c5cf0afa4c8db2a7b81f236b98a5
ssdeep: 384:i33fjJxKyAbfaxC0WUUq/xh4l7t2yvG1WVg0FDoa:I3fFxKyIaY/UW2310BF
Doa
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x14bf
timedatestamp.....: 0x3d06b9b7 (Wed Jun 12 03:02:15 2002)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x3a6c 0x4000 6.29 e3fff0e0ed64a8be46f15ad1433ba10c
.rdata 0x5000 0x8e6 0x1000 3.57 cea5d63f4a457a8c82ecc5a0d2c115e7
.data 0x6000 0x2a1c 0x3000 0.43 c05e51030a9b90b3f791d5cb86ed891b
.rsrc 0x9000 0x3b8 0x1000 0.97 3a61b79be370d6a074929060f1e655b8

( 1 imports )
> KERNEL32.dll: GetLastError, ReadFile, WriteFile, CreateFileA, GetExitCodeProcess, OpenProcess, WaitForMultipleObjects, ResetEvent, CloseHandle, CreateSemaphoreA, SetEvent, WaitForSingleObject, CreateEventA, SetPriorityClass, GetCurrentProcess, GetModuleHandleA, GetStartupInfoA, GetCommandLineA, GetVersion, ExitProcess, TerminateProcess, UnhandledExceptionFilter, GetModuleFileNameA, FreeEnvironmentStringsA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetEnvironmentVariableA, GetVersionExA, HeapDestroy, HeapCreate, VirtualFree, HeapFree, RtlUnwind, MultiByteToWideChar, GetStringTypeA, GetStringTypeW, GetCPInfo, GetACP, GetOEMCP, HeapAlloc, VirtualAlloc, HeapReAlloc, GetProcAddress, LoadLibraryA, LCMapStringA, LCMapStringW

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
sigcheck:
publisher....: Realtek
copyright....: Copyright c 2002
product......: rtdrvmon
description..: rtdrvmon
original name: rtdrvmon.exe
internal name: rtdrvmon
file version.: 1, 0, 0, 3
comments.....: Realtek Planet 2002
signers......: -
signing date.: -
verified.....: Unsigned



JOTTISCANu log:


Výsledky

2010-01-21 Žádný nález

2010-01-21 Žádný nález

2010-01-21 Žádný nález

2010-01-21 Žádný nález

2010-01-21 Žádný nález

2010-01-21 Žádný nález

2010-01-20 Žádný nález

2010-01-21 Žádný nález

2010-01-21 Žádný nález

2010-01-21 Žádný nález

2010-01-21 Žádný nález

2010-01-21 Žádný nález

2010-01-21 Žádný nález

2010-01-21 Žádný nález

2010-01-21 Žádný nález

2010-01-21 Žádný nález

2010-01-21 Žádný nález

2010-01-21 Žádný nález

2010-01-20 Žádný nález

2010-01-21 Žádný nález

[earl]

Ok,jak se chova pc?

[Sleseleseleci]

No, jak jsem psal. V TuneUp Start manageru je pořád ten ihaupd32.exe, který nejde odstranit. Předtím tam byl zakřížkovaný, teď není, takže už nenaskakuje... ale nic to nemění na tom, že tam pořád je. Jinak tam nic navíc není, takže i v procesech je klid. Čas od času se mi počítač trochu kousne, jakoby zapracuje, a pak už zase běží normálně. Nevím, nedělo se mi to předtím, ale myslím, že to bude spíš tím, že už je dost ojetej po posledním formátu. Myslím, že všechno tedy klape v pohodě, tak jestli už nic nevidíte, je to v pořádku... Můžete to tu uzavřít.

Děkuji moc! Sle

[earl]

Ta polozka v TuneUp je pouze zaznam o neexistujicim souboru,takze to je ok,v pc uz neni.

Jeste docistime po procesu odvirovani:

Start - spustit - napiste ComboFix /Uninstall - a klepnout na OK

ComboFix /Uninstall
-----------------------------------------------------------------------------------------------------------------

Pouzijte T-Cleaner na vycisteni pc po utilitach pouzitych pri odvirovani.Postupujte dle instrukci na obrazovce.Pri detekci antivirem se jedna o falesny poplach.
-----------------------------------------------------------------------------------------------------------------

Vycistete pc Ccleanerem.

Vzdy nejprve Analyzovat a pak Spustit Cleaner.2x po sobe.

Windows-odskrtnout historii a historii automatickeho vyplnovani formularu - prisel byste o historii navstivenych stranek a o ulozena hesla ve formularich

(je to sice z pohledu zabezpeceni spatne,ale aspon pak uzivatel nenadava,kam ze mu to zmizelo )

Aplikace-u prohlizecu internetu odskrtnout Historii internetu.

Registry-nechat vse zaskrtle,Hledej problemy,Opravit vybrane problemy

(nechat ho udelat zalohu-ta je ulozena v Dokumentech-DULEZITE).

Taktez 2x-3x po sobe.

A nemate zac.

[Sleseleseleci]

Ještě jednou děkuji! Mám!!! Hodně štěstí!

[earl]

Nemate

Kdyby neco,jsme tu.