Nejdou spustit .exe Win32:Rootkit-gen

[Caroprd111]

OK, ještě druhý log.

[radval]

OK, ještě druhý log.

Který druhý ? Z MBR i Gmer tady je.

[Caroprd111]

Druhý log z Gmer, je to popsané v návodu.

[radval]

Druhý log z Gmer, je to popsané v návodu.

My bad...omlouvám se...tady je - teda není poněvadž probíhá vypnutí systému.....RPC bylo neočekávaně ukončeno....

[Caroprd111]

Zkuste Gmer přejmenovat (cokoliv.com) a spustit v nouzovém režimu.

[radval]

Zkuste Gmer přejmenovat (cokoliv.com) a spustit v nouzovém režimu.

Zkusím ho spustit ještě jednou...a nebudu nic zpouštet navíc, to RPC to zahlásilo když jsem otvíral .txt a .jpg..

Takže i v nouzovém režimu jsem ho přejmenoval na bla.com spustil sken, v momentě kdy jsem spustil IE ikonu už na mě vyskočí hláška o nuceném vypnutí PC - vyvolal NT Authority/SYStEM...

[Caroprd111]

OK

[radval]

OK

Sken po hodině je tu :

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-01 16:53:39
Windows 5.1.2600 Service Pack 3
Running: bla.com.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxtdypow.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xF0BE4C56]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xF0BE4B12]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteKey [0xF0BE50C6]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xF0BE4FF0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xF0BE46E8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xF0BE4BEC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xF0BE4628]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xF0BE468C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xF0BE4D0C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRenameKey [0xF0BE5194]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xF0BE4CCC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xF0BE4E4C]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateProcessEx [0xF0BF14FE]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateSection [0xF0BF1322]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwLoadDriver [0xF0BF145C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObMakeTemporaryObject

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!_abnormal_termination + 15C 804E27C8 4 Bytes CALL 8B3EE613
PAGE ntoskrnl.exe!ObInsertObject 8056503A 5 Bytes JMP F0BEE972 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntoskrnl.exe!NtCreateSection 805652B3 7 Bytes JMP F0BF1326 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntoskrnl.exe!ZwCreateProcessEx 80581030 7 Bytes JMP F0BF1502 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntoskrnl.exe!ObMakeTemporaryObject 8059F84D 5 Bytes JMP F0BED4BA \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntoskrnl.exe!ZwLoadDriver 805A3AF1 7 Bytes JMP F0BF1460 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\spoolsv.exe[472] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4
.text C:\WINDOWS\system32\spoolsv.exe[472] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C
.text C:\WINDOWS\system32\spoolsv.exe[472] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78
.text C:\WINDOWS\system32\spoolsv.exe[472] ws2_32.dll!connect 71A94A07 5 Bytes JMP 10003AF0
.text C:\WINDOWS\system32\spoolsv.exe[472] ws2_32.dll!send 71A94C27 5 Bytes JMP 10003264
.text C:\WINDOWS\system32\spoolsv.exe[472] ws2_32.dll!WSARecv 71A94CB5 5 Bytes JMP 100027F8
.text C:\WINDOWS\system32\spoolsv.exe[472] ws2_32.dll!recv 71A9676F 5 Bytes JMP 1000278C
.text C:\WINDOWS\system32\spoolsv.exe[472] ws2_32.dll!WSASend 71A968FA 5 Bytes JMP 10003A9C
.text C:\WINDOWS\system32\winlogon.exe[676] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4
.text C:\WINDOWS\system32\winlogon.exe[676] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C
.text C:\WINDOWS\system32\winlogon.exe[676] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78
.text C:\WINDOWS\system32\winlogon.exe[676] WS2_32.dll!connect 71A94A07 5 Bytes JMP 10003AF0
.text C:\WINDOWS\system32\winlogon.exe[676] WS2_32.dll!send 71A94C27 5 Bytes JMP 10003264
.text C:\WINDOWS\system32\winlogon.exe[676] WS2_32.dll!WSARecv 71A94CB5 5 Bytes JMP 100027F8
.text C:\WINDOWS\system32\winlogon.exe[676] WS2_32.dll!recv 71A9676F 5 Bytes JMP 1000278C
.text C:\WINDOWS\system32\winlogon.exe[676] WS2_32.dll!WSASend 71A968FA 5 Bytes JMP 10003A9C
.text C:\WINDOWS\system32\services.exe[724] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4
.text C:\WINDOWS\system32\services.exe[724] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C
.text C:\WINDOWS\system32\services.exe[724] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78
.text C:\WINDOWS\system32\services.exe[724] ws2_32.dll!connect 71A94A07 5 Bytes JMP 10003AF0
.text C:\WINDOWS\system32\services.exe[724] ws2_32.dll!send 71A94C27 5 Bytes JMP 10003264
.text C:\WINDOWS\system32\services.exe[724] ws2_32.dll!WSARecv 71A94CB5 5 Bytes JMP 100027F8
.text C:\WINDOWS\system32\services.exe[724] ws2_32.dll!recv 71A9676F 5 Bytes JMP 1000278C
.text C:\WINDOWS\system32\services.exe[724] ws2_32.dll!WSASend 71A968FA 5 Bytes JMP 10003A9C
.text C:\WINDOWS\system32\lsass.exe[736] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4
.text C:\WINDOWS\system32\lsass.exe[736] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C
.text C:\WINDOWS\system32\lsass.exe[736] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78
.text C:\WINDOWS\system32\lsass.exe[736] WS2_32.dll!connect 71A94A07 5 Bytes JMP 10003AF0
.text C:\WINDOWS\system32\lsass.exe[736] WS2_32.dll!send 71A94C27 5 Bytes JMP 10003264
.text C:\WINDOWS\system32\lsass.exe[736] WS2_32.dll!WSARecv 71A94CB5 5 Bytes JMP 100027F8
.text C:\WINDOWS\system32\lsass.exe[736] WS2_32.dll!recv 71A9676F 5 Bytes JMP 1000278C
.text C:\WINDOWS\system32\lsass.exe[736] WS2_32.dll!WSASend 71A968FA 5 Bytes JMP 10003A9C
.text C:\WINDOWS\system32\svchost.exe[908] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4
.text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C
.text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78
.text C:\WINDOWS\system32\svchost.exe[908] ws2_32.dll!connect 71A94A07 5 Bytes JMP 10003AF0
.text C:\WINDOWS\system32\svchost.exe[908] ws2_32.dll!send 71A94C27 5 Bytes JMP 10003264
.text C:\WINDOWS\system32\svchost.exe[908] ws2_32.dll!WSARecv 71A94CB5 5 Bytes JMP 100027F8
.text C:\WINDOWS\system32\svchost.exe[908] ws2_32.dll!recv 71A9676F 5 Bytes JMP 1000278C
.text C:\WINDOWS\system32\svchost.exe[908] ws2_32.dll!WSASend 71A968FA 5 Bytes JMP 10003A9C
.text C:\WINDOWS\System32\svchost.exe[1076] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4
.text C:\WINDOWS\System32\svchost.exe[1076] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C
.text C:\WINDOWS\System32\svchost.exe[1076] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78
.text C:\WINDOWS\System32\svchost.exe[1076] ws2_32.dll!connect 71A94A07 5 Bytes JMP 10003AF0
.text C:\WINDOWS\System32\svchost.exe[1076] ws2_32.dll!send 71A94C27 5 Bytes JMP 10003264
.text C:\WINDOWS\System32\svchost.exe[1076] ws2_32.dll!WSARecv 71A94CB5 5 Bytes JMP 100027F8
.text C:\WINDOWS\System32\svchost.exe[1076] ws2_32.dll!recv 71A9676F 5 Bytes JMP 1000278C
.text C:\WINDOWS\System32\svchost.exe[1076] ws2_32.dll!WSASend 71A968FA 5 Bytes JMP 10003A9C
.text C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe[1224] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4
.text C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe[1224] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C
.text C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe[1224] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78
.text C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe[1224] WS2_32.dll!connect 71A94A07 5 Bytes JMP 10003AF0
.text C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe[1224] WS2_32.dll!send 71A94C27 5 Bytes JMP 10003264
.text C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe[1224] WS2_32.dll!WSARecv 71A94CB5 5 Bytes JMP 100027F8
.text C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe[1224] WS2_32.dll!recv 71A9676F 5 Bytes JMP 1000278C
.text C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe[1224] WS2_32.dll!WSASend 71A968FA 5 Bytes JMP 10003A9C
.text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1452] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4
.text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1452] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C
.text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1452] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78
.text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1452] WS2_32.dll!connect 71A94A07 5 Bytes JMP 10003AF0
.text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1452] WS2_32.dll!send 71A94C27 5 Bytes JMP 10003264
.text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1452] WS2_32.dll!WSARecv 71A94CB5 5 Bytes JMP 100027F8
.text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1452] WS2_32.dll!recv 71A9676F 5 Bytes JMP 1000278C
.text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1452] WS2_32.dll!WSASend 71A968FA 5 Bytes JMP 10003A9C
.text C:\WINDOWS\system32\svchost.exe[1524] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4
.text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C
.text C:\WINDOWS\system32\svchost.exe[1524] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78
.text C:\WINDOWS\system32\svchost.exe[1524] ws2_32.dll!connect 71A94A07 5 Bytes JMP 10003AF0
.text C:\WINDOWS\system32\svchost.exe[1524] ws2_32.dll!send 71A94C27 5 Bytes JMP 10003264
.text C:\WINDOWS\system32\svchost.exe[1524] ws2_32.dll!WSARecv 71A94CB5 5 Bytes JMP 100027F8
.text C:\WINDOWS\system32\svchost.exe[1524] ws2_32.dll!recv 71A9676F 5 Bytes JMP 1000278C
.text C:\WINDOWS\system32\svchost.exe[1524] ws2_32.dll!WSASend 71A968FA 5 Bytes JMP 10003A9C
.text C:\WINDOWS\Explorer.EXE[1608] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4
.text C:\WINDOWS\Explorer.EXE[1608] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C
.text C:\WINDOWS\Explorer.EXE[1608] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78
.text C:\WINDOWS\Explorer.EXE[1608] ws2_32.dll!connect 71A94A07 5 Bytes JMP 10003AF0
.text C:\WINDOWS\Explorer.EXE[1608] ws2_32.dll!send 71A94C27 5 Bytes JMP 10003264
.text C:\WINDOWS\Explorer.EXE[1608] ws2_32.dll!WSARecv 71A94CB5 5 Bytes JMP 100027F8
.text C:\WINDOWS\Explorer.EXE[1608] ws2_32.dll!recv 71A9676F 5 Bytes JMP 1000278C
.text C:\WINDOWS\Explorer.EXE[1608] ws2_32.dll!WSASend 71A968FA 5 Bytes JMP 10003A9C
.text C:\WINDOWS\system32\igfxtray.exe[1712] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10023DF4
.text C:\WINDOWS\system32\igfxtray.exe[1712] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10023C3C
.text C:\WINDOWS\system32\igfxtray.exe[1712] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10023E78
.text C:\WINDOWS\system32\igfxtray.exe[1712] ws2_32.dll!connect 71A94A07 5 Bytes JMP 10023AF0
.text C:\WINDOWS\system32\igfxtray.exe[1712] ws2_32.dll!send 71A94C27 5 Bytes JMP 10023264
.text C:\WINDOWS\system32\igfxtray.exe[1712] ws2_32.dll!WSARecv 71A94CB5 5 Bytes JMP 100227F8
.text C:\WINDOWS\system32\igfxtray.exe[1712] ws2_32.dll!recv 71A9676F 5 Bytes JMP 1002278C
.text C:\WINDOWS\system32\igfxtray.exe[1712] ws2_32.dll!WSASend 71A968FA 5 Bytes JMP 10023A9C
.text C:\WINDOWS\system32\hkcmd.exe[1760] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10023DF4
.text C:\WINDOWS\system32\hkcmd.exe[1760] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10023C3C
.text C:\WINDOWS\system32\hkcmd.exe[1760] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10023E78
.text C:\WINDOWS\system32\hkcmd.exe[1760] ws2_32.dll!connect 71A94A07 5 Bytes JMP 10023AF0
.text C:\WINDOWS\system32\hkcmd.exe[1760] ws2_32.dll!send 71A94C27 5 Bytes JMP 10023264
.text C:\WINDOWS\system32\hkcmd.exe[1760] ws2_32.dll!WSARecv 71A94CB5 5 Bytes JMP 100227F8
.text C:\WINDOWS\system32\hkcmd.exe[1760] ws2_32.dll!recv 71A9676F 5 Bytes JMP 1002278C
.text C:\WINDOWS\system32\hkcmd.exe[1760] ws2_32.dll!WSASend 71A968FA 5 Bytes JMP 10023A9C
.text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1768] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4
.text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1768] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C
.text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1768] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78
.text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1768] WS2_32.dll!connect 71A94A07 5 Bytes JMP 10003AF0
.text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1768] WS2_32.dll!send 71A94C27 5 Bytes JMP 10003264
.text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1768] WS2_32.dll!WSARecv 71A94CB5 5 Bytes JMP 100027F8
.text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1768] WS2_32.dll!recv 71A9676F 5 Bytes JMP 1000278C
.text C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[1768] WS2_32.dll!WSASend 71A968FA 5 Bytes JMP 10003A9C
.text C:\Program Files\Internet Explorer\iexplore.exe[1884] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4
.text C:\Program Files\Internet Explorer\iexplore.exe[1884] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C
.text C:\Program Files\Internet Explorer\iexplore.exe[1884] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78
.text C:\Program Files\Internet Explorer\iexplore.exe[1884] ole32.dll!OleLoadFromStream 77519C85 5 Bytes JMP 7E2A524C C:\WINDOWS\system32\SHDOCVW.dll (Shell Doc Object and Control Library/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1884] ws2_32.dll!connect 71A94A07 5 Bytes JMP 10003AF0
.text C:\Program Files\Internet Explorer\iexplore.exe[1884] ws2_32.dll!send 71A94C27 5 Bytes JMP 10003264
.text C:\Program Files\Internet Explorer\iexplore.exe[1884] ws2_32.dll!WSARecv 71A94CB5 5 Bytes JMP 100027F8
.text C:\Program Files\Internet Explorer\iexplore.exe[1884] ws2_32.dll!recv 71A9676F 5 Bytes JMP 1000278C
.text C:\Program Files\Internet Explorer\iexplore.exe[1884] ws2_32.dll!WSASend 71A968FA 5 Bytes JMP 10003A9C
.text C:\WINDOWS\system32\wuauclt.exe[2072] ntdll.dll!NtOpenKey 7C90D5CE 5 Bytes JMP 10003DF4
.text C:\WINDOWS\system32\wuauclt.exe[2072] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 10003C3C
.text C:\WINDOWS\system32\wuauclt.exe[2072] kernel32.dll!ExitProcess 7C81CB12 5 Bytes JMP 10003E78
.text C:\WINDOWS\system32\wuauclt.exe[2072] ws2_32.dll!connect 71A94A07 5 Bytes JMP 10003AF0
.text C:\WINDOWS\system32\wuauclt.exe[2072] ws2_32.dll!send 71A94C27 5 Bytes JMP 10003264
.text C:\WINDOWS\system32\wuauclt.exe[2072] ws2_32.dll!WSARecv 71A94CB5 5 Bytes JMP 100027F8
.text C:\WINDOWS\system32\wuauclt.exe[2072] ws2_32.dll!recv 71A9676F 5 Bytes JMP 1000278C
.text C:\WINDOWS\system32\wuauclt.exe[2072] ws2_32.dll!WSASend 71A968FA 5 Bytes JMP 10003A9C

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\services.exe[724] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 006E0002
IAT C:\WINDOWS\system32\services.exe[724] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 006E0000

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/ALWIL Software)

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- Registry - GMER 1.0.15 ----

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ctvod\OpenWithProgids@\f\1T\0V\0o\0D
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{875105F7-D43A-B778-20AC-2E4B11DA425A}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{875105F7-D43A-B778-20AC-2E4B11DA425A}@kapicphedikdehifdeehaj 0x62 0x61 0x62 0x6F ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BCDFD1CF-9480-BE67-1AE2-A3F3EE3C892D}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{BCDFD1CF-9480-BE67-1AE2-A3F3EE3C892D}@kafhkjeccgjpehmgigeooa 0x62 0x61 0x6C 0x65 ...

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 01: copy of MBR

---- EOF - GMER 1.0.15 ----

[Caroprd111]

Pokračujte podle návodu AVPTool http://www.viry.cz/forum/viewtopic.php?f=29&t=58179

[radval]

Pokračujte podle návodu AVPTool http://www.viry.cz/forum/viewtopic.php?f=29&t=58179

Nejsem už teď v práci ale doma u jiného kompu, nicméně AVPTool bylo dnes první co jsem spustil když mi přestal fungovat ten Acrobat. Ten Kaspersky nic nenašel. AntiMalware nešlo ani po reinstalaci spustit, jen hodiny a nic.
Hned po něm jsem spustil ten Combo Fix, ten dle jeho txt souboru našel 2 soubory a dal je do karantény...takže to zkusím zítra, jinak než jsem odcházel PC se vyplo a zase zaplo, že prý činnost obnovena po závažné chybě.

[Caroprd111]

OK, AVPTool nedělejte. Jak to vypadá s PC

[radval]

OK, AVPTool nedělejte. Jak to vypadá s PC

Jak jsem psal, nejsem už u toho compu v práci, ale doma, takže dám vědět ráno.

Ale jen na okraj ...s Pc to vypadá velice zle, je to 256 MB RAM (umíte si představit tu rychlost), IE verze 6.0 - ta stabilita...XP SP3 s necenými 2GB místy na HDD.....

dávno bych ten explorer přeinstaloval, ale mám tam certifikáty, které mi musí druhá strana fyzicky znovu dodat při reinstalu....ty XP bych taky přeinstaloval, problém je že mám rozdělený disk C (8GB) a D (15GB) na C jsou XP a zabírají už 4 GB místa , a zbývá jen 1,8 GB volného, takže asi by byl problém je přeinstalovat páč by nebylo kde.

Napadlo mě nějak spojit a sformátovat ty disky a u dělat čistou instalaci a mít jen disk C ale to už se mi zdá jednoduší koupit nějaký šrot s aspoň 2 Gb RAM za 2000,- ......ale zase ta drbačka tam natahat ten nutný soft....uááá. Zkurvený červ.

[Caroprd111]

OK

[radval]

OK

Dobré ráno, ten AVPTool se stejně po startu spustil, nic nenašel. Acrobat jsem odinstaloval a nainstaloval znovu, nicméně spustit stejně nejde...vidím to zle.

[Caroprd111]

Poprosím o nový log z RSIT.