Net-Worm.Win32.Kido.jq nesmazatelny zmetek

Zpráva

DarkDave87 · #1 Příspěvek od **DarkDave87** » 10 kvě 2010 11:52

Zdar, před nějakou dobou jsem obměnil AV program na současně používaný Kaspersky (předešlý nic nenašel), který mě překvapil o dvou škodících souborech identifikovaných jako Net-Worm.Win32.Kido.jp (nelze je z nějakého důvodu smazat).

Nějaký návrh jak se toho zbavit ?

Kdyz tak log via HijackThis:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:58:44, on 10.5.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\games\Steam\Steam.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\Shodar87\Desktop\PDF\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKCU\..\Run: [Steam] "c:\games\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.0\ICQ.exe" silent loginmode=4
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O9 - Extra button: Statisktika ochrany webového provozu - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 4707 bytes

Snad to nejak pomůže

EDIT: identifikované soubory - c:\windows\system32\08748.tmp a c:\windows\system32\09548.tmp

#2 Příspěvek od **motji** » 10 kvě 2010 14:04

Hezké odpoledne

Vložte log ze Rsitu, viz můj podpis.

DarkDave87 · #3 Příspěvek od **DarkDave87** » 10 kvě 2010 16:10

Taky přeji hezke odpoledne

Logfile of random's system information tool 1.07 (written by random/random)
Run by Shodar87 at 2010-05-10 17:08:47
Microsoft® Windows Vista™ Home Basic Service Pack 2
System drive C: has 23 GB (20%) free of 112 GB
Total RAM: 2045 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:08:52, on 10.5.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\games\Steam\Steam.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Users\Shodar87\Desktop\PDF\RSIT.exe
C:\Program Files\trend micro\Shodar87.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKCU\..\Run: [Steam] "c:\games\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.0\ICQ.exe" silent loginmode=4
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O9 - Extra button: Statisktika ochrany webového provozu - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 4736 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Ad-Aware Update (Weekly).job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll [2010-05-10 62728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2009-09-01 13797992]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]
"VirtualCloneDrive"=C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [2009-06-17 85160]
"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-04-13 1135912]
"AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe [2010-05-10 201992]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Steam"=c:\games\steam\steam.exe [2010-05-07 1238352]
"ICQ"=C:\Program Files\ICQ7.0\ICQ.exe [2010-03-28 133368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\Windows\system32\klogon.dll [2008-04-25 206088]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2010-05-10 17:08:47 ----D---- C:\rsit
2010-05-10 13:23:17 ----D---- C:\Program Files\trend micro
2010-05-10 10:29:18 ----D---- C:\ProgramData\Kaspersky Lab
2010-05-10 10:29:18 ----D---- C:\Program Files\Kaspersky Lab
2010-05-10 10:27:43 ----D---- C:\ProgramData\Kaspersky Lab Setup Files
2010-05-10 10:16:11 ----D---- C:\ProgramData\WindowsSearch
2010-05-09 23:29:57 ----A---- C:\Windows\system32\lsdelete.exe
2010-05-04 22:27:23 ----D---- C:\Program Files\WinPcap
2010-04-20 23:05:07 ----D---- C:\Users\Shodar87\AppData\Roaming\DivX
2010-04-20 23:04:29 ----D---- C:\Program Files\Common Files\PX Storage Engine
2010-04-20 23:02:57 ----D---- C:\Program Files\Common Files\DivX Shared
2010-04-20 22:53:04 ----D---- C:\Program Files\DivX
2010-04-17 21:40:37 ----D---- C:\ProgramData\DivX
2010-04-11 12:56:42 ----D---- C:\Users\Shodar87\AppData\Roaming\Youtube Downloader HD
2010-04-11 12:46:12 ----D---- C:\Users\Shodar87\AppData\Roaming\AnvSoft

======List of files/folders modified in the last 1 months======

2010-05-10 17:08:51 ----D---- C:\Windows\Temp
2010-05-10 17:03:52 ----D---- C:\Windows
2010-05-10 13:23:17 ----RD---- C:\Program Files
2010-05-10 12:59:30 ----D---- C:\Windows\Tasks
2010-05-10 12:57:26 ----D---- C:\Windows\system32\WDI
2010-05-10 11:00:09 ----D---- C:\Windows\Prefetch
2010-05-10 10:56:28 ----SHD---- C:\Windows\Installer
2010-05-10 10:55:46 ----SHD---- C:\System Volume Information
2010-05-10 10:52:42 ----D---- C:\Windows\system32\Tasks
2010-05-10 10:44:08 ----D---- C:\Windows\system32\drivers
2010-05-10 10:30:05 ----D---- C:\Windows\system32\catroot
2010-05-10 10:30:03 ----D---- C:\Windows\inf
2010-05-10 10:29:44 ----D---- C:\Windows\System32
2010-05-10 10:29:18 ----HD---- C:\ProgramData
2010-05-09 11:13:35 ----D---- C:\programs
2010-05-09 10:41:44 ----D---- C:\Program Files\Common Files\InstallShield
2010-05-09 10:39:19 ----D---- C:\games
2010-05-08 12:04:44 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-05-06 00:40:00 ----D---- C:\Users\Shodar87\AppData\Roaming\Mumble
2010-05-05 14:57:28 ----HD---- C:\Program Files\InstallShield Installation Information
2010-05-04 16:29:41 ----A---- C:\Windows\win.ini
2010-05-04 11:30:54 ----D---- C:\Users\Shodar87\AppData\Roaming\ICQ
2010-04-25 19:54:56 ----D---- C:\Windows\Minidump
2010-04-23 10:30:35 ----D---- C:\Windows\system32\catroot2
2010-04-21 18:08:05 ----RSD---- C:\Windows\assembly
2010-04-20 23:04:29 ----D---- C:\Program Files\Common Files
2010-04-20 23:03:35 ----D---- C:\Windows\winsxs
2010-04-19 21:28:19 ----SD---- C:\Users\Shodar87\AppData\Roaming\Microsoft
2010-04-17 21:41:48 ----SD---- C:\Windows\Downloaded Program Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ElbyCDIO;ElbyCDIO Driver; C:\Windows\System32\Drivers\ElbyCDIO.sys [2009-12-18 26024]
R1 kl1;kl1; C:\Windows\system32\DRIVERS\kl1.sys [2008-04-16 112144]
R1 KLIF;Kaspersky Lab Driver; C:\Windows\system32\DRIVERS\klif.sys [2010-05-10 224272]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter; C:\Windows\system32\DRIVERS\klim6.sys [2008-03-26 20496]
R3 CmBatt;Ovladač baterie Microsoft ACPI Control Method Battery; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-18 14208]
R3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-04-10 236544]
R3 NETw3v32;Intel(R) PRO/Wireless 3945ABG Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw3v32.sys [2008-01-18 2225664]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2009-08-31 9825728]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-10 89088]
R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2006-11-02 1010560]
R3 VClone;VClone; C:\Windows\system32\DRIVERS\VClone.sys [2009-08-09 29696]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-18 11264]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-02 194048]
S2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys []
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-10 22528]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-18 92160]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2009-04-10 507904]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-04-10 29696]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-18 5632]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-18 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-18 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-18 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-18 6016]
S3 nocashio;nocashio; C:\Windows\system32\drivers\nocashio.sys [2010-03-06 4096]
S3 NPF;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2009-10-20 50704]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-04-10 148992]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-18 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-18 83328]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AVP;Kaspersky Anti-Virus; C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe [2010-05-10 201992]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2010-05-02 1285864]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-09-01 211560]
S2 rlxptqcd;Windows Support; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2009-10-20 117264]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2009-07-16 316664]

-----------------EOF-----------------

Jinak neví zda to s tím nesouvisí, ale ony dva soubory jsou starší než jeden měsíc (výpis z 3 měsíců je fest dlouhý, případně jej postnu.)

#4 Příspěvek od **motji** » 10 kvě 2010 20:15

:arrow:Stáhněte OTM http://oldtimer.geekstogo.com/OTM.exe
Stáhněte na plochu Otm, 2krát klikněte na Otm,spustí se program,
Do levého okna "Paste Instructions for Items to be Moved" pod žlutou čáru zkopírujete skript

Kód: Vybrat vše

:processes
explorer.exe
 
:files
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s
c:\windows\system32\*.tmp /s

:reg
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

:commands
[resethosts]
[emptytemp]
[EMPTYFLASH]
[clearallrestorepoints]
[Reboot]

-klikněte na červené tlačítko Moveit!
-sem vložte obsah zeleného okénka
-Pokud se bude chtít restartovat pc, dejte YES,log pak najdete C:\_OTM\MovedFiles. Log vložte sem

Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe

- ComboFix je třeba spustit pod účtem s právy administrátora

- Před použitím vypněte všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary

- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího se okna

- Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, zkopírujte celý jeho obsah sem

DarkDave87 · #5 Příspěvek od **DarkDave87** » 10 kvě 2010 22:25

Výpis z OTM

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOWS\system32\SET*.tmp not found.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2EBD.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9AF7.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPA5B0.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPB0D7.tmp folder moved successfully.
File move failed. C:\WINDOWS\System32\08748.tmp scheduled to be moved on reboot.
File move failed. C:\WINDOWS\System32\09548.tmp scheduled to be moved on reboot.
C:\WINDOWS\System32\tmp343E.tmp moved successfully.
C:\WINDOWS\System32\tmp5372.tmp moved successfully.
C:\WINDOWS\System32\tmp5F46.tmp moved successfully.
File move failed. c:\windows\system32\08748.tmp scheduled to be moved on reboot.
File move failed. c:\windows\system32\09548.tmp scheduled to be moved on reboot.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys\ deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: Shodar87
->Temp folder emptied: 201033668 bytes
->Temporary Internet Files folder emptied: 1258607 bytes
->Flash cache emptied: 2180 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 8192 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 17658 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33239 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 193,00 mb

Restore point Set: OTM Restore Point

OTM by OldTimer - Version 3.1.12.0 log created on 05102010_224938

Files moved on Reboot...
File move failed. C:\WINDOWS\System32\08748.tmp scheduled to be moved on reboot.
File move failed. C:\WINDOWS\System32\09548.tmp scheduled to be moved on reboot.

Registry entries deleted on Reboot...

a druhý výpis z ComboFix:

ComboFix 10-05-10.02 - Shodar87 10.05.2010 23:02:36.1.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1250.420.1029.18.2045.1166 [GMT 2:00]
Spuštěný z: c:\users\Shodar87\Desktop\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Kaspersky Anti-Virus *disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-04-10 do 2010-05-10 )))))))))))))))))))))))))))))))
.

2010-05-10 21:10 . 2010-05-10 21:10 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-05-10 20:49 . 2010-05-10 20:49 -------- d-----w- C:\_OTM
2010-05-10 15:08 . 2010-05-10 15:08 -------- d-----w- C:\rsit
2010-05-10 11:23 . 2010-05-10 15:08 -------- d-----w- c:\program files\trend micro
2010-05-10 08:44 . 2010-05-10 08:44 33808 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\klbg.sys
2010-05-10 08:44 . 2010-05-10 08:44 224272 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\Vista\klif.sys
2010-05-10 08:44 . 2010-05-10 08:44 21256 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\vkbd.dll
2010-05-10 08:27 . 2010-05-10 08:27 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2010-05-10 08:16 . 2010-05-10 08:16 -------- d-----w- c:\programdata\WindowsSearch
2010-05-09 21:29 . 2010-05-02 20:13 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-05-05 07:38 . 2010-05-05 07:38 56766 ----a-w- c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-05-05 07:38 . 2010-05-05 07:38 53600 ----a-w- c:\programdata\DivX\Update\Uninstaller.exe
2010-05-05 07:38 . 2010-05-05 07:38 57679 ----a-w- c:\programdata\DivX\Player\Uninstaller.exe
2010-05-05 07:37 . 2010-05-05 07:37 84040 ----a-w- c:\programdata\DivX\TransferWizard\Uninstaller.exe
2010-05-05 07:37 . 2010-05-05 07:37 54153 ----a-w- c:\programdata\DivX\DFXPlugin\Uninstaller.exe
2010-05-05 07:37 . 2010-05-05 07:37 54128 ----a-w- c:\programdata\DivX\Converter\Uninstaller.exe
2010-05-05 07:37 . 2010-05-05 07:37 57409 ----a-w- c:\programdata\DivX\ControlPanel\Uninstaller.exe
2010-05-04 20:27 . 2010-05-04 20:27 -------- d-----w- c:\program files\WinPcap
2010-04-20 21:08 . 2010-05-05 07:42 57344 ----a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-04-20 21:05 . 2010-05-05 07:17 754984 ----a-w- c:\programdata\DivX\Setup\Resource.dll
2010-04-20 21:05 . 2010-05-05 07:17 1180952 ----a-w- c:\programdata\DivX\Setup\DivXSetup.exe
2010-04-20 21:05 . 2010-04-20 21:05 56978 ----a-w- c:\programdata\DivX\WebPlayer\Uninstaller.exe
2010-04-20 21:05 . 2010-04-21 14:30 -------- d-----w- c:\users\Shodar87\AppData\Roaming\DivX
2010-04-20 21:04 . 2010-05-05 07:37 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-04-20 21:04 . 2010-04-20 21:04 57054 ----a-w- c:\programdata\DivX\DSDesktopComponents\Uninstaller.exe
2010-04-20 21:04 . 2010-04-20 21:04 54166 ----a-w- c:\programdata\DivX\DSAVCDecoder\Uninstaller.exe
2010-04-20 21:04 . 2010-04-20 21:04 57532 ----a-w- c:\programdata\DivX\DSASPDecoder\Uninstaller.exe
2010-04-20 21:04 . 2010-04-20 21:04 56458 ----a-w- c:\programdata\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-04-20 21:04 . 2010-04-20 21:04 54174 ----a-w- c:\programdata\DivX\DSAACDecoder\Uninstaller.exe
2010-04-20 21:03 . 2010-04-20 21:03 54629 ----a-w- c:\programdata\DivX\TranscodeEngine\Uninstaller.exe
2010-04-20 21:03 . 2010-04-20 21:03 54101 ----a-w- c:\programdata\DivX\MPEG2Plugin\Uninstaller.exe
2010-04-20 21:03 . 2010-04-20 21:03 52963 ----a-w- c:\programdata\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-04-20 21:03 . 2010-04-20 21:03 54073 ----a-w- c:\programdata\DivX\Qt4.5\Uninstaller.exe
2010-04-20 21:02 . 2010-04-20 21:03 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-04-20 21:02 . 2010-04-20 21:02 56969 ----a-w- c:\programdata\DivX\ASPEncoder\Uninstaller.exe
2010-04-20 20:53 . 2010-05-05 07:38 -------- d-----w- c:\program files\DivX
2010-04-20 20:49 . 2010-05-05 07:17 144696 ----a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.exe
2010-04-19 19:28 . 2010-04-19 19:28 -------- d-----w- c:\users\Shodar87\AppData\Local\Mumble
2010-04-17 19:40 . 2010-05-05 07:42 -------- d-----w- c:\programdata\DivX
2010-04-11 10:56 . 2010-04-11 10:57 -------- d-----w- c:\users\Shodar87\AppData\Roaming\Youtube Downloader HD
2010-04-11 10:46 . 2010-04-11 10:46 -------- d-----w- c:\users\Shodar87\AppData\Roaming\AnvSoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-10 20:55 . 2010-05-10 08:29 -------- d-----w- c:\programdata\Kaspersky Lab
2010-05-10 20:53 . 2010-02-23 18:10 32156 ----a-w- c:\programdata\nvModes.dat
2010-05-10 20:52 . 2010-05-10 08:29 4626976 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-05-10 20:52 . 2010-05-10 08:29 37228 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-05-10 20:52 . 2010-05-10 08:29 253984 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-05-10 20:52 . 2010-05-10 08:29 1948 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-05-10 20:51 . 2010-03-01 12:26 12 ----a-w- c:\windows\bthservsdp.dat
2010-05-10 08:44 . 2008-01-29 16:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2010-05-10 08:44 . 2010-05-10 08:30 113933 ----a-w- c:\windows\system32\drivers\klin.dat
2010-05-10 08:44 . 2010-05-10 08:30 97549 ----a-w- c:\windows\system32\drivers\klick.dat
2010-05-10 08:44 . 2010-05-10 08:44 861448 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\updater.dll
2010-05-10 08:43 . 2010-05-10 08:43 83208 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\mzvkbd.dll
2010-05-10 08:43 . 2010-05-10 08:43 62728 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\ievkbd.dll
2010-05-10 08:43 . 2010-05-10 08:43 43784 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\fssync.dll
2010-05-10 08:43 . 2010-05-10 08:43 365832 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\ckahum.dll
2010-05-10 08:43 . 2010-05-10 08:43 201992 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\avp.exe
2010-05-10 08:29 . 2010-05-10 08:29 -------- d-----w- c:\program files\Kaspersky Lab
2010-05-10 07:23 . 2010-02-23 16:46 53832 ----a-w- c:\users\Shodar87\AppData\Local\GDIPFONTCACHEV1.DAT
2010-05-09 11:13 . 2010-03-27 12:59 1 ----a-w- c:\users\Shodar87\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-09 08:41 . 2010-02-24 08:24 -------- d-----w- c:\program files\Common Files\InstallShield
2010-05-08 10:04 . 2010-02-24 01:32 598838 ----a-w- c:\windows\system32\perfh005.dat
2010-05-08 10:04 . 2010-02-24 01:32 115014 ----a-w- c:\windows\system32\perfc005.dat
2010-05-05 22:40 . 2010-03-20 17:25 -------- d-----w- c:\users\Shodar87\AppData\Roaming\Mumble
2010-05-05 12:57 . 2010-02-24 08:26 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-05-04 09:30 . 2010-02-27 08:31 -------- d-----w- c:\users\Shodar87\AppData\Roaming\ICQ
2010-04-08 11:24 . 2010-04-08 11:24 -------- d-----w- c:\program files\Common Files\BioWare
2010-04-08 10:11 . 2010-04-07 11:09 -------- d-----w- c:\programdata\Media Center Programs
2010-04-07 08:48 . 2010-04-07 08:48 -------- d-----w- c:\program files\Microsoft Silverlight
2010-04-06 12:54 . 2010-03-20 21:43 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-06 12:53 . 2010-03-20 21:44 -------- d-----w- c:\program files\AGEIA Technologies
2010-04-05 09:58 . 2010-04-05 09:58 -------- d-----w- c:\users\Shodar87\AppData\Roaming\GHISLER
2010-04-04 18:03 . 2010-02-27 08:31 -------- d-----w- c:\program files\ICQ7.0
2010-03-31 20:12 . 2010-03-31 20:12 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-03-27 13:03 . 2010-02-23 16:52 -------- d-----w- c:\program files\Opera
2010-03-27 12:58 . 2010-03-27 12:58 -------- d-----w- c:\users\Shodar87\AppData\Roaming\OpenOffice.org
2010-03-26 11:33 . 2010-03-26 11:33 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-03-23 17:17 . 2010-03-23 17:10 -------- d--h--w- c:\program files\Zero G Registry
2010-03-23 17:08 . 2010-03-23 17:08 -------- d-----w- c:\users\Shodar87\AppData\Roaming\Sports Interactive
2010-03-22 10:51 . 2010-03-22 10:51 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2010-03-22 07:29 . 2010-03-22 06:37 -------- d-----w- c:\program files\ESET
2010-03-21 21:10 . 2010-03-21 21:06 -------- d-----w- c:\programdata\Lavasoft
2010-03-21 21:07 . 2010-03-21 21:06 -------- d-----w- c:\program files\Lavasoft
2010-03-21 21:07 . 2010-03-21 21:07 -------- dc-h--w- c:\programdata\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-03-21 20:51 . 2010-03-21 20:51 -------- d-----w- c:\programdata\Alwil Software
2010-03-21 20:51 . 2010-03-21 20:51 -------- d-----w- c:\program files\Alwil Software
2010-03-21 19:20 . 2010-03-21 19:20 4096 ----a-w- c:\windows\system32\08748.tmp
2010-03-21 19:20 . 2010-02-28 08:35 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-03-21 14:55 . 2010-03-21 14:55 -------- d-----w- c:\programdata\Age of Empires 3
2010-03-20 17:25 . 2010-03-20 17:25 -------- d-----w- c:\program files\Mumble
2010-03-19 15:34 . 2010-03-19 15:34 -------- d-----w- c:\users\Shodar87\AppData\Roaming\InstallShield
2010-03-18 06:36 . 2010-03-18 06:36 -------- d-----w- c:\program files\RADVideo
2010-03-09 12:09 . 2010-03-09 12:09 444952 ----a-w- c:\windows\system32\wrap_oal.dll
2010-03-09 12:09 . 2010-03-09 12:09 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2010-03-08 17:59 . 2010-03-08 17:59 94208 ----a-w- c:\windows\system32\dpl100.dll
2010-03-08 13:14 . 2010-03-08 13:14 4096 ----a-w- c:\windows\system32\09548.tmp
2010-03-06 15:02 . 2010-03-06 15:02 4096 ----a-w- c:\windows\system32\drivers\nocashio.sys
2010-02-24 01:31 . 2010-02-24 01:32 34724 ----a-w- c:\windows\system32\perfd005.dat
2010-02-24 01:31 . 2010-02-24 01:32 286912 ----a-w- c:\windows\system32\perfi005.dat
2010-02-24 01:31 . 2010-02-24 01:31 34724 ----a-w- c:\windows\inf\PERFLIB\0405\perfd.dat
2010-02-24 01:31 . 2010-02-24 01:31 34724 ----a-w- c:\windows\inf\PERFLIB\0405\perfc.dat
2010-02-24 01:31 . 2010-02-24 01:31 286912 ----a-w- c:\windows\inf\PERFLIB\0405\perfi.dat
2010-02-24 01:31 . 2010-02-24 01:31 286912 ----a-w- c:\windows\inf\PERFLIB\0405\perfh.dat
2010-02-23 20:46 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2010-02-23 19:57 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2010-02-23 19:57 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll
2010-02-23 18:23 . 2010-02-23 18:24 737280 ----a-w- c:\windows\iun6002.exe
2010-02-23 16:49 . 2010-02-23 16:45 680 ----a-w- c:\users\Shodar87\AppData\Local\d3d9caps.dat
2010-02-19 19:27 . 2010-02-19 19:27 720384 ----a-w- c:\windows\system32\DivX.dll
2010-02-19 19:27 . 2010-02-19 19:27 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2010-02-19 19:27 . 2010-02-19 19:27 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2010-02-19 19:27 . 2010-02-19 19:27 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2010-02-19 19:27 . 2010-02-19 19:27 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2010-02-19 19:27 . 2010-02-19 19:27 839680 ----a-w- c:\windows\system32\divx_xx11.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\games\steam\steam.exe" [2010-05-07 1238352]
"ICQ"="c:\program files\ICQ7.0\ICQ.exe" [2010-03-28 133368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-18 1008184]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-01 13797992]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2010-05-10 201992]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):66,8e,fb,23,ca,b4,ca,01

R2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-05-02 1285864]
R2 rlxptqcd;Windows Support;c:\windows\system32\svchost.exe [2008-01-18 21504]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-10-20 50704]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2010-05-10 33808]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-02-04 64288]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2008-03-26 20496]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
rlxptqcd
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-10 23:10
Windows 6.0.6002 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Celkový čas: 2010-05-10 23:14:33
ComboFix-quarantined-files.txt 2010-05-10 21:14

Před spuštěním: Volných bajtů: 23 551 320 064
Po spuštění: Volných bajtů: 23 319 752 704

- - End Of File - - 151442E2842B962D9F546B841757CF49

#6 Příspěvek od **motji** » 11 kvě 2010 06:02

Prosím nedávejte mi logy ani do citace, prosím odstrante log z combofixu z té citace, mně se to špatně luští.

Ještě si něco ověřím a hurá delete

Stáhněte Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878
- rozbalte a spusťte
-proběhne sken, po skončení se otevře okno s výsledky, klikněte na Save a tím si uložíte log,který sem vložíte

-Podle návodu v odkazu provedete druhý sken a log sem také vložíte.

DarkDave87 · #7 Příspěvek od **DarkDave87** » 11 kvě 2010 09:55

No výpis z Gmeru je krapet kratší, takže citaci použít nemusím

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-05-11 10:51:58
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\Shodar87\AppData\Local\Temp\uflcrkob.sys

---- Kernel code sections - GMER 1.0.15 ----

? C:\Users\Shodar87\AppData\Local\Temp\catchme.sys Systém nemůže nalézt uvedený soubor. !
? C:\Windows\system32\Drivers\PROCEXP113.SYS Systém nemůže nalézt uvedený soubor. !
? C:\Users\Shodar87\AppData\Local\Temp\mbr.sys Systém nemůže nalézt uvedený soubor. !

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\tdx \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\tdx \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

---- Threads - GMER 1.0.15 ----

Thread System [4:452] 86E46100
Thread System [4:460] 86E46100
Thread System [4:464] 86EA5640
Thread System [4:468] 86EA5640
Thread System [4:476] 86EA7630
Thread System [4:480] 86EA7630
Thread System [4:484] 86EA7630
Thread System [4:492] 86EA5640

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001641dc9a96
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001641dc9a96 (not active ControlSet)

---- EOF - GMER 1.0.15 ----

#8 Příspěvek od **motji** » 11 kvě 2010 10:30

A první log z Gmeru by nebyl

DarkDave87 · #9 Příspěvek od **DarkDave87** » 11 kvě 2010 10:40

První log (z quick scanu) jsem neuložil, moje chyba

, přidávám ,,první" log z druhého scanu.

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-05-11 11:38:20
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\Shodar87\AppData\Local\Temp\uflcrkob.sys

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\tdx \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\tdx \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

---- Threads - GMER 1.0.15 ----

Thread System [4:452] 86E46100
Thread System [4:460] 86E46100
Thread System [4:464] 86EA5640
Thread System [4:468] 86EA5640
Thread System [4:476] 86EA7630
Thread System [4:480] 86EA7630
Thread System [4:484] 86EA7630
Thread System [4:492] 86EA5640

---- EOF - GMER 1.0.15 ----

#10 Příspěvek od **motji** » 11 kvě 2010 11:35

Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

KillAll::

Driver::
rlxptqcd
eamonm

Netsvc::
rlxptqcd

File::
c:\windows\system32\DRIVERS\eamonm.sys

Rootkit::
c:\windows\system32\09548.tmp
c:\windows\system32\08748.tmp

-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:

Obrázek

-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

DarkDave87 · #11 Příspěvek od **DarkDave87** » 11 kvě 2010 12:10

ComboFix 10-05-10.03 - Shodar87 11.05.2010 12:49:08.2.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1250.420.1029.18.2045.1132 [GMT 2:00]
Spuštěný z: c:\users\Shodar87\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Shodar87\Desktop\CFScript.txt
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Kaspersky Anti-Virus *disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

FILE ::
"c:\windows\system32\DRIVERS\eamonm.sys"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_EAMONM
-------\Service_eamonm
-------\Service_rlxptqcd

((((((((((((((((((((((((( Soubory vytvořené od 2010-04-11 do 2010-05-11 )))))))))))))))))))))))))))))))
.

2010-05-11 10:57 . 2010-05-11 10:59 -------- d-----w- c:\users\Shodar87\AppData\Local\temp
2010-05-11 10:57 . 2010-05-11 10:57 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-05-10 20:49 . 2010-05-10 20:49 -------- d-----w- C:\_OTM
2010-05-10 15:08 . 2010-05-10 15:08 -------- d-----w- C:\rsit
2010-05-10 11:23 . 2010-05-10 15:08 -------- d-----w- c:\program files\trend micro
2010-05-10 08:30 . 2010-05-10 08:44 113933 ----a-w- c:\windows\system32\drivers\klin.dat
2010-05-10 08:30 . 2010-05-10 08:44 97549 ----a-w- c:\windows\system32\drivers\klick.dat
2010-05-10 08:29 . 2010-05-11 10:58 4626976 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-05-10 08:29 . 2010-05-11 10:58 253984 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-05-10 08:29 . 2010-05-10 20:55 -------- d-----w- c:\programdata\Kaspersky Lab
2010-05-10 08:29 . 2010-05-10 08:29 -------- d-----w- c:\program files\Kaspersky Lab
2010-05-10 08:27 . 2010-05-10 08:27 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2010-05-10 08:16 . 2010-05-10 08:16 -------- d-----w- c:\programdata\WindowsSearch
2010-05-09 21:29 . 2010-05-02 20:13 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-05-04 20:27 . 2010-05-04 20:27 -------- d-----w- c:\program files\WinPcap
2010-04-20 21:05 . 2010-04-21 14:30 -------- d-----w- c:\users\Shodar87\AppData\Roaming\DivX
2010-04-20 21:04 . 2010-05-05 07:37 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-04-20 21:02 . 2010-04-20 21:03 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-04-20 20:53 . 2010-05-05 07:38 -------- d-----w- c:\program files\DivX
2010-04-19 19:28 . 2010-04-19 19:28 -------- d-----w- c:\users\Shodar87\AppData\Local\Mumble
2010-04-17 19:40 . 2010-05-05 07:42 -------- d-----w- c:\programdata\DivX

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-11 10:59 . 2010-02-23 18:10 32156 ----a-w- c:\programdata\nvModes.dat
2010-05-11 10:58 . 2010-05-10 08:29 37228 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-05-11 10:58 . 2010-05-10 08:29 1948 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-05-11 10:57 . 2010-03-01 12:26 12 ----a-w- c:\windows\bthservsdp.dat
2010-05-10 08:44 . 2008-01-29 16:29 33808 ----a-w- c:\windows\system32\drivers\klbg.sys
2010-05-10 08:44 . 2010-05-10 08:44 33808 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\klbg.sys
2010-05-10 08:44 . 2010-05-10 08:44 224272 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\Vista\klif.sys
2010-05-10 08:44 . 2010-05-10 08:44 21256 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\vkbd.dll
2010-05-10 08:44 . 2010-05-10 08:44 861448 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\updater.dll
2010-05-10 08:43 . 2010-05-10 08:43 83208 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\mzvkbd.dll
2010-05-10 08:43 . 2010-05-10 08:43 62728 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\ievkbd.dll
2010-05-10 08:43 . 2010-05-10 08:43 43784 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\fssync.dll
2010-05-10 08:43 . 2010-05-10 08:43 365832 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\ckahum.dll
2010-05-10 08:43 . 2010-05-10 08:43 201992 ----a-w- c:\programdata\Kaspersky Lab\AVP8\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav8exec\8.0.0.357\avp.exe
2010-05-10 07:23 . 2010-02-23 16:46 53832 ----a-w- c:\users\Shodar87\AppData\Local\GDIPFONTCACHEV1.DAT
2010-05-09 11:13 . 2010-03-27 12:59 1 ----a-w- c:\users\Shodar87\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-09 08:41 . 2010-02-24 08:24 -------- d-----w- c:\program files\Common Files\InstallShield
2010-05-08 10:04 . 2010-02-24 01:32 598838 ----a-w- c:\windows\system32\perfh005.dat
2010-05-08 10:04 . 2010-02-24 01:32 115014 ----a-w- c:\windows\system32\perfc005.dat
2010-05-05 22:40 . 2010-03-20 17:25 -------- d-----w- c:\users\Shodar87\AppData\Roaming\Mumble
2010-05-05 12:57 . 2010-02-24 08:26 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-05-05 07:42 . 2010-04-20 21:08 57344 ----a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-05-05 07:38 . 2010-05-05 07:38 56766 ----a-w- c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-05-05 07:38 . 2010-05-05 07:38 53600 ----a-w- c:\programdata\DivX\Update\Uninstaller.exe
2010-05-05 07:38 . 2010-05-05 07:38 57679 ----a-w- c:\programdata\DivX\Player\Uninstaller.exe
2010-05-05 07:37 . 2010-05-05 07:37 84040 ----a-w- c:\programdata\DivX\TransferWizard\Uninstaller.exe
2010-05-05 07:37 . 2010-05-05 07:37 54153 ----a-w- c:\programdata\DivX\DFXPlugin\Uninstaller.exe
2010-05-05 07:37 . 2010-05-05 07:37 54128 ----a-w- c:\programdata\DivX\Converter\Uninstaller.exe
2010-05-05 07:37 . 2010-05-05 07:37 57409 ----a-w- c:\programdata\DivX\ControlPanel\Uninstaller.exe
2010-05-05 07:17 . 2010-04-20 20:49 144696 ----a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.exe
2010-05-05 07:17 . 2010-04-20 21:05 754984 ----a-w- c:\programdata\DivX\Setup\Resource.dll
2010-05-05 07:17 . 2010-04-20 21:05 1180952 ----a-w- c:\programdata\DivX\Setup\DivXSetup.exe
2010-05-04 09:30 . 2010-02-27 08:31 -------- d-----w- c:\users\Shodar87\AppData\Roaming\ICQ
2010-04-20 21:05 . 2010-04-20 21:05 56978 ----a-w- c:\programdata\DivX\WebPlayer\Uninstaller.exe
2010-04-20 21:04 . 2010-04-20 21:04 57054 ----a-w- c:\programdata\DivX\DSDesktopComponents\Uninstaller.exe
2010-04-20 21:04 . 2010-04-20 21:04 54166 ----a-w- c:\programdata\DivX\DSAVCDecoder\Uninstaller.exe
2010-04-20 21:04 . 2010-04-20 21:04 57532 ----a-w- c:\programdata\DivX\DSASPDecoder\Uninstaller.exe
2010-04-20 21:04 . 2010-04-20 21:04 56458 ----a-w- c:\programdata\DivX\DivXDecoderShortcut\Uninstaller.exe
2010-04-20 21:04 . 2010-04-20 21:04 54174 ----a-w- c:\programdata\DivX\DSAACDecoder\Uninstaller.exe
2010-04-20 21:03 . 2010-04-20 21:03 54629 ----a-w- c:\programdata\DivX\TranscodeEngine\Uninstaller.exe
2010-04-20 21:03 . 2010-04-20 21:03 54101 ----a-w- c:\programdata\DivX\MPEG2Plugin\Uninstaller.exe
2010-04-20 21:03 . 2010-04-20 21:03 52963 ----a-w- c:\programdata\DivX\MSVC80CRTRedist\Uninstaller.exe
2010-04-20 21:03 . 2010-04-20 21:03 54073 ----a-w- c:\programdata\DivX\Qt4.5\Uninstaller.exe
2010-04-20 21:02 . 2010-04-20 21:02 56969 ----a-w- c:\programdata\DivX\ASPEncoder\Uninstaller.exe
2010-04-11 10:57 . 2010-04-11 10:56 -------- d-----w- c:\users\Shodar87\AppData\Roaming\Youtube Downloader HD
2010-04-11 10:46 . 2010-04-11 10:46 -------- d-----w- c:\users\Shodar87\AppData\Roaming\AnvSoft
2010-04-08 11:24 . 2010-04-08 11:24 -------- d-----w- c:\program files\Common Files\BioWare
2010-04-08 10:11 . 2010-04-07 11:09 -------- d-----w- c:\programdata\Media Center Programs
2010-04-07 08:48 . 2010-04-07 08:48 -------- d-----w- c:\program files\Microsoft Silverlight
2010-04-06 12:54 . 2010-03-20 21:43 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-06 12:53 . 2010-03-20 21:44 -------- d-----w- c:\program files\AGEIA Technologies
2010-04-05 09:58 . 2010-04-05 09:58 -------- d-----w- c:\users\Shodar87\AppData\Roaming\GHISLER
2010-04-04 18:03 . 2010-02-27 08:31 -------- d-----w- c:\program files\ICQ7.0
2010-03-31 20:12 . 2010-03-31 20:12 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-03-27 13:03 . 2010-02-23 16:52 -------- d-----w- c:\program files\Opera
2010-03-27 12:58 . 2010-03-27 12:58 -------- d-----w- c:\users\Shodar87\AppData\Roaming\OpenOffice.org
2010-03-26 11:33 . 2010-03-26 11:33 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-03-23 17:17 . 2010-03-23 17:10 -------- d--h--w- c:\program files\Zero G Registry
2010-03-23 17:08 . 2010-03-23 17:08 -------- d-----w- c:\users\Shodar87\AppData\Roaming\Sports Interactive
2010-03-22 10:51 . 2010-03-22 10:51 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2010-03-22 07:29 . 2010-03-22 06:37 -------- d-----w- c:\program files\ESET
2010-03-21 21:10 . 2010-03-21 21:06 -------- d-----w- c:\programdata\Lavasoft
2010-03-21 21:07 . 2010-03-21 21:06 -------- d-----w- c:\program files\Lavasoft
2010-03-21 21:07 . 2010-03-21 21:07 -------- dc-h--w- c:\programdata\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-03-21 20:51 . 2010-03-21 20:51 -------- d-----w- c:\programdata\Alwil Software
2010-03-21 20:51 . 2010-03-21 20:51 -------- d-----w- c:\program files\Alwil Software
2010-03-21 19:20 . 2010-03-21 19:20 4096 ----a-w- c:\windows\system32\08748.tmp
2010-03-21 19:20 . 2010-02-28 08:35 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-03-21 14:55 . 2010-03-21 14:55 -------- d-----w- c:\programdata\Age of Empires 3
2010-03-20 17:25 . 2010-03-20 17:25 -------- d-----w- c:\program files\Mumble
2010-03-19 15:34 . 2010-03-19 15:34 -------- d-----w- c:\users\Shodar87\AppData\Roaming\InstallShield
2010-03-18 06:36 . 2010-03-18 06:36 -------- d-----w- c:\program files\RADVideo
2010-03-09 12:09 . 2010-03-09 12:09 444952 ----a-w- c:\windows\system32\wrap_oal.dll
2010-03-09 12:09 . 2010-03-09 12:09 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2010-03-08 17:59 . 2010-03-08 17:59 94208 ----a-w- c:\windows\system32\dpl100.dll
2010-03-08 13:14 . 2010-03-08 13:14 4096 ----a-w- c:\windows\system32\09548.tmp
2010-03-06 15:02 . 2010-03-06 15:02 4096 ----a-w- c:\windows\system32\drivers\nocashio.sys
2010-02-24 01:31 . 2010-02-24 01:32 34724 ----a-w- c:\windows\system32\perfd005.dat
2010-02-24 01:31 . 2010-02-24 01:32 286912 ----a-w- c:\windows\system32\perfi005.dat
2010-02-24 01:31 . 2010-02-24 01:31 34724 ----a-w- c:\windows\inf\PERFLIB\0405\perfd.dat
2010-02-24 01:31 . 2010-02-24 01:31 34724 ----a-w- c:\windows\inf\PERFLIB\0405\perfc.dat
2010-02-24 01:31 . 2010-02-24 01:31 286912 ----a-w- c:\windows\inf\PERFLIB\0405\perfi.dat
2010-02-24 01:31 . 2010-02-24 01:31 286912 ----a-w- c:\windows\inf\PERFLIB\0405\perfh.dat
2010-02-23 20:46 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2010-02-23 19:57 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2010-02-23 19:57 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll
2010-02-23 18:23 . 2010-02-23 18:24 737280 ----a-w- c:\windows\iun6002.exe
2010-02-23 16:49 . 2010-02-23 16:45 680 ----a-w- c:\users\Shodar87\AppData\Local\d3d9caps.dat
2010-02-19 19:27 . 2010-02-19 19:27 720384 ----a-w- c:\windows\system32\DivX.dll
2010-02-19 19:27 . 2010-02-19 19:27 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2010-02-19 19:27 . 2010-02-19 19:27 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2010-02-19 19:27 . 2010-02-19 19:27 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2010-02-19 19:27 . 2010-02-19 19:27 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2010-02-19 19:27 . 2010-02-19 19:27 839680 ----a-w- c:\windows\system32\divx_xx11.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\games\steam\steam.exe" [2010-05-07 1238352]
"ICQ"="c:\program files\ICQ7.0\ICQ.exe" [2010-03-28 133368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-18 1008184]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-01 13797992]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2010-05-10 201992]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):66,8e,fb,23,ca,b4,ca,01

R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-10-20 50704]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2010-05-10 33808]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-02-04 64288]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2008-03-26 20496]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-05-02 1285864]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
.
Obsah adresáře 'Naplánované úlohy'

2010-05-11 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 20:11]
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-11 13:03
Windows 6.0.6002 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\windows\system32\conime.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Celkový čas: 2010-05-11 13:07:46 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-05-11 11:07
ComboFix2.txt 2010-05-10 21:14

Před spuštěním: Volných bajtů: 20 215 472 128
Po spuštění: Volných bajtů: 19 947 331 584

- - End Of File - - 5D2A8EF8D29A03C563B1DD8015B250EC

#12 Příspěvek od **motji** » 11 kvě 2010 12:15

Zkuste otestovat ty dva soubory, třeba z nouzového režimu, at vím co jsou zač

otestujte na www.virustotal.com
c:\windows\system32\09548.tmp
c:\windows\system32\08748.tmp

DarkDave87 · #13 Příspěvek od **DarkDave87** » 11 kvě 2010 12:23

Nemáte oprávnění k otevření tohoto souboru.

Požádejte vlastníka souboru nebo správce o přidělění oprávnění.

#14 Příspěvek od **motji** » 11 kvě 2010 12:52

šmejd jeden

Nemáte nějaké linuxové cd při ruce?

Stáhněte Avenger
http://swandog46.geekstogo.com/avenger.exe

-spustíte program a potvrdíte kliknutím na ok,tím potvrzujete, že všechny činnosti s tím spojené činíte na vlastní riziko.
-Po odkliknutí se objeví hlavní okno programu,do bílého okna něj zkopírujte tento skript:

Kód: Vybrat vše

Files to delete:
c:\windows\system32\09548.tmp
c:\windows\system32\08748.tmp

-zaškrtněte políčko scan for rootkits

a klikněte na tlačítko Execute.
-Potom se objeví okno,kde kliknutím Yes potvrdíte spuštění skriptu. Pak znovu tlačítkem yes potvrdíte restart počítače.
-Po restartu by se měl otevřít poznámkový blok s logem o vykonání skriptu, bude také uložený v C:\avenger.txt.
-Log vložte sem

DarkDave87 · #15 Příspěvek od **DarkDave87** » 11 kvě 2010 12:59

Myslím, že tohle ten šmejd nečekal

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "c:\windows\system32\09548.tmp" deleted successfully.
File "c:\windows\system32\08748.tmp" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

VIRY.CZ

Net-Worm.Win32.Kido.jq nesmazatelny zmetek

Net-Worm.Win32.Kido.jq nesmazatelny zmetek

Re: Net-Worm.Win32.Kido.jq nesmazatelny zmetek

Re: Net-Worm.Win32.Kido.jq nesmazatelny zmetek

Re: Net-Worm.Win32.Kido.jq nesmazatelny zmetek

Re: Net-Worm.Win32.Kido.jq nesmazatelny zmetek

Re: Net-Worm.Win32.Kido.jq nesmazatelny zmetek

Re: Net-Worm.Win32.Kido.jq nesmazatelny zmetek

Re: Net-Worm.Win32.Kido.jq nesmazatelny zmetek

Re: Net-Worm.Win32.Kido.jq nesmazatelny zmetek

Re: Net-Worm.Win32.Kido.jq nesmazatelny zmetek

Re: Net-Worm.Win32.Kido.jq nesmazatelny zmetek

Re: Net-Worm.Win32.Kido.jq nesmazatelny zmetek

Re: Net-Worm.Win32.Kido.jq nesmazatelny zmetek

Re: Net-Worm.Win32.Kido.jq nesmazatelny zmetek

Re: Net-Worm.Win32.Kido.jq nesmazatelny zmetek