Prosím o kontrolu - podezření na vir

[hrasek]

Pročištěno. Přejmenování combofixu pomohlo, tady je log:
Hybernace již fubnguje jak má.

ComboFix 10-07-06.03 - Jakubec 07.07.2010 11:05:24.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1280.997 [GMT 2:00]
Spuštěný z: c:\documents and settings\Jakubec\Plocha\zmije.com
* Vytvořen nový Bod Obnovení

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\install.exe
c:\program files\webserver
c:\program files\webserver\locale.ini
c:\program files\webserver\PdvrParser.ax
c:\program files\webserver\PdvrServer.dll
c:\program files\webserver\uninstall.exe
c:\program files\webserver\WebServer.ocx
c:\program files\WinPCap
c:\program files\WinPCap\daemon_mgm.exe
c:\program files\WinPCap\INSTALL.LOG
c:\program files\WinPCap\npf_mgm.exe
c:\program files\WinPCap\rpcapd.exe
c:\program files\WinPCap\Uninstall.exe
c:\windows\inf\vvt.pnf
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\wpcap.dll

Nakažená kopie c:\windows\system32\drivers\rasacd.sys byla nalezena a vyléčena.
Obnovena kopie z - Kitty had a snack :p
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF


((((((((((((((((((((((((( Soubory vytvořené od 2010-06-07 do 2010-07-07 )))))))))))))))))))))))))))))))
.

2010-07-07 08:20 . 2010-07-07 08:20 -------- d-----w- c:\program files\CCleaner
2010-06-30 06:24 . 2010-06-30 06:24 -------- d-----w- c:\program files\Metel
2010-06-28 11:28 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-28 11:28 . 2010-06-28 11:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-06-28 11:28 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-06-28 06:36 . 2010-07-07 08:18 -------- d-----w- c:\program files\trend micro
2010-06-28 06:26 . 2010-06-28 06:26 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-06-25 08:59 . 2010-07-07 07:57 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-06-23 08:25 . 2010-06-23 08:26 -------- d-----w- C:\backup
2010-06-23 08:11 . 2010-06-23 08:11 -------- d-----w- C:\Storage
2010-06-23 07:27 . 2010-06-23 07:27 -------- d-----w- C:\SYS
2010-06-23 07:25 . 2010-06-23 07:26 -------- d-----w- c:\program files\AKR Player
2010-06-23 06:37 . 2010-06-23 06:37 -------- d-----w- C:\Temp_MicroDVRPlayer
2010-06-22 09:14 . 2010-02-01 08:35 15360 ------w- c:\windows\system32\AVC_AP_JPEG.dll
2010-06-22 09:14 . 2010-01-11 18:10 5632 ------w- c:\windows\system32\AVC_AP_SCALE.dll
2010-06-22 09:14 . 2009-09-14 09:41 46592 ------w- c:\windows\system32\avutil-50.dll
2010-06-22 09:14 . 2009-09-14 09:41 120320 ------w- c:\windows\system32\swscale-0.dll
2010-06-22 09:14 . 2009-09-14 09:41 75776 ------w- c:\windows\system32\avformat-52.dll
2010-06-22 09:14 . 2009-09-14 09:41 4608 ------w- c:\windows\system32\avdevice-52.dll
2010-06-22 09:14 . 2009-09-14 09:41 877568 ------w- c:\windows\system32\avcodec-52.dll
2010-06-22 09:14 . 2008-05-15 15:44 323584 ------w- c:\windows\system32\Deinterlace.dll
2010-06-21 10:30 . 2010-06-21 12:56 -------- d-----w- C:\_storage
2010-06-17 06:37 . 2010-06-17 06:37 -------- d-----w- c:\program files\WinSCP
2010-06-17 06:32 . 2005-04-07 10:16 28672 ----a-w- c:\windows\system32\NdUnreg.dll
2010-06-10 11:42 . 2010-06-10 11:42 -------- d-----w- c:\program files\DVR Videoplayer
2010-06-10 06:10 . 2010-05-06 10:35 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-10 06:03 . 2010-06-10 06:03 -------- d-sh--w- c:\documents and settings\Jakubec\IECompatCache
2010-06-08 14:51 . 2010-06-08 14:51 -------- d-----w- c:\program files\Axis Communications
2010-06-08 09:28 . 2010-06-08 09:28 -------- d-----w- c:\program files\VideoLAN
2010-06-08 07:03 . 2010-06-21 09:34 -------- d-----w- c:\program files\AirLive CamPro Express-server
2010-06-07 14:14 . 2010-06-07 14:14 -------- d-----w- c:\program files\Shutter

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-07 08:28 . 2010-01-05 15:05 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-07-07 08:12 . 2010-01-06 16:01 -------- d-----w- c:\program files\SpeedFan
2010-07-07 07:58 . 2010-02-09 09:48 438 ----a-w- c:\windows\NView16.dat
2010-07-01 15:02 . 2010-01-06 09:56 -------- d-----w- c:\program files\EMS
2010-07-01 11:39 . 2010-01-07 15:08 -------- d-----w- c:\program files\VideoViewer
2010-07-01 11:35 . 2010-01-07 15:08 17408 ----a-w- C:\psapi.dll
2010-06-30 06:25 . 2008-03-13 11:51 57536 ----a-w- c:\windows\system32\drivers\ftdibus.sys
2010-06-30 06:25 . 2008-03-13 11:50 202048 ----a-w- c:\windows\system32\ftd2xx.dll
2010-06-30 06:25 . 2008-03-13 11:49 120128 ----a-w- c:\windows\system32\ftbusui.dll
2010-06-30 06:25 . 2008-03-13 11:49 185664 ----a-w- c:\windows\system32\FTLang.dll
2010-06-29 07:15 . 2010-04-20 08:39 -------- d---a-w- c:\program files\MemoCam
2010-06-24 06:15 . 2008-04-14 12:00 77850 ----a-w- c:\windows\system32\perfc005.dat
2010-06-24 06:15 . 2008-04-14 12:00 428744 ----a-w- c:\windows\system32\perfh005.dat
2010-06-23 11:46 . 2010-02-11 13:13 -------- d-----w- c:\program files\Micro D Player
2010-06-23 07:25 . 2010-01-05 14:06 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-22 06:07 . 2010-05-03 10:17 -------- d-----w- c:\program files\TCMS
2010-06-11 15:37 . 2010-01-07 15:07 880640 ------w- c:\windows\system32\AVC_LIVE.dll
2010-05-26 07:28 . 2010-05-26 07:28 -------- d-----w- c:\program files\TTERMPRO
2010-05-21 13:43 . 2010-01-07 15:07 278528 ------w- c:\windows\system32\AVC_PB.dll
2010-05-21 06:36 . 2010-01-06 08:37 -------- d-----w- c:\program files\OpenOffice.org 3
2010-05-21 06:26 . 2010-05-21 06:26 -------- d-----w- c:\program files\Common Files\Java
2010-05-21 06:25 . 2010-01-06 07:34 -------- d-----w- c:\program files\Java
2010-05-11 09:31 . 2010-01-07 15:07 225280 ------w- c:\windows\system32\AVC_RTSP.dll
2010-05-10 07:03 . 2010-04-21 06:19 -------- d-----w- c:\program files\NUUODriver
2010-05-10 06:59 . 2010-04-21 06:20 -------- d-----w- c:\program files\NUUO
2010-05-10 06:53 . 2010-01-06 13:58 -------- d-----w- c:\program files\Google
2010-05-06 10:35 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 08:09 . 2008-04-14 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-04-28 10:33 . 2010-04-28 10:33 75776 ----a-w- c:\windows\cadkasdeinst01e.exe
2010-04-20 05:32 . 2008-04-14 12:00 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-14 10:15 . 2010-04-14 10:15 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-04-12 15:29 . 2010-05-21 06:25 411368 ----a-w- c:\windows\system32\deployJava1.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

c:\documents and settings\kucera\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-2-16 384512]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\EMS\\EMS.exe"=
"c:\\Program Files\\Video Server E\\Video Server E.exe"=
"c:\\Program Files\\VideoViewer\\VideoViewer.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Documents and Settings\\kucera\\Dokumenty\\ICQ\\205449255\\ReceivedFiles\\349353578 Bohosek\\bulanci.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\NetworkCameraWizard\\NetworkCameraWizard.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\LG Electronics\\Smart Station\\mDNSResponder.exe"=
"\\\\192.168.0.31\\Disk_U\\WorkData\\docasny\\technici\\CCTV\\IP Corder\\KNR-412\\CD\\Tools\\Discover\\Windows\\Discover.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4014:UDP"= 4014:UDP:DVR TIME SYNC SERVICE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [5.1.2010 17:48 77312]
R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [6.4.2010 9:15 181120]
R1 IfsMount;IfsMount;c:\windows\system32\drivers\ifsmount.sys [6.4.2010 9:15 51072]
R2 DvrTimeServer;DvrTimeServer;c:\program files\EMS\DvrTimeSvr.exe [29.10.2008 12:21 49152]
R2 EMSService;Schedule Service;c:\program files\EMS\ScheduleService.exe [27.4.2010 10:04 1990656]
S2 BT878_01;BT878.G3 Video Capture;c:\windows\system32\drivers\cxvcap.sys [10.5.2010 9:03 72064]
S2 BTAUD01;BT878.G3 Audio Capture;c:\windows\system32\drivers\cxtscap.sys [10.5.2010 9:04 15872]
S3 NUUO Remote Desktop Server;NUUO Remote Desktop Server;c:\program files\NUUO\SCB_MPEG4_Hybrid\RmtDskServer.exe [10.5.2010 9:00 352256]
S3 PV-26xVPRODrv;Wdm Driver for H264 series V2;c:\windows\system32\drivers\h264_d1.sys [21.4.2010 8:19 27328]
S3 slockusb;slockusb;\??\c:\windows\system32\slockusb.sys --> c:\windows\system32\slockusb.sys [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [14.4.2010 12:15 691696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.eurosat.cz/
DPF: {14E35D5F-DEBA-4DB3-B2ED-17542BA12D1F} - hxxp://192.168.0.152/AVC_AX_DVR.cab
DPF: {1FBDF235-C5A9-4F21-BD79-9EC0DCF8AC29} - hxxp://192.168.0.237/AVC_AX_DVR.cab
DPF: {336C9D79-263A-4D75-AA7C-60DAF945AE67} - hxxp://192.168.0.153/classes/OvisLinkCamV_H264.cab
DPF: {361E6B79-4A69-4376-B0F2-3D1EBEE9D7E2} - hxxp://192.168.0.220/RtspVaPgDec.cab
DPF: {45830FF9-D9E6-4F41-86ED-B266933D8E90} - hxxp://192.168.0.185/RtspVaPgDec.cab
DPF: {7B40618E-CC3D-4E7C-800A-E0306DD8BD48} - hxxp://192.168.0.150/AVC_AX_757.cab
DPF: {8214B72E-B0CD-466E-A44D-1D54D926038D} - hxxp://192.168.0.152/AVC_AX_724.cab
DPF: {C1D592D2-D4F6-4E9C-968D-797449DC0ADC} - hxxp://www.dvrstation.com/webServer.cab
DPF: {D64CF6D4-45DF-4D8F-9F14-E65FADF2777C} - hxxp://www.dvrstation.com/pdvratl.php?vendor=0
DPF: {DB7ACFA2-9634-4C98-BC9D-FB9416153022} - hxxp://192.168.0.183/nvEPLMedia.cab
DPF: {DD01C8CA-5DA0-4B01-9603-B7194E561D32} - hxxp://192.168.0.199/rel/webViewer.cab
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://85.13.108.212/activex/AMC.cab
FF - ProfilePath - c:\documents and settings\Jakubec\Data aplikací\Mozilla\Firefox\Profiles\vm0kph7d.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.eurosat.cz/111-cctv-kamerove-system ... nstvi.html
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKLM-Run-ST7501 - (no file)
AddRemove-WebServer - c:\program files\WebServer\uninstall.exe
AddRemove-WinPcapInst - c:\program files\WinPcap\Uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-07 11:15
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(612)
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2010-07-07 11:21:01 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-07-07 09:20

Před spuštěním: 9 742 606 336
Po spuštění: 9 628 217 344

- - End Of File - - 6748B652316FA5852FE55497B033C45B

[cernohous13]

Klikni na https://www.virustotal.com/cs/
klik "Procházet" > do zadávacího pole zkopíruj:

c:\windows\system32\drivers\rasacd.sys

"Odeslat soubor" (pokud byl již testován, nech testovat znovu)
Trpělivě vyčkej dokončení scanu dokud se neobjeví konečný výsledek např.0/39
Do fóra zkopíruj výsledný log. nebo link na stránku.

jdi Start -> Spustit... a zkopíruj ComboFix /Uninstall (pozor, za x je mezera) -> OK

[hrasek]

virustotal

[cernohous13]

Jelikož můj soubor dopadl stejně, dovolím si považovat ho za čistý.
A když ti funguje i hibernace, máme zřejmě hotovo.

[hrasek]

Jsem téhož názoru. Děkuji za pohotovou odbornou pomoc a obrovskou ochotu!

[cernohous13]

Nemáš zač - rádo se stalo a jsme tady i příště