Zamrzání, virus dle Avastu?

Zpráva

#16 Příspěvek od **stell** » 21 črc 2010 16:00

a uz nechaj po restarte nabehnut normalny windows.
Pri tejto akcii je nutné mať ComboFix na ploche.

Vypni>FIREWALL>Antivir>Antispyware>vsetko rezidentne.

Otvor Notepad (Poznámkový blok) a zkopíruj do neho celý zeleny tex:

Kód: Vybrat vše

AWF::
g:\program files\HP\HP Software Update\bak\HPWuSchd2.exe
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"=-
"SunJavaUpdateSched"=-
"Adobe Reader Speed Launcher"=-
"Adobe ARM"=-
File::
G:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\HP Digital Imaging Monitor.lnk
G:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\LUMIX Simple Viewer.lnk
G:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
G:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Rychlé spuštění aplikace HP Image Zone.lnk

Potom klik na Subor -> Uložiť ako.. .. -> Ako je Názov souboru tak do toho riadku napiš:CFScript.txt
Typ súboru tak tam vyberies *všetky súbory
A ulož ho na plochu.> Pozor CFScript.txt>Neotvarat a nemoze byt ani>CFScript.txt.txt A Urobis Toto :
Obrázek

Po skonceni skenu vlož log čo ComboFix vytvorí

mantisa · #17 Příspěvek od **mantisa** » 21 črc 2010 16:31

Bohužel beze změny. Combofix ani nedokončil log, protože po restartu a spuštění windows klasickým způsobem se to zase "seklo"..šlo hýbat myší, ale Combofix viditelně velmi dlouho nepracoval, tak jsem jen rozkliknul nabídku Start a to samé jako vždy - totální zásek, pomohl jen tvrdý restart.
Není zde něco divného?

#18 Příspěvek od **stell** » 21 črc 2010 16:37

nie tam je vsetko ok,
Takze restart do nudzoveho rezimu:
bootkit_remover
stiahni na plochu a spust,otvori sa ti okno.
klikni pravym tlacitkom mys do cierného okna,zvolit Vybrat vse, stisknout CTRL+C a tu na foru CTRL+V. takto vloz do svojho prispevku log.

mantisa · #19 Příspěvek od **mantisa** » 21 črc 2010 16:55

Bootkit Remover version 1.0.0.1
(c) 2009 eSage Lab
www.esagelab.com

\\.\C: -> \\.\PhysicalDrive1
MD5: ee7fe9f24bc949ea3a78cf7064fbe50b
\\.\D: -> \\.\PhysicalDrive1
\\.\G: -> \\.\PhysicalDrive0
MD5: ee7fe9f24bc949ea3a78cf7064fbe50b

Size Device Name MBR Status
--------------------------------------------
9 GB \\.\PhysicalDrive1 Unknown boot code
149 GB \\.\PhysicalDrive0 Unknown boot code

Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>

Press any key to quit...

#20 Příspěvek od **stell** » 21 črc 2010 17:02

Otvor Notepad (Poznámkový blok) a zkopíruj do neho celý zeleny tex:

Kód: Vybrat vše

@ECHO OFF
remover.exe fix \\.\PhysicalDrive0
remover.exe fix \\.\PhysicalDrive1
EXIT

Potom klik na Subor -> Uložiť ako.. .. -> Ako je Názov souboru tak do toho riadku napiš:fix.bat
Typ súboru tak tam vyberies *všetky súbory
A ulož ho na plochu.-2x klikni na fix.bat
Restartni pocitac-znovu -do nudzoveho rezimu.
spust,bootkit remover otvori sa ti okno.
klikni pravym tlacitkom mys do cierného okna,zvolit Vybrat vse, stisknout CTRL+C a tu na foru CTRL+V. takto vloz do svojho prispevku log.

mantisa · #21 Příspěvek od **mantisa** » 21 črc 2010 17:12

Bootkit Remover version 1.0.0.1
(c) 2009 eSage Lab
www.esagelab.com

\\.\C: -> \\.\PhysicalDrive1
MD5: ee7fe9f24bc949ea3a78cf7064fbe50b
\\.\D: -> \\.\PhysicalDrive1
\\.\G: -> \\.\PhysicalDrive0
MD5: ee7fe9f24bc949ea3a78cf7064fbe50b

Size Device Name MBR Status
--------------------------------------------
9 GB \\.\PhysicalDrive1 Unknown boot code
149 GB \\.\PhysicalDrive0 Unknown boot code

Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>

Press any key to quit...

#22 Příspěvek od **stell** » 21 črc 2010 17:18

takto,este raz takto start-spustit vloz prikaz.
"%userprofile%\plocha\remover.exe" fix \\.\PhysicalDrive0 [enter]
"%userprofile%\plocha\remover.exe" fix \\.\PhysicalDrive1 [enter]

Pri tejto akcii je nutné mať ComboFix na ploche.

Vypni>FIREWALL>Antivir>Antispyware>vsetko rezidentne.

Otvor Notepad (Poznámkový blok) a zkopíruj do neho celý zeleny tex:

Kód: Vybrat vše

AWF::
g:\program files\HP\HP Software Update\bak\HPWuSchd2.exe
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"=-
"SunJavaUpdateSched"=-
"Adobe Reader Speed Launcher"=-
"Adobe ARM"=-
File::
G:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\HP Digital Imaging Monitor.lnk
G:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\LUMIX Simple Viewer.lnk
G:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
G:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\Rychlé spuštění aplikace HP Image Zone.lnk

Potom klik na Subor -> Uložiť ako.. .. -> Ako je Názov souboru tak do toho riadku napiš:CFScript.txt
Typ súboru tak tam vyberies *všetky súbory
A ulož ho na plochu.> Pozor CFScript.txt>Neotvarat a nemoze byt ani>CFScript.txt.txt A Urobis Toto :
Obrázek

Po skonceni skenu vlož log čo ComboFix vytvorí

mantisa · #23 Příspěvek od **mantisa** » 21 črc 2010 17:38

Příkaz se neprovede, místo toho vyskočí toto okno

mantisa · #24 Příspěvek od **mantisa** » 21 črc 2010 17:39

už vím, moje chyba

momentík..

#25 Příspěvek od **stell** » 21 črc 2010 17:40

no jasne,kde mas bootkit_remover-musi byt na ploche,,a ak to mas tam tak treba aj rozbalit na plochu.

mantisa · #26 Příspěvek od **mantisa** » 21 črc 2010 17:48

Bootkit Remover version 1.0.0.1
(c) 2009 eSage Lab
www.esagelab.com

\\.\C: -> \\.\PhysicalDrive1
MD5: 6def5ffcbcdbdb4082f1015625e597bd
\\.\D: -> \\.\PhysicalDrive1
\\.\G: -> \\.\PhysicalDrive0
MD5: 6def5ffcbcdbdb4082f1015625e597bd

Size Device Name MBR Status
--------------------------------------------
9 GB \\.\PhysicalDrive1 OK (DOS/Win32 Boot code found)
149 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)

Press any key to quit...

Combofix dodám až pozdě večer, nebo zítra (potřebuji teď odejít). Prozatím děkuji.

#27 Příspěvek od **stell** » 21 črc 2010 17:50

ok,stacis,,a uz spust windows do normalneho rezimu ze cio povie,

mantisa · #28 Příspěvek od **mantisa** » 22 črc 2010 19:28

Vypadá to OK, zatím nic nezamrzlo

Mnohokrát děkuji

Mám tedy ještě provést ten Combofix? (ten poslední se nedokončil, jak jsem psal - kvůli přechodu do normálního režimu, kdy to ještě zamrzalo). Nebo je potřeba ještě nějaké doladění či případné bezpečnostní rady?

#29 Příspěvek od **stell** » 22 črc 2010 19:37

nie ,vloz sem novy log z RSIT a docistime to inak,
odinstaluj combofix-klik-start-klik-spustit-skopituj do okna prikaz combofix /uninstall

mantisa · #30 Příspěvek od **mantisa** » 22 črc 2010 20:35

Logfile of random's system information tool 1.08 (written by random/random)
Run by Vit at 2010-07-22 21:33:51
Systém Microsoft Windows XP Professional Service Pack 2
System drive G: has 90 GB (59%) free of 153 GB
Total RAM: 1023 MB (38% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:34:06, on 22.7.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
G:\Program Files\Alwil Software\Avast4\ashServ.exe
G:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
G:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
G:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\system32\HPZipm12.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\UAService7.exe
G:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
G:\Program Files\Alwil Software\Avast4\ashWebSv.exe
G:\WINDOWS\system32\ctfmon.exe
G:\Program Files\Mozilla Firefox\firefox.exe
G:\Program Files\ICQ6.5\ICQ.exe
G:\Documents and Settings\Vit\Dokumenty\Stažené soubory\RSIT.exe
G:\Program Files\trend micro\Vit.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - G:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - G:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - G:\PROGRA~1\ICQTOO~1\3217\toolbaru.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - G:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - G:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - G:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - G:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - G:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - G:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - G:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - G:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [snpstd] G:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [StartCCC] "G:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [SpybotSD TeaTimer] G:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] "G:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] G:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &ICQ Toolbar Search - res://G:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - G:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - G:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - G:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - G:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - G:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: G:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} - http://asp01.photoprintit.de/microsite/ ... loader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B298EE45-5066-4BC7-A88D-8DB104BDD928}: NameServer = 192.168.29.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - G:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - G:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - G:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - G:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - G:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - G:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - G:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - G:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - G:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - G:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - G:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - G:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Pml Driver HPZ12 - HP - G:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - G:\WINDOWS\system32\UAService7.exe

--
End of file - 7536 bytes

======Scheduled tasks folder======

G:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
G:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
Yahoo! Toolbar Helper - G:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2006-10-26 440384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055FD26D-3A88-4e15-963D-DC8493744B1D}]
XTTBPos00 Class - G:\PROGRA~1\ICQTOO~1\3217\toolbaru.dll [2006-12-25 701952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - G:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - G:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2007-08-25 1062184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - G:\Program Files\Java\jre1.5.0_10\bin\ssv.dll [2006-11-09 440056]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - G:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-04-17 323904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - G:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2009-07-08 256112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - G:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll [2009-11-24 764912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - G:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll [2009-07-08 458736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - G:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2006-10-26 440384]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - G:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2009-07-08 256112]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"snpstd"=G:\WINDOWS\vsnpstd.exe [2004-06-10 286720]
"StartCCC"=G:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-08-29 61440]
"KernelFaultCheck"=G:\WINDOWS\system32\dumprep 0 -k []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=G:\Program Files\Spybot - Search & Destroy\TeaTimer.exe []
"swg"=G:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-07-09 39408]
"ctfmon.exe"=G:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
G:\WINDOWS\system32\Ati2evxx.dll [2009-01-14 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - G:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoBandCustomize"=0
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoBandCustomize"=0
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\BearShare\BearShare.exe"="C:\Program Files\BearShare\BearShare.exe:*:Enabled:BearShare"
"G:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="G:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"G:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="G:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"G:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="G:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"G:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="G:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"G:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="G:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"G:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="G:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"G:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="G:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"G:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="G:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"G:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="G:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"G:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="G:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"G:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="G:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"G:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="G:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"G:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="G:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"G:\WINDOWS\system32\dpvsetup.exe"="G:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"G:\Program Files\EA SPORTS\FIFA 07\fifa07.exe"="G:\Program Files\EA SPORTS\FIFA 07\fifa07.exe:*:Enabled:fifa07"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"G:\Program Files\ICQ6.5\ICQ.exe"="G:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"G:\Program Files\Skype\Phone\Skype.exe"="G:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "
"G:\Program Files\Google\Google Earth\plugin\geplugin.exe"="G:\Program Files\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"G:\Program Files\MSN Messenger\msnmsgr.exe"="G:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"G:\Program Files\MSN Messenger\msncall.exe"="G:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======File associations======

.txt - open - Notepad.exe %1

======List of files/folders created in the last 1 months======

2010-07-21 17:30:51 ----SHD---- G:\RECYCLER
2010-07-21 17:10:57 ----D---- G:\WINDOWS\temp
2010-07-21 15:21:46 ----RASHD---- G:\cmdcons
2010-07-21 14:34:38 ----SHD---- G:\WINDOWS\CSC
2010-07-20 13:29:13 ----A---- G:\WINDOWS\ntbtlog.txt
2010-07-19 14:41:11 ----D---- G:\Documents and Settings\All Users\Data aplikací\Adobe
2010-06-30 11:17:30 ----D---- G:\Program Files\HIP GAMES

======List of files/folders modified in the last 1 months======

2010-07-22 21:34:01 ----D---- G:\Program Files\trend micro
2010-07-22 21:33:59 ----D---- G:\WINDOWS\Prefetch
2010-07-22 20:45:32 ----D---- G:\WINDOWS\system32\Restore
2010-07-22 20:44:56 ----D---- G:\WINDOWS
2010-07-22 20:44:47 ----D---- G:\WINDOWS\ERDNT
2010-07-22 20:44:40 ----D---- G:\WINDOWS\system32\CatRoot2
2010-07-22 20:34:09 ----D---- G:\Program Files\Mozilla Firefox
2010-07-22 20:08:22 ----D---- G:\WINDOWS\system32\ias
2010-07-21 17:12:38 ----D---- G:\WINDOWS\system32\drivers\etc
2010-07-21 17:12:03 ----D---- G:\WINDOWS\system32\drivers
2010-07-21 17:08:23 ----D---- G:\WINDOWS\system32
2010-07-21 17:08:23 ----D---- G:\WINDOWS\AppPatch
2010-07-21 17:08:14 ----D---- G:\Program Files\Common Files
2010-07-21 16:25:09 ----A---- G:\WINDOWS\system.ini
2010-07-21 16:23:32 ----D---- G:\WINDOWS\system32\config
2010-07-21 15:27:43 ----RSHDC---- G:\WINDOWS\system32\dllcache
2010-07-21 15:21:50 ----RASH---- G:\boot.ini
2010-07-21 15:00:25 ----RD---- G:\Program Files
2010-07-21 14:54:39 ----A---- G:\WINDOWS\pxinstall_log.txt
2010-07-21 14:52:26 ----D---- G:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2010-07-21 14:14:52 ----D---- G:\WINDOWS\network diagnostic
2010-07-20 13:30:15 ----D---- G:\Documents and Settings
2010-07-20 03:19:13 ----A---- G:\WINDOWS\SchedLgU.Txt
2010-07-19 14:45:15 ----D---- G:\Config.Msi
2010-07-19 14:41:44 ----SHD---- G:\WINDOWS\Installer
2010-07-19 14:41:14 ----D---- G:\Program Files\Common Files\Adobe
2010-07-19 14:41:12 ----D---- G:\WINDOWS\WinSxS
2010-07-19 14:40:48 ----D---- G:\Program Files\Adobe
2010-07-17 20:37:58 ----D---- G:\Documents and Settings\Vit\Data aplikací\ICQ
2010-07-07 14:16:44 ----D---- G:\Documents and Settings\Vit\Data aplikací\Google
2010-07-07 14:16:18 ----D---- G:\Program Files\Google
2010-07-07 14:14:25 ----SD---- G:\WINDOWS\Tasks
2010-07-05 14:02:38 ----D---- G:\Program Files\ICQ6.5
2010-06-30 11:17:26 ----HD---- G:\Program Files\InstallShield Installation Information
2010-06-28 10:41:32 ----D---- G:\Program Files\Stroj na poklady
2010-06-24 23:14:10 ----D---- G:\Documents and Settings\Vit\Data aplikací\Skype
2010-06-23 17:40:38 ----D---- G:\Program Files\Playrix Games

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; G:\WINDOWS\System32\Drivers\PxHelp20.sys [2005-01-26 20576]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); G:\WINDOWS\System32\drivers\sfdrv01.sys [2005-08-10 50688]
R0 SiSide;SiSide; G:\WINDOWS\system32\DRIVERS\siside.sys [2003-03-25 4096]
R0 sisidex;sisidex; G:\WINDOWS\system32\drivers\sisidex.sys [2002-10-17 49024]
R0 sisperf;Add Performance Filter Driver; G:\WINDOWS\system32\drivers\sisperf.sys [2002-08-20 9472]
R0 SiSRaid;SiSRaid; G:\WINDOWS\system32\DRIVERS\SiSRaid.sys [2003-12-09 45568]
R0 uagp35;Filtr Microsoft AGPv3.5; G:\WINDOWS\system32\DRIVERS\uagp35.sys [2004-08-04 44672]
R1 Aavmker4;avast! Asynchronous Virus Monitor; G:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 aswSP;avast! Self Protection; G:\WINDOWS\system32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; G:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 intelppm;Řadič procesoru Intel; G:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-17 39936]
R1 truecrypt;truecrypt; G:\WINDOWS\System32\drivers\truecrypt.sys [2007-11-21 188672]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; G:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
R2 aswFsBlk;aswFsBlk; G:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
R2 aswMon2;avast! Standard Shield Support; G:\WINDOWS\system32\drivers\aswMon2.sys [2009-11-25 94160]
R3 aeaudio;aeaudio; G:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816]
R3 aswRdr;aswRdr; G:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
R3 ati2mtag;ati2mtag; G:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-01-14 3455488]
R3 Pcouffin;Low level access layer for CD devices; G:\WINDOWS\System32\Drivers\Pcouffin.sys [2007-07-25 47360]
R3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; G:\WINDOWS\system32\DRIVERS\sisnic.sys [2002-07-10 32256]
R3 smwdm;smwdm; G:\WINDOWS\system32\drivers\smwdm.sys [2003-08-29 578304]
R3 snpstd;VideoCAM Trek; G:\WINDOWS\system32\DRIVERS\snpstd.sys [2005-06-20 390912]
S3 catchme;catchme; \??\G:\ComboFix\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; G:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 hamachi;Hamachi Network Interface; G:\WINDOWS\system32\DRIVERS\hamachi.sys [2007-05-30 25544]
S3 HidUsb;Ovladač třídy standardu HID; G:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-10-25 9600]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; G:\WINDOWS\system32\DRIVERS\HPZid412.sys [2005-03-08 51120]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; G:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2005-03-08 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; G:\WINDOWS\system32\DRIVERS\HPZius12.sys [2005-03-08 21744]
S3 k750bus;Sony Ericsson 750 driver (WDM); G:\WINDOWS\system32\DRIVERS\k750bus.sys [2005-02-11 55216]
S3 k750mdfl;Sony Ericsson 750 USB WMC Modem Filter; G:\WINDOWS\system32\DRIVERS\k750mdfl.sys [2005-02-11 6576]
S3 k750mdm;Sony Ericsson 750 USB WMC Modem Drivers; G:\WINDOWS\system32\DRIVERS\k750mdm.sys [2005-02-11 89872]
S3 k750mgmt;Sony Ericsson 750 USB WMC Device Management Drivers; G:\WINDOWS\system32\DRIVERS\k750mgmt.sys [2005-02-11 81728]
S3 k750obex;Sony Ericsson 750 USB WMC OBEX Interface Drivers; G:\WINDOWS\system32\DRIVERS\k750obex.sys [2005-02-11 79488]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; G:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; G:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; G:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-17 10880]
S3 nm;Ovladač programu Sledování sítě; G:\WINDOWS\system32\DRIVERS\NMnt.sys [2004-08-04 40320]
S3 SLIP;BDA Slip De-Framer; G:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-04 11136]
S3 sony_ssm.sys;sony_ssm.sys; \??\G:\DOCUME~1\Vit\LOCALS~1\Temp\sony_ssm.sys []
S3 streamip;BDA IPSink; G:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; G:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
S3 usbprint;Třída USB Printer; G:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbscan;Ovladač skeneru USB; G:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 usbser;Siemens SX1; G:\WINDOWS\system32\DRIVERS\usbser.sys [2004-08-03 25600]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; G:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S3 WSTCODEC;Dálnopisný kodek světového standardu; G:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; G:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; G:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 Ati HotKey Poller;Ati HotKey Poller; G:\WINDOWS\system32\Ati2evxx.exe [2009-01-14 598016]
R2 avast! Antivirus;avast! Antivirus; G:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
R2 Pml Driver HPZ12;Pml Driver HPZ12; G:\WINDOWS\system32\HPZipm12.exe [2007-08-09 73728]
R2 UserAccess7;SecuROM User Access Service (V7); G:\WINDOWS\system32\UAService7.exe [2008-03-13 225280]
R3 avast! Mail Scanner;avast! Mail Scanner; G:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; G:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
S2 ATI Smart;ATI Smart; G:\WINDOWS\system32\ati2sgag.exe [2009-01-13 593920]
S2 gupdate;Služba Google Update (gupdate); G:\Program Files\Google\Update\GoogleUpdate.exe [2010-07-07 136176]
S3 aspnet_state;ASP.NET State Service; G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 gusvc;Google Software Updater; G:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-09 182768]
S3 NBService;NBService; G:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-11-10 774144]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; G:\WINDOWS\system32\svchost.exe [2004-08-17 14336]

-----------------EOF-----------------

VIRY.CZ

Zamrzání, virus dle Avastu?

Re: Zamrzání, virus dle Avastu?

Re: Zamrzání, virus dle Avastu?

Re: Zamrzání, virus dle Avastu?

Re: Zamrzání, virus dle Avastu?

Re: Zamrzání, virus dle Avastu?

Re: Zamrzání, virus dle Avastu?

Re: Zamrzání, virus dle Avastu?

Re: Zamrzání, virus dle Avastu?

Re: Zamrzání, virus dle Avastu?

Re: Zamrzání, virus dle Avastu?

Re: Zamrzání, virus dle Avastu?

Re: Zamrzání, virus dle Avastu?

Re: Zamrzání, virus dle Avastu?

Re: Zamrzání, virus dle Avastu?

Re: Zamrzání, virus dle Avastu?