NEJDE VYPNOUT PC

[SirMaty]

mám v PC nějaký vir , byl v windows (nečekaně) \temp projel jsem to esetem a promazal 5 trojanu avšak problém přetvává , mám použít ComboFix nebo vás napadá něco jiného? prosím o radu

[JaRon]

skus ako drviva vacsina uzivatelov vlozit log RSIT

[SirMaty]

nevim co mi to tady říkáš ale spustil jsem ComboFix a už mi jde vypnout PC a to je hlavní Vše se zdá v pořádku ale stejně přiložim nějakej log co mi tady vyjel pro zajímavost



((((((((((((((((((((((((( Soubory vytvořené od 2010-08-27 do 2010-09-27 )))))))))))))))))))))))))))))))
.

2010-09-27 09:44 . 2010-09-27 09:44 390144 ----a-w- c:\windows\system32\CF27712.exe
2010-09-27 08:06 . 2010-09-27 08:06 -------- d-----w- c:\program files\ESET
2010-09-26 19:47 . 2010-09-26 19:47 -------- d-----w- c:\program files\Ask.com
2010-09-26 19:32 . 2010-09-26 19:39 45212 ----a-w- c:\windows\War3Unin.dat
2010-09-26 19:32 . 2010-09-26 19:38 2829 ----a-w- c:\windows\War3Unin.pif
2010-09-26 19:32 . 2010-09-26 19:38 139264 ----a-w- c:\windows\War3Unin.exe
2010-09-26 19:31 . 2010-09-26 19:31 -------- d-----w- C:\hry
2010-09-26 19:18 . 2010-09-26 19:18 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-09-26 19:18 . 2010-09-26 19:18 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-09-22 13:36 . 2010-09-22 13:36 -------- d-----w- c:\documents and settings\albina\.gimp-2.6
2010-09-22 13:35 . 2010-09-22 13:35 -------- d-----w- c:\program files\GIMP-2.0
2010-09-21 15:22 . 2010-09-22 13:58 -------- d-----w- C:\Data
2010-09-21 13:41 . 2009-09-04 15:29 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2010-09-21 13:41 . 2006-09-28 14:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2010-09-21 13:41 . 2010-09-21 13:41 -------- d-----w- c:\windows\Logs
2010-09-21 13:16 . 2010-09-21 13:16 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-09-21 13:15 . 2010-09-21 13:15 -------- d-----w- c:\program files\Common Files\Skype
2010-09-21 13:15 . 2010-09-21 13:15 -------- d-----r- c:\program files\Skype
2010-09-21 07:31 . 2010-09-21 07:31 0 ----a-w- c:\windows\nsreg.dat
2010-09-21 07:31 . 2010-09-27 08:42 -------- d-----w- C:\Programy
2010-09-20 12:50 . 2010-09-20 12:54 592 ----a-w- c:\windows\chgkey.vbs
2010-09-20 12:08 . 2010-09-20 12:08 -------- d-s---w- c:\documents and settings\albina\UserData
2010-09-20 12:00 . 2010-09-20 12:00 -------- d-----w- c:\windows\system32\Lang
2010-09-20 11:58 . 2010-09-20 11:58 -------- d-----w- c:\program files\Realtek
2010-09-20 11:58 . 2010-07-06 16:26 2815592 ----a-w- c:\windows\ALCWZRD.EXE
2010-09-20 11:58 . 2010-07-06 16:26 64104 ----a-w- c:\windows\ALCMTR.EXE
2010-09-20 11:58 . 2009-11-18 05:16 1691480 ----a-w- c:\windows\system32\drivers\Ambfilt.sys
2010-09-20 11:58 . 2010-09-20 11:58 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-09-20 11:58 . 2010-06-24 09:13 1251944 ----a-w- c:\windows\RtlExUpd.dll
2010-09-20 11:58 . 2010-09-20 11:58 -------- d-----w- c:\program files\Common Files\InstallShield
2010-09-20 11:55 . 2010-09-20 11:55 -------- d-----w- c:\program files\AGEIA Technologies
2010-09-20 11:55 . 2010-09-20 11:55 -------- d-----w- c:\windows\system32\AGEIA
2010-09-20 11:55 . 2010-09-20 11:55 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-09-20 11:54 . 2010-09-20 11:55 -------- d-----w- c:\program files\NVIDIA Corporation
2010-09-20 11:51 . 2009-08-05 14:10 6136 ----a-w- c:\windows\system32\drivers\nvphy.bin
2010-09-20 11:51 . 2009-07-30 14:48 701440 ----a-w- c:\windows\system32\cohelper.dll
2010-09-20 11:51 . 2009-07-29 22:28 485920 ----a-w- c:\windows\system32\nvunrm.exe
2010-09-20 11:51 . 2009-09-27 14:12 490088 ----a-w- c:\windows\system32\NVUNINST.EXE

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-20 12:54 . 2010-09-20 12:50 592 ----a-w- c:\windows\chgkey.vbs
2010-09-20 12:04 . 2004-08-18 12:00 46016 ----a-w- c:\windows\system32\perfc005.dat
2010-09-20 12:04 . 2004-08-18 12:00 309716 ----a-w- c:\windows\system32\perfh005.dat
2010-09-20 09:02 . 2010-09-20 08:32 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-09-20 09:02 . 2010-09-20 08:32 2740 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-09-20 09:01 . 2010-09-20 08:32 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-09-20 08:33 . 2010-09-20 08:33 -------- d-----w- c:\program files\microsoft frontpage
2010-09-20 08:29 . 2010-09-20 08:29 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-08-04 09:50 . 2010-08-04 09:50 140752 ----a-w- c:\windows\system32\drivers\eamon.sys
2010-08-03 11:28 . 2010-08-03 11:28 95896 ----a-w- c:\windows\system32\drivers\epfwtdir.sys
2010-07-29 11:31 . 2010-07-29 11:31 115008 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-07-06 16:27 . 2010-09-20 11:59 84584 ----a-w- c:\windows\SOUNDMAN.EXE
2010-07-06 16:27 . 2010-09-20 11:59 359016 ----a-w- c:\windows\vncutil.exe
2010-07-06 16:27 . 2010-09-20 11:59 1833576 ----a-w- c:\windows\SkyTel.exe
2010-07-06 16:27 . 2010-09-20 11:59 1489512 ----a-w- c:\windows\RtlUpd.exe
2010-07-06 16:26 . 2010-09-20 11:59 9721960 ----a-w- c:\windows\RTLCPL.EXE
2010-07-06 16:26 . 2010-09-20 11:59 6088296 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys
2010-07-06 16:26 . 2010-09-20 11:59 53864 ----a-w- c:\windows\system32\RtkCoInstXP.dll
2010-07-06 16:26 . 2010-09-20 11:59 129640 ----a-w- c:\windows\RtkAudioService.exe
2010-07-06 16:26 . 2010-09-20 11:59 19556968 ----a-w- c:\windows\RTHDCPL.EXE
2010-07-06 16:26 . 2010-09-20 11:59 2180712 ----a-w- c:\windows\MicCal.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-26 13:23 1385864 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Infium"="c:\programy\QIP 2010\qip.exe" [2010-09-10 5809616]
"DAEMON Tools Lite"="c:\programy\sys\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-09-27 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-27 13918208]
"RTHDCPL"="RTHDCPL.EXE" [2010-07-06 19556968]
"WinampAgent"="c:\programy\Winamp\winampa.exe" [2010-07-12 74752]
"LogMeIn Hamachi Ui"="c:\programy\Hamachi 2\hamachi-2-ui.exe" [2010-03-30 1820040]
"egui"="c:\programy\ESET NOD32 Antivirus\egui.exe" [2010-08-12 2215064]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programy\\Garena\\Garena.exe"=
"c:\\Programy\\sys\\uTorrent\\uTorrent.exe"=
"c:\\WINDOWS\\system32\\winver.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [29.7.2010 13:31 115008]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [3.8.2010 13:28 95896]
R2 ekrn;ESET Service;c:\programy\ESET NOD32 Antivirus\ekrn.exe [12.8.2010 14:16 810144]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\programy\Hamachi 2\hamachi-2.exe [30.3.2010 11:16 1107336]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [20.9.2010 13:58 1691480]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\albina\LOCALS~1\Temp\MRR77.tmp --> c:\docume~1\albina\LOCALS~1\Temp\MRR77.tmp [?]
S3 GGSAFERDriver;GGSAFER Driver;\??\c:\programy\Garena\plugins\UI\safedrv.sys --> c:\programy\Garena\plugins\UI\safedrv.sys [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.9.2010 21:18 691696]
.
Obsah adresáře 'Naplánované úlohy'

2010-09-27 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-05-26 13:23]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/
FF - ProfilePath - c:\documents and settings\albina\Data aplikací\Mozilla\Firefox\Profiles\uttp336a.default\
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - www.google.cz
FF - plugin: c:\programy\sys\Mozilla Firefox\plugins\npwachk.dll

---- NASTAVENÍ FIREFOXU ----
c:\programy\sys\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\programy\sys\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\programy\sys\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\programy\sys\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKLM-Run-nwiz - c:\program files\NVIDIA Corporation\nView\nwiz.exe
Notify-winlyv32 - winlyv32.dll
AddRemove-NVIDIA nView Desktop Manager - c:\program files\NVIDIA Corporation\nView\nViewSetup.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-27 11:50
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\albina\LOCALS~1\Temp\MRR77.tmp"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Celkový čas: 2010-09-27 11:51:40
ComboFix-quarantined-files.txt 2010-09-27 09:51

Před spuštěním: Volných bajtů: 123 561 611 264
Po spuštění: Volných bajtů: 123 680 399 360

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - BBCBA7E9311829375693A138EB538B1F

[JaRon]

doporucujem odinstalovat c:\program files\Ask.com