Avast, při zapnutí nebo restartu počítače hlásí malware

[Preach]

Dobrý den,

vždy po zapnutí počítače či restartu PC Avast detekuje Win32:Malware-gen, dokonce popíše i cestu a program:C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe, zkoušel jsem program normálně smazat ale, píše pokud chcete tento soubor měnit obraťte se na TrustedInstaller, aby vám byla přidělena příslušná oprávnění.


Logfile of random's system information tool 1.08 (written by random/random)
Run by Lukas at 2010-10-28 16:50:24
Microsoft Windows 7 Home Premium
System drive C: has 858 GB (90%) free of 954 GB
Total RAM: 4093 MB (70% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:50:31, on 28.10.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16671)
Boot mode: Normal

Running processes:
C:\Users\Lukas\AppData\Roaming\Microsoft\Svhost.exe
C:\Program Files (x86)\OpenOffice.org 2.4\program\soffice.exe
C:\Data\Programy\Avast\AvastUI.exe
C:\Data\Programy\PowerIso\PWRISOVM.EXE
C:\Program Files (x86)\OpenOffice.org 2.4\program\soffice.BIN
C:\Users\Lukas\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Lukas\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Lukas\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Lukas\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Lukas.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT1750559
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\tbBS_P.dll
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
O2 - BHO: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\tbBS_P.dll
O3 - Toolbar: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files (x86)\BS_Player\tbBS_P.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [avast5] "C:\Data\Programy\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Data\Programy\PowerIso\PWRISOVM.EXE
O4 - HKLM\..\Run: [amd_dc_opt] C:\Data\Games\Borderlands\Nainstalovaný\amd_dc_opt.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Data\Programy\Adobe\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Lukas\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Steam] "c:\data\games\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Update] C:\Users\Lukas\AppData\Roaming\Microsoft\Svhost.exe
O4 - HKCU\..\Run: [RGSC] C:\Data\Games\GTA4\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files (x86)\OpenOffice.org 2.4\program\quickstart.exe
O8 - Extra context menu item: WikiKomentáře Google... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
O17 - HKLM\System\CCS\Services\Tcpip\..\{130DA134-B689-40E2-B5EC-65573AF39FDC}: NameServer = 10.0.0.1,10.0.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{130DA134-B689-40E2-B5EC-65573AF39FDC}: NameServer = 10.0.0.1,10.0.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{130DA134-B689-40E2-B5EC-65573AF39FDC}: NameServer = 10.0.0.1,10.0.2.1
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Data\Programy\Avast\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Data\Programy\Avast\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Data\Programy\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8106 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Data\Programy\Avast\AvastSvc.exe"
atieclxx
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
"taskhost.exe"
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Users\Lukas\AppData\Roaming\Microsoft\Svhost.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\OpenOffice.org 2.4\program\soffice.exe" -quickstart
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM"
"C:\Data\Programy\Avast\AvastUI.exe" /nogui
"C:\Data\Programy\PowerIso\PWRISOVM.EXE"
"C:\Program Files (x86)\OpenOffice.org 2.4\program\soffice.exe" -quickstart
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Users\Lukas\AppData\Local\Google\Chrome\Application\chrome.exe"
"C:\Users\Lukas\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_60/Prefetch/ContentPrefetchDisabled/ProxyConnectionImpact/proxy_connections_32/SpdyImpact/npn_with_spdy/ --channel=4024.04385900.364219974 /prefetch:3
"C:\Users\Lukas\AppData\Local\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Users\Lukas\AppData\Local\Google\Chrome\Application\7.0.517.41\gcswf32.dll" --lang=cs --plugin-data-dir="C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default" --channel=4024.0662FC4C.174814514 /prefetch:4
"taskhost.exe"
"C:\Users\Lukas\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtest=CacheSize/CacheSizeGroup_6/ConnCountImpact/conn_count_6/ConnnectBackupJobs/ConnectBackupJobsEnabled/DnsImpact/default_enabled_prefetch/GlobalSdch/global_enable_sdch/IdleSktToImpact/idle_timeout_60/Prefetch/ContentPrefetchDisabled/ProxyConnectionImpact/proxy_connections_32/SpdyImpact/npn_with_spdy/ --channel=4024.09096D80.929916974 /prefetch:3
"C:\Users\Lukas\Desktop\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1103358879-1914603141-1882199632-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1103358879-1914603141-1882199632-1000UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2010-10-23 398512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg64.dll [2010-10-23 317496]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2010-10-23 297648]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll [2010-10-23 843832]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}]
BS Player Toolbar - C:\Program Files (x86)\BS_Player\tbBS_P.dll [2009-12-31 2349080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2010-10-23 398512]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - BS Player Toolbar - C:\Program Files (x86)\BS_Player\tbBS_P.dll [2009-12-31 2349080]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2010-10-23 297648]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\Lukas\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-03 136176]
"Steam"=c:\data\games\steam\steam.exe [2010-09-04 1242448]
"Update"=C:\Users\Lukas\AppData\Roaming\Microsoft\Svhost.exe [2010-10-02 124928]
"RGSC"=C:\Data\Games\GTA4\Rockstar Games Social Club\RGSCLauncher.exe /silent []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-04-06 102400]
"avast5"=C:\Data\Programy\Avast\avastUI.exe [2010-09-07 2838912]
"PWRISOVM.EXE"=C:\Data\Programy\PowerIso\PWRISOVM.EXE [2009-03-15 180224]
"amd_dc_opt"=C:\Data\Games\Borderlands\Nainstalovaný\amd_dc_opt.exe []
"Adobe Reader Speed Launcher"=C:\Data\Programy\Adobe\Reader\Reader_sl.exe [2010-09-23 35760]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288]

C:\Users\Lukas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
OpenOffice.org 2.4.lnk - C:\Program Files (x86)\OpenOffice.org 2.4\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-10-28 16:50:24 ----D---- C:\rsit
2010-10-28 16:50:24 ----D---- C:\Program Files\trend micro
2010-10-28 16:33:03 ----A---- C:\Bug.txt
2010-10-28 16:33:01 ----A---- C:\Windows\SYSWOW64\cmd.execf
2010-10-28 16:32:56 ----D---- C:\32788R22FWJFW
2010-10-28 15:36:09 ----A---- C:\Windows\system32\drivers\sffp_sd.sys
2010-10-28 15:29:51 ----D---- C:\Program Files (x86)\Microsoft.NET
2010-10-27 18:32:53 ----A---- C:\Windows\system32\msdri.dll
2010-10-27 18:32:52 ----A---- C:\Windows\SYSWOW64\CPFilters.dll
2010-10-27 18:32:52 ----A---- C:\Windows\system32\CPFilters.dll
2010-10-27 18:32:48 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2010-10-26 20:03:58 ----RHD---- C:\Users\Lukas\AppData\Roaming\SecuROM
2010-10-26 20:02:47 ----A---- C:\Windows\SYSWOW64\CmdLineExt_x64.dll
2010-10-23 19:33:22 ----A---- C:\Windows\SYSWOW64\VB6STKIT.DLL
2010-10-23 19:33:22 ----A---- C:\Windows\SYSWOW64\VB6FR.DLL
2010-10-23 19:33:22 ----A---- C:\Windows\SYSWOW64\TABCTFR.DLL
2010-10-23 19:33:22 ----A---- C:\Windows\SYSWOW64\msvcr70.dll
2010-10-23 19:33:22 ----A---- C:\Windows\SYSWOW64\MSCMCFR.DLL
2010-10-23 19:33:22 ----A---- C:\Windows\SYSWOW64\Mscc2fr.dll
2010-10-23 19:33:22 ----A---- C:\Windows\SYSWOW64\inetfr.DLL
2010-10-23 19:33:22 ----A---- C:\Windows\SYSWOW64\CMDLGFR.DLL
2010-10-23 19:27:21 ----A---- C:\Windows\SYSWOW64\t3odm.dll
2010-10-23 19:02:48 ----D---- C:\Users\Lukas\AppData\Roaming\AnvSoft
2010-10-21 12:47:56 ----D---- C:\Program Files (x86)\Conduit
2010-10-21 12:47:55 ----D---- C:\Program Files (x86)\BS_Player
2010-10-21 12:47:53 ----D---- C:\Users\Lukas\AppData\Roaming\BSplayer Pro
2010-10-21 12:47:53 ----D---- C:\Users\Lukas\AppData\Roaming\BSplayer
2010-10-17 16:36:58 ----D---- C:\PFiles
2010-10-17 15:22:06 ----A---- C:\Windows\SYSWOW64\t2embed.dll
2010-10-17 15:22:06 ----A---- C:\Windows\system32\t2embed.dll
2010-10-17 15:21:57 ----A---- C:\Windows\system32\ole32.dll
2010-10-17 15:21:56 ----A---- C:\Windows\SYSWOW64\ole32.dll
2010-10-17 15:21:55 ----A---- C:\Windows\SYSWOW64\StructuredQuery.dll
2010-10-17 15:21:55 ----A---- C:\Windows\system32\StructuredQuery.dll
2010-10-17 15:21:53 ----A---- C:\Windows\SYSWOW64\schannel.dll
2010-10-17 15:21:53 ----A---- C:\Windows\system32\schannel.dll
2010-10-17 15:21:53 ----A---- C:\Windows\system32\comctl32.dll
2010-10-17 15:21:52 ----A---- C:\Windows\SYSWOW64\wmpmde.dll
2010-10-17 15:21:52 ----A---- C:\Windows\SYSWOW64\comctl32.dll
2010-10-17 15:21:52 ----A---- C:\Windows\system32\wmpmde.dll
2010-10-17 15:21:51 ----A---- C:\Windows\SYSWOW64\mfc40u.dll
2010-10-17 15:21:51 ----A---- C:\Windows\SYSWOW64\mfc40.dll
2010-10-17 15:21:50 ----A---- C:\Windows\system32\mshtml.dll
2010-10-17 15:21:49 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2010-10-17 15:21:49 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2010-10-17 15:21:49 ----A---- C:\Windows\system32\iertutil.dll
2010-10-17 15:21:49 ----A---- C:\Windows\system32\ieframe.dll
2010-10-17 15:21:48 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2010-10-17 15:21:48 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2010-10-17 15:21:48 ----A---- C:\Windows\system32\urlmon.dll
2010-10-17 15:21:48 ----A---- C:\Windows\system32\msfeeds.dll
2010-10-17 15:21:47 ----A---- C:\Windows\SYSWOW64\wininet.dll
2010-10-17 15:21:47 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2010-10-17 15:21:47 ----A---- C:\Windows\SYSWOW64\mstime.dll
2010-10-17 15:21:47 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2010-10-17 15:21:47 ----A---- C:\Windows\SYSWOW64\msfeedssync.exe
2010-10-17 15:21:47 ----A---- C:\Windows\SYSWOW64\msfeedsbs.dll
2010-10-17 15:21:47 ----A---- C:\Windows\SYSWOW64\licmgr10.dll
2010-10-17 15:21:47 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2010-10-17 15:21:47 ----A---- C:\Windows\SYSWOW64\ieui.dll
2010-10-17 15:21:47 ----A---- C:\Windows\SYSWOW64\iepeers.dll
2010-10-17 15:21:47 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2010-10-17 15:21:47 ----A---- C:\Windows\system32\wininet.dll
2010-10-17 15:21:47 ----A---- C:\Windows\system32\mstime.dll
2010-10-17 15:21:47 ----A---- C:\Windows\system32\mshtmled.dll
2010-10-17 15:21:47 ----A---- C:\Windows\system32\msfeedssync.exe
2010-10-17 15:21:47 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-10-17 15:21:47 ----A---- C:\Windows\system32\licmgr10.dll
2010-10-17 15:21:47 ----A---- C:\Windows\system32\jsproxy.dll
2010-10-17 15:21:47 ----A---- C:\Windows\system32\ieui.dll
2010-10-17 15:21:47 ----A---- C:\Windows\system32\iepeers.dll
2010-10-17 15:21:47 ----A---- C:\Windows\system32\iedkcs32.dll
2010-10-17 15:21:42 ----A---- C:\Windows\system32\wmp.dll
2010-10-17 15:21:41 ----A---- C:\Windows\SYSWOW64\wmp.dll
2010-10-17 15:21:40 ----A---- C:\Windows\SYSWOW64\wmploc.DLL
2010-10-17 15:21:39 ----A---- C:\Windows\system32\wmploc.DLL
2010-10-17 15:21:38 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-10-17 15:21:38 ----A---- C:\Windows\system32\drivers\srv.sys
2010-10-17 15:21:37 ----A---- C:\Windows\SYSWOW64\sscore.dll
2010-10-17 15:21:37 ----A---- C:\Windows\system32\srvsvc.dll
2010-10-17 15:21:37 ----A---- C:\Windows\system32\drivers\srvnet.sys
2010-10-17 15:21:36 ----A---- C:\Windows\system32\win32k.sys
2010-10-06 21:08:16 ----A---- C:\Windows\system32\drivers\ks.sys
2010-10-06 18:00:16 ----A---- C:\Windows\SYSWOW64\tzres.dll
2010-10-06 18:00:16 ----A---- C:\Windows\system32\tzres.dll

======List of files/folders modified in the last 1 months======

2010-10-28 16:50:31 ----D---- C:\Windows\Prefetch
2010-10-28 16:50:28 ----D---- C:\Windows\Temp
2010-10-28 16:50:24 ----RD---- C:\Program Files
2010-10-28 16:33:01 ----D---- C:\Windows\SysWOW64
2010-10-28 16:24:37 ----D---- C:\Windows\System32
2010-10-28 16:24:37 ----D---- C:\Windows\inf
2010-10-28 16:24:37 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-10-28 16:20:03 ----D---- C:\Users\Lukas\AppData\Roaming\OpenOffice.org2
2010-10-28 16:15:25 ----D---- C:\Windows\system32\config
2010-10-28 15:37:38 ----D---- C:\Windows
2010-10-28 15:37:37 ----D---- C:\Windows\winsxs
2010-10-28 15:36:47 ----D---- C:\Windows\system32\DriverStore
2010-10-28 15:36:46 ----D---- C:\Windows\system32\drivers
2010-10-28 15:36:38 ----D---- C:\Users\Lukas\AppData\Roaming\uTorrent
2010-10-28 15:36:12 ----D---- C:\Windows\system32\catroot
2010-10-28 15:35:52 ----SHD---- C:\System Volume Information
2010-10-28 15:35:03 ----SHD---- C:\Windows\Installer
2010-10-28 15:35:02 ----RSD---- C:\Windows\assembly
2010-10-28 15:31:46 ----D---- C:\Windows\SYSWOW64\cs-CZ
2010-10-28 15:31:46 ----D---- C:\Windows\system32\cs-CZ
2010-10-28 15:30:03 ----D---- C:\Windows\Microsoft.NET
2010-10-28 15:29:52 ----D---- C:\Windows\SYSWOW64\en-US
2010-10-28 15:29:52 ----D---- C:\Windows\system32\en-US
2010-10-28 15:29:51 ----RD---- C:\Program Files (x86)
2010-10-28 15:29:12 ----D---- C:\Windows\system32\catroot2
2010-10-28 15:12:54 ----D---- C:\Windows\AppPatch
2010-10-28 12:06:25 ----D---- C:\Users\Lukas\AppData\Roaming\AIMP
2010-10-28 10:38:43 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2010-10-27 21:36:48 ----D---- C:\Windows\ehome
2010-10-26 20:03:10 ----HD---- C:\ProgramData
2010-10-23 19:27:24 ----RSD---- C:\Windows\Fonts
2010-10-22 18:57:04 ----D---- C:\Windows\system32\wdi
2010-10-21 12:47:56 ----RD---- C:\Users
2010-10-19 11:41:44 ----N---- C:\Windows\system32\MpSigStub.exe
2010-10-18 17:11:53 ----D---- C:\Windows\SYSWOW64\migration
2010-10-18 17:11:53 ----D---- C:\Windows\system32\migration
2010-10-18 17:11:53 ----D---- C:\Program Files\Windows Media Player
2010-10-18 17:11:53 ----D---- C:\Program Files\Internet Explorer
2010-10-18 17:11:53 ----D---- C:\Program Files (x86)\Windows Media Player
2010-10-18 17:11:53 ----D---- C:\Program Files (x86)\Internet Explorer
2010-10-17 20:23:19 ----A---- C:\Windows\system32\MRT.exe
2010-10-17 15:30:39 ----D---- C:\Windows\Logs
2010-10-10 14:54:34 ----D---- C:\ProgramData\Adobe
2010-10-10 14:54:33 ----D---- C:\Program Files (x86)\Common Files
2010-10-09 14:07:46 ----D---- C:\Windows\rescache
2010-10-02 19:04:38 ----SD---- C:\Users\Lukas\AppData\Roaming\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-09-07 28752]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-09-07 121936]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-09-07 51280]
R1 SCDEmu;SCDEmu; C:\Windows\system32\drivers\SCDEmu.sys [2009-03-15 85424]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-09-07 20048]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-09-07 61008]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-04-07 6659072]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2010-04-07 195584]
R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2010-03-09 123408]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-03-01 187392]
S3 ALSysIO;ALSysIO; \??\C:\Users\Lukas\AppData\Local\Temp\ALSysIO64.sys []
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 40448]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-04-07 202752]
R2 avast! Antivirus;avast! Antivirus; C:\Data\Programy\Avast\AvastSvc.exe [2010-09-07 40384]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Data\Programy\Avast\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Data\Programy\Avast\AvastSvc.exe [2010-09-07 40384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-07-15 135664]
S3 gusvc;Google Software Updater; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-07-15 182768]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2010-10-20 411432]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-07-15 1255736]

-----------------EOF-----------------

[Rudy]

Log vypadá čistý. Mám za to, že jde o falešný poplach. Zkuste soubor online otestovat na www.virustotal.com .

[Preach]

File already submitted: The file sent has already been analysed by VirusTotal in the past. This is same basic info regarding the sample itself and its last analysis:

MD5: aeec0405a1c587562275ab20cc6e3521
Date first seen: 2010-05-04 00:51:17 (UTC)
Date last seen: 2010-10-28 07:56:23 (UTC)
Detection ratio: 0/43
What do you wish to do?

Jestliže je to falešný poplach, navrhujete při dalším detekování Avastem, ohlásit poplach jako falešný? ( Ještě poznámka, tento malware naskakuje nezávisle na mém stolním PC a na notebooku co máme vedle v pokoji, počítače nejsou nijak propojený, jenom se střídají v připojení na net, takže společná IP adresa.)

[Rudy]

VT dal jasně na jevo, že se nejedná o virus. Pokud by i po příští aktualizaci hlásil ten soubor jako vir, ozamte to tech podpoře Avastu. Avast občas falešné poplachy mívá.