divné chování PC viz podrobnsti

[Yoshua]

ComboFix 10-11-13.01 - Jan Holík 15.11.2010 18:03:54.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2558.2228 [GMT 1:00]
Spuštěný z: c:\documents and settings\Jan Holík\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Jan Holík\Plocha\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_mailKmd


((((((((((((((((((((((((( Soubory vytvořené od 2010-10-15 do 2010-11-15 )))))))))))))))))))))))))))))))
.

2010-11-14 17:48 . 2010-11-14 17:48 -------- d-----w- c:\documents and settings\Jan Holík\Data aplikací\Malwarebytes
2010-11-14 17:48 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-14 17:48 . 2010-11-14 17:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-14 17:48 . 2010-11-14 17:48 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2010-11-14 17:48 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-14 16:47 . 2010-11-14 21:32 -------- d-----w- C:\QIP Infium bz™Pack
2010-11-14 11:36 . 2010-11-14 11:36 -------- d-----w- c:\program files\trend micro
2010-11-14 11:36 . 2010-11-14 11:36 -------- d-----w- C:\rsit
2010-11-13 21:46 . 2010-11-13 22:37 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-11-13 21:46 . 2010-11-13 22:37 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2010-11-03 16:43 . 2009-02-13 19:02 11520 ----a-r- c:\windows\system32\drivers\wdcsam.sys
2010-11-01 20:06 . 2010-11-01 20:08 -------- d-----w- c:\program files\ConBuilder
2010-10-28 12:01 . 2010-10-28 12:01 -------- d-----w- c:\windows\system32\XPSViewer
2010-10-28 12:01 . 2010-10-28 12:01 -------- d-----w- c:\program files\MSBuild
2010-10-28 12:00 . 2010-10-28 12:00 -------- d-----w- c:\program files\Reference Assemblies
2010-10-28 12:00 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-10-28 12:00 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-10-28 12:00 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-10-28 12:00 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-10-28 12:00 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2010-10-28 12:00 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-10-28 12:00 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-10-28 12:00 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-10-28 12:00 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-10-28 11:47 . 2010-10-28 11:47 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Canneverbe Limited
2010-10-28 11:46 . 2010-10-28 11:47 -------- d-----w- C:\cdBurnerXp
2010-10-28 11:13 . 2010-10-28 11:13 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Apple Computer
2010-10-28 11:13 . 2010-03-17 20:53 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-10-28 11:13 . 2010-03-17 20:53 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-10-28 11:13 . 2010-03-17 20:53 180224 ----a-w- c:\windows\system32\QTCF.dll
2010-10-28 11:13 . 2010-10-28 11:14 -------- d-----w- c:\program files\QuickTime Alternative
2010-10-25 18:07 . 2010-10-25 18:07 -------- d-----w- c:\documents and settings\Jan Holík\Data aplikací\Sync App Settings
2010-10-25 18:07 . 2010-10-25 18:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Sync App Settings
2010-10-25 18:07 . 2010-10-25 18:07 -------- d-----w- c:\program files\Allway Sync
2010-10-25 17:52 . 2010-10-25 18:05 -------- d-----w- c:\documents and settings\Jan Holík\Data aplikací\Western Digital
2010-10-25 17:52 . 2010-10-25 17:52 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Western Digital
2010-10-25 17:52 . 2010-10-25 17:52 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\ServiceTest
2010-10-21 16:06 . 2010-03-15 09:31 165376 ----a-w- c:\windows\system32\unrar.dll
2010-10-21 16:06 . 2010-01-17 15:18 151552 ----a-w- c:\windows\system32\ac3acm.acm
2010-10-21 16:06 . 2006-10-18 18:05 232448 ----a-w- c:\windows\system32\mp3fhg.acm
2010-10-21 16:06 . 2010-10-18 08:00 108032 ----a-w- c:\windows\system32\ff_vfw.dll
2010-10-21 16:06 . 2010-06-08 16:10 790528 ----a-w- c:\windows\system32\xvidcore.dll
2010-10-21 16:06 . 2010-06-08 16:10 134144 ----a-w- c:\windows\system32\xvidvfw.dll
2010-10-21 16:06 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2010-10-19 20:06 . 2010-10-19 20:06 -------- d-----w- c:\program files\Kodek CZ
2010-10-19 19:13 . 2007-06-11 12:25 41856 ----a-w- c:\windows\system32\drivers\tosrfusb.sys
2010-10-19 19:13 . 2007-04-24 11:20 113920 ----a-w- c:\windows\system32\drivers\tosrfbd.sys
2010-10-19 19:13 . 2007-03-01 14:53 73728 ----a-w- c:\windows\system32\drivers\Tosrfhid.sys
2010-10-19 19:13 . 2007-01-22 08:43 53376 ----a-w- c:\windows\system32\drivers\TosRfSnd.sys
2010-10-19 19:13 . 2006-11-20 15:55 36480 ----a-w- c:\windows\system32\drivers\tosrfbnp.sys
2010-10-19 19:13 . 2005-01-07 03:42 18612 ----a-w- c:\windows\system32\drivers\tosrfnds.sys
2010-10-19 19:13 . 2007-05-24 12:27 64000 ----a-w- c:\windows\system32\drivers\tosrfcom.sys
2010-10-19 19:13 . 2006-10-10 17:33 41600 ----a-w- c:\windows\system32\drivers\tosporte.sys
2010-10-19 19:12 . 2010-10-19 19:12 -------- d-----w- c:\program files\Toshiba
2010-10-19 19:03 . 2010-10-19 19:03 -------- d-----w- c:\documents and settings\Jan Holík\Data aplikací\TOSHIBA
2010-10-19 18:59 . 2008-04-14 06:52 152064 -c--a-w- c:\windows\system32\dllcache\irftp.exe
2010-10-19 18:59 . 2008-04-14 06:52 152064 ----a-w- c:\windows\system32\irftp.exe
2010-10-19 18:59 . 2008-04-14 06:52 8192 -c--a-w- c:\windows\system32\dllcache\wshirda.dll
2010-10-19 18:59 . 2008-04-14 06:52 8192 ----a-w- c:\windows\system32\wshirda.dll
2010-10-19 18:59 . 2008-04-14 06:51 27648 -c--a-w- c:\windows\system32\dllcache\irmon.dll
2010-10-19 18:59 . 2008-04-14 06:51 27648 ----a-w- c:\windows\system32\irmon.dll
2010-10-17 12:29 . 2010-10-17 12:29 -------- d-----w- c:\program files\IrfanView

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-06 16:58 . 2010-10-06 16:58 737280 ----a-w- c:\windows\iun6002.exe
2010-09-18 14:25 . 2010-09-18 14:25 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-09-18 14:25 . 2010-09-18 14:25 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-18 14:05 . 2010-09-18 14:05 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-09-07 15:12 . 2010-09-18 13:56 38848 ----a-w- c:\windows\avastSS.scr
2010-09-07 15:11 . 2010-09-18 13:56 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-07 14:52 . 2010-09-18 13:56 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-07 14:52 . 2010-09-18 13:56 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-07 14:47 . 2010-09-18 13:56 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-07 14:47 . 2010-09-18 13:56 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-07 14:47 . 2010-09-18 13:56 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-07 14:47 . 2010-09-18 13:56 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-07 14:46 . 2010-09-18 13:56 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-11-14_15.33.41 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-11-15 17:09 . 2010-11-15 17:09 16384 c:\windows\Temp\Perflib_Perfdata_870.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gmail Notifier.exe"="c:\program files\Gmail Notifier\Gmail Notifier.exe" [2010-10-03 2155520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-16 8495104]
"nwiz"="nwiz.exe" [2007-11-16 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-16 81920]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-22 16236032]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"avast5"="c:\program files\Avast5\avastUI.exe" [2010-09-07 2838912]
"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2005-07-25 32768]
"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2006-12-14 192512]
"LMgrVolOSD"="c:\program files\Launch Manager\OSD.exe" [2006-12-26 180224]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-08-28 1557800]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [BU]
"Wbutton"="c:\program files\Launch Manager\WButton.exe" [BU]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^Jan Holík^Nabídka Start^Programy^Po spuštění^OpenOffice.org 3.2.lnk]
path=c:\documents and settings\Jan Holík\Nabídka Start\Programy\Po spuštění\OpenOffice.org 3.2.lnk
backup=c:\windows\pss\OpenOffice.org 3.2.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KONICA MINOLTA PagePro 1350WStatusDisplay]
2004-11-26 16:21 167936 ----a-w- c:\windows\system32\MSTMON_Q.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Age of Empires II\\empires2.exe"=
"c:\\Program Files\\Age of Empires II\\age2_x1.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Program Files\\Mozilla Firefox 4.0 Beta 6\\plugin-container.exe"=
"d:\\hry\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"d:\\hry\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [18.9.2010 15:05 691696]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [18.9.2010 14:56 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [18.9.2010 14:56 17744]
R3 WisLMSvc;WisLMSvc;c:\program files\Launch Manager\WisLMSvc.exe [18.9.2010 15:12 118784]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [21.9.2010 16:23 136176]
S2 MLPTDR_Q;MLPTDR_Q;c:\windows\system32\MLPTDR_Q.SYS [22.7.2003 15:44 18848]
S3 flash;flash;c:\windows\system32\drivers\flash.sys [18.9.2010 15:26 8064]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [3.11.2010 17:43 11520]
.
Obsah adresáře 'Naplánované úlohy'

2010-11-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-21 15:23]

2010-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-21 15:23]
.
.
------- Doplňkový sken -------
.
uStart Page = https://www.mojebanka.cz/InternetBanking/?L=CS
IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: {{67F44070-BF30-43D7-BD5B-71237E821170} - c:\program files\FreshDevices\FreshDownload\fd.exe
FF - ProfilePath - c:\documents and settings\Jan Holík\Data aplikací\Mozilla\Firefox\Profiles\bgyd3rvu.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-15 18:09
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CtrlVol = c:\program files\Launch Manager\CtrlVol.exe?x???0???\???????0??????????? ??|???|???????|????????L???????XO????F?????????????h?????????????B????? ??|`??|????]??|[?A?????????z?A???H???7~??????F?4^@???????????????A?????????z?A???@?HO??6u@?HO????H???@?XO?????
Wbutton = c:\program files\Launch Manager\WButton.exe?x???0???\???????0??????????? ??|???|???????|????????L???????XO????F?????????????h?????????????B????? ??|`??|????]??|[?A?????????z?A???H???7~??????F?4^@???????????????A?????????z?A???@?HO??6u@?HO????H???@?XO?????

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(4052)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Avast5\AvastSvc.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
c:\windows\system32\rundll32.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\tcpsvcs.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2010-11-15 18:12:16 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-11-15 17:12
ComboFix2.txt 2010-11-14 15:34

Před spuštěním: 6 259 240 960
Po spuštění: 6 195 564 544

- - End Of File - - A92ECB4DE40C58DCD01D2C823C5A981D


Pořád stejné...

[motji]

Co s Vámi

odinstalujte všechny virtuální jednotky (Daemon nebo alcohol)

Stáhněte SPTD http://www.duplexsecure.com/en/downloads
-vyberte verzi podle svého operačního systému. SPTD for Windows (32 bit) nebo (64b)
-uložte na plochu a spusťte
- zvolte možnost Uninstall
- restart PC


Stahněte http://www.jpshortstuff.247fixes.com/Defogger.exe
- spustte,
- potvrdte disabled
-log vložte zde



Stáhněte Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878
- rozbalte a spusťte
-proběhne sken, po skončení se otevře okno s výsledky, kliknete na Save a tím si uložíte log,který sem vložíte

-Podle návodu v odkazu proveďte druhý sken a log sem také vložte.

stáhněte MBR
http://www2.gmer.net/mbr/mbr.exe
-uložte ho na plochu


start-spustit
do okénka zkopírujte

Kód: Vybrat vše

"%userprofile%\plocha\mbr" -t

ok

vytvoří se log s názvem mbr.log, vložte ho zde [/quote]

[Yoshua]

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit quick scan 2010-11-16 19:45:35
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD16 rev.04.0
Running: gmer.exe; Driver: C:\DOCUME~1\JANHOL~1\LOCALS~1\Temp\kxtdqpow.sys


---- System - GMER 1.0.15 ----

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0xB2D63BAE]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateSection [0xB2D639D2]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwLoadDriver [0xB2D63B0C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 wdf01000.sys (Kernel Mode Driver Framework Runtime/Microsoft Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 wdf01000.sys (Kernel Mode Driver Framework Runtime/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-11-16 20:53:52
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD16 rev.04.0
Running: gmer.exe; Driver: C:\DOCUME~1\JANHOL~1\LOCALS~1\Temp\kxtdqpow.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwClose [0xB2D56CF0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateKey [0xB2D56BAC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwDeleteKey [0xB2D57160]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwDeleteValueKey [0xB2D5708A]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwDuplicateObject [0xB2D56782]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwOpenKey [0xB2D56C86]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwOpenProcess [0xB2D566C2]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwOpenThread [0xB2D56726]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwQueryValueKey [0xB2D56DA6]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRenameKey [0xB2D5722E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRestoreKey [0xB2D56D66]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwSetValueKey [0xB2D56EE6]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0xB2D63BAE]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateSection [0xB2D639D2]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwLoadDriver [0xB2D63B0C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject

---- Kernel code sections - GMER 1.0.15 ----

PAGE ntoskrnl.exe!ObInsertObject 8056DA64 5 Bytes JMP B2D60FFA \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntoskrnl.exe!NtCreateSection 8056DB66 7 Bytes JMP B2D639D6 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntoskrnl.exe!ZwCreateProcessEx 8059056D 7 Bytes JMP B2D63BB2 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntoskrnl.exe!ZwLoadDriver 805AEDE2 7 Bytes JMP B2D63B10 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntoskrnl.exe!ObMakeTemporaryObject 805E74E6 5 Bytes JMP B2D5F5D4 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB85A2360, 0x30A247, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Avast5\AvastSvc.exe[1892] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 4 Bytes [C2, 04, 00, 90] {RET 0x4; NOP }
.text C:\Program Files\Mozilla Firefox 4.0 Beta 6\firefox.exe[1996] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 00401430 C:\Program Files\Mozilla Firefox 4.0 Beta 6\firefox.exe (Firefox/Mozilla Corporation)
.text C:\Program Files\Mozilla Firefox 4.0 Beta 6\plugin-container.exe[3920] USER32.dll!SetWindowLongA 7E37C29D 5 Bytes JMP 1066CF00 C:\Program Files\Mozilla Firefox 4.0 Beta 6\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox 4.0 Beta 6\plugin-container.exe[3920] USER32.dll!SetWindowLongW 7E37C2BB 5 Bytes JMP 1066CEA0 C:\Program Files\Mozilla Firefox 4.0 Beta 6\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox 4.0 Beta 6\plugin-container.exe[3920] USER32.dll!TrackPopupMenu 7E3B531E 5 Bytes JMP 104D1695 C:\Program Files\Mozilla Firefox 4.0 Beta 6\xul.dll (Mozilla Foundation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\services.exe[1220] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 003D0002
IAT C:\WINDOWS\system32\services.exe[1220] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 003D0000

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 wdf01000.sys (Kernel Mode Driver Framework Runtime/Microsoft Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 wdf01000.sys (Kernel Mode Driver Framework Runtime/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001641dc98d8
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001641dc98d8@347e3966c64a 0x0C 0xA3 0x7B 0xC9 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xFD 0x6A 0x71 0xF1 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x33 0x3D 0x37 0xA5 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x99 0x71 0x77 0x5D ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x2F 0x70 0x6A 0xDD ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001641dc98d8 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001641dc98d8@347e3966c64a 0x0C 0xA3 0x7B 0xC9 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xFD 0x6A 0x71 0xF1 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x33 0x3D 0x37 0xA5 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x99 0x71 0x77 0x5D ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x2F 0x70 0x6A 0xDD ...

---- EOF - GMER 1.0.15 ----

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD16 rev.04.0 -> Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll iaStor.sys
C:\WINDOWS\system32\drivers\iaStor.sys Intel Corporation Intel Matrix Storage Manager driver
1 nt!IofCallDriver[0x804E13B9] -> \Device\Harddisk0\DR0[0x89E5DAB8]
3 CLASSPNP[0xF7637FD7] -> nt!IofCallDriver[0x804E13B9] -> \Device\00000081[0x89E57A28]
5 ACPI[0xF75AE620] -> nt!IofCallDriver[0x804E13B9] -> \Device\Ide\IAAStorageDevice-0[0x89EAD030]
kernel: MBR read successfully
user & kernel MBR OK

ten první mi žádný log nevyplivl

[motji]

Já nikde nic prostě nevidím , jedině že by jste měl nějak poškozené windows. Nebo nemůže Vám to dělat myš?

[Yoshua]

Vůbec netuším. Windows po přeinstalování chodiy v pohodě, tohle se začlo dít až po čase. Zajímavé ale je, že se to stalo už několikrát za sebou. Myš bych vyloučil. To asi nemá vliv na vynechávání písmenek a otvírání oken na pozadí apod. Každopádně vám děkuji. Asi to budu muset řešit nějak jinak...

[motji]

Je to divný

Stáhněte Bootkit Remover http://www.esagelab.com/files/bootkit_remover.rar
-uložte ho na plochu a spusťte
- pravým tlačítkem myši klikněte do černého okna, zvolte Vybrat vše, stiskněte CTRL+C a pak zde na foru CTRL+V.



Ještě můžeme zkusit prověřit disk, zda není chyba v něm
Stahněte HD tune http://www.slunecnice.cz/sw/hd-tune/
-zvolete poslední záložku Error scan
-dejte skenovat, trvá to kolem hodiny.
-pak napište jestli jste měl nějaká políčka červená

[Yoshua]

Nevím. Ten první program mi vyplivne okno v příkazovém řádku a jediná možnost je Press any key to exit.

A ten HD tester - všechny čtverečky zelené.

Zkusím ještě to s tou USB klávesnicí, ale rozeberu NTB a odpojím tu stávající. Tak uvidíme...

[motji]

A ten prvné program Vám něco vypíše v tom černé=m okénku? Jestli ano, dejte prosím screen.

[Yoshua]

[motji]

Máte jen jeden disk, jeden oddíl, nepoužíváte žádné kodovám disku, a podobně?

arrow: stáhněte MBR
http://www2.gmer.net/mbr/mbr.exe
-uložte ho na plochu a spusťte
-vytvoří se log s názvem mbr.log, vložte ho zde

[Yoshua]

Používm 1 disk, rozdělený na 2 oddíly. Nic víc, nic míň.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD16 rev.04.0 -> Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

[motji]

A jen jeden systém?

[Yoshua]

Ovšem. Disk se dvěma oddíly, na jednom systém a na druhém data...Tento způsob používám už dlouho.

[motji]

Nabootujte z inst. cd do konzoli zotavení a udělejte příkaz fixmbr

http://viry.cz/forum/viewtopic.php?f=11&t=7294