prosim o pomoc z virtumonde

[ASYRIUS]

tak uz som to nasiel



ComboFix 10-11-26.07 - Administrator . 11. 2010 9:34:18.5.2 - x86 NETWORK
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.3199.2907 [GMT 1:00]
Running from: I:\Download\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\windows\Tasks\AppleSoftwareUpdate.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-2147200963-1801674531-1003Core.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-839522115-2147200963-1801674531-1003UA.job"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\explorer.exe . . . is infected!!

Infected copy of c:\windows\system32\comctl32.dll was found and disinfected
Restored copy from - C:\WINDOWS\ERDNT\cache\comctl32.dll

Infected copy of c:\windows\system32\ctfmon.exe was found and disinfected
Restored copy from - C:\WINDOWS\ERDNT\cache\ctfmon.exe

Infected copy of c:\windows\system32\dllcache\iexplore.exe was found and disinfected
Restored copy from - C:\WINDOWS\VistaMizer\old\iexplore.exe

Infected copy of c:\windows\system32\dllcache\mshtml.dll was found and disinfected
Restored copy from - C:\WINDOWS\VistaMizer\old\mshtml.dll

Infected copy of c:\windows\system32\dllcache\ole32.dll was found and disinfected
Restored copy from - C:\WINDOWS\VistaMizer\old\ole32.dll

Infected copy of c:\windows\system32\dllcache\wininet.dll was found and disinfected
Restored copy from - C:\WINDOWS\VistaMizer\old\wininet.dll

c:\windows\system32\ntkrnlpa.exe . . . is infected!!

c:\windows\system32\ntoskrnl.exe . . . is infected!!

Infected copy of c:\windows\system32\user32.dll was found and disinfected
Restored copy from - C:\WINDOWS\ERDNT\cache\user32.dll

Infected copy of c:\windows\system32\winlogon.exe was found and disinfected
Restored copy from - C:\WINDOWS\ERDNT\cache\winlogon.exe

Infected copy of c:\windows\system32\wuauclt.exe was found and disinfected
Restored copy from - C:\WINDOWS\ERDNT\cache\wuauclt.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ICQ_SERVICE
-------\Service_ICQ Service


((((((((((((((((((((((((( Files Created from 2010-10-27 to 2010-11-27 )))))))))))))))))))))))))))))))
.

2010-11-27 08:29:57 . 2010-11-27 08:30:15 -------- d-----w- C:\Documents and Settings\Administrator
2010-11-26 15:50:01 . 2010-11-27 06:17:30 -------- d-----w- C:\Program Files\Crawler
2010-11-26 12:25:55 . 2009-10-22 11:54:18 37392 ----a-w- C:\WINDOWS\system32\drivers\37939712.sys
2010-11-26 12:25:55 . 2009-10-09 21:31:10 315408 ----a-w- C:\WINDOWS\system32\drivers\3793971.sys
2010-11-26 12:25:55 . 2009-09-25 15:59:42 128016 ----a-w- C:\WINDOWS\system32\drivers\37939711.sys
2010-11-26 07:14:53 . 2010-11-26 07:15:04 -------- d-----w- C:\rsit
2010-11-26 07:06:59 . 2010-11-26 07:14:58 -------- d-----w- C:\Program Files\trend micro
2010-11-26 05:32:22 . 2010-11-26 05:32:22 -------- d-----w- C:\Documents and Settings\user\Application Data\Panda Security
2010-11-26 05:32:00 . 2010-11-26 05:32:00 -------- d-----w- C:\Documents and Settings\user\Application Data\SurfSecret Privacy Suite
2010-11-26 05:31:46 . 2010-11-26 05:31:52 -------- d-----w- C:\Documents and Settings\user\Local Settings\Application Data\panda2_0dn
2010-11-26 05:31:14 . 2010-11-26 05:31:14 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Panda Security
2010-11-26 04:25:26 . 2010-11-26 04:25:52 -------- d-----w- C:\Documents and Settings\user\Local Settings\Application Data\Divinity 2
2010-11-25 18:42:08 . 2010-11-25 18:42:08 -------- d-----w- C:\Documents and Settings\user\Application Data\Runscanner.net
2010-11-20 09:29:39 . 2010-11-20 09:29:39 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Electronic Arts
2010-11-20 09:29:39 . 2010-11-20 09:29:39 -------- d-----w- C:\Documents and Settings\All Users\Application Data\EA Core
2010-11-15 10:20:02 . 2010-11-15 10:20:02 -------- d--h--r- C:\Documents and Settings\user\Application Data\SecuROM
2010-11-14 14:24:14 . 2010-11-14 14:24:14 -------- d-----w- C:\Documents and Settings\user\Local Settings\Application Data\Two Worlds II
2010-11-14 11:05:10 . 2010-11-14 11:05:10 -------- d-----w- C:\Program Files\Mozilla Firefox 4.0
2010-11-09 19:26:08 . 2010-11-09 19:26:08 -------- d-----w- C:\Program Files\Common Files\Skype
2010-11-09 19:26:01 . 2010-11-09 19:26:08 -------- d-----r- C:\Program Files\Skype
2010-11-07 09:49:08 . 2010-11-07 09:49:08 -------- d-----w- C:\Program Files\Common Files\DirectX
2010-11-07 09:43:58 . 2010-11-07 09:43:58 -------- d-----w- C:\WINDOWS\B83FC356B7C0441F8A4DD71E088E7974.TMP
2010-11-07 09:19:00 . 2010-11-07 09:19:00 60416 ----a-w- C:\WINDOWS\ALCFDRTM.EXE
2010-11-07 09:18:59 . 2010-11-22 17:43:55 60416 ----a-w- C:\WINDOWS\ALCFDRTM.VER
2010-11-07 09:18:58 . 2010-11-07 09:18:58 -------- d-----w- C:\WINDOWS\system32\Lang
2010-10-30 11:29:38 . 2010-10-30 11:29:38 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Apple Computer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 09:41:44 . 2010-09-29 04:50:46 222080 ------w- C:\WINDOWS\system32\MpSigStub.exe
2010-09-15 02:50:37 . 2010-09-01 13:50:07 472808 ----a-w- C:\WINDOWS\system32\deployJava1.dll
2010-09-15 00:29:49 . 2010-09-01 13:50:07 73728 ----a-w- C:\WINDOWS\system32\javacpl.cpl
2010-09-08 09:17:46 . 2010-09-08 09:17:46 94208 ----a-w- C:\WINDOWS\system32\QuickTimeVR.qtx
2010-09-08 09:17:46 . 2010-09-08 09:17:46 69632 ----a-w- C:\WINDOWS\system32\QuickTime.qts
2010-09-07 15:12:17 . 2010-08-26 11:56:30 38848 ----a-w- C:\WINDOWS\avastSS.scr
2010-09-07 15:11:54 . 2010-08-26 11:56:29 167592 ----a-w- C:\WINDOWS\system32\aswBoot.exe
2010-09-07 14:52:25 . 2010-08-26 11:56:42 46672 ----a-w- C:\WINDOWS\system32\drivers\aswTdi.sys
2010-09-07 14:52:03 . 2010-08-26 11:56:44 165584 ----a-w- C:\WINDOWS\system32\drivers\aswSP.sys
2010-09-07 14:47:46 . 2010-08-26 11:56:43 23376 ----a-w- C:\WINDOWS\system32\drivers\aswRdr.sys
2010-09-07 14:47:19 . 2010-08-26 11:56:40 100176 ----a-w- C:\WINDOWS\system32\drivers\aswmon2.sys
2010-09-07 14:47:16 . 2010-08-26 11:56:40 94544 ----a-w- C:\WINDOWS\system32\drivers\aswmon.sys
2010-09-07 14:47:07 . 2010-08-26 11:56:44 17744 ----a-w- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2010-09-07 14:46:51 . 2010-08-26 11:56:40 28880 ----a-w- C:\WINDOWS\system32\drivers\aavmker4.sys
2010-09-02 12:31:26 . 2010-09-02 12:31:26 444952 ----a-w- C:\WINDOWS\system32\wrap_oal.dll
2010-09-02 12:31:26 . 2010-09-02 12:31:26 109080 ----a-w- C:\WINDOWS\system32\OpenAL32.dll
2010-09-01 07:26:45 . 2010-09-01 07:13:18 505128 ----a-w- C:\WINDOWS\system32\msvcp71.dll
2010-09-01 07:26:45 . 2010-09-01 07:13:18 353576 ----a-w- C:\WINDOWS\system32\msvcr71.dll
2010-09-01 07:26:45 . 2010-09-01 07:13:18 29480 ----a-w- C:\WINDOWS\system32\msxml3a.dll
2010-09-01 06:58:55 . 2010-09-01 06:58:55 691696 ----a-w- C:\WINDOWS\system32\drivers\sptd.sys
2010-08-30 08:54:56 . 2010-08-30 08:54:56 47360 ----a-w- C:\WINDOWS\system32\drivers\pcouffin.sys
2010-08-30 08:54:56 . 2010-08-30 08:54:56 47360 ----a-w- C:\Documents and Settings\user\Application Data\pcouffin.sys
.

------- Sigcheck -------

[-] 2009-03-08 02:41:16 . F957DD818054F2B324209F43FC2EC27C . 6161408 . . [8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)] . . C:\WINDOWS\system32\mshtml.dll
[7] 2009-03-08 02:41:16 . D469A0EBA2EF5C6BEE8065B7E3196E5E . 5937152 . . [8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)] . . C:\WINDOWS\system32\dllcache\mshtml.dll
[7] 2009-03-08 02:41:16 . D469A0EBA2EF5C6BEE8065B7E3196E5E . 5937152 . . [8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)] . . C:\WINDOWS\VistaMizer\old\mshtml.dll
[7] 2008-04-14 03:42:00 . A706E122B398FE1AB85CB9B75D044223 . 3066880 . . [6.00.2900.5512 (xpsp.080413-2105)] . . C:\WINDOWS\ie8\mshtml.dll

[-] 2009-03-08 02:34:58 . 2868B8B04547CAF8B5E6024CAC3DF0FD . 1016320 . . [8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)] . . C:\WINDOWS\system32\wininet.dll
[7] 2009-03-08 02:34:58 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)] . . C:\WINDOWS\system32\dllcache\wininet.dll
[7] 2009-03-08 02:34:58 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)] . . C:\WINDOWS\VistaMizer\old\wininet.dll
[7] 2008-04-14 03:42:10 . 7A4F775ABB2F1C97DEF3E73AFA2FAEDD . 666112 . . [6.00.2900.5512 (xpsp.080413-2105)] . . C:\WINDOWS\ie8\wininet.dll

[-] 2008-04-14 03:42:04 . BD604DB0B7FF60CCC578DF54C5563E80 . 1312256 . . [5.1.2600.5512 (xpsp.080413-2108)] . . C:\WINDOWS\system32\ole32.dll
[7] 2008-04-14 03:42:04 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512 (xpsp.080413-2108)] . . C:\WINDOWS\system32\dllcache\ole32.dll
[7] 2008-04-14 03:42:04 . ECCE74BC6168375016450A86A164D976 . 1287168 . . [5.1.2600.5512 (xpsp.080413-2108)] . . C:\WINDOWS\VistaMizer\old\ole32.dll

[-] 2008-04-14 03:51:44 . C8E7AEEEF81D5FE655CCF69E8217BEB3 . 2280960 . . [5.1.2600.5512 (xpsp.080413-2111)] . . C:\WINDOWS\system32\ntkrnlpa.exe
[7] 2008-04-14 03:51:44 . 7F653A89F6E89E3AE0D49830EECE35D4 . 2023936 . . [5.1.2600.5512 (xpsp.080413-2111)] . . C:\WINDOWS\VistaMizer\old\ntkrnlpa.exe

[7] 2009-03-08 12:09:26 . B60DDDD2D63CE41CB8C487FCFBB6419E . 638816 . . [8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)] . . C:\WINDOWS\system32\dllcache\iexplore.exe
[7] 2009-03-08 12:09:26 . B60DDDD2D63CE41CB8C487FCFBB6419E . 638816 . . [8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)] . . C:\WINDOWS\VistaMizer\old\iexplore.exe
[7] 2008-04-14 03:42:24 . 55794B97A7FAABD2910873C85274F409 . 93184 . . [6.00.2900.5512 (xpsp.080413-2105)] . . C:\WINDOWS\ie8\iexplore.exe

[-] 2008-04-13 22:54:38 . F129FB11F0871750888AEBC3F7B3CE7D . 2402304 . . [5.1.2600.5512 (xpsp.080413-2111)] . . C:\WINDOWS\system32\ntoskrnl.exe
[7] 2008-04-13 22:54:38 . 40F8880122A030A7E9E1FEDEA833B33D . 2145280 . . [5.1.2600.5512 (xpsp.080413-2111)] . . C:\WINDOWS\VistaMizer\old\ntoskrnl.exe
.
((((((((((((((((((((((((((((( SnapShot@2010-11-26_11.58.15 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-11-27 08:37:21 . 2010-11-27 08:37:21 16384 C:\WINDOWS\temp\Perflib_Perfdata_66c.dat
+ 2008-04-14 03:42:18 . 2008-04-14 03:42:18 15360 C:\WINDOWS\system32\ctfmon.exe
+ 2008-04-14 03:42:40 . 2008-04-14 03:42:40 507904 C:\WINDOWS\system32\winlogon.exe
+ 2008-04-14 03:42:10 . 2008-04-14 03:42:10 578560 C:\WINDOWS\system32\user32.dll
+ 2008-04-14 03:41:52 . 2008-04-14 03:42:52 1054208 C:\WINDOWS\system32\comctl32.dll
+ 2008-04-14 03:42:20 . 2008-04-14 03:42:20 1033728 C:\WINDOWS\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 03:42:18 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 03:42:52 577536]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 12:01:00 13529088]
"nwiz"="nwiz.exe" [2008-05-16 12:01:00 1630208]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 12:01:00 86016]
"OODefragTray"="C:\Program Files\OO Software\Defrag\oodtray.exe" [2010-05-11 20:35:58 2528584]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 03:42:42 110592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 03:42:18 15360]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 23:01:00 437160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-03-08 02:32:48 128512]

C:\Documents and Settings\user\Start Menu\Programs\Startup\
setup_9.0.0.722_26.11.2010_14-14.lnk - C:\Documents and Settings\user\Desktop\Virus Removal Tool\setup_9.0.0.722_26.11.2010_14-14\startup.exe [2010-11-26 72208]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-11 73728]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"C:\\Program Files\\ICQ7.2\\ICQ.exe"=
"C:\\Program Files\\ICQ7.2\\aolload.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"C:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 37939712;37939712 Boot Guard Driver;C:\WINDOWS\system32\drivers\37939712.sys [26.11.2010 13:25:55 37392]
R0 sptd;sptd;C:\WINDOWS\system32\drivers\sptd.sys [1.9.2010 7:58:55 691696]
R1 37939711;37939711;C:\WINDOWS\system32\drivers\37939711.sys [26.11.2010 13:25:55 128016]
R1 aswSP;aswSP;C:\WINDOWS\system32\drivers\aswSP.sys [26.8.2010 12:56:44 165584]
R1 setup_9.0.0.722_26.11.2010_14-14drv;setup_9.0.0.722_26.11.2010_14-14drv;C:\WINDOWS\system32\drivers\3793971.sys [26.11.2010 13:25:55 315408]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};C:\Program Files\CyberLink\PowerDVD8\000.fcl [7.10.2008 19:31:38 61424]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\drivers\aswFsBlk.sys [26.8.2010 12:56:44 17744]
R2 OODefragAgent;O&O Defrag Agent;C:\Program Files\OO Software\Defrag\oodag.exe [11.5.2010 21:36:10 1619272]
S2 ATE_PROCMON;ATE_PROCMON;\??\C:\Program Files\Anti Trojan Elite\ATEPMon.sys --> C:\Program Files\Anti Trojan Elite\ATEPMon.sys [?]
.
.
------- Supplementary Scan -------
.
IE: Crawler Search - tbr:iemenu
IE: E&xportovať do programu Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll
FF - ProfilePath -
.

[ASYRIUS]

.

[ASYRIUS]

uz 2x som to sem posielal a nikde to nevidim

[ASYRIUS]

prepacte pisem to z notebooku ktori ma ten isty virus a dost mi to blbne

[vyosek]

Odpojte ten ntb ze site, jelikoz se muze infekce prenaset...

Mate instalacni CD, vypada to, ze je system velmi naboreny

[ASYRIUS]

notebook mam napojeny na druhu siet aby som nieco nechytil,takze pocitac by som mal preinstalovat,tak velmi pekne vam dakujem za pomoc a a vsetkym co sa tu angazovali a zelam pekny den

[vyosek]

Staci provest opravnou instalaci, ta prepise jen systemove soubory, ale o data neprijdete...