Mebroot v operační paměti.

Zpráva

Zakov · #1 Příspěvek od **Zakov** » 11 Bře 2011 11:42

Eset mi hlasi v operacni pameti win32/ Mebroot. Kontrola pomoci NOD32 ho nikde jinde neukaze. Zkusil jsem pustit combofix. Nepomohlo. Log z MBR je cisty...
Prikladam log z RSIT:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Karel at 2011-03-11 11:38:32
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 102 GB (68%) free of 150 GB
Total RAM: 1023 MB (38% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:38:38, on 11.3.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Documents and Settings\Karel\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Karel\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\Karel.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Karel\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Rychlý začátek s aplikací HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 6304800687
O16 - DPF: {93B08541-9F6B-4697-9F9A-7058F1E33785} (NTR ActiveX 1.1.8.2) - http://213.226.254.58/inquiero/mod/setu ... ex1182.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ESET HTTP Server (EHttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O24 - Desktop Component 0: (no name) - (no file)

--
End of file - 6923 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-01-30 62376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Plug-In - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-11-22 1242504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-01-30 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-01-30 79648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-12-19 16062464]
"SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-05-16 2879488]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-03-11 49152]
"snp2std"=C:\WINDOWS\vsnp2std.exe [2005-11-16 344064]
"RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2004-11-02 32768]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-11-15 932288]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2011-01-12 2219184]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Documents and Settings\Karel\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2011-01-30 136176]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Rychlý začátek s aplikací HP Photosmart Premier.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2010-06-22 159744]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Java\jre6\launch4j-tmp\frd.exe"="C:\Program Files\Java\jre6\launch4j-tmp\frd.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Google\Google Earth\client\googleearth.exe"="C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2011-03-11 11:38:33 ----D---- C:\Program Files\trend micro
2011-03-11 11:38:32 ----D---- C:\rsit
2011-03-11 11:37:09 ----HDC---- C:\WINDOWS\$NtUninstallKB2479943$
2011-03-11 11:35:30 ----HDC---- C:\WINDOWS\$NtUninstallKB2481109$
2011-03-11 11:35:03 ----D---- C:\WINDOWS\LastGood
2011-03-10 20:31:22 ----SHD---- C:\RECYCLER
2011-03-01 21:19:49 ----SHD---- C:\$RECYCLE.BIN
2011-02-28 22:50:41 ----A---- C:\WINDOWS\ntbtlog.txt
2011-02-28 22:34:27 ----A---- C:\ComboFix.txt
2011-02-28 22:11:15 ----A---- C:\WINDOWS\zip.exe
2011-02-28 22:11:15 ----A---- C:\WINDOWS\SWXCACLS.exe
2011-02-28 22:11:15 ----A---- C:\WINDOWS\SWSC.exe
2011-02-28 22:11:15 ----A---- C:\WINDOWS\SWREG.exe
2011-02-28 22:11:15 ----A---- C:\WINDOWS\sed.exe
2011-02-28 22:11:15 ----A---- C:\WINDOWS\PEV.exe
2011-02-28 22:11:15 ----A---- C:\WINDOWS\NIRCMD.exe
2011-02-28 22:11:15 ----A---- C:\WINDOWS\MBR.exe
2011-02-28 22:11:15 ----A---- C:\WINDOWS\grep.exe
2011-02-28 22:11:11 ----D---- C:\WINDOWS\ERDNT
2011-02-28 22:08:06 ----D---- C:\Qoobox
2011-02-28 20:56:36 ----A---- C:\WINDOWS\system32\drivers\kbdhid.sys
2011-02-27 15:09:25 ----D---- C:\Documents and Settings\Karel\Data aplikací\ESET
2011-02-27 14:54:06 ----D---- C:\Program Files\ESET
2011-02-27 14:54:06 ----D---- C:\Documents and Settings\All Users\Data aplikací\ESET
2011-02-23 07:31:01 ----HDC---- C:\WINDOWS\$NtUninstallKB971029$
2011-02-15 18:11:36 ----D---- C:\Documents and Settings\Karel\Data aplikací\ntr
2011-02-13 16:08:56 ----D---- C:\Program Files\Screamer Radio
2011-02-13 15:41:10 ----A---- C:\WINDOWS\system32\drivers\AtiHdmi.sys
2011-02-13 15:40:41 ----A---- C:\WINDOWS\system32\ATIDEMGX.dll
2011-02-13 15:40:39 ----A---- C:\WINDOWS\system32\atiiiexx.dll
2011-02-13 15:39:50 ----D---- C:\Program Files\ATI Technologies

======List of files/folders modified in the last 1 months======

2011-03-11 11:38:33 ----RD---- C:\Program Files
2011-03-11 11:38:33 ----D---- C:\WINDOWS\Temp
2011-03-11 11:37:12 ----HD---- C:\WINDOWS\inf
2011-03-11 11:37:12 ----D---- C:\WINDOWS\Prefetch
2011-03-11 11:37:11 ----D---- C:\WINDOWS
2011-03-11 11:37:10 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-03-11 11:37:10 ----D---- C:\WINDOWS\system32
2011-03-11 11:35:47 ----D---- C:\WINDOWS\Debug
2011-03-11 11:35:44 ----A---- C:\WINDOWS\system32\MRT.exe
2011-03-11 11:35:40 ----A---- C:\WINDOWS\imsins.BAK
2011-03-11 11:34:28 ----D---- C:\Program Files\Mozilla Firefox
2011-03-11 11:34:03 ----D---- C:\Config.Msi
2011-03-11 11:33:51 ----SHD---- C:\WINDOWS\Installer
2011-03-11 11:30:11 ----D---- C:\WINDOWS\system32\CatRoot2
2011-03-10 20:36:45 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-03-10 20:21:25 ----HD---- C:\WINDOWS\$hf_mig$
2011-03-10 20:11:26 ----D---- C:\WINDOWS\system32\drivers
2011-02-28 22:33:57 ----SD---- C:\WINDOWS\Tasks
2011-02-28 22:29:39 ----A---- C:\WINDOWS\system.ini
2011-02-28 22:29:30 ----D---- C:\WINDOWS\system32\drivers\etc
2011-02-28 22:26:03 ----D---- C:\WINDOWS\AppPatch
2011-02-28 22:26:02 ----D---- C:\Program Files\Common Files
2011-02-27 14:50:32 ----D---- C:\Documents and Settings\All Users\Data aplikací\Alwil Software
2011-02-27 14:28:45 ----D---- C:\Program Files\JDownloader
2011-02-24 14:19:46 ----A---- C:\WINDOWS\NeroDigital.ini
2011-02-18 17:29:06 ----D---- C:\Documents and Settings\Karel\Data aplikací\Skype
2011-02-18 16:05:01 ----D---- C:\Documents and Settings\Karel\Data aplikací\skypePM
2011-02-17 11:19:09 ----D---- C:\FreeRapid-0.85-build555
2011-02-15 18:11:36 ----SD---- C:\WINDOWS\Downloaded Program Files
2011-02-15 13:04:18 ----D---- C:\Documents and Settings\Karel\Data aplikací\Vso
2011-02-13 16:02:37 ----HD---- C:\Program Files\InstallShield Installation Information
2011-02-13 15:41:10 ----DC---- C:\WINDOWS\system32\DRVSTORE
2011-02-13 15:36:31 ----D---- C:\Program Files\ATI
2011-02-13 07:46:21 ----D---- C:\WINDOWS\Minidump

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\WINDOWS\system32\drivers\iaStor.sys [2005-03-09 870912]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI Texas Instruments; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-14 61696]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2005-08-19 46080]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-12-21 115008]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2010-08-03 55256]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-12-21 141264]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2010-12-21 134000]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2010-06-23 5068288]
R3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\AtiHdmi.sys [2010-05-17 101904]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2010-12-21 33120]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-12-21 4405248]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2011-01-29 5810]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2011-01-30 47360]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2005-02-01 229888]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2007-03-08 49920]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2007-03-08 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2007-03-08 21568]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 SNP2STD;USB2.0 PC Camera (SNP2STD); C:\WINDOWS\system32\DRIVERS\snp2sxp.sys [2005-11-18 10192896]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\WINDOWS\system32\drivers\AtihdXP3.sys []
S4 dwshd;dwshd; C:\WINDOWS\System32\drivers\dwshd.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2010-06-22 602112]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2011-01-12 810144]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-01-30 153376]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R3 hpqcxs08;hpqcxs08; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-01-30 136176]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EHttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2011-01-12 33584]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-06-11 136120]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

#2 Příspěvek od **vyosek** » 11 Bře 2011 13:03

Zdravim a pekny den preji

Kdyz date log z RSIT po CFku tak je videt kulovy

Log z CF jste si vylustil

Navic CFko se nema pouzivat bez doporuceni radce - vizte nize

Nebezpeci CFka

Je urcen primarne pro radce - jeho svevolnym pouzitim ztracite narok na podporu
Maze stopy po haveti, takze v logu z RSIT neni nic videt
Jeho log je treba dolustit, jelikoz neumi smazat vse - to ovsem tezko zvladnete pokud k tomu nejste vyskolen
CF muze mit bug = sunda Vam system, pokud nevite kam co uklada, jak co obnovit, mate system v kytkam a ceka Vas reinstal
CF taky bohuzel prozatim nekontroluje nektere dulezite knihovny (napr. hal.dll) - ty treba mazou nektere typy haveti (napr. angela) - smaze Vam po restartu hal.dll = nenajede Vam system a jste o radek vyse = reinstal

Poprosim o ten log z CF, je ulozen v c:\combofix.txt

Zakov · #3 Příspěvek od **Zakov** » 11 Bře 2011 13:15

Priste se polepsim

Log z combofix:

ComboFix 11-02-28.02 - Karel 28.02.2011 22:20:45.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.720 [GMT 1:00]
Spuštěný z: c:\documents and settings\Karel\Dokumenty\Stažené soubory\ComboFix.exe

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Karel\Local Settings\Temporary Internet Files\dxva_sig.txt
c:\windows\system32\AutoRun.inf

Nakažená kopie c:\windows\regedit.exe byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\ServicePackFiles\i386\regedit.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2011-01-28 do 2011-02-28 )))))))))))))))))))))))))))))))
.

2011-02-28 19:56 . 2008-04-14 06:59 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2011-02-28 19:56 . 2008-04-14 06:59 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2011-02-27 14:23 . 2011-02-27 14:23 -------- d-----w- c:\windows\system32\config\systemprofile\Data aplikací\ESET
2011-02-27 14:09 . 2011-02-27 14:09 -------- d-----w- c:\documents and settings\Karel\Local Settings\Data aplikací\ESET
2011-02-27 14:09 . 2011-02-27 14:09 -------- d-----w- c:\documents and settings\Karel\Data aplikací\ESET
2011-02-27 14:09 . 2011-02-27 14:09 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\ESET
2011-02-27 13:54 . 2011-02-27 13:54 -------- d-----w- c:\program files\ESET
2011-02-27 13:54 . 2011-02-27 13:54 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ESET
2011-02-15 17:11 . 2011-02-22 17:33 -------- d-----w- c:\documents and settings\Karel\Data aplikací\ntr
2011-02-13 15:08 . 2011-02-13 15:09 -------- d-----w- c:\program files\Screamer Radio
2011-02-13 14:41 . 2010-05-17 07:04 101904 ----a-w- c:\windows\system32\drivers\AtiHdmi.sys
2011-02-13 14:40 . 2010-06-22 21:58 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-02-13 14:40 . 2010-06-22 22:02 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2011-02-13 14:39 . 2011-02-13 14:39 -------- d-----w- c:\program files\ATI Technologies
2011-02-08 17:55 . 2011-02-08 17:55 -------- d-----w- C:\spoolerlogs
2011-02-08 17:51 . 2011-02-08 17:51 -------- d-----w- c:\windows\Sun
2011-02-05 16:41 . 2011-02-05 16:41 -------- d-----w- c:\documents and settings\All Users\Data aplikací\vsosdk
2011-02-05 14:31 . 2011-02-05 14:31 -------- d-----w- c:\documents and settings\All Users\Data aplikací\SUPERAntiSpyware.com
2011-02-05 14:08 . 2008-04-14 07:52 26624 ----a-w- c:\documents and settings\LocalService\Data aplikací\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2011-02-05 14:07 . 2011-02-05 14:07 -------- d-----w- c:\program files\Windows Media Connect 2
2011-02-05 14:05 . 2011-02-05 14:06 -------- d-----w- c:\windows\system32\drivers\UMDF
2011-02-05 14:05 . 2011-02-05 14:05 -------- d-----w- c:\windows\system32\LogFiles
2011-01-31 08:22 . 2011-01-31 08:22 -------- d-----w- c:\program files\MSXML 4.0
2011-01-31 07:31 . 2008-04-14 07:52 221184 ----a-w- c:\windows\system32\wmpns.dll
2011-01-31 00:27 . 2011-01-31 00:27 -------- d-----w- c:\documents and settings\Karel\Data aplikací\CyberLink
2011-01-30 17:20 . 2011-01-30 17:20 -------- d-----w- c:\documents and settings\Karel\Local Settings\Data aplikací\Ahead
2011-01-30 14:13 . 2011-01-30 14:13 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Data aplikací\Google
2011-01-30 14:08 . 2011-01-30 14:08 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\Google
2011-01-30 14:03 . 2011-02-27 13:28 -------- d-----w- c:\program files\JDownloader
2011-01-30 14:01 . 2011-02-18 15:05 -------- d-----w- c:\documents and settings\Karel\Data aplikací\skypePM
2011-01-30 13:50 . 2011-01-30 13:50 -------- d-----w- c:\program files\Common Files\Skype
2011-01-30 13:50 . 2011-01-30 13:50 -------- d-----r- c:\program files\Skype
2011-01-30 13:50 . 2011-02-18 16:29 -------- d-----w- c:\documents and settings\Karel\Data aplikací\Skype
2011-01-30 13:50 . 2011-01-30 13:50 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Skype
2011-01-30 13:48 . 2011-02-18 13:57 -------- d-----w- c:\documents and settings\Karel\Local Settings\Data aplikací\Temp
2011-01-30 13:48 . 2011-01-30 13:48 -------- d-----w- c:\documents and settings\Karel\Local Settings\Data aplikací\Adobe
2011-01-30 13:47 . 2011-01-30 13:47 -------- d-----w- c:\program files\Common Files\Adobe
2011-01-30 13:44 . 2011-01-30 13:44 -------- d-----w- c:\documents and settings\Karel\Local Settings\Data aplikací\Mozilla
2011-01-30 13:41 . 2011-01-30 13:42 -------- d-----w- c:\program files\The KMPlayer
2011-01-30 13:38 . 2011-01-30 13:38 -------- d-----w- c:\documents and settings\All Users\Data aplikací\CyberLink
2011-01-30 13:38 . 2011-01-30 13:38 -------- d-----w- c:\program files\CyberLink
2011-01-30 13:31 . 2001-09-05 04:18 77824 ----a-w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\ctor.dll
2011-01-30 13:31 . 2001-09-05 04:18 225280 ----a-w- c:\program files\Common Files\InstallShield\IScript\iscript.dll
2011-01-30 13:31 . 2001-09-05 04:14 176128 ----a-w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\iuser.dll
2011-01-30 13:31 . 2001-09-05 04:13 32768 ----a-w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\objectps.dll
2011-01-30 13:31 . 2006-06-07 15:27 212992 ----a-w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\ILog.dll
2011-01-30 13:25 . 1998-06-24 10:06 297984 ----a-w- c:\windows\unin0405.exe
2011-01-30 13:25 . 2011-01-30 13:25 -------- d-----w- c:\documents and settings\Karel\WINDOWS
2011-01-30 13:21 . 2004-08-09 16:43 94208 ----a-w- c:\windows\amcap.exe
2011-01-30 13:19 . 2011-01-30 13:19 -------- d-----w- c:\documents and settings\All Users\Data aplikací\WEBREG
2011-01-30 13:16 . 2011-01-30 13:16 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\HP
2011-01-30 13:13 . 2007-03-08 04:20 21568 ----a-r- c:\windows\system32\drivers\HPZius12.sys
2011-01-30 13:13 . 2007-03-08 04:20 364544 ----a-r- c:\windows\system32\hppldcoi.dll
2011-01-30 13:13 . 2007-03-08 04:20 309760 ----a-r- c:\windows\system32\difxapi.dll
2011-01-30 13:08 . 2011-01-30 13:08 -------- d-----w- c:\documents and settings\All Users\Data aplikací\HP Product Assistant
2011-01-30 13:08 . 2011-01-30 13:08 -------- d-----w- c:\documents and settings\All Users\Data aplikací\HP
2011-01-30 13:04 . 2008-04-13 23:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2011-01-30 13:04 . 2008-04-13 23:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2011-01-30 13:04 . 2008-04-13 23:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2011-01-30 13:04 . 2008-04-13 23:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2011-01-30 12:48 . 2007-01-24 08:46 438272 ----a-r- c:\windows\system32\hpg400co.dll
2011-01-30 12:48 . 2008-04-13 23:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2011-01-30 12:48 . 2008-04-13 23:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2011-01-30 12:43 . 2011-01-30 12:49 -------- d-----w- c:\documents and settings\Karel\Data aplikací\HP
2011-01-30 12:42 . 2011-01-30 12:42 -------- d-----w- c:\documents and settings\Karel\Local Settings\Data aplikací\IsolatedStorage
2011-01-30 12:42 . 2011-01-30 12:42 -------- d-----w- c:\documents and settings\Karel\Local Settings\Data aplikací\HP
2011-01-30 12:42 . 2011-02-28 21:29 -------- d-----w- c:\documents and settings\Karel\Local Settings\Data aplikací\ApplicationHistory
2011-01-30 12:39 . 2011-01-30 12:39 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Sonic
2011-01-30 12:39 . 2011-01-30 12:39 -------- d-----w- c:\program files\Common Files\Sonic Shared
2011-01-30 12:38 . 2011-01-30 12:39 -------- d-----w- c:\program files\Common Files\HP
2011-01-30 12:37 . 2011-01-30 12:37 -------- d-----w- c:\windows\system32\URTTEMP
2011-01-30 12:35 . 2011-01-30 12:35 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2011-01-30 12:35 . 2011-01-30 13:11 -------- d-----w- c:\program files\Hewlett-Packard
2011-01-30 12:33 . 2011-01-30 13:11 -------- d-----w- c:\program files\HP
2011-01-30 12:29 . 2008-04-14 07:51 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2011-01-30 12:29 . 2008-04-14 07:51 21504 ----a-w- c:\windows\system32\hidserv.dll
2011-01-30 12:29 . 2001-10-24 10:54 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2011-01-30 12:29 . 2001-10-24 10:54 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2011-01-30 12:29 . 2008-04-13 23:15 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys
2011-01-30 12:29 . 2008-04-13 23:15 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
2011-01-30 11:09 . 2011-01-30 11:14 -------- d-----w- c:\documents and settings\Karel\Data aplikací\Zoner
2011-01-30 11:08 . 2011-01-30 11:08 -------- d-----w- c:\program files\Zoner
2011-01-30 11:04 . 2011-01-30 11:04 -------- d-----w- c:\program files\AVI MPEG RM WMV Joiner
2011-01-30 11:02 . 2011-01-30 11:02 -------- d-----w- c:\program files\Lavalys
2011-01-30 10:57 . 2011-01-30 11:02 -------- d-----w- c:\program files\CDex
2011-01-30 10:52 . 2011-01-30 10:52 -------- d-----w- c:\program files\Common Files\Nero
2011-01-30 10:50 . 2000-06-26 09:45 106496 ----a-w- c:\windows\system32\TwnLib20.dll
2011-01-30 10:50 . 2004-07-26 15:16 471040 ------w- c:\windows\system32\ImagXRA7.dll
2011-01-30 10:50 . 2004-07-26 15:16 476320 ------w- c:\windows\system32\ImagXpr7.dll
2011-01-30 10:50 . 2004-07-26 15:16 262144 ------w- c:\windows\system32\ImagXR7.dll
2011-01-30 10:50 . 2004-07-26 15:16 1568768 ------w- c:\windows\system32\ImagX7.dll
2011-01-30 10:50 . 2011-01-30 10:50 -------- d-----w- c:\program files\Common Files\Ahead
2011-01-30 10:50 . 2001-07-09 09:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
2011-01-30 10:50 . 2011-01-30 10:50 -------- d-----w- c:\program files\Ahead
2011-01-30 10:43 . 2011-01-30 10:43 -------- d-----w- c:\program files\DVDFab 5
2011-01-30 10:41 . 2011-01-30 10:41 -------- d-----w- c:\program files\7-Zip
2011-01-30 10:23 . 2011-01-30 10:43 87608 ----a-w- c:\documents and settings\Karel\Data aplikací\inst.exe
2011-01-30 10:23 . 2011-01-30 10:43 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2011-01-30 10:23 . 2011-01-30 10:43 47360 ----a-w- c:\documents and settings\Karel\Data aplikací\pcouffin.sys
2011-01-30 10:18 . 2011-02-15 12:04 -------- d-----w- c:\documents and settings\Karel\Data aplikací\Vso
2011-01-30 10:18 . 2009-09-02 11:44 65602 ----a-w- c:\windows\system32\cook3260.dll
2011-01-30 10:18 . 2009-09-02 11:44 217127 ----a-w- c:\windows\system32\drv43260.dll
2011-01-30 10:18 . 2009-09-02 11:44 208935 ----a-w- c:\windows\system32\drv33260.dll
2011-01-30 10:18 . 2009-09-02 11:44 176165 ----a-w- c:\windows\system32\drv23260.dll
2011-01-30 10:18 . 2009-09-02 11:44 102439 ----a-w- c:\windows\system32\sipr3260.dll
2011-01-30 10:18 . 2009-09-02 11:44 626688 ----a-w- c:\windows\system32\vp7vfw.dll
2011-01-30 10:18 . 2011-01-30 10:18 -------- d-----w- c:\program files\VSO
2011-01-30 09:29 . 2011-02-27 13:50 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Alwil Software
2011-01-30 09:29 . 2011-01-30 09:29 -------- d-----w- c:\program files\Alwil Software
2011-01-30 09:21 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2011-01-30 09:19 . 2011-01-30 09:19 -------- d-----w- c:\documents and settings\Karel\Data aplikací\VitySoft
2011-01-30 09:19 . 2011-01-30 09:19 -------- d-----w- c:\program files\Common Files\Java
2011-01-30 09:18 . 2011-01-30 09:18 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-01-30 09:18 . 2011-01-30 09:18 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-01-30 09:18 . 2011-01-30 09:18 -------- d-----w- c:\program files\Java
2011-01-30 09:16 . 2011-01-30 09:16 -------- d-----w- c:\program files\CCleaner
2011-01-30 08:45 . 2011-01-30 08:45 -------- d-----w- c:\documents and settings\Karel\Local Settings\Data aplikací\GHISLER
2011-01-30 08:29 . 2011-01-30 08:29 -------- d-----w- C:\totalcmd
2011-01-30 08:29 . 2011-01-30 08:29 -------- d-----w- c:\documents and settings\Karel\Data aplikací\GHISLER
2011-01-30 08:29 . 2010-12-17 06:56 545 ----a-w- c:\windows\UC.PIF
2011-01-30 08:29 . 2010-12-17 06:56 545 ----a-w- c:\windows\RAR.PIF
2011-01-30 08:29 . 2010-12-17 06:56 545 ----a-w- c:\windows\PKZIP.PIF
2011-01-30 08:29 . 2010-12-17 06:56 545 ----a-w- c:\windows\PKUNZIP.PIF
2011-01-30 08:29 . 2010-12-17 06:56 545 ----a-w- c:\windows\NOCLOSE.PIF
2011-01-30 08:29 . 2010-12-17 06:56 545 ----a-w- c:\windows\LHA.PIF

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-29 12:09 . 2004-08-13 09:56 5810 ----a-w- c:\windows\system32\drivers\ASACPI.sys
2011-01-29 11:57 . 2011-01-29 11:57 32768 ----a-w- c:\windows\inf\UpdateUSB.exe
2011-01-21 14:44 . 2006-03-02 12:00 440320 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2006-03-02 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 14:04 . 2006-03-02 12:00 1854976 ----a-w- c:\windows\system32\win32k.sys
2010-12-22 12:34 . 2006-03-02 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-21 14:04 . 2010-12-21 14:04 141264 ----a-w- c:\windows\system32\drivers\eamon.sys
2010-12-21 12:47 . 2010-12-21 12:47 33120 ----a-w- c:\windows\system32\drivers\epfwndis.sys
2010-12-21 12:47 . 2010-12-21 12:47 134000 ----a-w- c:\windows\system32\drivers\epfw.sys
2010-12-20 23:52 . 2006-03-02 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 23:52 . 2006-03-02 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2010-12-20 23:52 . 2006-03-02 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-12-20 17:25 . 2006-03-02 12:00 729088 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 12:55 . 2006-03-02 12:00 385024 ------w- c:\windows\system32\html.iec
2010-12-09 15:15 . 2006-03-02 12:00 713216 ----a-w- c:\windows\system32\ntdll.dll
2010-12-09 15:14 . 2004-08-17 15:45 2029056 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-12-09 15:14 . 2006-03-02 12:00 2150912 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-12-09 14:30 . 2006-03-02 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2010-12-07 11:14 . 2010-12-07 11:14 51200 ----a-w- c:\windows\system32\OpenCL.dll
2010-12-02 03:35 . 2010-12-02 03:35 4280320 ----a-w- c:\windows\system32\GPhotos.scr
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Karel\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2011-01-30 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-19 16062464]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"snp2std"="c:\windows\vsnp2std.exe" [2005-11-16 344064]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-01-12 2219184]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]
Rychlě zaź tek s aplikacˇ HP Photosmart Premier.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:Remote Desktop
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2622:TCP"= 2622:TCP:Services
"3744:TCP"= 3744:TCP:Services
"4484:TCP"= 4484:TCP:Services
"7468:TCP"= 7468:TCP:Services
"7587:TCP"= 7587:TCP:Services
"9258:TCP"= 9258:TCP:Services
"4414:TCP"= 4414:TCP:Services
"2898:TCP"= 2898:TCP:Services
"7086:TCP"= 7086:TCP:Services
"3274:TCP"= 3274:TCP:Services
"9867:TCP"= 9867:TCP:Services
"2259:TCP"= 2259:TCP:Services
"8008:TCP"= 8008:TCP:Services
"2040:TCP"= 2040:TCP:Services
"4319:TCP"= 4319:TCP:Services
"9336:TCP"= 9336:TCP:Services
"2680:TCP"= 2680:TCP:Services
"4289:TCP"= 4289:TCP:Services
"6945:TCP"= 6945:TCP:Services
"9553:TCP"= 9553:TCP:Services
"8040:TCP"= 8040:TCP:Services
"6149:TCP"= 6149:TCP:Services
"4040:TCP"= 4040:TCP:Services
"1774:TCP"= 1774:TCP:Services
"9991:TCP"= 9991:TCP:Services
"3259:TCP"= 3259:TCP:Services
"2009:TCP"= 2009:TCP:Services
"3321:TCP"= 3321:TCP:Services
"1976:TCP"= 1976:TCP:Services
"3681:TCP"= 3681:TCP:Services
"8368:TCP"= 8368:TCP:Services
"9851:TCP"= 9851:TCP:Services
"2837:TCP"= 2837:TCP:Services
"7515:TCP"= 7515:TCP:Services
"1602:TCP"= 1602:TCP:Services
"4446:TCP"= 4446:TCP:Services
"3539:TCP"= 3539:TCP:Services
"4705:TCP"= 4705:TCP:Services
"5882:TCP"= 5882:TCP:Services
"3569:TCP"= 3569:TCP:Services
"1695:TCP"= 1695:TCP:Services
"4586:TCP"= 4586:TCP:Services
"8682:TCP"= 8682:TCP:Services
"3164:TCP"= 3164:TCP:Services
"4828:TCP"= 4828:TCP:Services

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [30.1.2011 15:08 136176]
S4 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys --> c:\windows\system32\drivers\AtihdXP3.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'

2011-02-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-30 14:08]

2011-02-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-30 14:08]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {93B08541-9F6B-4697-9F9A-7058F1E33785} - hxxp://213.226.254.58/inquiero/mod/setup/ntractivex1182.cab
FF - ProfilePath - c:\documents and settings\Karel\Data aplikací\Mozilla\Firefox\Profiles\63gpcm26.default\
FF - prefs.js: browser.search.selectedEngine - SluneÄŤnice
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-28 22:29
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(584)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll

- - - - - - - > 'explorer.exe'(156)
c:\windows\system32\webcheck.dll
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
c:\program files\Common Files\Microsoft Shared\Web Components\10\1029\OWCI10.DLL
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
c:\program files\Common Files\Microsoft Shared\Web Components\11\1029\OWCI11.DLL
c:\windows\system32\msls31.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
.
**************************************************************************
.
Celkový čas: 2011-02-28 22:34:27 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-02-28 21:34

Před spuštěním: Volných bajtů: 105 947 729 920
Po spuštění: Volných bajtů: 107 530 510 336

- - End Of File - - 88AAE5493F1F6250B7DEC8E9B140D63B

#4 Příspěvek od **vyosek** » 11 Bře 2011 13:34

Tyhle porty mate otevrene ve firewallu umyslne

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:Remote Desktop
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2622:TCP"= 2622:TCP:Services
"3744:TCP"= 3744:TCP:Services
"4484:TCP"= 4484:TCP:Services
"7468:TCP"= 7468:TCP:Services
"7587:TCP"= 7587:TCP:Services
"9258:TCP"= 9258:TCP:Services
"4414:TCP"= 4414:TCP:Services
"2898:TCP"= 2898:TCP:Services
"7086:TCP"= 7086:TCP:Services
"3274:TCP"= 3274:TCP:Services
"9867:TCP"= 9867:TCP:Services
"2259:TCP"= 2259:TCP:Services
"8008:TCP"= 8008:TCP:Services
"2040:TCP"= 2040:TCP:Services
"4319:TCP"= 4319:TCP:Services
"9336:TCP"= 9336:TCP:Services
"2680:TCP"= 2680:TCP:Services
"4289:TCP"= 4289:TCP:Services
"6945:TCP"= 6945:TCP:Services
"9553:TCP"= 9553:TCP:Services
"8040:TCP"= 8040:TCP:Services
"6149:TCP"= 6149:TCP:Services
"4040:TCP"= 4040:TCP:Services
"1774:TCP"= 1774:TCP:Services
"9991:TCP"= 9991:TCP:Services
"3259:TCP"= 3259:TCP:Services
"2009:TCP"= 2009:TCP:Services
"3321:TCP"= 3321:TCP:Services
"1976:TCP"= 1976:TCP:Services
"3681:TCP"= 3681:TCP:Services
"8368:TCP"= 8368:TCP:Services
"9851:TCP"= 9851:TCP:Services
"2837:TCP"= 2837:TCP:Services
"7515:TCP"= 7515:TCP:Services
"1602:TCP"= 1602:TCP:Services
"4446:TCP"= 4446:TCP:Services
"3539:TCP"= 3539:TCP:Services
"4705:TCP"= 4705:TCP:Services
"5882:TCP"= 5882:TCP:Services
"3569:TCP"= 3569:TCP:Services
"1695:TCP"= 1695:TCP:Services
"4586:TCP"= 4586:TCP:Services
"8682:TCP"= 8682:TCP:Services
"3164:TCP"= 3164:TCP:Services
"4828:TCP"= 4828:TCP:Services

Zakov · #5 Příspěvek od **Zakov** » 11 Bře 2011 13:42

vyosek napsal: Tyhle porty mate otevrene ve firewallu umyslne

Urcite ne. Jedine, ze by si je oteviral Rapid downloader, nebo jdownloader...

#6 Příspěvek od **vyosek** » 11 Bře 2011 13:58

Stahnete si TDSSKiller http://support.kaspersky.com/downloads/ ... killer.exe

Utilitu spustte a prikazte ji, at skenuje - klik na Start Scan
Pokud utilita najde infikekci, bude ji chtit lecit (Cure), povolte leceni kliknutim na Continue
Pokud utilita najde podezrely soubor (suspicious), bude jej chtit preskocit (Skip), povolte preskoceni kliknutim na Continue
Po dokonceni skenu bude mozna nutny restart PC, povolte jej kliknutim na Reboot now
Po restartu na Vas vyskoci log, pokud se tak nestane, najdete jej primo na disku, kde mate Windows (obvykle c:\) ve tvaru TDSSKiller.nejaka cisilka _log.txt - jeho obsah sem vlozte
Pokud restart nebude vyzadovan, kliknete na Close a nasledne na Report - vytvori se log - jeho obsah sem vlozte

Zakov · #7 Příspěvek od **Zakov** » 11 Bře 2011 14:26

2011/03/11 14:23:01.0296 0220 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/03/11 14:23:01.0593 0220 ================================================================================
2011/03/11 14:23:01.0593 0220 SystemInfo:
2011/03/11 14:23:01.0593 0220
2011/03/11 14:23:01.0593 0220 OS Version: 5.1.2600 ServicePack: 3.0
2011/03/11 14:23:01.0593 0220 Product type: Workstation
2011/03/11 14:23:01.0593 0220 ComputerName: STASTNIK
2011/03/11 14:23:01.0593 0220 UserName: Karel
2011/03/11 14:23:01.0593 0220 Windows directory: C:\WINDOWS
2011/03/11 14:23:01.0593 0220 System windows directory: C:\WINDOWS
2011/03/11 14:23:01.0593 0220 Processor architecture: Intel x86
2011/03/11 14:23:01.0593 0220 Number of processors: 2
2011/03/11 14:23:01.0593 0220 Page size: 0x1000
2011/03/11 14:23:01.0593 0220 Boot type: Normal boot
2011/03/11 14:23:01.0593 0220 ================================================================================
2011/03/11 14:23:01.0843 0220 Initialize success
2011/03/11 14:23:04.0984 0592 ================================================================================
2011/03/11 14:23:04.0984 0592 Scan started
2011/03/11 14:23:04.0984 0592 Mode: Manual;
2011/03/11 14:23:04.0984 0592 ================================================================================
2011/03/11 14:23:05.0296 0592 ACPI (4fe34f1f3126b61fcc6b2043aa8112c9) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/03/11 14:23:05.0343 0592 ACPIEC (afdff022a01f0b11c776f0860c3b282f) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/03/11 14:23:05.0406 0592 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/03/11 14:23:05.0468 0592 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2011/03/11 14:23:05.0562 0592 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/03/11 14:23:05.0656 0592 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/03/11 14:23:05.0687 0592 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/03/11 14:23:05.0906 0592 ati2mtag (e53b55aff4845751f2c612d2640cdc23) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
2011/03/11 14:23:05.0984 0592 AtiHdmiService (7e13f3f0f4c4c337a6949a18d1d23089) C:\WINDOWS\system32\drivers\AtiHdmi.sys
2011/03/11 14:23:06.0031 0592 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/03/11 14:23:06.0078 0592 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/03/11 14:23:06.0140 0592 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/03/11 14:23:06.0203 0592 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/03/11 14:23:06.0265 0592 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/03/11 14:23:06.0312 0592 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/03/11 14:23:06.0343 0592 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/03/11 14:23:06.0390 0592 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/03/11 14:23:06.0890 0592 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/03/11 14:23:07.0140 0592 dmboot (db5fd2bf5b07dc54bfcb3664ff05bd7c) C:\WINDOWS\system32\drivers\dmboot.sys
2011/03/11 14:23:07.0281 0592 dmio (fff1720af51171f32f1ead5cf71f2810) C:\WINDOWS\system32\drivers\dmio.sys
2011/03/11 14:23:07.0421 0592 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/03/11 14:23:07.0609 0592 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/03/11 14:23:08.0000 0592 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/03/11 14:23:08.0187 0592 eamon (d42dd9021acd47683b33adf21bca49aa) C:\WINDOWS\system32\DRIVERS\eamon.sys
2011/03/11 14:23:08.0250 0592 ehdrv (fe7824239d132ad9ebd8645fe1199b30) C:\WINDOWS\system32\DRIVERS\ehdrv.sys
2011/03/11 14:23:08.0296 0592 epfw (73411c14a8c6062bb6a510772cf2f38c) C:\WINDOWS\system32\DRIVERS\epfw.sys
2011/03/11 14:23:08.0343 0592 Epfwndis (490329bf80f333e788df9596a752a915) C:\WINDOWS\system32\DRIVERS\Epfwndis.sys
2011/03/11 14:23:08.0375 0592 epfwtdi (bdde7dd8fcdb1de7e879bb320b0605c0) C:\WINDOWS\system32\DRIVERS\epfwtdi.sys
2011/03/11 14:23:08.0437 0592 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/03/11 14:23:08.0484 0592 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/03/11 14:23:08.0500 0592 Fips (ac366695a0796560aa37215ad5762aaf) C:\WINDOWS\system32\drivers\Fips.sys
2011/03/11 14:23:08.0531 0592 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/03/11 14:23:08.0593 0592 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/03/11 14:23:08.0625 0592 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/03/11 14:23:08.0640 0592 Ftdisk (4e664d8541db4a66b73a24257e322e1f) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/03/11 14:23:08.0687 0592 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/03/11 14:23:08.0765 0592 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/03/11 14:23:08.0828 0592 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/03/11 14:23:08.0906 0592 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
2011/03/11 14:23:08.0937 0592 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
2011/03/11 14:23:08.0984 0592 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
2011/03/11 14:23:09.0046 0592 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/03/11 14:23:09.0093 0592 i8042prt (c528e27945367191e7bae364930b6932) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/03/11 14:23:09.0140 0592 iaStor (79ae2a97c120f282845d854d0f070ea9) C:\WINDOWS\system32\drivers\iaStor.sys
2011/03/11 14:23:09.0218 0592 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/03/11 14:23:09.0406 0592 IntcAzAudAddService (001aaca6ed0e6b00fc5b8faf74977e81) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/03/11 14:23:09.0484 0592 intelppm (27b290d632af2cf3cf40bfddb7370985) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/03/11 14:23:09.0515 0592 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/03/11 14:23:09.0546 0592 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/03/11 14:23:09.0562 0592 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/03/11 14:23:09.0578 0592 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/03/11 14:23:09.0609 0592 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/03/11 14:23:09.0625 0592 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/03/11 14:23:09.0656 0592 isapnp (cc9f8a2d60aed1a51a3ac34c59b987ae) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/03/11 14:23:09.0687 0592 Kbdclass (1b6162fe7f66b1a71a4b70f941c4aa9b) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/03/11 14:23:09.0734 0592 kbdhid (86c8f23616c6c6e5b2776901c17b945b) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/03/11 14:23:09.0781 0592 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/03/11 14:23:09.0812 0592 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/03/11 14:23:09.0906 0592 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/03/11 14:23:09.0937 0592 Modem (44032b0c6d9954d3fd26438330b99ee7) C:\WINDOWS\system32\drivers\Modem.sys
2011/03/11 14:23:09.0953 0592 Mouclass (4cb582831dbde63ce43b45d771218374) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/03/11 14:23:09.0968 0592 mouhid (bb269eba740737ab749b214d568b6812) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/03/11 14:23:09.0984 0592 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/03/11 14:23:10.0031 0592 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/03/11 14:23:10.0093 0592 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/03/11 14:23:10.0125 0592 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/03/11 14:23:10.0171 0592 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/03/11 14:23:10.0187 0592 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/03/11 14:23:10.0203 0592 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/03/11 14:23:10.0234 0592 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/03/11 14:23:10.0281 0592 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/03/11 14:23:10.0328 0592 MTsensor (d48659bb24c48345d926ecb45c1ebdf5) C:\WINDOWS\system32\DRIVERS\ASACPI.sys
2011/03/11 14:23:10.0343 0592 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/03/11 14:23:10.0390 0592 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/03/11 14:23:10.0453 0592 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/03/11 14:23:10.0468 0592 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/03/11 14:23:10.0500 0592 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/03/11 14:23:10.0515 0592 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/03/11 14:23:10.0531 0592 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/03/11 14:23:10.0562 0592 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/03/11 14:23:10.0593 0592 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/03/11 14:23:10.0625 0592 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/03/11 14:23:10.0671 0592 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/03/11 14:23:10.0687 0592 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/03/11 14:23:10.0734 0592 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/03/11 14:23:10.0796 0592 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/03/11 14:23:10.0828 0592 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/03/11 14:23:10.0843 0592 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/03/11 14:23:10.0875 0592 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/03/11 14:23:10.0906 0592 Parport (46f8db73b4a53e543f8e371dc7c75bae) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/03/11 14:23:10.0921 0592 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/03/11 14:23:10.0953 0592 ParVdm (1fae19d0457176318bba4a8795656ebc) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/03/11 14:23:10.0984 0592 PCI (6ce351d149cb4befc702951e471e1730) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/03/11 14:23:11.0031 0592 PCIIde (2da4ec85e0ea7a45c6b2a05820492d5a) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/03/11 14:23:11.0062 0592 Pcmcia (4fc31e6c19a5ce5198b1abff94cae758) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/03/11 14:23:11.0109 0592 pcouffin (5b6c11de7e839c05248ced8825470fef) C:\WINDOWS\system32\Drivers\pcouffin.sys
2011/03/11 14:23:11.0250 0592 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/03/11 14:23:11.0281 0592 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/03/11 14:23:11.0312 0592 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/03/11 14:23:11.0328 0592 PxHelp20 (0457e25bb122b854e267cf552dcdc370) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/03/11 14:23:11.0421 0592 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/03/11 14:23:11.0453 0592 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/03/11 14:23:11.0468 0592 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/03/11 14:23:11.0484 0592 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/03/11 14:23:11.0515 0592 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/03/11 14:23:11.0531 0592 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/03/11 14:23:11.0546 0592 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/03/11 14:23:11.0593 0592 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/03/11 14:23:11.0625 0592 redbook (611bfd220305be3a85ae876ea47d4aa5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/03/11 14:23:11.0687 0592 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/03/11 14:23:11.0734 0592 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/03/11 14:23:11.0765 0592 Serial (b842729337c9b921615c40d3c1a1af96) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/03/11 14:23:11.0796 0592 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/03/11 14:23:11.0859 0592 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/03/11 14:23:12.0218 0592 SNP2STD (e7e68ecb968c9812d9faf68517426673) C:\WINDOWS\system32\DRIVERS\snp2sxp.sys
2011/03/11 14:23:12.0531 0592 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/03/11 14:23:12.0562 0592 sr (94610c8653635e4459316a0050d55ce7) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/03/11 14:23:12.0609 0592 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/03/11 14:23:12.0656 0592 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/03/11 14:23:12.0671 0592 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/03/11 14:23:12.0750 0592 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/03/11 14:23:12.0859 0592 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/03/11 14:23:12.0921 0592 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/03/11 14:23:12.0968 0592 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/03/11 14:23:12.0984 0592 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/03/11 14:23:13.0000 0592 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/03/11 14:23:13.0046 0592 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/03/11 14:23:13.0109 0592 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/03/11 14:23:13.0171 0592 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/03/11 14:23:13.0234 0592 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/03/11 14:23:13.0265 0592 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/03/11 14:23:13.0312 0592 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/03/11 14:23:13.0343 0592 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/03/11 14:23:13.0359 0592 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/03/11 14:23:13.0406 0592 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/03/11 14:23:13.0421 0592 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/03/11 14:23:13.0453 0592 VolSnap (28a4b296b47782173c346e376cb374d1) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/03/11 14:23:13.0484 0592 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/03/11 14:23:13.0531 0592 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/03/11 14:23:13.0671 0592 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/03/11 14:23:13.0718 0592 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/03/11 14:23:13.0734 0592 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/03/11 14:23:13.0812 0592 yukonwxp (deb4c7d9f61a75c360b925bf0592275d) C:\WINDOWS\system32\DRIVERS\yk51x86.sys
2011/03/11 14:23:13.0843 0592 \HardDisk0 - detected Backdoor.Win32.Sinowal.knf (0)
2011/03/11 14:23:13.0843 0592 ================================================================================
2011/03/11 14:23:13.0843 0592 Scan finished
2011/03/11 14:23:13.0843 0592 ================================================================================
2011/03/11 14:23:13.0859 3848 Detected object count: 1
2011/03/11 14:23:33.0375 3848 \HardDisk0 (Backdoor.Win32.Sinowal.knf) - will be cured after reboot
2011/03/11 14:23:33.0375 3848 \HardDisk0 - ok
2011/03/11 14:23:33.0375 3848 Backdoor.Win32.Sinowal.knf(\HardDisk0) - User select action: Cure
2011/03/11 14:23:38.0703 0776 Deinitialize success

#8 Příspěvek od **vyosek** » 11 Bře 2011 14:31

Parada TDSKiller udelal co mel, ted jeste docistime

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

KillAll::

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-
"NeroFilterCheck"=-
"HP Software Update"=-
"RemoteControl"=-
"Adobe ARM"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"=-
"65533:TCP"=-
"52344:TCP"=-
"2622:TCP"=-
"3744:TCP"=-
"4484:TCP"=-
"7468:TCP"=-
"7587:TCP"=-
"9258:TCP"=-
"4414:TCP"=-
"2898:TCP"=-
"7086:TCP"=-
"3274:TCP"=-
"9867:TCP"=-
"2259:TCP"=-
"8008:TCP"=-
"2040:TCP"=-
"4319:TCP"=-
"9336:TCP"=-
"2680:TCP"=-
"4289:TCP"=-
"6945:TCP"=-
"9553:TCP"=-
"8040:TCP"=-
"6149:TCP"=-
"4040:TCP"=-
"1774:TCP"=-
"9991:TCP"=-
"3259:TCP"=-
"2009:TCP"=-
"3321:TCP"=-
"1976:TCP"=-
"3681:TCP"=-
"8368:TCP"=-
"9851:TCP"=-
"2837:TCP"=-
"7515:TCP"=-
"1602:TCP"=-
"4446:TCP"=-
"3539:TCP"=-
"4705:TCP"=-
"5882:TCP"=-
"3569:TCP"=-
"1695:TCP"=-
"4586:TCP"=-
"8682:TCP"=-
"3164:TCP"=-
"4828:TCP"=-

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

Driver::
gupdate

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

Reboot::

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

Zakov · #9 Příspěvek od **Zakov** » 11 Bře 2011 15:14

Log Combofix:

ComboFix 11-03-10.03 - Karel 11.03.2011 14:58:52.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.664 [GMT 1:00]
Spuštěný z: c:\documents and settings\Karel\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Karel\Plocha\CFScript.txt.txt
AV: ESET Smart Security 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *Disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Rezidentní štít AV je zapnutý
.
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_GUPDATE
-------\Service_gupdate
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-02-11 do 2011-03-11 )))))))))))))))))))))))))))))))
.
.
2011-03-11 10:38 . 2011-03-11 10:38 -------- d-----w- c:\program files\trend micro
2011-03-11 10:38 . 2011-03-11 10:38 -------- d-----w- C:\rsit
2011-03-03 20:19 . 2011-03-03 20:19 -------- d-----w- c:\documents and settings\Karel\DoctorWeb
2011-02-28 19:56 . 2008-04-14 06:59 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2011-02-28 19:56 . 2008-04-14 06:59 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2011-02-27 14:09 . 2011-02-27 14:09 -------- d-----w- c:\documents and settings\Karel\Local Settings\Data aplikací\ESET
2011-02-27 14:09 . 2011-02-27 14:09 -------- d-----w- c:\documents and settings\Karel\Data aplikací\ESET
2011-02-27 14:09 . 2011-02-27 14:09 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\ESET
2011-02-27 13:54 . 2011-02-27 13:54 -------- d-----w- c:\program files\ESET
2011-02-27 13:54 . 2011-02-27 13:54 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ESET
2011-02-15 17:11 . 2011-02-22 17:33 -------- d-----w- c:\documents and settings\Karel\Data aplikací\ntr
2011-02-13 15:08 . 2011-02-13 15:09 -------- d-----w- c:\program files\Screamer Radio
2011-02-13 14:41 . 2010-05-17 07:04 101904 ----a-w- c:\windows\system32\drivers\AtiHdmi.sys
2011-02-13 14:40 . 2010-06-22 21:58 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-02-13 14:40 . 2010-06-22 22:02 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2011-02-13 14:39 . 2011-02-13 14:39 -------- d-----w- c:\program files\ATI Technologies
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-09 13:53 . 2006-03-02 12:00 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2006-03-02 12:00 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58 . 2011-01-29 11:14 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-30 10:43 . 2011-01-30 10:23 87608 ----a-w- c:\documents and settings\Karel\Data aplikací\inst.exe
2011-01-30 10:43 . 2011-01-30 10:23 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2011-01-30 10:43 . 2011-01-30 10:23 47360 ----a-w- c:\documents and settings\Karel\Data aplikací\pcouffin.sys
2011-01-30 09:18 . 2011-01-30 09:18 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-01-30 09:18 . 2011-01-30 09:18 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-01-29 12:09 . 2004-08-13 09:56 5810 ----a-w- c:\windows\system32\drivers\ASACPI.sys
2011-01-29 11:57 . 2011-01-29 11:57 32768 ----a-w- c:\windows\inf\UpdateUSB.exe
2011-01-27 11:57 . 2011-01-29 11:14 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 2006-03-02 12:00 440320 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2006-03-02 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll
2011-01-05 02:46 . 2011-02-05 13:51 1112576 ----a-w- c:\windows\system32\ativvamv.dll
2010-12-31 14:04 . 2006-03-02 12:00 1854976 ----a-w- c:\windows\system32\win32k.sys
2010-12-22 12:34 . 2006-03-02 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-21 14:04 . 2010-12-21 14:04 141264 ----a-w- c:\windows\system32\drivers\eamon.sys
2010-12-21 14:04 . 2010-12-21 14:04 115008 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-12-21 12:47 . 2010-12-21 12:47 33120 ----a-w- c:\windows\system32\drivers\epfwndis.sys
2010-12-21 12:47 . 2010-12-21 12:47 134000 ----a-w- c:\windows\system32\drivers\epfw.sys
2010-12-20 23:52 . 2006-03-02 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 23:52 . 2006-03-02 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2010-12-20 23:52 . 2006-03-02 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-12-20 17:25 . 2006-03-02 12:00 729088 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 12:55 . 2006-03-02 12:00 385024 ------w- c:\windows\system32\html.iec
2010-12-17 06:56 . 2011-01-30 08:29 545 ----a-w- c:\windows\UC.PIF
2010-12-17 06:56 . 2011-01-30 08:29 545 ----a-w- c:\windows\RAR.PIF
2010-12-17 06:56 . 2011-01-30 08:29 545 ----a-w- c:\windows\PKZIP.PIF
2010-12-17 06:56 . 2011-01-30 08:29 545 ----a-w- c:\windows\PKUNZIP.PIF
2010-12-17 06:56 . 2011-01-30 08:29 545 ----a-w- c:\windows\NOCLOSE.PIF
2010-12-17 06:56 . 2011-01-30 08:29 545 ----a-w- c:\windows\LHA.PIF
2010-12-17 06:56 . 2011-01-30 08:29 545 ----a-w- c:\windows\ARJ.PIF
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-19 16062464]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"snp2std"="c:\windows\vsnp2std.exe" [2005-11-16 344064]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-01-12 2219184]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]
Rychlě zaź tek s aplikacˇ HP Photosmart Premier.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9117:TCP"= 9117:TCP:Services
"9116:TCP"= 9116:TCP:Services
"4694:TCP"= 4694:TCP:Services
"9882:TCP"= 9882:TCP:Services
"9148:TCP"= 9148:TCP:Services
"2445:TCP"= 2445:TCP:Services
"3390:TCP"= 3390:TCP:Services
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [21.12.2010 15:04 115008]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [12.1.2011 16:41 810144]
S4 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys --> c:\windows\system32\drivers\AtihdXP3.sys [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {93B08541-9F6B-4697-9F9A-7058F1E33785} - hxxp://213.226.254.58/inquiero/mod/setup/ntractivex1182.cab
FF - ProfilePath - c:\documents and settings\Karel\Data aplikací\Mozilla\Firefox\Profiles\63gpcm26.default\
FF - prefs.js: browser.search.selectedEngine - SluneÄŤnice
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-11 15:07
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1020)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'explorer.exe'(372)
c:\windows\system32\webcheck.dll
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
c:\program files\Common Files\Microsoft Shared\Web Components\10\1029\OWCI10.DLL
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
c:\program files\Common Files\Microsoft Shared\Web Components\11\1029\OWCI11.DLL
c:\windows\system32\msls31.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\RTHDCPL.EXE
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2011-03-11 15:12:25 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-03-11 14:12
ComboFix2.txt 2011-02-28 21:34
.
Před spuštěním: Volných bajtů: 107 009 724 416
Po spuštění: Volných bajtů: 106 936 864 768
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - A36F33E9FFB61F262D8D8A7ED6A9591D

#10 Příspěvek od **vyosek** » 11 Bře 2011 15:19

Otevrete si poznamkovy blok

Start->spustit->notepad
Vlozte text nize

Kód: Vybrat vše

Windows Registry Editor Version 5.00

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9117:TCP"=-
"9116:TCP"=-
"4694:TCP"=-
"9882:TCP"=-
"9148:TCP"=-
"2445:TCP"=-
"3390:TCP"=-

Soubor ulozte jako oprava.reg
Pri ukladani dejte ulozit jako typ Vsechny soubory (nastevni je uvedeno na obrazku nize)
Zavrit notepad a spustit dvojklikem oprava.reg
Pripadny dotaz na zmenu registru potvrdte
Okno jen problikne a opravi regsitry - soubor muzete smazat

Jak se chova PC

Zakov · #11 Příspěvek od **Zakov** » 11 Bře 2011 16:33

Zda se ze je to OK. NOD uz v pameti nic nehlasi. Pri kontrole nasel jeden napadeny soubor (Kryptik.KPL) v jednom z bodu obnoveni. Ten vylecil.
PC mel jeste problemy pri stahovani vetsich souboru, treba filmu z ulozto. Vyzkousim a kdyby byl problem, ozval bych se.

Diky za pomoc!

#12 Příspěvek od **vyosek** » 11 Bře 2011 16:35

Havet se usadila v bodech obnoveni - smazte je dle navodu kolegy riffa http://www.viry.cz/forum/viewtopic.php?f=11&t=47040

Kdyby neco, tak napiste. Jinak nemate zac, rad jsem pomohl

VIRY.CZ

Mebroot v operační paměti.

Mebroot v operační paměti.

Re: Mebroot v operační paměti.

Re: Mebroot v operační paměti.

Re: Mebroot v operační paměti.

Re: Mebroot v operační paměti.

Re: Mebroot v operační paměti.

Re: Mebroot v operační paměti.

Re: Mebroot v operační paměti.

Re: Mebroot v operační paměti.

Re: Mebroot v operační paměti.

Re: Mebroot v operační paměti.

Re: Mebroot v operační paměti.