Čisté PC před formátem (prosím VYOSEK)

[petr0266]

Dobrý den, potřebuju zkontrolovat mé PC, protože budu dávat znovu OS, abych si něco náhodou nevzal s sebou v boot sektoru, nebo kdekoli a flash disk, jestli je vše v pořádku a bez červů (na flash také autorun - conficter). Můžete mi prosím vysvětlit, proč když v příkazovém řádků zadám del autorun.inf na flash disku (jednou jsem ho tak mazal a potom už se nevytvořil), tak se hlásí jakože neexistuje? Používám jinak licenci ESET SMART SECURITY.


Logfile of random's system information tool 1.08 (written by random/random)
Run by Lukáš at 2011-03-22 18:06:44
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 108 GB (71%) free of 153 GB
Total RAM: 2046 MB (69% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:06:48, on 22.3.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Steam\steam.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Documents and Settings\Lukáš\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Lukáš\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Lukáš\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Lukáš\Plocha\RSIT.exe
C:\Program Files\trend micro\Lukáš.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Lukáš\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 7883147312
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 7883218593
O17 - HKLM\System\CCS\Services\Tcpip\..\{58B904BE-97AC-4745-9EAF-8AA656175B66}: NameServer = 192.168.10.1
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 5799 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-507921405-2025429265-725345543-1004Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-507921405-2025429265-725345543-1004UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-01-30 62376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-03-14 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-03-14 79648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2010-11-02 19580520]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-01-26 98304]
"ATICustomerCare"=C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe [2010-05-04 311296]
"WheelMouse"=C:\Program Files\A4Tech\Mouse\Amoumain.exe [2007-05-15 204800]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2010-12-09 74752]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2011-01-12 2219184]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe [2011-01-30 35736]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-11-15 932288]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-10-29 249064]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Steam"=C:\Program Files\Steam\steam.exe [2011-03-05 1242448]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Google Update"=C:\Documents and Settings\Lukáš\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2011-03-14 136176]

C:\Documents and Settings\Lukáš\Nabídka Start\Programy\Po spuštění
OpenOffice.org 3.2.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2011-01-26 188416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2009-01-30 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\Steam\steamapps\common\call of duty black ops\BlackOps.exe"="C:\Program Files\Steam\steamapps\common\call of duty black ops\BlackOps.exe:*:Enabled:Call of Duty: Black Ops"
"C:\Program Files\Steam\steamapps\common\call of duty black ops\BlackOpsMP.exe"="C:\Program Files\Steam\steamapps\common\call of duty black ops\BlackOpsMP.exe:*:Enabled:Call of Duty: Black Ops - Multiplayer"
"C:\Program Files\Steam\steamapps\common\left 4 dead\left4dead.exe"="C:\Program Files\Steam\steamapps\common\left 4 dead\left4dead.exe:*:Enabled:Left 4 Dead"
"C:\Program Files\Steam\steamapps\common\dragon age ii demo\DragonAge2Launcher.exe"="C:\Program Files\Steam\steamapps\common\dragon age ii demo\DragonAge2Launcher.exe:*:Enabled:Dragon Age II Demo"
"C:\Program Files\Steam\steamapps\common\dragon age ii demo\docs\EA Help\Electronic_Arts_Technical_Support.htm"="C:\Program Files\Steam\steamapps\common\dragon age ii demo\docs\EA Help\Electronic_Arts_Technical_Support.htm:*:Enabled:Dragon Age II Demo"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2011-03-22 18:06:45 ----D---- C:\Program Files\trend micro
2011-03-22 18:06:44 ----D---- C:\rsit
2011-03-20 15:01:24 ----D---- C:\Documents and Settings\All Users\Data aplikací\Solidshield
2011-03-19 18:11:52 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\id Software
2011-03-19 18:11:36 ----D---- C:\Documents and Settings\All Users\Data aplikací\id Software
2011-03-18 17:43:02 ----D---- C:\Program Files\Microsoft XNA
2011-03-14 18:11:32 ----D---- C:\Documents and Settings\All Users\Data aplikací\Sun
2011-03-14 18:11:31 ----D---- C:\Program Files\Common Files\Java
2011-03-14 18:10:29 ----A---- C:\WINDOWS\system32\javaws.exe
2011-03-14 18:10:29 ----A---- C:\WINDOWS\system32\javaw.exe
2011-03-14 18:10:29 ----A---- C:\WINDOWS\system32\java.exe
2011-03-14 18:10:20 ----D---- C:\Program Files\Java
2011-03-14 18:10:13 ----D---- C:\Documents and Settings\All Users\Data aplikací\McAfee
2011-03-14 18:09:34 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Sun
2011-03-14 18:07:54 ----D---- C:\Program Files\Microsoft Silverlight
2011-03-14 18:07:05 ----D---- C:\Program Files\Common Files\Adobe
2011-03-14 18:04:33 ----D---- C:\Program Files\Adobe
2011-03-14 18:04:32 ----D---- C:\Program Files\Common Files\Adobe AIR
2011-03-14 18:03:02 ----D---- C:\WINDOWS\system32\Adobe
2011-03-14 17:47:58 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Macromedia
2011-03-13 18:14:43 ----A---- C:\WINDOWS\IsUninst.exe
2011-03-13 18:14:36 ----A---- C:\WINDOWS\QIII.INI
2011-03-12 22:31:13 ----SHD---- C:\RECYCLER
2011-03-12 19:48:46 ----D---- C:\WINDOWS\ERDNT
2011-03-12 19:48:37 ----D---- C:\Qoobox
2011-03-12 11:26:12 ----D---- C:\Program Files\World of Warcraft
2011-03-12 11:26:12 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2011-03-12 11:26:02 ----D---- C:\Documents and Settings\All Users\Data aplikací\Blizzard Entertainment
2011-03-11 22:35:15 ----D---- C:\Program Files\Deep Silver
2011-03-11 22:31:09 ----A---- C:\WINDOWS\system32\drivers\dtsoftbus01.sys
2011-03-11 22:30:55 ----D---- C:\Program Files\DAEMON Tools Lite
2011-03-11 22:30:15 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\DAEMON Tools Lite
2011-03-11 22:30:15 ----D---- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
2011-03-09 15:40:36 ----HDC---- C:\WINDOWS\$NtUninstallKB2479943$
2011-03-09 15:39:43 ----HDC---- C:\WINDOWS\$NtUninstallKB2481109$
2011-03-05 19:44:47 ----D---- C:\Program Files\Steam
2011-02-26 20:17:26 ----D---- C:\Program Files\CCleaner
2011-02-25 21:29:21 ----A---- C:\WINDOWS\system32\drivers\lirsgt.sys
2011-02-25 21:29:21 ----A---- C:\WINDOWS\system32\drivers\atksgt.sys
2011-02-23 15:46:21 ----HDC---- C:\WINDOWS\$NtUninstallKB971029$

======List of files/folders modified in the last 1 months======

2011-03-22 18:06:45 ----RD---- C:\Program Files
2011-03-22 18:06:45 ----D---- C:\WINDOWS\Temp
2011-03-22 18:06:40 ----D---- C:\Download
2011-03-22 17:45:42 ----D---- C:\WINDOWS\system32\CatRoot2
2011-03-22 17:15:39 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-03-21 19:57:43 ----D---- C:\WINDOWS
2011-03-21 19:11:13 ----D---- C:\WINDOWS\Prefetch
2011-03-20 20:25:25 ----D---- C:\Documents and Settings\Lukáš\Data aplikací\Winamp
2011-03-20 18:28:33 ----D---- C:\Documents and Settings
2011-03-20 17:56:17 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2011-03-20 17:21:11 ----SHD---- C:\WINDOWS\Installer
2011-03-20 17:21:11 ----D---- C:\WINDOWS\WinSxS
2011-03-20 17:21:01 ----HD---- C:\WINDOWS\inf
2011-03-20 17:20:35 ----RSD---- C:\WINDOWS\assembly
2011-03-20 17:20:10 ----D---- C:\WINDOWS\system32\DirectX
2011-03-19 12:28:46 ----D---- C:\WINDOWS\system32
2011-03-18 09:39:19 ----D---- C:\WINDOWS\system32\config
2011-03-14 18:11:31 ----D---- C:\Program Files\Common Files
2011-03-14 18:10:22 ----A---- C:\WINDOWS\system32\deployJava1.dll
2011-03-14 18:07:07 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2011-03-14 17:46:23 ----SD---- C:\WINDOWS\Tasks
2011-03-14 17:42:59 ----D---- C:\Program Files\Mozilla Firefox
2011-03-14 17:40:52 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-03-13 12:29:41 ----HD---- C:\Program Files\InstallShield Installation Information
2011-03-13 10:47:29 ----D---- C:\WINDOWS\system32\drivers
2011-03-12 22:25:25 ----D---- C:\WINDOWS\system32\drivers\etc
2011-03-12 20:01:03 ----A---- C:\WINDOWS\system.ini
2011-03-12 19:59:42 ----D---- C:\WINDOWS\AppPatch
2011-03-12 19:48:50 ----SHD---- C:\System Volume Information
2011-03-12 19:48:50 ----D---- C:\WINDOWS\system32\Restore
2011-03-11 10:05:47 ----SD---- C:\Documents and Settings\Lukáš\Data aplikací\Microsoft
2011-03-09 15:46:58 ----D---- C:\WINDOWS\Debug
2011-03-09 15:40:38 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-03-09 15:39:50 ----A---- C:\WINDOWS\system32\MRT.exe
2011-03-09 15:35:39 ----HD---- C:\WINDOWS\$hf_mig$
2011-02-26 12:15:33 ----HD---- C:\WINDOWS\msdownld.tmp
2011-02-25 21:29:13 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-02-25 21:28:15 ----D---- C:\WINDOWS\Microsoft.NET
2011-02-25 21:00:27 ----D---- C:\Program Files\Common Files\InstallShield

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2009-04-28 44944]
R1 Amfilter;A4Tech Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\Amfilter.sys [2007-05-14 9216]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-12-21 115008]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2010-08-03 55256]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2011-02-25 281760]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-12-21 141264]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2010-12-21 134000]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2011-02-25 25888]
R3 Amusbprt;A4Tech HID-compliant Mouse Driver; C:\WINDOWS\system32\DRIVERS\Amusbprt.sys [2007-05-14 14336]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2011-01-27 6406656]
R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys [2011-03-11 218688]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2010-12-21 33120]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2010-11-02 6188648]
R3 RTHDMIAzAudService;Service for HDMI; C:\WINDOWS\system32\drivers\RtKHDMI.sys [2010-05-25 4003008]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2011-01-14 277352]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2009-11-18 1691480]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2004-06-22 51088]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2004-06-22 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2004-06-22 21744]
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2009-11-18 1395800]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-02 12160]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2011-01-26 638976]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2011-01-12 810144]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-03-14 153376]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2011-01-12 33584]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2009-02-04 913920]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[vyosek]

Zdravim a pekny dne preji

Proverime tedy jen boot sektor a flash disky, kdyz to chcete formatovat

Stahnete Bootkit Remover http://www.esagelab.com/files/bootkit_remover.rar

• Rozbalte nejlepe na plochu a spustte
• Kliknete pravym mysidlem do okna a klik na Vybrat vše - text bude na bilem pozadi a pak stisknout Enter - text bude na cernem pozadi (pokud po enteru pozadi nezcerna, tak stisknete Ctrl+C)
• Stisknete libovolnou klavesu pro ukoceni utility
• Sem pak vlozte log pomoci tradicni zkratky Ctrl+V

Zapojte do PC vsechny USB klice (flashky, ext. disky apod.)

• Stahne a ulozte na plochu UsbFix http://www.viry.cz/forum/viewtopic.php?f=24&t=102308
• Spustte a kliknete na Deletion
• Po dokonceni sem vlozte log, pokud na Vas nevyskoci, najdete jej zde C:\UsbFix.txt

[petr0266]

Co znamnáte přesně to vaccinate, které bylo provedeno a proč mě dříve nešel vymazat autorun.inf, ale nyní když zkusím přes příkazový řádek, tak ho to najde? Děkuju


Bootkit Remover
(c) 2009 eSage Lab
www.esagelab.com

Program version: 1.2.0.0
OS Version: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00
Boot sector MD5 is: 6def5ffcbcdbdb4082f1015625e597bd

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)


Done;
Press any key to quit...

############################## | UsbFix 7.014 | [Deletion]

User: Lukáš (Administrator) # DOMOV-742668764 [ ]
Updated 24/06/10 by El Desaparecido / C_XX
Started at 18:29:23 | 22/03/2011
Website: http://pagesperso-orange.fr/NosTools/index.html
Contact: FindyKill.Contact@gmail.com

CPU: Intel(R) Core(TM)2 CPU 6420 @ 2.13GHz
CPU 2: Intel(R) Core(TM)2 CPU 6420 @ 2.13GHz
Microsoft Windows XP Home Edition (5.1.2600 32-Bit) # Service Pack 3
Internet Explorer 8.0.6001.18702

Windows Firewall: Disabled /!\
Antivirus: ESET Smart Security 4.2 4.2 [Enabled | Updated]
Firewall: ESET personal firewall 4.2.71.2 [Enabled]
RAM -> 2046 Mb
C:\ (%systemdrive%) -> Fixed drive # 149 Gb (106 Mb free - 71%) [] # NTFS
D:\ -> CD-ROM
I:\ -> Removable drive # 15 Gb (15 Mb free - 100%) [PATRIOT] # FAT32

################## | Files # Infected Folders |


################## | Registry |

Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools
Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoDrives
Deleted ! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoDrives

################## | Mountpoints2 |


################## | Listing |

[16/02/2011 - 16:48:16 | A | 0] C:\AUTOEXEC.BAT
[16/02/2011 - 16:44:08 | SH | 211] C:\boot.ini
[02/03/2006 - 13:00:00 | RASH | 4952] C:\Bootfont.bin
[16/02/2011 - 16:48:16 | A | 0] C:\CONFIG.SYS
[20/03/2011 - 18:28:33 | D ] C:\Documents and Settings
[22/03/2011 - 18:28:36 | D ] C:\Download
[16/02/2011 - 16:48:16 | RASH | 0] C:\IO.SYS
[16/02/2011 - 16:48:16 | RASH | 0] C:\MSDOS.SYS
[02/03/2006 - 13:00:00 | RASH | 47564] C:\NTDETECT.COM
[16/02/2011 - 17:36:58 | RASH | 250576] C:\ntldr
[22/03/2011 - 17:45:02 | ASH | 2145386496] C:\pagefile.sys
[22/03/2011 - 18:06:45 | RD ] C:\Program Files
[12/03/2011 - 21:37:26 | D ] C:\Qoobox
[22/03/2011 - 18:31:30 | SHD ] C:\RECYCLER
[22/03/2011 - 18:06:49 | D ] C:\rsit
[12/03/2011 - 19:48:50 | SHD ] C:\System Volume Information
[22/03/2011 - 18:31:30 | D ] C:\UsbFix
[22/03/2011 - 18:31:31 | A | 897] C:\UsbFix.txt
[21/03/2011 - 19:57:43 | D ] C:\WINDOWS
[19/02/2011 - 16:49:40 | A | 19774] I:\anglictina-kozak.odt

################## | Vaccin |

C:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)
I:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)

################## | E.O.F |

[petr0266]

zformátoval jsem flash disk, zkusil jsem v cmd, jestli mi najde autorun na flashce a nic...(ještě předtím jsem bezpečně odebral flashku a znova připojil).

[vyosek]

Ta funkce vaccinate slouzi k tomu, ze na vsechn discich vytvori slozku autorun.inf (neskodnou), takze se na disky uz nemohou zapsat skodlive autorun.inf = jste chranen pred haveti typu autorun - nejcastejsi typ haveti sireny pres flash disky...
Drive tam asi nebyl, jelikoz ted byl teprve vytvoren

[petr0266]

a jak je možné, že tam soubor nebyl? , by se měl přepisovat po každém startu flashky ne? http://leteckaposta.cz/787343870 jinak tohle mi vyhazuje eset v protokolu firewallu občas (červené ikonky se nelekejte - nemám nic nelegálního, pouze 15 dní vypršenou licenci, kterou si budu obnovovat, ale zatim nejsou finance).

[vyosek]

Nemusi tam byt, kdyz zformatujete flash disk, tak jej tam nemate a jsou pak dve moznosti - bud jej naockujete (vaccinate )= vytvorite ochranny autorun, nebo se Vam tam hodi skodlivy autorun = flash disk bude zavirovany...

S chybou FW bohuzel neporadim, neni to zadna havet zrejme, ale zkuste kontaktovat jejich tech. podporu

[petr0266]

Děkuji za pomoc, opět jste nezklamal : ) . Je tedy PC čisté pro nový OS? Pokud vím, tak bootkit remover je jen na whistlera (klidně udělám další kontroly). Flash Disk po formátu tedy nemá nikdy už autorun.inf, vadí to pro nějaké používání bez vakcinace (nepočítám s tím, že bych si zaviroval PC, jine usb disky nedávám do PC a hledím na bezpečnost). Je Flash disk v pořádku?

[petr0266]

Je vhodné tedy:

1) formát flash-disku
2) vaccinate
3) nahrát si tam soubory

[vyosek]

Ano postup s flashkou je vhodny

Stahnete SPTD http://www.duplexsecure.com/en/downloads

• Vyberte z uvedene stranky verzi dle sveho operacniho systemu (32(x86)bit ci 64(x64)bit)
• Ulozte na plochu a spustte
• Zvolte moznost Uninstall a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte

Stahnete Defogger http://www.jpshortstuff.247fixes.com/Defogger.exe

• Ulozte na plochu a spustte
• Kliknete na Disable a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte

Stahnete MBR na plochu http://www2.gmer.net/mbr/mbr.exe ale nespoustejte

Kliknete na Start a pote Spustit, pripadne pouzijte klavesou zkratku Win+R

• Vyskoci na Vas okenko, do ktereho zkopirujte text nize

• Kód: Vybrat vše

  "%userprofile%\plocha\mbr" -t

• Kliknete na OK
• Na plose se Vam vytvori log s nazvem mbr.txt, jeho obsah mi sem vlozte

[petr0266]

prvni krok jsem musel preskocit, protoze tam uninstall nebylo, druhy jsem disabnul a nyni dám restart... potom se vrhnu na MBR. Jinak, jak to máte vy s flashkou, taky máte zformátovanou a vaccined?

[petr0266]

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD1600AAJS-00PSA0 rev.05.06H05 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-16

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
1 ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\Harddisk0\DR0[0x89DF2AB8]
3 CLASSPNP[0xBA0E8FD7] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\0000006a[0x89E5B238]
5 ACPI[0xB9F7F620] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\Ide\IdeDeviceP2T0L0-16[0x89E5DD98]
kernel: MBR read successfully
user & kernel MBR OK

zkoušel jsem klikat na defogger (nic jsem s nim nedělal) a po restartu nebylo uninstall šedé.

[vyosek]

Ja ji neformatoval, pac jsem vedel ze je cista, jen jsem si ji naockoval (vacinate)

Tak mbr sektor je tez cisty na havet

[petr0266]

vše tedy čisté? . Ještě k minulým scanům combofixu, kdy mi kontroloval log RUDY, tak vždy před zprávy dokončena fáze 1-50, mi to napsalo, ze byl nalezen rootkit a je vyžadován restart počítače, po stisknutí ok se pc restartovalo a proběhla kontrola, nevíte, proč to udělalo? Dělalo to zatím při všech combofixech, s rádci jsem dělal hodně kontrol a nic nenašli.

[vyosek]

Bohuzel CFko obcas rootkit hlasi ackoliv tam neni

Jinak PC vypada ciste