Nestha a virus

[Sulfaen]

Zdravim.ESET mi začal posílat spoustu souborů do karantény z důvodu Win32/Nestha A virus.Když chci něco spustit nahlásí mi to není platná aplikace typu Win32 . Našel sem zde několik podobných témat ale nepodařilo se mi to pomocí uvedených návodů spravit(snad sem aspon udělal správně Log).Prosím o pomoc.
děkuji



Log z RSIT
Logfile of random's system information tool 1.08 (written by random/random)
Run by Sator at 2011-05-02 11:04:09
Microsoft Windows 7 Ultimate
System drive C: has 5 GB (15%) free of 30 GB
Total RAM: 4094 MB (68% free)


======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
atieclxx
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe"
"C:\Program Files (x86)\Clarus\Samsung SecretZone\MSSvc.exe"
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k imgsvc
"taskhost.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe"
"C:\Users\Sator\Desktop\brekeke.com"
C:\Windows\System32\svchost.exe -k secsvcs
"D:\Mozilla Firefox\firefox.exe"
"D:\Mozilla Firefox\plugin-container.exe" --channel=2208.f47a2e0.1937619835 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll" "Mozilla.Firefox.4.0.1" -omnijar D:\Mozilla Firefox\omni.jar 2208 \\.\pipe\gecko-crash-server-pipe.2208 plugin
"X:\Astahování\brekeke.com.exe"
"C:\Users\Sator\Desktop\brekeke.com" C:\Users\Sator\Desktop\CFScript.txt
"C:\Users\Sator\Desktop\cudo.com"
"C:\Users\Sator\Desktop\rkill.scr" /S
"C:\Users\Sator\Desktop\rkill.exe"
"C:\Users\Sator\Desktop\cudo.com"
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 528 532 540 65536 536
"C:\Users\Sator\Desktop\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1033860688-509308204-2182955345-1001Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1033860688-509308204-2182955345-1001UA.job
C:\Windows\tasks\PCConfidential.job
C:\Windows\tasks\RegPowerClean.job
C:\Windows\tasks\RPCReminder.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64182481-4F71-486b-A045-B233BD0DA8FC}]
CescrtHlpr Object - C:\Program Files (x86)\facemoods.com\facemoods\1.4.15.13\bh\facemoods.dll [2010-08-30 262144]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83B80A9C-D91A-4F22-8DCF-EA7204039F79}]
NXIECatcher Class - D:\programky\Xi\NetXfer\NXIEHelper.dll [2010-02-20 49152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2011-02-01 1487240]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-11-29 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll [2010-03-25 1548096]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll [2010-01-03 1019128]
{C16CBAAC-A75C-4DB5-A0DD-CDF5CAFCDD3A} - NetXfer - D:\programky\Xi\NetXfer\NXToolBar.dll [2010-02-20 57344]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Ask Toolbar - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2011-02-01 1487240]
{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - facemoods Toolbar - C:\Program Files (x86)\facemoods.com\facemoods\1.4.15.13\facemoodsTlbr.dll [2010-08-30 217088]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll [2010-03-25 968000]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-01-19 9996320]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2011-01-12 2918656]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\Sator\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-02 136176]
"DAEMON Tools Lite"=D:\DAEMON~1\DTLite.exe [2011-05-02 357696]
"ICQ"=C:\Program Files (x86)\ICQ7.1\ICQ.exe [2011-05-02 133432]
"Steam"=X:\Steam\Steam.exe [2011-05-02 1242448]
"Spyware Doctor"=C:\Users\Sator\Desktop\sdsetup.exe -min []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe MSRun []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"facemoods"=C:\Program Files (x86)\facemoods.com\facemoods\1.4.15.13\facemoodssrv.exe [2011-05-02 323584]
"StartCCC"=D:\programky\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-09-30 98304]
"ATICustomerCare"=C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe [2011-05-02 311296]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2011-05-02 248552]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-05-02 932288]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
MSI US54SE 802.11b+g USB Stick Utility.lnk - D:\Programky\MSI\US54SE_Utility\ZDWlan.exe
Ralink Wireless Utility.lnk - C:\Program Files (x86)\Ralink\Common\RaUI.exe
WlanUtility.lnk - C:\Program Files (x86)\MicroStar\WLANUtility\WlanUtility.exe

C:\Users\Sator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Samsung Auto Backup Guage.lnk - C:\Program Files (x86)\Clarus\Samsung Auto Backup\ISFGuage.exe
Samsung Auto Backup Real-Time Daemon.lnk - C:\Program Files (x86)\Clarus\Samsung Auto Backup\ISFRealTimeD.exe
Samsung Auto Backup Scheduler.lnk - C:\Program Files (x86)\Clarus\Samsung Auto Backup\ISFTIMERD.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.exe - open - C:\Windows\svchost.com "%1" %*
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2011-05-02 11:04:09 ----D---- C:\rsit
2011-05-02 11:04:09 ----D---- C:\Program Files\trend micro
2011-05-02 10:57:00 ----RD---- C:\32788R22FWJFW
2011-05-02 09:58:52 ----DC---- C:\ProgramData\PC Tools
2011-05-02 09:21:53 ----DC---- C:\ProgramData\ESET
2011-05-02 09:21:53 ----D---- C:\Program Files\ESET
2011-05-02 08:45:34 ----DC---- C:\ProgramData\Martau
2011-05-02 08:45:32 ----DC---- C:\Program Files (x86)\Total Uninstall 5
2011-05-01 22:29:52 ----AC---- C:\Windows\directx.sys
2011-05-01 22:28:46 ----AC---- C:\Windows\svchost.com
2011-04-17 22:54:01 ----DC---- C:\Program Files (x86)\JoWooD
2011-04-07 10:04:46 ----ASH---- C:\pagefile.sys
2011-04-06 17:15:41 ----DC---- C:\Users\Sator\AppData\Roaming\Anim
2011-04-06 17:10:02 ----DC---- C:\ProgramData\ASign

======List of files/folders modified in the last 1 months======

2011-05-02 11:04:10 ----DC---- C:\Windows\Temp
2011-05-02 11:04:09 ----D---- C:\Program Files
2011-05-02 10:05:00 ----DC---- C:\Program Files (x86)\Ask.com
2011-05-02 09:58:52 ----DC---- C:\ProgramData
2011-05-02 09:48:01 ----DC---- C:\Program Files (x86)\Mozilla Firefox
2011-05-02 09:46:23 ----DC---- C:\Windows\system32\Tasks
2011-05-02 09:25:29 ----DC---- C:\Windows
2011-05-02 09:23:42 ----DC---- C:\Program Files (x86)\DAEMON Tools Toolbar
2011-05-02 09:23:33 ----DC---- C:\Program Files (x86)\WinRAR
2011-05-02 09:22:24 ----D---- C:\Fraps
2011-05-02 09:22:22 ----SHDC---- C:\Windows\Installer
2011-05-02 09:22:17 ----DC---- C:\Windows\system32\drivers
2011-05-02 09:22:17 ----DC---- C:\Windows\system32\catroot
2011-05-02 09:22:17 ----DC---- C:\Windows\inf
2011-05-02 09:22:17 ----D---- C:\Windows\system32\DriverStore
2011-05-02 09:21:49 ----SHD---- C:\System Volume Information
2011-05-02 09:17:09 ----DC---- C:\Users\Sator\AppData\Roaming\ICQ
2011-05-02 08:45:32 ----DC---- C:\Program Files (x86)
2011-05-02 00:22:29 ----DC---- C:\Windows\system32\wbem
2011-05-02 00:21:35 ----DC---- C:\Windows\system32\config
2011-05-02 00:21:31 ----DC---- C:\Windows\system32\catroot2
2011-05-02 00:21:30 ----DC---- C:\Windows\registration
2011-05-02 00:16:12 ----HDC---- C:\Program Files (x86)\InstallShield Installation Information
2011-05-01 23:39:17 ----AC---- C:\Windows\ntbtlog.txt
2011-05-01 22:28:32 ----DC---- C:\Windows\Prefetch
2011-05-01 21:33:38 ----DC---- C:\Windows\SysWOW64
2011-04-29 18:07:34 ----DC---- C:\Users\Sator\AppData\Roaming\uTorrent
2011-04-29 05:22:01 ----DC---- C:\Windows\Tasks
2011-04-29 05:22:01 ----DC---- C:\Windows\system32\wfp
2011-04-29 05:22:01 ----DC---- C:\Windows\System32
2011-04-29 05:20:03 ----DC---- C:\Windows\system32\LogFiles
2011-04-26 15:08:50 ----DC---- C:\Users\Sator\AppData\Roaming\.minecraft
2011-04-25 09:51:42 ----AC---- C:\Windows\WINCMD.INI
2011-04-21 17:26:54 ----AC---- C:\Windows\system32\PerfStringBackup.INI
2011-04-21 17:25:48 ----AC---- C:\Windows\NeroDigital.ini
2011-04-17 15:58:21 ----AC---- C:\Windows\level.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-04-03 834544]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-12-21 141264]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-12-21 170640]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2010-12-21 125296]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2010-09-29 7883264]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2010-09-29 285696]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2010-08-16 116240]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-01-19 2242720]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
S2 ithsgt;ithsgt; C:\Windows\system32\DRIVERS\ithsgt.sys []
S2 lilsgt;lilsgt; C:\Windows\system32\DRIVERS\lilsgt.sys []
S3 a4lysvcw;a4lysvcw; C:\Windows\system32\drivers\a4lysvcw.sys []
S3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2010-01-28 116736]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-09-29 203264]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-01-12 810144]
R2 ICQ Service;ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [2010-01-03 246520]
R2 MSR Service;Virtual Disk Service Manager; C:\Program Files (x86)\Clarus\Samsung SecretZone\MSSvc.exe [2010-03-13 114688]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2010-08-31 66872]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe []
S3 DAUpdaterSvc;Dragon Age: Prameny - aktualizace obsahu; D:\hry\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-12-15 25832]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2011-01-12 42360]
S3 gusvc;Google Updater Service; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-05-01 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2011-05-01 69632]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-05-01 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2011-05-01 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]

-----------------EOF-----------------

[JaRon]

C:\Windows\svchost.com premenuj na lubovolny nazov napr. bubak.com
restart PC a spust kontrolu s MBAM

[Sulfaen]

Děkuji za pomoc vše zas normálně funguje

[JaRon]

ani to nebolelo nemas zac

[stell]

Doplnim kolegu
Sprav este toto: