Mám vir Backdoor.Graybird! Jak ho odstranit prosím?!

[Caroprd111]

Spusťte OTL a do spodního okna vložte následující skript.

Kód: Vybrat vše

:OTL
SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
O20 - Winlogon\Notify\dimsntfy: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
[2010.07.11 11:49:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Data aplikací\TEMP
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

:Commands
[EMPTYTEMP] 
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]

Klikněte na Opravit, PC se restartuje, log vložte sem.


Doporučuji odinstalovat µTorrent.

P2P sítě a jejich klienti jsou potenciálním bezpečnostním rizikem, prakticky neustále jsou zdrojem virů, zbytečně se vystavujete riziku.

[Phoenixman]

Doufám, že je to ono:

All processes killed
========== OTL ==========
Service HidServ stopped successfully!
Service HidServ deleted successfully!
File C:\WINDOWS\System32\hidserv.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy\ deleted successfully.
C:\Documents and Settings\All Users\Data aplikací\TEMP folder moved successfully.
C:\WINDOWS\002725_.tmp deleted successfully.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SET4.tmp deleted successfully.
C:\WINDOWS\SET8.tmp deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56504 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Phoenixman
->Temp folder emptied: 105017996 bytes
->Temporary Internet Files folder emptied: 48760080 bytes
->Java cache emptied: 60850 bytes
->FireFox cache emptied: 95123617 bytes
->Flash cache emptied: 67477 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2505532 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 240,00 mb


[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: Phoenixman
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb

Restore points cleared and new OTL Restore Point set!

OTL by OldTimer - Version 3.2.9.0 log created on 07112010_130720

Files\Folders moved on Reboot...
C:\WINDOWS\temp\Perflib_Perfdata_770.dat moved successfully.

Registry entries deleted on Reboot...

[Caroprd111]

Odinstalujte všechny emulátory virtuálních mechanik.

Stáhněte SPTD http://www.duplexsecure.com/en/downloads

• Vyberte verzi podle svého operačního systému (64 & 32b). Uložte na plochu a spusťte.
• zvolte možnost Uninstall a restartujte PC.

Stáhněte a spusťte http://www.jpshortstuff.247fixes.com/Defogger.exe

• Klikněte na "Disable" a restartujte PC.

Stáhněte MBR na plochu http://www2.gmer.net/mbr/mbr.exe

Start > Spustit (Win + R)

• Vyskočí okénko, zkopírujte do něj:

Kód: Vybrat vše

"%userprofile%\plocha\mbr" -t

• Klikněte na OK

• Vytvoří se log s názvem mbr.log, vložte ho sem.

Dejte log z Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878

[Phoenixman]

Zatím přináším MBR.log, to ostatní se mě zatím nedaří splnit...

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe

[Caroprd111]

Jste si jistý, že jste log zkopíroval celý? Jak to myslíte, že se Vám nedaří spustit?

[Phoenixman]

Myslíte ten MBR.log ? Ano, ten sem zkopíroval celý

[Phoenixman]

Když dělám ten SCAN v GMERU, tak se mi počítač sám po nějaké době samorestartuje, už se mi tohle stalo dvakrát...

[Phoenixman]

MBR sem udělal znovu:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys
kernel: MBR read successfully
user & kernel MBR OK

[Caroprd111]

OK, ještě Gmer.

[Phoenixman]

Tak konečně se zadařilo...GMER je tu:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-07-11 17:35:29
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\PHOENI~1\LOCALS~1\Temp\uwkcypod.sys


---- System - GMER 1.0.15 ----

SSDT 8833D7D0 ZwAlertResumeThread
SSDT 883497D0 ZwAlertThread
SSDT 87B77A48 ZwAllocateVirtualMemory
SSDT 882FB050 ZwAssignProcessToJobObject
SSDT 899AF4A0 ZwConnectPort
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwCreateKey [0xB5F75210]
SSDT 87B6D8C0 ZwCreateMutant
SSDT 87B68428 ZwCreateSymbolicLinkObject
SSDT 88303930 ZwCreateThread
SSDT 899918C8 ZwDebugActiveProcess
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteKey [0xB5F75490]
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xB5F759F0]
SSDT 87B77CE0 ZwDuplicateObject
SSDT 87B772A8 ZwFreeVirtualMemory
SSDT 883504D0 ZwImpersonateAnonymousToken
SSDT 8836F4D0 ZwImpersonateThread
SSDT 88447450 ZwLoadDriver
SSDT 87B77148 ZwMapViewOfSection
SSDT 88315050 ZwOpenEvent
SSDT 87B77F80 ZwOpenProcess
SSDT 87C50890 ZwOpenProcessToken
SSDT 88310050 ZwOpenSection
SSDT 87B77E30 ZwOpenThread
SSDT 87B68A38 ZwProtectVirtualMemory
SSDT 883297D0 ZwResumeThread
SSDT 88300070 ZwSetContextThread
SSDT 87B75008 ZwSetInformationProcess
SSDT 87BCB050 ZwSetSystemInformation
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xB5F75C40]
SSDT 87C41050 ZwSuspendProcess
SSDT 88327890 ZwSuspendThread
SSDT 88340E00 ZwTerminateProcess
SSDT 8832A688 ZwTerminateThread
SSDT 8995D780 ZwUnmapViewOfSection
SSDT 87B776B8 ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.15 ----

? SYMDS.SYS Systém nemůže nalézt uvedený soubor. !
? SYMEFA.SYS Systém nemůže nalézt uvedený soubor. !
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB7722360, 0x33ABBD, 0xE8000020]
? C:\DOCUME~1\PHOENI~1\LOCALS~1\Temp\mbr.sys Systém nemůže nalézt uvedený soubor. !

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xBB 0x7E 0xA2 0x67 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xBB 0x7E 0xA2 0x67 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x77 0x94 0x37 0x1D ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x78 0x0F 0x5D 0x1C ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xBB 0x7E 0xA2 0x67 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x77 0x94 0x37 0x1D ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x78 0x0F 0x5D 0x1C ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xBB 0x7E 0xA2 0x67 ...

---- EOF - GMER 1.0.15 ----

[Caroprd111]

Stáhněte a uložte, nejlépe na plochu http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypněte všechny rezidentní bezpečnostní programy - firewally, antiviry, antispywary
• Vložte do PC všechny flash disky, které používáte.
• Spusťte aplikaci pod účtem s oprávněním Administrátora (Správce), ihned po startu se zobrazí stránka s licenčními podmínkami, pokračujte stisknutím tlačítka "Ano"
• Dále postupujte dle pokynů, během scanu nespouštějte jiné aplikace a neklikejte do zobrazujícího se okna
• Scan by měl trvat okolo 5 - 10 minut, po dokončení Combofix zobrazí log C:\ComboFix.txt , který sem vložte.
• Během skenování může být počítač restartován.

[Phoenixman]

Spusťte aplikaci pod účtem s oprávněním Administrátora (Správce)


...

můžete mi napsat přesnou cestu, jak to myslíte?

[Phoenixman]

normálně jsem program spustil a objevilo se okénko Zřeknutí se práva záruky na funkčnost software ANO / NE... tam dat teda ANO ?

[Caroprd111]

Dejte "ANO".

[Phoenixman]

posílám log.txt - můžu už zapnout firewall a nortona?

ComboFix 10-07-10.02 - Phoenixman 11.07.2010 20:17:52.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.2046.1510 [GMT 2:00]
Spuštěný z: c:\documents and settings\Phoenixman\Plocha\ComboFix.exe
AV: Norton AntiVirus *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\st325602.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-06-11 do 2010-07-11 )))))))))))))))))))))))))))))))
.

2010-07-11 11:07 . 2010-07-11 11:07 -------- d-----w- C:\_OTL
2010-07-11 10:14 . 2010-07-11 10:14 -------- d-----w- C:\rsit
2010-07-11 10:14 . 2010-07-11 10:14 -------- d-----w- c:\program files\trend micro
2010-07-08 15:56 . 2001-10-24 10:25 5632 ----a-w- c:\windows\system32\ptpusb.dll
2010-07-08 15:56 . 2004-08-17 13:49 159232 ----a-w- c:\windows\system32\ptpusd.dll
2010-07-08 15:56 . 2004-08-03 20:58 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2010-07-08 15:56 . 2004-08-03 20:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-07-05 13:09 . 2010-07-05 14:23 -------- d-----w- c:\program files\Electronic Arts
2010-07-04 00:52 . 2010-07-04 01:00 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-07-04 00:49 . 2010-07-05 13:23 -------- d-----w- C:\ProgramData
2010-07-04 00:45 . 2008-09-05 00:22 447752 ----a-r- c:\windows\system32\vp6vfw.dll
2010-07-04 00:45 . 2010-07-04 00:45 -------- d-----w- c:\program files\Microsoft WSE
2010-07-04 00:39 . 2006-09-28 14:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2010-07-04 00:39 . 2010-07-04 00:39 -------- d-----w- c:\windows\Logs
2010-07-02 18:22 . 2010-07-11 14:11 -------- d-----w- c:\program files\bwinPoker
2010-06-30 21:47 . 2010-06-30 21:48 -------- d-----w- c:\program files\QuickTime
2010-06-30 21:47 . 2010-06-30 21:47 -------- d-----w- c:\program files\Common Files\Apple
2010-06-30 21:47 . 2010-06-30 21:47 -------- d-----w- c:\program files\Apple Software Update
2010-06-26 14:14 . 2010-06-26 14:20 -------- d-----w- c:\windows\system32\CatRoot_bak
2010-06-26 12:10 . 2008-04-14 03:22 221184 ----a-w- c:\windows\system32\wmpns.dll
2010-06-26 10:22 . 2010-06-26 13:41 -------- d-----w- c:\windows\l2schemas
2010-06-26 10:22 . 2010-06-26 13:41 -------- d-----w- c:\windows\system32\bits
2010-06-26 10:22 . 2010-06-26 10:22 -------- d-----w- c:\windows\system32\cs
2010-06-26 10:05 . 2009-10-21 06:03 25088 ----a-w- c:\windows\system32\dllcache\httpapi.dll
2010-06-26 09:55 . 2009-08-21 06:52 450560 -c--a-w- c:\windows\system32\dllcache\jscript.dll
2010-06-26 03:59 . 2010-05-04 17:18 52224 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-06-26 03:59 . 2010-05-04 17:18 459264 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-06-26 03:59 . 2010-05-04 17:18 6067200 -c----w- c:\windows\system32\dllcache\ieframe.dll
2010-06-26 03:59 . 2010-05-04 17:18 268288 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-06-26 03:59 . 2010-05-04 17:18 380928 -c----w- c:\windows\system32\dllcache\ieapfltr.dll
2010-06-26 03:59 . 2010-04-16 13:24 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe
2010-06-26 03:59 . 2010-02-22 22:04 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat
2010-06-26 03:59 . 2010-05-04 17:18 63488 -c----w- c:\windows\system32\dllcache\icardie.dll
2010-06-26 03:59 . 2010-06-26 10:22 -------- d-----w- c:\windows\system32\cs-cz
2010-06-25 22:27 . 2010-06-25 22:27 -------- d-----w- c:\windows\system32\KB905474
2010-06-25 09:29 . 2010-06-25 09:30 -------- d-----w- c:\program files\PhotoFiltre
2010-06-24 14:18 . 2010-06-24 14:18 -------- d-----w- c:\windows\Sun
2010-06-24 13:32 . 2010-06-24 13:32 -------- d-----w- c:\program files\Common Files\Java
2010-06-24 13:29 . 2010-06-24 13:29 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-06-24 13:29 . 2010-06-24 13:29 -------- d-----w- c:\program files\Java
2010-06-24 13:17 . 2010-06-24 13:27 -------- d-----w- c:\windows\system32\Adobe
2010-06-24 12:49 . 2010-06-24 12:49 -------- d-----w- c:\program files\Common Files\Adobe
2010-06-24 12:26 . 2010-06-24 12:26 -------- d-----w- c:\program files\Webteh
2010-06-24 12:20 . 2010-06-24 12:20 -------- d-----w- c:\program files\MPC HomeCinema
2010-06-24 12:15 . 2010-06-24 12:15 -------- d-----w- c:\program files\VS Revo Group
2010-06-24 12:11 . 2010-06-24 12:17 -------- d-----w- c:\program files\VideoLAN
2010-06-24 11:53 . 2009-08-06 17:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-06-24 11:53 . 2009-08-06 17:23 215920 ----a-w- c:\windows\system32\muweb.dll
2010-06-24 11:51 . 2008-11-10 09:41 32656 ----a-w- c:\windows\system32\msonpmon.dll
2010-06-24 11:51 . 2006-10-26 17:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2010-06-24 11:49 . 2010-06-25 22:23 -------- d-----w- c:\program files\Microsoft Works
2010-06-24 11:49 . 2010-06-24 11:49 -------- d-----w- c:\program files\MSBuild
2010-06-24 11:45 . 2010-06-24 11:48 -------- d-----w- c:\windows\SHELLNEW
2010-06-24 11:45 . 2010-06-24 11:45 -------- d-----r- C:\MSOCache
2010-06-24 11:33 . 2010-06-24 11:34 -------- d-----w- c:\program files\QIP
2010-06-24 10:54 . 2010-06-24 10:55 -------- d-----w- c:\program files\totalcmd
2010-06-24 10:54 . 2010-06-17 05:55 545 ----a-w- c:\windows\UC.PIF
2010-06-24 10:54 . 2010-06-17 05:55 545 ----a-w- c:\windows\RAR.PIF
2010-06-24 10:54 . 2010-06-17 05:55 545 ----a-w- c:\windows\PKZIP.PIF
2010-06-24 10:54 . 2010-06-17 05:55 545 ----a-w- c:\windows\PKUNZIP.PIF
2010-06-24 10:54 . 2010-06-17 05:55 545 ----a-w- c:\windows\NOCLOSE.PIF
2010-06-24 10:54 . 2010-06-17 05:55 545 ----a-w- c:\windows\LHA.PIF
2010-06-24 10:54 . 2010-06-17 05:55 545 ----a-w- c:\windows\ARJ.PIF
2010-06-24 10:38 . 2010-06-24 10:54 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-06-24 10:38 . 2010-06-24 10:38 -------- d-----w- c:\program files\Symantec
2010-06-24 10:38 . 2010-06-24 10:38 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2010-06-24 10:38 . 2010-06-24 10:38 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-06-24 10:38 . 2010-06-24 18:40 -------- d-----w- c:\windows\system32\drivers\NAV
2010-06-24 10:38 . 2010-06-24 10:38 -------- d-----w- c:\program files\Windows Sidebar
2010-06-24 10:38 . 2010-06-24 10:38 -------- d-----w- c:\program files\Norton AntiVirus
2010-06-24 01:28 . 2010-07-10 15:38 32346 ----a-w- c:\windows\system32\nvModes.dat
2010-06-24 01:26 . 2010-06-24 01:26 -------- d-----w- c:\windows\nview
2010-06-24 01:26 . 2009-03-11 12:04 453152 ----a-w- c:\windows\system32\nvudisp.exe
2010-06-24 01:25 . 2009-03-09 10:04 453152 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-06-24 00:42 . 2007-05-10 08:23 94208 ----a-w- c:\windows\system32\stacsv.exe
2010-06-24 00:42 . 2007-05-10 08:22 405504 ----a-w- c:\windows\stsystra.exe
2010-06-24 00:42 . 2007-04-10 15:02 1601536 ----a-w- c:\windows\system32\stlang.dll
2010-06-24 00:42 . 2004-08-17 13:49 4096 ----a-w- c:\windows\system32\ksuser.dll
2010-06-24 00:42 . 2007-05-10 08:24 1222840 ----a-w- c:\windows\system32\drivers\sthda.sys
2010-06-24 00:42 . 2007-05-10 08:23 270336 ----a-w- c:\windows\system32\stacapi.dll
2010-06-24 00:42 . 2010-07-05 14:23 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-24 00:42 . 2010-06-24 00:42 -------- d-----w- c:\program files\SigmaTel
2010-06-24 00:42 . 2010-06-24 00:42 -------- d-----w- c:\program files\Common Files\InstallShield

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-11 11:07 . 2001-10-25 14:00 69114 ----a-w- c:\windows\system32\perfc005.dat
2010-07-11 11:07 . 2001-10-25 14:00 390176 ----a-w- c:\windows\system32\perfh005.dat
2010-06-26 13:36 . 2008-11-24 02:12 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-06-26 13:36 . 2008-11-24 02:12 2426 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-06-24 13:25 . 2010-06-24 10:37 -------- d-----w- c:\program files\NortonInstaller
2010-06-24 10:38 . 2010-06-24 10:38 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2010-06-24 10:38 . 2010-06-24 10:38 7443 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2010-06-24 10:34 . 2010-06-24 10:34 -------- d-----w- c:\program files\MSXML 6.0
2010-05-04 17:18 . 2004-08-17 13:49 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-05-02 08:27 . 2010-06-26 10:05 1850880 ----a-w- c:\windows\system32\win32k.sys
2010-04-29 09:47 . 2010-04-29 09:47 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-04-29 09:47 . 2010-04-29 09:47 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-04-20 05:48 . 2004-08-17 13:48 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-16 15:38 . 2004-08-17 13:49 663040 ----a-w- c:\windows\system32\wininet.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-10-08 995328]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-10-08 1101824]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-11 13594624]
"nwiz"="nwiz.exe" [2009-03-11 1657376]
"NVHotkey"="nvHotkey.dll" [2009-03-11 90112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-11 86016]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-07-02 159744]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1107000.00C\symds.sys [24.6.2010 19:40 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1107000.00C\symefa.sys [24.6.2010 19:40 173104]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\BASHDefs\20100619.001\BHDrvx86.sys [19.6.2010 0:46 691248]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1107000.00C\cchpx86.sys [24.6.2010 19:40 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1107000.00C\ironx86.sys [24.6.2010 19:40 116784]
R2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\17.7.0.12\ccsvchst.exe [24.6.2010 19:40 126392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [24.6.2010 12:46 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\IPSDefs\20100709.001\IDSXpx86.sys [10.7.2010 3:39 331640]
S4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
.
Obsah adresáře 'Naplánované úlohy'

2010-07-11 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-06-25 20:18]
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = hxxp://firefox.com/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Phoenixman\Data aplikací\Mozilla\Firefox\Profiles\iczpqh5h.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - component: c:\documents and settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\IPSFFPlgn\components\IPSFFPl.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

MSConfigStartUp-DAEMON Tools Lite - c:\program files\DAEMON Tools Lite\DTLite.exe



**************************************************************************
skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NAV]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\17.7.0.12\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\17.7.0.12\diMaster.dll\" /prefetch:1"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(904)
c:\windows\system32\netprovcredman.dll

- - - - - - - > 'explorer.exe'(2472)
c:\windows\system32\netprovcredman.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\StacSV.exe
c:\program files\Intel\Wireless\Bin\WLKeeper.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\DellTPad\ApMsgFwd.exe
c:\program files\DellTPad\Apntex.exe
c:\program files\DellTPad\HidFind.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
.
**************************************************************************
.
Celkový čas: 2010-07-11 20:29:27 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-07-11 18:29

Před spuštěním: Volných bajtů: 68 408 467 456
Po spuštění: Volných bajtů: 68 317 753 344

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 95F4995269ACCA6289BB9AA7B3AE0FC7