Modra smrt

[Ronyc]

Nejdriv jsem zkusil tedy prehodit hdd do jineho pc kde je Avira kterou jsem ho proscanoval a pak jsem spustil crystaldiskinfo..mate jeste nejake rady co dal?Vidite tam neco?Pridavam obrazky a log z Aviry...


http://imageshack.us/g/685/foto1812k.jpg/



Log z Aviry...

Avira Free Antivirus
Report file date: 23. února 2012 17:53

Scanning for 3494289 virus strains and unwanted programs.

The program is running as an unrestricted full version.
Online services are available:

Licensee : Avira AntiVir Personal - Free Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : Andrea
Computer name : DOMA-5213877B98

Version information:
BUILD.DAT : 12.0.0.898 41963 Bytes 31.1.2012 14:50:00
AVSCAN.EXE : 12.1.0.20 492496 Bytes 16.2.2012 08:58:50
AVSCAN.DLL : 12.1.0.18 54224 Bytes 16.2.2012 08:58:50
LUKE.DLL : 12.1.0.19 68304 Bytes 16.2.2012 08:58:50
AVSCPLR.DLL : 12.1.0.22 100048 Bytes 16.2.2012 08:58:50
AVREG.DLL : 12.1.0.29 228048 Bytes 16.2.2012 08:58:50
VBASE000.VDF : 7.10.0.0 19875328 Bytes 6.11.2009 18:18:34
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 23:33:10
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 22:29:58
VBASE003.VDF : 7.11.21.238 4472832 Bytes 1.2.2012 17:40:54
VBASE004.VDF : 7.11.21.239 2048 Bytes 1.2.2012 17:40:54
VBASE005.VDF : 7.11.21.240 2048 Bytes 1.2.2012 17:40:54
VBASE006.VDF : 7.11.21.241 2048 Bytes 1.2.2012 17:40:54
VBASE007.VDF : 7.11.21.242 2048 Bytes 1.2.2012 17:40:54
VBASE008.VDF : 7.11.21.243 2048 Bytes 1.2.2012 17:40:54
VBASE009.VDF : 7.11.21.244 2048 Bytes 1.2.2012 17:40:54
VBASE010.VDF : 7.11.21.245 2048 Bytes 1.2.2012 17:40:54
VBASE011.VDF : 7.11.21.246 2048 Bytes 1.2.2012 17:40:54
VBASE012.VDF : 7.11.21.247 2048 Bytes 1.2.2012 17:40:54
VBASE013.VDF : 7.11.22.33 1486848 Bytes 3.2.2012 17:40:38
VBASE014.VDF : 7.11.22.56 687616 Bytes 3.2.2012 17:40:40
VBASE015.VDF : 7.11.22.92 178176 Bytes 6.2.2012 18:28:30
VBASE016.VDF : 7.11.22.154 144896 Bytes 8.2.2012 18:29:52
VBASE017.VDF : 7.11.22.220 183296 Bytes 13.2.2012 20:14:02
VBASE018.VDF : 7.11.23.34 202752 Bytes 15.2.2012 08:58:50
VBASE019.VDF : 7.11.23.98 126464 Bytes 17.2.2012 08:59:10
VBASE020.VDF : 7.11.23.150 148480 Bytes 20.2.2012 14:37:32
VBASE021.VDF : 7.11.23.151 2048 Bytes 20.2.2012 14:37:32
VBASE022.VDF : 7.11.23.152 2048 Bytes 20.2.2012 14:37:34
VBASE023.VDF : 7.11.23.153 2048 Bytes 20.2.2012 14:37:34
VBASE024.VDF : 7.11.23.154 2048 Bytes 20.2.2012 14:37:34
VBASE025.VDF : 7.11.23.155 2048 Bytes 20.2.2012 14:37:34
VBASE026.VDF : 7.11.23.156 2048 Bytes 20.2.2012 14:37:34
VBASE027.VDF : 7.11.23.157 2048 Bytes 20.2.2012 14:37:34
VBASE028.VDF : 7.11.23.158 2048 Bytes 20.2.2012 14:37:34
VBASE029.VDF : 7.11.23.159 2048 Bytes 20.2.2012 14:37:34
VBASE030.VDF : 7.11.23.160 2048 Bytes 20.2.2012 14:37:34
VBASE031.VDF : 7.11.23.222 172544 Bytes 23.2.2012 14:37:20
Engineversion : 8.2.10.4
AEVDF.DLL : 8.1.2.2 106868 Bytes 15.12.2011 14:00:12
AESCRIPT.DLL : 8.1.4.5 442745 Bytes 10.2.2012 18:29:02
AESCN.DLL : 8.1.8.2 131444 Bytes 27.1.2012 17:38:34
AESBX.DLL : 8.2.4.5 434549 Bytes 15.12.2011 14:00:10
AERDL.DLL : 8.1.9.15 639348 Bytes 14.12.2011 23:32:24
AEPACK.DLL : 8.2.16.3 799094 Bytes 10.2.2012 18:29:00
AEOFFICE.DLL : 8.1.2.25 201084 Bytes 24.1.2000 00:01:04
AEHEUR.DLL : 8.1.3.31 4395383 Bytes 17.2.2012 08:59:28
AEHELP.DLL : 8.1.19.0 254327 Bytes 20.1.2012 11:25:22
AEGEN.DLL : 8.1.5.21 409971 Bytes 3.2.2012 17:40:42
AEEXP.DLL : 8.1.0.22 70005 Bytes 17.2.2012 08:59:30
AEEMU.DLL : 8.1.3.0 393589 Bytes 14.12.2011 23:32:20
AECORE.DLL : 8.1.25.4 201079 Bytes 13.2.2012 20:14:02
AEBB.DLL : 8.1.1.0 53618 Bytes 14.12.2011 23:32:20
AVWINLL.DLL : 12.1.0.17 27344 Bytes 15.12.2011 14:00:18
AVPREF.DLL : 12.1.0.17 51920 Bytes 15.12.2011 14:00:14
AVREP.DLL : 12.1.0.17 179408 Bytes 15.12.2011 14:00:14
AVARKT.DLL : 12.1.0.23 209360 Bytes 16.2.2012 08:58:50
AVEVTLOG.DLL : 12.1.0.17 169168 Bytes 15.12.2011 14:00:14
SQLITE3.DLL : 3.7.0.0 398288 Bytes 15.12.2011 14:00:26
AVSMTP.DLL : 12.1.0.17 62928 Bytes 15.12.2011 14:00:16
NETNT.DLL : 12.1.0.17 17104 Bytes 15.12.2011 14:00:22
RCIMAGE.DLL : 12.1.0.17 4450000 Bytes 15.12.2011 14:00:36
RCTEXT.DLL : 12.1.1.16 96208 Bytes 15.12.2011 14:00:36

Configuration settings for the scan:
Jobname.............................: ShlExt
Configuration file..................: C:\DOCUME~1\Andrea\LOCALS~1\Temp\25836085.avp
Logging.............................: default
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: D:,
Process scan........................: off
Scan registry.......................: off
Search for rootkits.................: off
Integrity checking of system files..: off
Scan all files......................: Intelligent file selection
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: extended

Start of the scan: 23. února 2012 17:53

Starting the file scan:

Begin scan in 'D:\' <120 GB>
D:\Documents and Settings\Roman\Data aplikací\dplaysvr.exe
[DETECTION] Is the TR/Cleaman.G.572 Trojan
D:\Documents and Settings\Roman\Data aplikací\xakfsoymehfbqpeqimtecala1jqde1gs2\svcnost.exe
[DETECTION] Is the TR/Nedsym.G.381 Trojan
D:\Documents and Settings\Roman\Dokumenty\ICQ\233556124\ReceivedFiles\209832797 Ko+v!c\Lavasoft_Ad-Aware_Anniversary_2009_Professional_Edition_8.0.2.rar
[0] Archive type: RAR
--> Lavasoft Ad-Aware Anniversary 2009 Professional Edition 8.0.2\Ad-AwareAE.exe
[WARNING] The file could not be read!
[WARNING] The file could not be read!
D:\Documents and Settings\Roman\Local Settings\Data aplikací\47bbd5d7\X
[DETECTION] Is the TR/Drop.Sirefef.B.519 Trojan
D:\Documents and Settings\Roman\Local Settings\Temp\9.sys
[DETECTION] Is the TR/Agent.185344.37 Trojan
D:\Documents and Settings\Roman\Local Settings\Temp\nwaorvwa.exe
[DETECTION] Is the TR/Dldr.Yorobun.A.38 Trojan
D:\Documents and Settings\Roman\Local Settings\Temp\vqhowqy.exe
[DETECTION] Is the TR/Cleaman.G.570 Trojan
D:\Documents and Settings\Roman\Local Settings\Temporary Internet Files\Content.IE5\KBON6H0F\bromeo[1].htm
[DETECTION] Is the TR/Cleaman.G.570 Trojan
D:\Documents and Settings\Roman\Local Settings\Temporary Internet Files\Content.IE5\KBON6H0F\bromeo[4].htm
[DETECTION] Is the TR/Dldr.Harnig.S.2 Trojan
D:\Documents and Settings\Roman\Local Settings\Temporary Internet Files\Content.IE5\KBON6H0F\lpxemg[1].htm
[DETECTION] Is the TR/Nedsym.G.381 Trojan
D:\WINDOWS\assembly\GAC_MSIL\Desktop.ini
[DETECTION] Is the TR/ATRAPS.Gen2 Trojan
D:\WINDOWS\system32\MobilityService.dll
[DETECTION] Is the TR/Sirefef.BP.1 Trojan
D:\WINDOWS\temp\_ex-08.exe
--> Object
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

Beginning disinfection:
D:\WINDOWS\temp\_ex-08.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '4c4c2fba.qua'.
D:\WINDOWS\system32\MobilityService.dll
[DETECTION] Is the TR/Sirefef.BP.1 Trojan
[NOTE] The file was moved to the quarantine directory under the name '54cd0017.qua'.
D:\WINDOWS\assembly\GAC_MSIL\Desktop.ini
[DETECTION] Is the TR/ATRAPS.Gen2 Trojan
[NOTE] The file was moved to the quarantine directory under the name '068352e2.qua'.
D:\Documents and Settings\Roman\Local Settings\Temporary Internet Files\Content.IE5\KBON6H0F\lpxemg[1].htm
[DETECTION] Is the TR/Nedsym.G.381 Trojan
[NOTE] The file was moved to the quarantine directory under the name '60b312c3.qua'.
D:\Documents and Settings\Roman\Local Settings\Temporary Internet Files\Content.IE5\KBON6H0F\bromeo[4].htm
[DETECTION] Is the TR/Dldr.Harnig.S.2 Trojan
[NOTE] The file was moved to the quarantine directory under the name '253c3fff.qua'.
D:\Documents and Settings\Roman\Local Settings\Temporary Internet Files\Content.IE5\KBON6H0F\bromeo[1].htm
[DETECTION] Is the TR/Cleaman.G.570 Trojan
[NOTE] The file was moved to the quarantine directory under the name '5a270d9e.qua'.
D:\Documents and Settings\Roman\Local Settings\Temp\vqhowqy.exe
[DETECTION] Is the TR/Cleaman.G.570 Trojan
[NOTE] The file was moved to the quarantine directory under the name '168421d5.qua'.
D:\Documents and Settings\Roman\Local Settings\Temp\nwaorvwa.exe
[DETECTION] Is the TR/Dldr.Yorobun.A.38 Trojan
[NOTE] The file was moved to the quarantine directory under the name '6a95618f.qua'.
D:\Documents and Settings\Roman\Local Settings\Temp\9.sys
[DETECTION] Is the TR/Agent.185344.37 Trojan
[NOTE] The file was moved to the quarantine directory under the name '47d1490d.qua'.
D:\Documents and Settings\Roman\Local Settings\Data aplikací\47bbd5d7\X
[DETECTION] Is the TR/Drop.Sirefef.B.519 Trojan
[NOTE] The file was moved to the quarantine directory under the name '5e7d72ae.qua'.
D:\Documents and Settings\Roman\Data aplikací\xakfsoymehfbqpeqimtecala1jqde1gs2\svcnost.exe
[DETECTION] Is the TR/Nedsym.G.381 Trojan
[NOTE] The file was moved to the quarantine directory under the name '32f55968.qua'.
D:\Documents and Settings\Roman\Data aplikací\dplaysvr.exe
[DETECTION] Is the TR/Cleaman.G.572 Trojan
[NOTE] The file was moved to the quarantine directory under the name '435760f7.qua'.


End of the scan: 23. února 2012 19:55
Used time: 1:53:33 Hour(s)

The scan has been done completely.

10678 Scanned directories
372044 Files were scanned
12 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 Files were deleted
0 Viruses and unwanted programs were repaired
12 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
372032 Files not concerned
5261 Archives were scanned
2 Warnings
12 Notes

[Rudy]

Avira něco smazala. Ještě by nebyl od věci sken AVPTool: http://www.viry.cz/forum/viewtopic.php?f=29&t=58179 . Dejte log.

[Ronyc]

Jen upresnim zajima nas disk "D"... neco behem skenu vyhodila i Avira...

Kaspersky log:

Status: Quarantined (events: 12)
23.2.2012 22:39:16 Quarantined virus HEUR:Trojan.Win32.Generic D:\Documents and Settings\All Users\Resfont.exe High
24.2.2012 2:50:13 Quarantined virus HEUR:Trojan-Downloader.Win32.Generic D:\Documents and Settings\Prográmky\itvsetup.exe High
24.2.2012 2:50:12 Quarantined virus HEUR:Trojan-Downloader.Win32.Generic D:\Documents and Settings\Prográmky\itvsetup.exe//data0000 High
24.2.2012 3:33:24 Quarantined virus HEUR:Trojan.Win32.StartPage D:\Documents and Settings\Prográmky\Internet\Notifikator (upoz.na mail)\centrum-notifikator-blonde_xp.exe High
24.2.2012 4:32:55 Quarantined virus HEUR:Trojan.Win32.Generic D:\Documents and Settings\Roman\Data aplikací\setupbalancer.exe High
24.2.2012 4:54:20 Quarantined unknown threat UDS:DangerousObject.Multi.Generic D:\Documents and Settings\Roman\Dokumenty\ICQ Lite\233556124\ASKA_334287268\WebcamMaxv2300_Crack.exe High
24.2.2012 5:24:54 Quarantined virus HEUR:Trojan.Win32.Generic D:\Documents and Settings\Roman\Local Settings\Temp\labelgdi.exe High
24.2.2012 5:25:01 Quarantined virus HEUR:Trojan.Win32.Generic D:\Documents and Settings\Roman\Local Settings\Temp\sjdyw.exe High
24.2.2012 5:25:03 Quarantined virus HEUR:Backdoor.Win32.Generic D:\Documents and Settings\Roman\Local Settings\Temp\swnyrh.exe High
24.2.2012 5:25:08 Quarantined virus HEUR:Trojan.Win32.Generic D:\Documents and Settings\Roman\Local Settings\Temporary Internet Files\Content.IE5\8TY3WPMR\xavqxszh[1].htm High
24.2.2012 5:25:10 Quarantined virus HEUR:Trojan.Win32.Generic D:\Documents and Settings\Roman\Local Settings\Temporary Internet Files\Content.IE5\KBON6H0F\bromeo[2].htm High
24.2.2012 5:25:13 Quarantined virus HEUR:Backdoor.Win32.Generic D:\Documents and Settings\Roman\Local Settings\Temporary Internet Files\Content.IE5\KBON6H0F\pgojdlf[1].htm High
Status: Deleted (events: 6)
24.2.2012 4:24:41 Deleted adware not-a-virus:AdWare.Win32.Agent.xip D:\Documents and Settings\Prográmky\Unlocker\unlocker1.8.7.exe Medium
24.2.2012 4:24:41 Deleted adware not-a-virus:AdWare.Win32.Agent.xip D:\Documents and Settings\Prográmky\Unlocker\unlocker1.8.7.exe//data0013 Medium
24.2.2012 4:24:41 Deleted adware not-a-virus:AdWare.Win32.Agent.xip D:\Documents and Settings\Prográmky\Unlocker\unlocker1.8.7.exe//data0013//data0002 Medium
24.2.2012 4:32:52 Deleted Trojan program Trojan-Clicker.Win32.Vizita.fs D:\Documents and Settings\Roman\Data aplikací\dplayx.dll High
24.2.2012 5:24:57 Deleted Trojan program Trojan-PSW.Win32.Agent.abyd D:\Documents and Settings\Roman\Local Settings\Temp\osbmbt.exe High
24.2.2012 5:25:05 Deleted Trojan program Trojan-PSW.Win32.Agent.abyd D:\Documents and Settings\Roman\Local Settings\Temporary Internet Files\Content.IE5\8TY3WPMR\gxojucjryg[1].htm High
Status: Detected (events: 2)
24.2.2012 11:04:56 Detected Trojan program Trojan.Win32.Chifrax.cxp C:\Documents and Settings\Andrea\Dokumenty\Stažené soubory\Hirens.BootCD.15.1.zip/Hiren's.BootCD.15.1.iso//HBCD/Programs/Files/WinNTSetup.7z//WinNTSetup.exe High
24.2.2012 17:30:09 Detected Trojan program Trojan.Win32.Chifrax.cxp E:\Hirens.BootCD.15.1.zip/Hiren's.BootCD.15.1.iso//HBCD/Programs/Files/WinNTSetup.7z//WinNTSetup.exe High



Jeste jedna vec...jak se dostanu k ovladacum te zvukovky?Resp. jak spravne odstranit vsechno co se ji tyka,kdyz mam hdd v jinem pc?

[Rudy]

1. dost věcí AVP smazal.
2. Pokud to nepůjde odinstalovat, musíte znát, jak se soubory jmenují a dále bude třeba editovat registry podle návodu: http://forum.viry.cz/viewtopic.php?f=11&t=2791 , což lze ovšem provést, až pojede systém.

[Ronyc]

co mi tedy doporucujete?Mam zkusit hdd vratit do sveho pc a spustit jestli nabehne system nebo mate jeste nejakou radu?Jine logy (napr z HJT,RSIT...)?Nebo je zkusit az pokud nabehne system?...

[Rudy]

Vrátit disk do PC a zkusit start. Příp.provést opravu z instal. média.

[Ronyc]

Vratil jsem hdd zpet a po zapnuti pokracovala oprava z instlacniho cd.Behem te opravy vyskocila chyba (viz obr.1).Opakovani nepomohlo ,tak jsem dal ,ze chci pokracovat v instalaci bez kopirovani toho souboru a okamzite vyskocila dalsi chyba a dalsi a dalsi (vypis nize).Kdyz jsem dosel k posledni ,tak potom vyskocila opet "modra" se stejnou chybou jako predtim (obr.2)...

http://imageshack.us/g/594/foto1815n.jpg/

sapi.dl_
sapi.cp_
sapisvr.ex_
ltts1033.lx_
r1033tts.lx_
spttseng.dl_
sam.sd_
sam.sp_
spcommon.dl_
spcplni.dl_

[Rudy]

Je tam někde chyba v přenosu dat z instal. CD na disk. teoreticky může být kdekoli na cestě, tj.počínaje CD, přes mechaniku, kabely, RAMku, diskový řadič a disk samotný. Takto na dálku lze dost těžko zjistit.

[Ronyc]

Hmm ...tak co ted?Zkusim jinou mechaniku,zkontroluju vsechno propojeni...Jeste me napadlo...kdyz jsem poprve spustil opravu z instal cd,tak se prerusila "modrou".Kazdy dalsi spusteni pc pokracovala ta oprava nekde z pulky.Jak ji spustim znova?Treba ,kdyz byla hned poprve prerusena ,tak proto to ted blbne.Neni mozny?Jen nevim ,jak ji spustit znova od zacatku,protoze pokazdy mi naskoci do cca pulky.Do stejnyho mista.A to i kdyz mam v biosu prvni bootovani z hdd.

[Rudy]

Na tohle je právě dobré HBCD (viz odkaz výše). Najdete na něm všechny utility potřebné ke kontrole.