VIRY.CZ

Tak jsem znovu pouzil navod na MWAV se vsim smazanim cage a historie i nastavenim obnovy systemu - zrusit s timto vysledkem:

Soubor H:\System Volume Information\_restore{647E7953-0346-44F5-8F9D-4781DD249444}\RP80\A0011241.exe je infikovaný virem Exe.Corrupted !! Provedené akce: Ponecháno, neodstraněno!.
Soubor H:\System Volume Information\_restore{D4AADF8A-13F5-4EFE-BBEE-B554B3198A8B}\RP9\A0004569.exe je infikovaný virem Trojan.Feutel.AV (DB) !! Provedené akce: Ponecháno, neodstraněno!.
Soubor H:\System Volume Information\_restore{D4AADF8A-13F5-4EFE-BBEE-B554B3198A8B}\RP9\A0005017.exe je infikovaný virem Gen:Trojan.Heur.PT.cqW@byCOz!ke (DB) !! Provedené akce: Ponecháno, neodstraněno!.

Tohle nelze odstranit ani pres obnovu systemu. Disk H: je samostatny 320GB fyzicky SATA disk s daty.

Ted jeste zkusim ten CurelIt....

Takze ani CurelIt nenasel nic.

UP

ake su problemy s PC

PC funguje vcelku bez problemu. Problem je ten, ze komunikatory ICQ a QIP neustale rozesilaji a naopak prijimaji ruzne spamy s odkazy na ruske stranky. Neustale se autorizuji uzivatele (cca 2-3 za den), kteri zjevne nejsou nebo nechteji byt moji znami a ani nejsou z CR (nejcasteji opet Rusko nebo Ukrajina). Ja pouzivam QIP a moje pritelkyne pouziva ICQ. Nikdo jiny na PC nechodi. Obcas se stane, ze se objevi online cislo me pritelkyne, ktera prokazatelne neni a nemuze byt pripojena, protoze je doma nebo v praci, kde ICQ nepouziva (ani jej nepouziva nikdo jiny). Diky

preventivne vloz log z ComboFix-u

Zmen si hesla na uctoch ICQ a QIP, pravdepodobne ti unikli a teraz ich pouziva nejaky spamovaci robot

ComboFix 10-02-24.03 - scratch 25.02.2010 8:40.4.3 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3326.2765 [GMT 1:00]
Spuštěný z: c:\documents and settings\scratch\Plocha\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((( Soubory vytvořené od 2010-01-25 do 2010-02-25 )))))))))))))))))))))))))))))))
.

2010-02-24 12:26 . 2010-02-24 12:26 -------- d-----w- c:\program files\Common Files\Freedom Scientific
2010-02-24 12:25 . 2010-02-24 12:25 -------- d-----w- c:\program files\Common Files\soft602
2010-02-24 12:25 . 2010-02-24 12:25 -------- d-----w- c:\program files\Software602
2010-02-17 15:42 . 2010-02-17 15:42 -------- d-----w- c:\program files\MediaInfo
2010-01-26 13:14 . 2010-01-26 13:14 25586 ----a-w- C:\aem8.dat
2010-01-26 13:12 . 2005-05-18 10:52 1212416 ----a-w- c:\windows\system32\NCTAudioInformation2.dll
2010-01-26 13:12 . 2005-05-17 11:37 1986560 ----a-w- c:\windows\system32\NCTAudioFile2.dll
2010-01-26 13:12 . 2005-04-25 12:01 458752 ----a-w- c:\windows\system32\NCTAudioRecord2.dll
2010-01-26 13:12 . 2005-04-25 12:01 458752 ----a-w- c:\windows\system32\NCTAudioPlayer2.dll
2010-01-26 13:12 . 2005-04-15 11:08 880640 ----a-w- c:\windows\system32\NCTAudioEditor2.dll
2010-01-26 13:12 . 2005-04-04 16:21 602112 ----a-w- c:\windows\system32\NCTAudioTransform2.dll
2010-01-26 13:12 . 2005-04-04 14:06 348160 ----a-w- c:\windows\system32\NCTWMAFile2.dll
2010-01-26 13:12 . 2005-03-29 06:57 2084864 ----a-w- c:\windows\system32\NCTAudioDesign2.dll
2010-01-26 13:12 . 2005-03-28 14:56 417792 ----a-w- c:\windows\system32\NCTAudioDisplay2.dll
2010-01-26 13:12 . 2005-03-28 14:54 479232 ----a-w- c:\windows\system32\NCTAudioVisualization2.dll
2010-01-26 13:12 . 2004-11-04 12:31 835584 ----a-w- c:\windows\system32\NCTAudioCDGrabber2.dll
2010-01-26 13:12 . 2010-01-26 13:12 -------- d-----w- c:\program files\Audio Edit Magic
2010-01-26 12:18 . 2010-01-26 12:18 -------- d-----w- c:\program files\VideoLAN
2010-01-26 11:28 . 2010-01-26 11:31 -------- d-----w- c:\documents and settings\scratch\IGC
2010-01-26 11:25 . 2010-01-26 11:25 -------- d-----w- c:\program files\IGC
2010-01-26 11:16 . 2001-09-27 08:28 260531 ----a-w- c:\windows\pdfcvt.dat
2010-01-26 11:16 . 2010-01-26 11:16 -------- d-----w- c:\program files\Any DWG to PDF Converter

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-25 07:34 . 2010-02-25 07:35 390144 ----a-w- c:\windows\system32\CF14322.exe
2010-02-25 05:26 . 2009-10-19 17:28 -------- d-----w- c:\program files\JDownloader 0.8
2010-02-25 05:20 . 2009-06-19 15:24 -------- d-----w- c:\program files\MSXML 4.0
2010-02-11 08:00 . 2009-07-14 08:53 -------- d-----w- c:\program files\BeSweetv1.4
2010-02-01 13:48 . 2009-06-17 21:42 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-26 11:25 . 2009-06-15 11:49 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-25 13:23 . 2001-10-25 14:00 484222 ----a-w- c:\windows\system32\perfh005.dat
2010-01-25 13:23 . 2001-10-25 14:00 107256 ----a-w- c:\windows\system32\perfc005.dat
2010-01-25 12:57 . 2010-01-25 12:57 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-01-24 18:02 . 2010-01-13 08:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-23 18:59 . 2010-01-23 18:59 -------- d-----w- c:\program files\TrendMicro
2010-01-22 05:25 . 2009-06-15 14:03 -------- d-----w- c:\program files\totalcmd
2010-01-20 15:22 . 2009-06-19 13:38 -------- d-----w- c:\program files\Electronic Arts
2010-01-20 15:21 . 2009-06-18 10:53 -------- d-----w- c:\program files\EA Games
2010-01-20 15:12 . 2009-06-18 08:18 -------- d-----w- c:\program files\EA SPORTS
2010-01-20 15:06 . 2009-06-15 15:42 -------- d-----w- c:\program files\Ubisoft
2010-01-20 15:05 . 2009-06-15 17:21 -------- d-----w- c:\program files\Your Uninstaller 2008
2010-01-13 17:37 . 2009-06-18 11:06 -------- d-----w- c:\program files\Activision
2010-01-13 11:28 . 2010-01-13 11:28 -------- d-----w- c:\program files\CCleaner
2010-01-07 15:07 . 2010-01-13 08:30 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2010-01-13 08:30 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-04 18:00 . 2010-01-25 12:57 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2009-12-31 16:50 . 2004-08-03 21:14 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:08 . 2004-08-17 13:49 916480 ------w- c:\windows\system32\wininet.dll
2009-12-17 07:42 . 2009-06-15 11:40 343552 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:10 . 2004-08-17 13:49 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-12 14:15 . 2010-01-25 12:57 178176 ----a-w- c:\windows\system32\unrar.dll
2009-12-09 10:11 . 2004-08-17 13:45 2147328 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-09 10:11 . 2004-08-17 15:45 2025984 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2004-08-03 21:15 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:14 . 2004-08-17 13:49 1294336 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 17:14 . 2004-08-17 15:49 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:09 . 2001-10-25 14:00 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:09 . 2001-10-24 12:25 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:09 . 2004-08-17 15:49 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:09 . 2004-08-17 13:49 11264 ----a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:09 . 2004-08-17 13:49 84992 ----a-w- c:\windows\system32\avifil32.dll
2006-03-20 13:34 . 2009-07-22 06:42 4796416 ----a-w- c:\program files\mplayerc.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 94208]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"QIP2005"="c:\program files\QIP\qip.exe" [2009-08-13 3276288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-08-26 16851456]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-09 13680640]
"nwiz"="nwiz.exe" [2009-02-09 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-09 86016]
"TWCU"="c:\program files\TP-LINK\TWCU\TWCU.exe" [2006-03-29 364544]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2007-12-21 1443072]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"FineReader7NewsReaderPro"="c:\program files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe" [2003-12-09 278528]
"ICQ Lite"="c:\program files\ICQLite\ICQLite.exe" [2009-11-11 3142236]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Program Files\\ICQLite\\ICQLite.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=

R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [21.12.2007 7:21 468224]
S0 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [25.10.2001 15:00 3584]
S3 SureThing Labelflash service;SureThing Labelflash service;c:\program files\Common Files\SureThing Shared\stllssvr.exe [17.8.2009 10:01 74392]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.facebook.com/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\scratch\Data aplikací\Mozilla\Firefox\Profiles\zp8ichb8.default\
FF - prefs.js: browser.startup.homepage - www.centrum.cz
FF - prefs.js: network.proxy.type - 2
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll
FF - plugin: c:\program files\Opera\program\plugins\nppl3260.dll
FF - plugin: c:\program files\Opera\program\plugins\nprpjplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-360WAVESPATCHERCLT - c:\download\360WavesPatcher\WDUNINST.EXE



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-25 08:43
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-2052111302-1326574676-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:e1,d5,7a,01,59,ee,49,d9,57,ff,2a,29,2f,a2,60,d7,69,0e,22,88,49,
41,6d,75,84,2f,0f,67,84,27,1f,4f,92,47,6f,16,ef,e5,ea,e7,a2,e5,a1,d3,50,48,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(2884)
c:\program files\ScanSoft\OmniPageSE4\OpHookSE4.dll
c:\windows\system32\webcheck.dll
.
Celkový čas: 2010-02-25 08:44:03
ComboFix-quarantined-files.txt 2010-02-25 07:44

Před spuštěním: Volných bajtů: 16 565 374 976
Po spuštění: Volných bajtů: 16 920 641 536

- - End Of File - - 11BD149BE3A4BE6D3300FEDCE7220406

dvojak

archeo píše:Zmen si hesla na uctoch ICQ a QIP, pravdepodobne ti unikli a teraz ich pouziva nejaky spamovaci robot

Zmena hesla provedena, tak jsem zvedav, zda-li to pomuze.