Win32:Rootkit - prosím o pomoc

Zpráva

xstorm · #16 Příspěvek od **xstorm** » 20 úno 2010 18:06

stell píše:preberam ta -zmazal si driver alebo nie?? je to systemovy subor CD-ROM Audio Filter Driver

udělal jsem ten krok, co napsal Tom8sh16, ale ten soubor cdaudio.sys v systému zůstal - teda nějak se aktualizoval, neboť předtím byl datum vytvoření rok 2002 a teď je ta dnešek......

#17 Příspěvek od **stell** » 20 úno 2010 18:08

Stiahni na plochu-spust-do okna zkopiruj text a klik look,log vloz sem
Download

Kód: Vybrat vše

:filefind 
Cdaudio.sys
Cdaudio*

:regfind
Cdaudio

xstorm · #18 Příspěvek od **xstorm** » 20 úno 2010 18:19

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 18:17 on 20/02/2010 by Jana (Administrator - Elevation successful)

========== filefind ==========

Searching for "Cdaudio.sys"
C:\WINDOWS\system32\drivers\Cdaudio.sys --a--- 792064 bytes [21:52 17/08/2001] [17:18 20/02/2010] (Unable to calculate MD5)

Searching for "Cdaudio*"
C:\WINDOWS\system32\drivers\Cdaudio.sys --a--- 792064 bytes [21:52 17/08/2001] [17:18 20/02/2010] (Unable to calculate MD5)
C:\WINDOWS\system32\drivers\Cdaudio.sys.bak --a--- 18688 bytes [21:52 17/08/2001] [12:00 18/08/2004] (Unable to calculate MD5)

========== regfind ==========

Searching for "Cdaudio"
[HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Tasks\CDAudioPane]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers]
"H:\\?\IDE#CdRomTEAC_DW-552G____________________________N4K1____#5&20f2915f&0&0.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+PlayCDAudioOnArrival"="MSPlayCDAudioOnArrival"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers]
"H:\\?\IDE#CdRomTEAC_DW-552G____________________________N4K1____#5&20f2915f&0&0.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+PlayCDAudioOnArrival"="MSPlayCDAudioOnArrival"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers]
"H:\\?\IDE#CdRomTEAC_DW-552G____________________________N4K1____#5&20f2915f&0&0.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+PlayCDAudioOnArrival"="MSPlayCDAudioOnArrival"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Nero.AutoPlay7\shell\CDAudio_HandleCDBurningOnArrival]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Nero.AutoPlay7\shell\CopyCD_PlayCDAudioOnArrival]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Nero.AutoPlay7\shell\PlayAudioCD_PlayCDAudioOnArrival]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayCDAudioOnArrival]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayCDAudioOnArrival]
"MSPlayCDAudioOnArrival"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayCDAudioOnArrival]
"MSPlayCDAudioOnArrival"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayCDAudioOnArrival]
"MSPlayCDAudioOnArrival"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayCDAudioOnArrival]
"MSPlayCDAudioOnArrival"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayCDAudioOnArrival]
"MSPlayCDAudioOnArrival"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayCDAudioOnArrival]
"MSPlayCDAudioOnArrival"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayCDAudioOnArrival]
"MSPlayCDAudioOnArrival"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSPlayCDAudioOnArrival]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSRipCDAudioOnArrival]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\NeroAutoPlay7CDAudio]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\NMMPlayCDAudioOnArrival]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\NMMRipCDAudioOnArrival]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDAUDIO]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDAUDIO\0000\Control]
"ActiveService"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Cdaudio]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\System\cdaudio]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Cdaudio]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\System\cdaudio]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CDAUDIO]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Cdaudio]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\System\cdaudio]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CDAUDIO]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CDAUDIO\0000\Control]
"ActiveService"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdaudio]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\cdaudio]
[HKEY_USERS\S-1-5-21-1454471165-764733703-682003330-1003\Software\Microsoft\MediaPlayer\Player\Tasks\CDAudioPane]
[HKEY_USERS\S-1-5-21-1454471165-764733703-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers]
"H:\\?\IDE#CdRomTEAC_DW-552G____________________________N4K1____#5&20f2915f&0&0.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+PlayCDAudioOnArrival"="MSPlayCDAudioOnArrival"
[HKEY_USERS\S-1-5-21-1454471165-764733703-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers]
"H:\\?\IDE#CdRomTEAC_DW-552G____________________________N4K1____#5&20f2915f&0&0.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+PlayCDAudioOnArrival"="MSPlayCDAudioOnArrival"
[HKEY_USERS\S-1-5-21-1454471165-764733703-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers]
"H:\\?\IDE#CdRomTEAC_DW-552G____________________________N4K1____#5&20f2915f&0&0.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+PlayCDAudioOnArrival"="MSPlayCDAudioOnArrival"

-=End Of File=-

#19 Příspěvek od **stell** » 20 úno 2010 18:41

Pri tejto akcii je nutné mať ComboFix na ploche.

Vypni>FIREWALL>Antivir>Antispyware>vsetko rezidentne.

Otvor Notepad (Poznámkový blok) a zkopíruj do neho celý zeleny tex:

Kód: Vybrat vše

KILLALL::
Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CDAUDIO]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDAUDIO]
SRPeek::
C:\WINDOWS\system32\drivers\Cdaudio.sys
RESTORE::
C:\WINDOWS\system32\drivers\Cdaudio.sys

Potom klik na Subor -> Uložiť ako.. .. -> Ako je Názov souboru tak do toho riadku napiš:CFScript.txt
Typ súboru tak tam vyberies *všetky súbory
A ulož ho na plochu.> Pozor CFScript.txt>Neotvarat a nemoze byt ani>CFScript.txt.txt A Urobis Toto :
Obrázek

Po skonceni skenu vlož log čo ComboFix vytvorí

xstorm · #20 Příspěvek od **xstorm** » 20 úno 2010 19:38

ComboFix 10-02-19.04 - Jana 20.02.2010 19:23:09.4.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2038.1323 [GMT 1:00]
Spuštěný z: c:\documents and settings\Jana\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Jana\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100220-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-01-20 do 2010-02-20 )))))))))))))))))))))))))))))))
.

2010-02-20 14:55 . 2010-02-20 14:55 -------- d-----w- C:\_OTM
2010-02-20 12:50 . 2010-02-20 12:50 -------- d-----w- c:\program files\TeamViewer
2010-02-20 12:30 . 2010-02-20 12:30 -------- d-----w- c:\program files\VirusTotalUploader2
2010-02-19 22:57 . 2010-02-19 22:46 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-02-19 22:46 . 2010-02-19 22:46 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-02-19 22:31 . 2010-02-19 22:31 -------- d-----w- c:\program files\Lavasoft
2010-02-19 22:30 . 2010-02-19 22:31 -------- d-----w- c:\program files\CCleaner
2010-02-19 22:27 . 2010-02-19 22:27 411368 ----a-w- c:\windows\system32\deploytk.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-20 18:31 . 2001-08-17 21:52 792064 ----a-w- c:\windows\system32\drivers\Cdaudio.sys
2010-02-19 22:26 . 2008-12-02 15:31 -------- d-----w- c:\program files\Java
2009-11-27 21:25 . 2004-08-18 12:00 46196 ----a-w- c:\windows\system32\perfc005.dat
2009-11-27 21:25 . 2004-08-18 12:00 309990 ----a-w- c:\windows\system32\perfh005.dat
2009-11-24 23:54 . 2008-12-01 17:17 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2008-12-01 17:17 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:50 . 2008-12-01 17:17 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-11-24 23:50 . 2008-12-01 17:17 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2008-12-01 17:17 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2008-12-01 17:17 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2008-12-01 17:17 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2008-12-01 17:17 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2008-12-01 17:17 97480 ----a-w- c:\windows\system32\AvastSS.scr
.

(((((((((((((((((((((((((((((((((((((((((( SR_Search ))))))))))))))))))))))))))))))))))))))))))))))))))))))))

[-] !HASH: COULD NOT OPEN FILE !!!!! 792064 c:\windows\system32\drivers\Cdaudio.sys
[7] C1B486A7658353D33A10CC15211A873B 18688 \RP121\A0027805.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688]
"wmstools"="c:\program files\WMS\WMS - Net Tools\wmstools.exe" [2004-07-28 167936]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Device Detector"="DevDetect.exe -autorun" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-21 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-21 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-21 137752]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-04-10 29757440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-07-28 188416]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-10-23 233472]
"DeviceDiscovery"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2003-05-21 229437]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-02-19 149280]
"WinampAgent"="c:\program files\Winamp3\winampa.exe" [2002-07-23 12288]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-12-25 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [1.12.2008 18:17 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1.12.2008 18:17 20560]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2.12.2008 16:13 222968]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [4.2.2010 16:52 1229232]
R2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [11.2.2010 12:42 172328]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [1.12.2008 18:10 222976]

--- Ostatní služby/ovladače v paměti ---

*Deregistered* - Cdaudio
.
Obsah adresáře 'Naplánované úlohy'

2010-02-20 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 22:45]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: {B2F872C1-F543-4AA7-9934-9A2CB65DE2D7} = 77.237.128.2,77.237.128.1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-20 19:28
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Cdaudio]

.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(128)
c:\program files\TeamViewer\Version5\tv.dll
c:\windows\system32\IEFRAME.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Common Files\ACD Systems\EN\DevDetect.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\windows\system32\wdfmgr.exe
c:\program files\TeamViewer\Version5\TeamViewer.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\wscntfy.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Celkový čas: 2010-02-20 19:32:37 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-02-20 18:32
ComboFix2.txt 2010-02-20 12:45
ComboFix3.txt 2010-02-20 12:10
ComboFix4.txt 2010-02-20 11:37

Před spuštěním: Volných bajtů: 51 374 206 976
Po spuštění: Volných bajtů: 51 352 793 088

- - End Of File - - 808B901831147934B2C3B1347E6B04F1

#21 Příspěvek od **stell** » 20 úno 2010 19:50

este vloz sem teno log,spust systemlook a vloz text

Kód: Vybrat vše

:reg
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Cdaudio]

xstorm · #22 Příspěvek od **xstorm** » 20 úno 2010 19:54

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 19:53 on 20/02/2010 by Jana (Administrator - Elevation successful)

========== reg ==========

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Cdaudio]
(Unable to open key)

-=End Of File=-

#23 Příspěvek od **stell** » 20 úno 2010 20:01

dobre este toto a deme zabit Rootkita

Kód: Vybrat vše

:reg
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Cdaudio]

xstorm · #24 Příspěvek od **xstorm** » 20 úno 2010 20:07

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 20:04 on 20/02/2010 by Jana (Administrator - Elevation successful)

========== reg ==========

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Cdaudio]
(Unable to open key)

-=End Of File=-

#25 Příspěvek od **stell** » 20 úno 2010 20:09

dobre,este raz

Kód: Vybrat vše

:regfind
Cdaudio

xstorm · #26 Příspěvek od **xstorm** » 20 úno 2010 20:14

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 20:13 on 20/02/2010 by Jana (Administrator - Elevation successful)

========== regfind ==========

Searching for "Cdaudio"
[HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Tasks\CDAudioPane]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers]
"H:\\?\IDE#CdRomTEAC_DW-552G____________________________N4K1____#5&20f2915f&0&0.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+PlayCDAudioOnArrival"="MSPlayCDAudioOnArrival"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers]
"H:\\?\IDE#CdRomTEAC_DW-552G____________________________N4K1____#5&20f2915f&0&0.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+PlayCDAudioOnArrival"="MSPlayCDAudioOnArrival"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers]
"H:\\?\IDE#CdRomTEAC_DW-552G____________________________N4K1____#5&20f2915f&0&0.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+PlayCDAudioOnArrival"="MSPlayCDAudioOnArrival"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Nero.AutoPlay7\shell\CDAudio_HandleCDBurningOnArrival]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Nero.AutoPlay7\shell\CopyCD_PlayCDAudioOnArrival]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Nero.AutoPlay7\shell\PlayAudioCD_PlayCDAudioOnArrival]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayCDAudioOnArrival]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayCDAudioOnArrival]
"MSPlayCDAudioOnArrival"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayCDAudioOnArrival]
"MSPlayCDAudioOnArrival"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayCDAudioOnArrival]
"MSPlayCDAudioOnArrival"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayCDAudioOnArrival]
"MSPlayCDAudioOnArrival"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayCDAudioOnArrival]
"MSPlayCDAudioOnArrival"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayCDAudioOnArrival]
"MSPlayCDAudioOnArrival"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlers\PlayCDAudioOnArrival]
"MSPlayCDAudioOnArrival"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSPlayCDAudioOnArrival]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\MSRipCDAudioOnArrival]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\NeroAutoPlay7CDAudio]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\NMMPlayCDAudioOnArrival]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\NMMRipCDAudioOnArrival]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDAUDIO]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDAUDIO\0000\Control]
"ActiveService"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Cdaudio]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\System\cdaudio]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Cdaudio]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\System\cdaudio]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CDAUDIO]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Cdaudio]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\System\cdaudio]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CDAUDIO]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CDAUDIO\0000\Control]
"ActiveService"="Cdaudio"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdaudio]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\cdaudio]
[HKEY_USERS\S-1-5-21-1454471165-764733703-682003330-1003\Software\Microsoft\MediaPlayer\Player\Tasks\CDAudioPane]
[HKEY_USERS\S-1-5-21-1454471165-764733703-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers]
"H:\\?\IDE#CdRomTEAC_DW-552G____________________________N4K1____#5&20f2915f&0&0.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+PlayCDAudioOnArrival"="MSPlayCDAudioOnArrival"
[HKEY_USERS\S-1-5-21-1454471165-764733703-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers]
"H:\\?\IDE#CdRomTEAC_DW-552G____________________________N4K1____#5&20f2915f&0&0.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+PlayCDAudioOnArrival"="MSPlayCDAudioOnArrival"
[HKEY_USERS\S-1-5-21-1454471165-764733703-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\UserChosenExecuteHandlers]
"H:\\?\IDE#CdRomTEAC_DW-552G____________________________N4K1____#5&20f2915f&0&0.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+PlayCDAudioOnArrival"="MSPlayCDAudioOnArrival"

-=End Of File=-

#27 Příspěvek od **stell** » 20 úno 2010 20:22

Pri tejto akcii je nutné mať ComboFix na ploche.

Vypni>FIREWALL>Antivir>Antispyware>vsetko rezidentne.

Otvor Notepad (Poznámkový blok) a zkopíruj do neho celý zeleny tex:

Kód: Vybrat vše

SCOPY::
\RP121\A0027805.sys | c:\windows\system32\drivers\Cdaudio.sys
Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDAUDIO]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_CDAUDIO\0000\Control]
"ActiveService"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CDAUDIO]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CDAUDIO\0000]
"Service"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CDAUDIO]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CDAUDIO\0000\Control]
"ActiveService"=-

Potom klik na Subor -> Uložiť ako.. .. -> Ako je Názov souboru tak do toho riadku napiš:CFScript.txt
Typ súboru tak tam vyberies *všetky súbory
A ulož ho na plochu.> Pozor CFScript.txt>Neotvarat a nemoze byt ani>CFScript.txt.txt A Urobis Toto :
Obrázek

Po skonceni skenu vlož log čo ComboFix vytvorí

xstorm · #28 Příspěvek od **xstorm** » 20 úno 2010 20:43

ComboFix 10-02-19.04 - Jana 20.02.2010 20:31:23.5.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2038.1334 [GMT 1:00]
Spuštěný z: c:\documents and settings\Jana\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Jana\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100220-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
--------------- SCopy ---------------

\RP121\A0027805.sys --> c:\windows\system32\drivers\Cdaudio.sys
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-01-20 do 2010-02-20 )))))))))))))))))))))))))))))))
.

2010-02-20 14:55 . 2010-02-20 14:55 -------- d-----w- C:\_OTM
2010-02-20 12:50 . 2010-02-20 12:50 -------- d-----w- c:\program files\TeamViewer
2010-02-20 12:30 . 2010-02-20 12:30 -------- d-----w- c:\program files\VirusTotalUploader2
2010-02-19 22:57 . 2010-02-19 22:46 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-02-19 22:46 . 2010-02-19 22:46 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-02-19 22:31 . 2010-02-19 22:31 -------- d-----w- c:\program files\Lavasoft
2010-02-19 22:30 . 2010-02-19 22:31 -------- d-----w- c:\program files\CCleaner
2010-02-19 22:27 . 2010-02-19 22:27 411368 ----a-w- c:\windows\system32\deploytk.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-20 19:39 . 2001-08-17 21:52 792064 ----a-w- c:\windows\system32\drivers\Cdaudio.sys
2010-02-19 22:26 . 2008-12-02 15:31 -------- d-----w- c:\program files\Java
2009-11-27 21:25 . 2004-08-18 12:00 46196 ----a-w- c:\windows\system32\perfc005.dat
2009-11-27 21:25 . 2004-08-18 12:00 309990 ----a-w- c:\windows\system32\perfh005.dat
2009-11-24 23:54 . 2008-12-01 17:17 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2008-12-01 17:17 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:50 . 2008-12-01 17:17 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-11-24 23:50 . 2008-12-01 17:17 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2008-12-01 17:17 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2008-12-01 17:17 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2008-12-01 17:17 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2008-12-01 17:17 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2008-12-01 17:17 97480 ----a-w- c:\windows\system32\AvastSS.scr
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688]
"wmstools"="c:\program files\WMS\WMS - Net Tools\wmstools.exe" [2004-07-28 167936]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Device Detector"="DevDetect.exe -autorun" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-21 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-21 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-21 137752]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-04-10 29757440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-07-28 188416]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-10-23 233472]
"DeviceDiscovery"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2003-05-21 229437]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-02-19 149280]
"WinampAgent"="c:\program files\Winamp3\winampa.exe" [2002-07-23 12288]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-12-25 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [1.12.2008 18:17 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1.12.2008 18:17 20560]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2.12.2008 16:13 222968]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [4.2.2010 16:52 1229232]
R2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [11.2.2010 12:42 172328]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [1.12.2008 18:10 222976]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - CDAUDIO
*Deregistered* - Cdaudio
.
Obsah adresáře 'Naplánované úlohy'

2010-02-20 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 22:45]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: {B2F872C1-F543-4AA7-9934-9A2CB65DE2D7} = 77.237.128.2,77.237.128.1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-20 20:36
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Cdaudio]

.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(1848)
c:\program files\TeamViewer\Version5\tv.dll
c:\windows\system32\IEFRAME.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Common Files\ACD Systems\EN\DevDetect.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\windows\system32\wdfmgr.exe
c:\program files\TeamViewer\Version5\TeamViewer.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\windows\system32\wscntfy.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Celkový čas: 2010-02-20 20:40:54 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-02-20 19:40
ComboFix2.txt 2010-02-20 18:32
ComboFix3.txt 2010-02-20 12:45
ComboFix4.txt 2010-02-20 12:10
ComboFix5.txt 2010-02-20 19:30

Před spuštěním: Volných bajtů: 51 354 275 840
Po spuštění: Volných bajtů: 51 324 702 720

- - End Of File - - 9152D5882CE8E41F46201605A4518C45

#29 Příspěvek od **stell** » 20 úno 2010 20:49

musi tam byt Rootkit znova sa infikoval,

sprav toto:

Kód: Vybrat vše

:regfind
Cdaudio

stiahnes specialnu verziu G-Mer
Special
uloz na plochu >>
Odpojiť sa od internetu a zatvor všetky otvorené programy,
Dočasne zakázať akékoľvek real-time aktívnej ochrany,
a spust>.prebehne kratky skan,,,
ak dostanes hlasku rootkit activity and asks if you want to run scan>>kliknes NO<<
a nastavis to takto

>> kliknes scan,<<
na konci skanu >>SAVE<< nazov das mojlog.txt>>uloz na plochu a log vloz sem,,

xstorm · #30 Příspěvek od **xstorm** » 20 úno 2010 20:51

ach jo, je to tam pořád.....já asi zešílím...... co s tím? Není lepší přeinstalovat systém???

VIRY.CZ

Win32:Rootkit - prosím o pomoc

Re: Win32:Rootkit - prosím o pomoc

Re: Win32:Rootkit - prosím o pomoc

Re: Win32:Rootkit - prosím o pomoc

Re: Win32:Rootkit - prosím o pomoc

Re: Win32:Rootkit - prosím o pomoc

Re: Win32:Rootkit - prosím o pomoc

Re: Win32:Rootkit - prosím o pomoc

Re: Win32:Rootkit - prosím o pomoc

Re: Win32:Rootkit - prosím o pomoc

Re: Win32:Rootkit - prosím o pomoc

Re: Win32:Rootkit - prosím o pomoc

Re: Win32:Rootkit - prosím o pomoc

Re: Win32:Rootkit - prosím o pomoc

Re: Win32:Rootkit - prosím o pomoc

Re: Win32:Rootkit - prosím o pomoc