VIRY.CZ

jsou věci mezi nebem a zemí. Počítač se rozběhl a běží celkem v pohodě.

přesto radši přikládám log z GMER:

log1:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-03-11 08:47:46
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\JANAHO~1\LOCALS~1\Temp\pxtdypoc.sys


---- Devices - GMER 1.0.15 ----

Device Ntfs.sys (NT File System Driver/Microsoft Corporation)

AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

---- EOF - GMER 1.0.15 ----



Log2:


GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-11 15:12:59
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\JANAHO~1\LOCALS~1\Temp\pxtdypow.sys


---- System - GMER 1.0.15 ----

SSDT FECBE690 ZwAlertResumeThread
SSDT FECBFA48 ZwAlertThread
SSDT FECC5620 ZwAllocateVirtualMemory
SSDT FECB3B48 ZwAssignProcessToJobObject
SSDT FF5F0190 ZwConnectPort
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwCreateKey [0xA9724040]
SSDT FECBAF40 ZwCreateMutant
SSDT FECB27B8 ZwCreateSymbolicLinkObject
SSDT FECD8278 ZwCreateThread
SSDT FECB7050 ZwDebugActiveProcess
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteKey [0xA97242C0]
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xA9724820]
SSDT FECC5938 ZwDuplicateObject
SSDT FECC4EB8 ZwFreeVirtualMemory
SSDT FECBBF90 ZwImpersonateAnonymousToken
SSDT FECBCE10 ZwImpersonateThread
SSDT 81687288 ZwLoadDriver
SSDT FECC4DD8 ZwMapViewOfSection
SSDT FECBA540 ZwOpenEvent
SSDT FECC5C98 ZwOpenProcess
SSDT FECD0050 ZwOpenProcessToken
SSDT FECB89C8 ZwOpenSection
SSDT FECC5AC8 ZwOpenThread
SSDT FECB33F8 ZwProtectVirtualMemory
SSDT FECE9070 ZwResumeThread
SSDT FECC7050 ZwSetContextThread
SSDT FECC4C80 ZwSetInformationProcess
SSDT FECB8680 ZwSetSystemInformation
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xA9724A70]
SSDT FECB9890 ZwSuspendProcess
SSDT FECC0B50 ZwSuspendThread
SSDT FECDC180 ZwTerminateProcess
SSDT FECC2B50 ZwTerminateThread
SSDT FECCA050 ZwUnmapViewOfSection
SSDT FECC5190 ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 2FD4 80504870 5 Bytes [80, C1, CD, FE, 50]
.text ntkrnlpa.exe!ZwCallbackReturn + 2FDA 80504876 2 Bytes [CC, FE]
? SYMEFA.SYS Systm neme nalzt uveden soubor. !

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1024] USER32.dll!DialogBoxParamW 7E3747AB 5 Bytes JMP 414E56E9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1024] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 415B9AD5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1024] USER32.dll!CallNextHookEx 7E37B3C6 5 Bytes JMP 415AD189 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1024] USER32.dll!CreateWindowExW 7E37D0A3 5 Bytes JMP 415BD964 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1024] USER32.dll!UnhookWindowsHookEx 7E37D5F3 5 Bytes JMP 415248CE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1024] USER32.dll!DialogBoxIndirectParamW 7E382072 5 Bytes JMP 416B43AF C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1024] USER32.dll!MessageBoxIndirectA 7E38A082 5 Bytes JMP 416B42E1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1024] USER32.dll!DialogBoxParamA 7E38B144 5 Bytes JMP 416B434C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1024] USER32.dll!MessageBoxExW 7E3A0838 5 Bytes JMP 416B41B2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1024] USER32.dll!MessageBoxExA 7E3A085C 5 Bytes JMP 416B4214 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1024] USER32.dll!DialogBoxIndirectParamA 7E3A6D7D 5 Bytes JMP 416B4412 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1024] USER32.dll!MessageBoxIndirectW 7E3B64D5 5 Bytes JMP 416B4276 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1024] ole32.dll!CoCreateInstance 774F057E 5 Bytes JMP 415BD9C0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[1024] ole32.dll!OleLoadFromStream 77519C85 5 Bytes JMP 416B4717 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2212] USER32.dll!DialogBoxParamW 7E3747AB 5 Bytes JMP 414E56E9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2212] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 415B9AD5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2212] USER32.dll!CallNextHookEx 7E37B3C6 5 Bytes JMP 415AD189 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2212] USER32.dll!CreateWindowExW 7E37D0A3 5 Bytes JMP 415BD964 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2212] USER32.dll!UnhookWindowsHookEx 7E37D5F3 5 Bytes JMP 415248CE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2212] USER32.dll!DialogBoxIndirectParamW 7E382072 5 Bytes JMP 416B43AF C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2212] USER32.dll!MessageBoxIndirectA 7E38A082 5 Bytes JMP 416B42E1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2212] USER32.dll!DialogBoxParamA 7E38B144 5 Bytes JMP 416B434C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2212] USER32.dll!MessageBoxExW 7E3A0838 5 Bytes JMP 416B41B2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2212] USER32.dll!MessageBoxExA 7E3A085C 5 Bytes JMP 416B4214 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2212] USER32.dll!DialogBoxIndirectParamA 7E3A6D7D 5 Bytes JMP 416B4412 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2212] USER32.dll!MessageBoxIndirectW 7E3B64D5 5 Bytes JMP 416B4276 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2212] ole32.dll!CoCreateInstance 774F057E 5 Bytes JMP 415BD9C0 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2212] ole32.dll!OleLoadFromStream 77519C85 5 Bytes JMP 416B4717 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4092] USER32.dll!DialogBoxParamW 7E3747AB 5 Bytes JMP 414E56E9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4092] USER32.dll!CreateWindowExW 7E37D0A3 5 Bytes JMP 415BD964 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4092] USER32.dll!DialogBoxIndirectParamW 7E382072 5 Bytes JMP 416B43AF C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4092] USER32.dll!MessageBoxIndirectA 7E38A082 5 Bytes JMP 416B42E1 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4092] USER32.dll!DialogBoxParamA 7E38B144 5 Bytes JMP 416B434C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4092] USER32.dll!MessageBoxExW 7E3A0838 5 Bytes JMP 416B41B2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4092] USER32.dll!MessageBoxExA 7E3A085C 5 Bytes JMP 416B4214 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4092] USER32.dll!DialogBoxIndirectParamA 7E3A6D7D 5 Bytes JMP 416B4412 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\IEXPLORE.EXE[4092] USER32.dll!MessageBoxIndirectW 7E3B64D5 5 Bytes JMP 416B4276 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[1024] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[2212] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Udfs \UdfsCdRom BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \FileSystem\Udfs \UdfsDisk BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)

AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \FileSystem\Cdfs \Cdfs BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\LastGood 0 bytes
File C:\WINDOWS\LastGood\INF 0 bytes
File C:\WINDOWS\LastGood\INF\oem29.inf 0 bytes
File C:\WINDOWS\LastGood\INF\oem29.PNF 0 bytes

---- EOF - GMER 1.0.15 ----

Tohle otestujte na http://www.virustotal.com/cs/
c:\windows\system32\ntkrnlpa.exe

(Soubor nehledejte, jenom vložíte tučně označenou cestu, v případě hlášky "Soubor již byl testován" dejte otestovat znovu. Výsledek analýzy sem v podobě odkazu vložte.)

tak mi to nahrálo. napsalo dokončeno, ale 0/42 a výsledek není ani u jednoho

OK, jak se chová PC

je to celkem lepší, dá se na tom už pracovat, ale není to ono. ale to asi bude i stářím

Stahněte MBAM http://www.viry.cz/forum/viewtopic.php?f=29&t=67229

• Podle návodu v odkazu nainstalujte, poté dejte úplný sken.
• Nic nemažte MBAM má občas falešné detekce a mohl by smazat např. systémové soubory.
• Log vložte sem.

MBAM jsem dělal.. ten nenašel nic

Pokračujte podle návodu AVPTool http://www.viry.cz/forum/viewtopic.php?f=29&t=58179