Ahoj klucí, tak jsem ho chytil taky. Nijak extra radost z toho nemám, zdá se, že s tím jsou asi dost potíže. Nicméně z toho, co jsem si tu přečetl, moc moudrej nejsem, nemohl by sem tedy někdo dát návod pro blbce? Moje situace je taková, že mám k počítači připojeny 3 fyzické disky (disk0: systémový, rozdělen na C, D, disk1: rozdělen na F, G - na Fku je taky systém, disk3: nerozdělen, písmeno E, pozici disk2 mi zabírá čtečka), všechny 3 disky zatím v systému vidím a pracuji s nimi (momentálně je především zálohuji). NOD hlásí
Objekt: MBR sektor 1. fyzického disku, Infiltrace: Win32/Mebroot.K ...
Objekt: MBR sektor 3. fyzického disku, Infiltrace: Win32/Mebroot.K ...
Zřejmě se tedy jedná o oba nesystémový disky... Ještě dodám, že jsou oba připojeny externě přes USB k notebooku.
Přikládám oba logy z gmeru:
Log 1:
GMER 1.0.14.14536 -
http://www.gmer.net
Rootkit scan 2009-01-02 01:22:25
Windows 5.1.2600 Service Pack 3
---- System - GMER 1.0.14 ----
SSDT Vax347b.sys (Plug and Play BIOS Extension/ ) ZwEnumerateKey [0xF73614FE]
SSDT Vax347b.sys (Plug and Play BIOS Extension/ ) ZwEnumerateValueKey [0xF736CD50]
---- Devices - GMER 1.0.14 ----
Device \FileSystem\Ntfs \Ntfs 84AB7C50
AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys
---- Modules - GMER 1.0.14 ----
Module _________ F72C3000-F72DB000 (98304 bytes)
---- EOF - GMER 1.0.14 ----
Log 2:
GMER 1.0.14.14536 -
http://www.gmer.net
Rootkit scan 2009-01-02 02:16:32
Windows 5.1.2600 Service Pack 3
---- System - GMER 1.0.14 ----
SSDT Vax347b.sys (Plug and Play BIOS Extension/ ) ZwClose [0xF736CC58]
SSDT Vax347b.sys (Plug and Play BIOS Extension/ ) ZwCreateKey [0xF736CC10]
SSDT Vax347b.sys (Plug and Play BIOS Extension/ ) ZwCreatePagingFile [0xF7360C70]
SSDT Vax347b.sys (Plug and Play BIOS Extension/ ) ZwEnumerateKey [0xF73614FE]
SSDT Vax347b.sys (Plug and Play BIOS Extension/ ) ZwEnumerateValueKey [0xF736CD50]
SSDT Vax347b.sys (Plug and Play BIOS Extension/ ) ZwOpenKey [0xF736CBD4]
SSDT Vax347b.sys (Plug and Play BIOS Extension/ ) ZwQueryKey [0xF736151E]
SSDT Vax347b.sys (Plug and Play BIOS Extension/ ) ZwQueryValueKey [0xF736CCA6]
SSDT Vax347b.sys (Plug and Play BIOS Extension/ ) ZwSetSystemPowerState [0xF736C4F0]
---- User code sections - GMER 1.0.14 ----
.text C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe[480] kernel32.dll!SetUnhandledExceptionFilter 7C8449FD 5 Bytes JMP 0056DBBD C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe (Windows Live Messenger/Microsoft Corporation)
.text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1660] kernel32.dll!SetUnhandledExceptionFilter 7C8449FD 4 Bytes [ C2, 04, 00, 00 ]
---- Kernel IAT/EAT - GMER 1.0.14 ----
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisCloseAdapter] [F7189500] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisOpenAdapter] [F71898C0] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisDeregisterProtocol] [F7189890] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] [F7189636] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [F7189636] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [F71898C0] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [F7189500] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [F7189890] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] [F7189890] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [F7189636] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [F71898C0] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [F7189500] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [F7189636] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [F7189890] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [F7189500] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [F71898C0] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [F7189500] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [F71898C0] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [F7189636] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [F7189890] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [F7189636] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [F71898C0] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [F7189500] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [F7189636] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [F7189890] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [F7189500] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [F71898C0] xpacket.sys (Filseclab Personal Firewall Kernel Module/Filseclab Corporation)
---- Devices - GMER 1.0.14 ----
Device \FileSystem\Ntfs \Ntfs 84AB7C50
AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
Device \FileSystem\Udfs \UdfsCdRom 82F8E158
Device \FileSystem\Udfs \UdfsDisk 82F8E158
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys
Device \Driver\Cdrom \Device\CdRom0 84730260
Device \FileSystem\Rdbss \Device\FsWrap 84A8D178
Device \Driver\Cdrom \Device\CdRom1 84730260
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 849EC160
Device \Driver\atapi \Device\Ide\IdePort0 849EC160
Device \Driver\atapi \Device\Ide\IdePort1 849EC160
Device \Driver\atapi \Device\Ide\IdePort2 849EC160
Device \Driver\atapi \Device\Ide\IdePort3 849EC160
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-e 849EC160
Device \FileSystem\Srv \Device\LanmanServer 836F37E0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 837C06F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 837C06F8
Device \FileSystem\Npfs \Device\NamedPipe 846EFB08
Device \FileSystem\Msfs \Device\Mailslot 84783AF8
Device \Driver\Vax347s \Device\Scsi\Vax347s1 8473A008
Device \Driver\Vax347s \Device\Scsi\Vax347s1Port4Path0Target0Lun0 8473A008
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer 8465BB08
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer 8465BB08
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer 8465BB08
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer 8465BB08
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer 8465BB08
Device \FileSystem\Cdfs \Cdfs 837D07B8
---- Modules - GMER 1.0.14 ----
Module _________ F72C3000-F72DB000 (98304 bytes)
---- Registry - GMER 1.0.14 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\Vax347s\Config\jdgg40
Reg HKLM\SYSTEM\CurrentControlSet\Services\Vax347s\Config\jdgg40@ujdew 0x20 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\Vax347s\Config\jdgg40@ljej40 0xC9 0xCD 0x24 0x53 ...
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}@DisplayName Alcohol 120%
Reg HKLM\SOFTWARE\Classes\Installer\Products\32418F9EE1126B64A90E8365B85CFCF6@ProductName Alcohol 120%
---- EOF - GMER 1.0.14 ----