VIRY.CZ

Ok

Dobrý den, Tady je log po několika pokusech...

http://www.uschovna.cz/zasilka/AV9GVAWSLUL96TTX

Prominte, co je to za log?

Kaspersky virus removal TOOL.
Udělal jsem špatnej??

No, on je moc dlouhý , to fakt číst nebudu .
Mrkněte se pořádně, jak se to má zkopírovat , nebo dejte jen screen toho co našel.

Jsem trocu zmatenej z toho návodu, tak skusím tohle:

To je z důležitých událostí...

Automatická kontrola: dokončeno před 27 min. (události: 3, objekty: 437197, čas: 01:07:19)
19.2.2011 11:15:34 Úloha byla spuštěna
19.2.2011 12:11:47 Chyba zpracování C:\Windows\Fonts\iskpotab.ttf Chyba čtení
19.2.2011 12:22:53 Úloha byla dokončena


A tohle z kritických událostí...

Automatická kontrola: dokončeno před 28 min. (události: 2, objekty: 437197, čas: 01:07:19)
19.2.2011 11:15:34 Úloha byla spuštěna
19.2.2011 12:22:53 Úloha byla dokončena

Otestujte na www.virustotal.com
C:\Windows\Fonts\iskpotab.ttf

Nikde jsem ten soubor v té složce nenašel.
Od I je tam 5 souborů ale žádnej takovej...

Na virustotalu dejte procházet, a pak do spodního okénka nakopírjte přímo celou cestu k tomu souboru a dejte odeslat

Nic, ani když dám procházet a nakopíruji tam cestu, tak nic nenajde...

Nevadí. Ještě mi otestujte na www.virustotal.com
c:\windows\system32\userinit.exe
-až se Vás zeptá, dejte reanalyse

Virustotal is a service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines. More information...

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name: userinit.exe
Submission date: 2011-02-19 12:31:19 (UTC)
Current status: queued (#20) queued analysing finished


Result: 0/ 43 (0.0%)
VT Community

not reviewed
Safety score: -
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2011.02.14.02 2011.02.14 -
AntiVir 7.11.3.164 2011.02.19 -
Antiy-AVL 2.0.3.7 2011.02.19 -
Avast 4.8.1351.0 2011.02.19 -
Avast5 5.0.677.0 2011.02.19 -
AVG 10.0.0.1190 2011.02.19 -
BitDefender 7.2 2011.02.19 -
CAT-QuickHeal 11.00 2011.02.19 -
ClamAV 0.96.4.0 2011.02.19 -
Commtouch 5.2.11.5 2011.02.19 -
Comodo 7737 2011.02.18 -
DrWeb 5.0.2.03300 2011.02.19 -
Emsisoft 5.1.0.2 2011.02.19 -
eSafe 7.0.17.0 2011.02.17 -
eTrust-Vet 36.1.8170 2011.02.18 -
F-Prot 4.6.2.117 2011.02.18 -
F-Secure 9.0.16160.0 2011.02.19 -
Fortinet 4.2.254.0 2011.02.19 -
GData 21 2011.02.19 -
Ikarus T3.1.1.97.0 2011.02.19 -
Jiangmin 13.0.900 2011.02.19 -
K7AntiVirus 9.87.3900 2011.02.19 -
Kaspersky 7.0.0.125 2011.02.19 -
McAfee 5.400.0.1158 2011.02.19 -
McAfee-GW-Edition 2010.1C 2011.02.18 -
Microsoft 1.6502 2011.02.19 -
NOD32 5888 2011.02.19 -
Norman 6.07.03 2011.02.19 -
nProtect 2011-02-10.01 2011.02.15 -
Panda 10.0.3.5 2011.02.18 -
PCTools 7.0.3.5 2011.02.19 -
Prevx 3.0 2011.02.19 -
Rising 23.45.04.06 2011.02.18 -
Sophos 4.61.0 2011.02.19 -
SUPERAntiSpyware 4.40.0.1006 2011.02.19 -
Symantec 20101.3.0.103 2011.02.19 -
TheHacker 6.7.0.1.132 2011.02.17 -
TrendMicro 9.200.0.1012 2011.02.19 -
TrendMicro-HouseCall 9.200.0.1012 2011.02.15 -
VBA32 3.12.14.3 2011.02.18 -
VIPRE 8471 2011.02.19 -
ViRobot 2011.2.19.4319 2011.02.19 -
VirusBuster 13.6.208.0 2011.02.18 -
Additional informationShow all
MD5 : 6de80f60d7de9ce6b8c2ddfdf79ef175
SHA1 : 8d439a6186ff526403989ac217dfe8e3a2d8bc2c
SHA256: 7784a6cada74e314e7d79573ad9e490f4a36e0deb86c07732a75856a7e8f1e3a
ssdeep: 384:Oj+CsDNjesrHdlvJhRLYZpgKeGf5F/hyWeR22PXG/7LKpuZeRsJCKWuVymWB:OxstZlRhNY
ZpgpuFeR22vo7L3O1
File size : 26112 bytes
First seen: 2009-08-11 16:56:55
Last seen : 2011-02-19 12:31:19
TrID:
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
sigcheck:
publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: Userinit Logon Application
original name: USERINIT.EXE
internal name: userinit
file version.: 6.1.7600.16385 (win7_rtm.090713-1255)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x2B4E
timedatestamp....: 0x4A5BC47B (Mon Jul 13 23:34:19 2009)
machinetype......: 0x14c (I386)

[[ 4 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0x4CC9, 0x4E00, 6.08, 42103130bcecb40c949779c1a865ac9a
.data, 0x6000, 0x4E8, 0x600, 0.87, 33d7907333f0fbf9350ce65ced1af048
.rsrc, 0x7000, 0x778, 0x800, 4.05, cb2b29ba8fea6ee6f3666d8bf554071f
.reloc, 0x8000, 0x410, 0x600, 5.22, ae619042157784c4e0538bf811d6d473

[[ 7 import(s) ]]
ntdll.dll: DbgPrint, RtlInitUnicodeString, NtOpenKey, NtClose
API_MS_Win_Core_LocalRegistry_L1_1_0.dll: RegCreateKeyExW, RegDeleteTreeW, RegSetValueExW, RegQueryValueExW, RegOpenKeyExW, RegCloseKey, RegQueryInfoKeyW
API_MS_Win_Core_ProcessThreads_L1_1_0.dll: SetThreadPriority, GetCurrentThread, CreateThread, GetCurrentProcess, CreateProcessW, OpenProcessToken
USER32.dll: CharNextW, GetKeyboardLayout, GetSystemMetrics, ExitWindowsEx, MessageBoxW, LoadStringW, LoadRemoteFonts, DefWindowProcW, RegisterClassExW, DestroyWindow, CreateWindowExW, SystemParametersInfoW
USERENV.dll: -
msvcrt.dll: _ismbblead, _XcptFilter, _exit, _cexit, exit, _wcsicmp, memset, memmove, _vsnwprintf, _initterm, _acmdln, _amsg_exit, __setusermatherr, __p__fmode, __set_app_type, _terminate@@YAXXZ, _except_handler4_common, _controlfp, __getmainargs, __p__commode
KERNEL32.dll: GetSystemTimeAsFileTime, TerminateProcess, UnhandledExceptionFilter, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, GetStartupInfoA, InterlockedExchange, LoadLibraryA, RegOpenKeyExA, RegQueryValueExA, ExpandEnvironmentStringsA, LoadLibraryExA, InterlockedCompareExchange, DelayLoadFailureHook, HeapSetInformation, SetCurrentDirectoryW, FormatMessageW, GetFileAttributesExW, GetSystemDirectoryW, SetLastError, ExpandEnvironmentStringsW, GetUserDefaultLangID, SetEvent, OpenEventW, Sleep, WaitForSingleObject, CloseHandle, GetLastError, SetEnvironmentVariableW, SearchPathW, GetCurrentThreadId, CompareFileTime, LoadLibraryW, GetProcAddress, FreeLibrary, GetEnvironmentVariableW, LocalAlloc, LocalFree, GetVersionExW, lstrlenW

ExifTool:
file metadata
CharacterSet: Unicode
CodeSize: 19968
CompanyName: Microsoft Corporation
EntryPoint: 0x2b4e
FileDescription: Userinit Logon Application
FileFlagsMask: 0x003f
FileOS: Windows NT 32-bit
FileSize: 26 kB
FileSubtype: 0
FileType: Win32 EXE
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
FileVersionNumber: 6.1.7600.16385
ImageVersion: 6.1
InitializedDataSize: 5120
InternalName: userinit
LanguageCode: English (U.S.)
LegalCopyright: Microsoft Corporation. All rights reserved.
LinkerVersion: 9.0
MIMEType: application/octet-stream
MachineType: Intel 386 or later, and compatibles
OSVersion: 6.1
ObjectFileType: Executable application
OriginalFilename: USERINIT.EXE
PEType: PE32
ProductName: Microsoft Windows Operating System
ProductVersion: 6.1.7600.16385
ProductVersionNumber: 6.1.7600.16385
Subsystem: Windows GUI
SubsystemVersion: 6.1
TimeStamp: 2009:07:14 01:34:19+02:00
UninitializedDataSize: 0



VT Community

0
This file has never been reviewed by any VT Community member. Be the first one to comment on it!
VirusTotal Team
Add your comment... Remember that when you write comments as an anonymous user they receive the lowest possible reputation. So if you have not signed in yet don't forget to do so. How to markup your comments?

You can add basic styles to your comments using the following accepted bbcode tags:

text -- bold
text -- italics
text -- underline
[s]text[/s] -- strikethrough -- preformatted text

You can also address comments to particular users using the "@" twitter-like mode. By prepending a "#" symbol to a word you can add custom tags to your comment, tags that can then be searched for.

Goodware Malware Spam attachment/link
P2P download Propagating via IM Network worm
Drive-by-download



Anonymous limit exceeded: anonymous users can only make one comment per file or URL, either sign in or register in order to continue making reviews on this item. Note that anonymous user discrimination is based on IP addresses, hence, it may be possible that another user behind your same proxy or NAT connection already made a review.

Preview commentEdit comment Post comment Posting comment...
Comment successfully posted







ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
VirusTotal © Hispasec Sistemas - Blog - Twitter - Contact: info@virustotal.com- TOS & Privacy Policy

Vadil by Vám testík na rootkity?
Pokud ne

Stáhněte Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878
- rozbalte a spusťte
-proběhne sken, po skončení se otevře okno s výsledky, klikněte na Save a tím si uložíte log,který sem vložíte

-Podle návodu v odkazu provedete druhý sken a log sem také vložíte.

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit quick scan 2011-02-19 13:57:32
Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST925031 rev.0020
Running: gmer.exe; Driver: C:\Users\BV-TEC~1\AppData\Local\Temp\fxrdapoc.sys


---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 09: copy of MBR

---- Devices - GMER 1.0.15 ----

Device \Driver\iaStor \Device\Ide\iaStor0 [88AEC390] \SystemRoot\system32\DRIVERS\iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\iaStor \Device\Ide\IAAStorageDevice-0 [88AEC390] \SystemRoot\system32\DRIVERS\iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\iaStor \Device\Ide\IAAStorageDevice-1 [88AEC390] \SystemRoot\system32\DRIVERS\iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \FileSystem\Ntfs \Ntfs 85A501F8
Device \FileSystem\fastfat \Fat AB1FD1F8

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

Tak ten druhej test nedokončí a v průběhu se restartuje pc a objeví se modrá obrazovka s kritickou chybou Windows. Co teď?? Skusil bych to v nouzovém režimu ale u Win 7 nevim jak na to...