VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

PC nejde vypnout, pouze se restartuje

https://forum.viry.cz:443/viewtopic.php?t=117232

Stránka 1 z 1

PC nejde vypnout, pouze se restartuje

Napsal: 22 lis 2011 13:32
od Benton
Zdravím a potřeboval bych poradit od někoho znalého věci. Předem podotýkám, že jsem v tomto naprostý laik tak prosím o polopatický postup. Včera jsem do PC přidával satelitní DVB kartu a zkoušel různé programy a pluginy pro tuto kartu a večer se mi už nepodařilo vypnout klasickým způsobem PC a musel jsem ho vypnout na tvrdo. Našel jsem zde na foru podobný problém, proto se na Vás obracím a zde je log z Combofix a budu velice rád když mi někdo poradí jak PC opět umravnit a předem děkuji.

Takže tedy log:

ComboFix 11-11-22.01 - xxx 22.11.2011 12:51:22.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1484 [GMT 1:00]
Spuštěný z: c:\documents and settings\xxx\Plocha\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Předchozí spuštění -------
.
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\system32\pthreadVC.dll
K:\install.exe
.
-- Předchozí spuštění --
.
Nakažená kopie c:\windows\system32\userinit.exe byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\ServicePackFiles\i386\userinit.exe
.
--------
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-10-22 do 2011-11-22 )))))))))))))))))))))))))))))))
.
.
2011-11-22 01:52 . 2011-11-22 10:44 -------- d-----w- c:\program files\DVB Dream
2011-11-21 21:16 . 2011-11-21 21:16 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Technisat
2011-11-21 21:16 . 2011-11-21 21:16 -------- d-----w- c:\program files\MainConcept
2011-11-21 17:47 . 2003-05-28 14:20 368912 ----a-w- c:\windows\system32\vbar332.dll
2011-11-21 17:47 . 2003-05-28 14:20 252176 ----a-w- c:\windows\system32\msrd2x35.dll
2011-11-21 17:47 . 2011-11-21 21:16 -------- d-----w- c:\program files\TechniSat DVB
2011-11-21 17:47 . 2003-05-28 14:20 24848 ----a-w- c:\windows\system32\msjter35.dll
2011-11-21 17:47 . 2003-05-28 14:20 123664 ----a-w- c:\windows\system32\Msjint35.dll
2011-11-21 17:47 . 2003-05-28 14:20 1045776 ----a-w- c:\windows\system32\msjet35.dll
2011-11-21 17:21 . 2010-05-10 08:09 627288 ----a-w- c:\windows\system32\drivers\SkyNET.sys
2011-11-16 01:17 . 2011-11-16 01:17 -------- d-----w- c:\program files\KASTNER software
2011-11-15 00:38 . 2011-11-16 01:22 -------- d-----w- c:\documents and settings\xxx\Data aplikací\Kastner software
2011-11-15 00:38 . 2011-11-16 01:17 -------- d-----w- c:\documents and settings\All Users\Data aplikací\KASTNER software
2011-11-04 20:45 . 2011-11-04 20:45 -------- d-----w- c:\documents and settings\xxx\Data aplikací\Boilsoft
2011-11-04 20:45 . 2011-11-04 20:45 -------- d-----w- c:\program files\Boilsoft
2011-10-27 20:11 . 2011-10-27 20:11 -------- d-----w- c:\program files\Elaborate Bytes
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-14 23:06 . 2011-07-25 19:29 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-10 14:22 . 2011-07-25 14:48 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-09-28 07:06 . 2006-03-02 12:00 602112 ----a-w- c:\windows\system32\crypt32.dll
2011-09-26 09:41 . 2008-07-29 17:59 613376 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 09:41 . 2006-03-02 12:00 22528 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 09:41 . 2006-03-02 12:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-06 14:10 . 2006-03-02 12:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-03-18 17:55 . 2011-08-21 23:28 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-05-17 11:29 1490312 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312]
"{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}"= "c:\program files\vShare.tv plugin\BarLcher.dll" [2011-06-01 177712]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{7ac3e13b-3bca-4158-b330-f66dbb03c1b5}]
[HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher.1]
[HKEY_CLASSES_ROOT\TypeLib\{BB7256DD-EBA9-480B-8441-A00388C2BEC3}]
[HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312]
"{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}"= "c:\program files\vShare.tv plugin\BarLcher.dll" [2011-06-01 177712]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{7ac3e13b-3bca-4158-b330-f66dbb03c1b5}]
[HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher.1]
[HKEY_CLASSES_ROOT\TypeLib\{BB7256DD-EBA9-480B-8441-A00388C2BEC3}]
[HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iTV"="c:\program files\iTV\iTV.exe" [2011-11-18 648192]
"VistaStartMenu"="c:\program files\Vista Start Menu\VistaStartMenu.exe" [2011-05-24 2752416]
"S60 PC Suite Tray"="c:\program files\Samsung\Samsung PC Studio 7\PCSuite.exe" [2008-12-05 699392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 16261632]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"GBB36X Configure"="c:\windows\system32\JMRaidTool.exe" [2006-07-12 356352]
"Sunkist2k"="c:\program files\Multimedia Card Reader\shwicon2k.exe" [2004-12-10 139264]
"FUFAXSTM"="c:\program files\Epson Software\FAX Utility\FUFAXSTM.exe" [2009-02-05 843776]
"EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2009-01-12 669520]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1352272]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]
"avp"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe" [2011-04-24 202296]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Samsung.PCSync"="c:\program files\Samsung\Samsung PC Studio 7\PcSync2.exe" [2009-06-04 1294336]
.
c:\documents and settings\xxx\Nabídka Start\Programy\Po spuštění\
Yahoo! Widgets.lnk - c:\program files\Yahoo!\Widgets\YahooWidgets.exe [2008-3-19 4742184]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
AVer HID Receiver.lnk - c:\program files\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe [2011-7-25 159744]
AVerQuick.lnk - c:\program files\Common Files\AVerMedia\AVerQuick\AVerQuick.exe [2011-7-25 651264]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-10-28 10:13 64592 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Google Update"="c:\documents and settings\xxx\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe"
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" -autorun
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe"
"BigDogPath326VMSnap"=c:\windows\VMSnap26.exe
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"Print2PDF Print Monitor"="c:\program files\Software602\Print2PDF\Print2PDF.exe" /server
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\xxx
\\Local Settings\\Data aplikací\\Google\\Chrome\\Application\\chrome.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\ProgDVB\\ProgDvbNet.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
.
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [26.7.2011 17:42 218688]
R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [4.3.2011 12:23 11352]
R2 602XML Updater;602Updater;c:\program files\Common Files\soft602\602updsvc\602updsvc.exe [27.8.2011 16:48 73728]
R2 AVerRemote;AVerRemote;c:\program files\Common Files\AVerMedia\Service\AVerRemote.exe [25.7.2011 21:57 344064]
R2 AVerScheduleService;AVerScheduleService;c:\program files\Common Files\AVerMedia\Service\AVerScheduleService.exe [25.7.2011 21:57 405504]
R2 DVBVRecorder;DVBViewer Recording Service;c:\program files\DVBViewer\DVBVservice.exe [1.9.2011 0:36 617600]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [28.7.2011 0:29 10448]
R2 ProgDVBService;ProgDVB Scheduler Service;c:\program files\ProgDVB\ProgDvbService.exe [12.8.2011 17:29 12736]
R3 appliandMP;appliandMP;c:\windows\system32\drivers\appliand.sys [19.8.2011 18:06 28256]
R3 AVerA706;AVerMedia A706 BDA Service;c:\windows\system32\drivers\AVerA706.sys [25.7.2011 21:56 1169920]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [10.3.2011 17:34 34608]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2.11.2009 19:27 19472]
R3 usbvm328;A4 TECH USB2.0 PC Camera G;c:\windows\system32\drivers\vmcam326av.sys [25.7.2011 17:32 104960]
R3 vvftav326_a4;VC0326 Camera Filter Service A4 TECH;c:\windows\system32\drivers\vvftav326.sys [25.7.2011 17:32 480128]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 12:16 130384]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [25.7.2011 22:52 136176]
S3 appliand;Applian Network Service;c:\windows\system32\drivers\appliand.sys [19.8.2011 18:06 28256]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [25.7.2011 22:52 136176]
S3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\drivers\SkyNET.sys [21.11.2011 18:21 627288]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 12:16 753504]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'
.
2011-11-22 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-07-16 08:30]
.
2011-11-21 c:\windows\Tasks\Epson Printer Software Downloader.job
- c:\program files\EPSON\EPAPDL\E_SAPDL2.EXE [2009-01-23 13:03]
.
2011-11-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-25 21:51]
.
2011-11-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-25 21:51]
.
2011-11-22 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2011-05-17 11:29]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
mStart Page = hxxp://startsear.ch/?aff=1
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\documents and settings\xxx\Data aplikací\Mozilla\Firefox\Profiles\95zg1wjx.default\
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://inm.startya.com/s/?src=FF-Address&site=Yahoo!&cfg=2-575-0-0&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-22 12:57
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1343024091-1614895754-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0FC50CE6-53C4-586A-0CF9-119D15AEC015}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1472)
c:\windows\system32\Ati2evxx.dll
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
- - - - - - - > 'explorer.exe'(292)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2011-11-22 12:59:34
ComboFix-quarantined-files.txt 2011-11-22 11:59
.
Před spuštěním: Volných bajtů: 65 428 594 688
Po spuštění: Volných bajtů: 65 378 951 168
.
- - End Of File - - 56960368F6A7AA425897274A423935D8


Za každou radu předem děkuji

Re: PC nejde vypnout, pouze se restartuje

Napsal: 22 lis 2011 18:49
od Rudy
Také zdravím!
Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:
KillAll::

Folder::
c:\program files\Ask.com

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"KernelFaultCheck"=-

Firefox::
FF - ProfilePath - c:\documents and settings\xxx\Data aplikací\Mozilla\Firefox\Profiles\95zg1wjx.default\
FF - prefs.js: keyword.URL - hxxp://inm.startya.com/s/?src=FF-Addres ... 575-0-0&q=
Uložte na plochu jako CFScript.txt. pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Obrázek

Re: PC nejde vypnout, pouze se restartuje

Napsal: 23 lis 2011 11:32
od Benton
Děkuji za odpověď a ochotu. Problém ovšem bohužel trvá dál.

Zde výpis z Combofixu:

ComboFix 11-11-22.01 - xxx 23.11.2011 2:46.6.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1011 [GMT 1:00]
Spuštěný z: c:\documents and settings\xxx\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\xxx\Plocha\CFScript.txt
AV: Kaspersky Internet Security *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-- Předchozí spuštění --
.
Nakažená kopie c:\windows\system32\Drivers\atapi.sys byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\ServicePackFiles\i386\atapi.sys
.
-- Předchozí spuštění --
.
Nakažená kopie c:\windows\system32\Drivers\atapi.sys byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\ServicePackFiles\i386\atapi.sys
.
--------
.
Nakažená kopie c:\windows\system32\userinit.exe byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\ServicePackFiles\i386\userinit.exe
.
--------
.
Nakažená kopie c:\windows\system32\Drivers\atapi.sys byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\ServicePackFiles\i386\atapi.sys
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-10-23 do 2011-11-23 )))))))))))))))))))))))))))))))
.
.
2011-11-22 23:33 . 2011-11-22 23:33 -------- d-----w- C:\found.000
2011-11-22 15:55 . 2011-11-22 15:55 -------- d-----w- c:\documents and settings\xxx\Data aplikací\Malwarebytes
2011-11-22 15:55 . 2011-11-22 15:55 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-11-22 15:54 . 2011-11-22 15:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-11-22 15:54 . 2011-08-31 16:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-22 01:52 . 2011-11-22 10:44 -------- d-----w- c:\program files\DVB Dream
2011-11-21 21:16 . 2011-11-21 21:16 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Technisat
2011-11-21 21:16 . 2011-11-21 21:16 -------- d-----w- c:\program files\MainConcept
2011-11-21 17:47 . 2003-05-28 14:20 368912 ----a-w- c:\windows\system32\vbar332.dll
2011-11-21 17:47 . 2003-05-28 14:20 252176 ----a-w- c:\windows\system32\msrd2x35.dll
2011-11-21 17:47 . 2011-11-21 21:16 -------- d-----w- c:\program files\TechniSat DVB
2011-11-21 17:47 . 2003-05-28 14:20 24848 ----a-w- c:\windows\system32\msjter35.dll
2011-11-21 17:47 . 2003-05-28 14:20 123664 ----a-w- c:\windows\system32\Msjint35.dll
2011-11-21 17:47 . 2003-05-28 14:20 1045776 ----a-w- c:\windows\system32\msjet35.dll
2011-11-21 17:21 . 2010-05-10 08:09 627288 ----a-w- c:\windows\system32\drivers\SkyNET.sys
2011-11-16 01:17 . 2011-11-16 01:17 -------- d-----w- c:\program files\KASTNER software
2011-11-15 00:38 . 2011-11-16 01:22 -------- d-----w- c:\documents and settings\xxx\Data aplikací\Kastner software
2011-11-15 00:38 . 2011-11-16 01:17 -------- d-----w- c:\documents and settings\All Users\Data aplikací\KASTNER software
2011-11-04 20:45 . 2011-11-04 20:45 -------- d-----w- c:\documents and settings\xxx\Data aplikací\Boilsoft
2011-11-04 20:45 . 2011-11-04 20:45 -------- d-----w- c:\program files\Boilsoft
2011-10-27 20:11 . 2011-10-27 20:11 -------- d-----w- c:\program files\Elaborate Bytes
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-14 23:06 . 2011-07-25 19:29 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-10 14:22 . 2011-07-25 14:48 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-09-28 07:06 . 2006-03-02 12:00 602112 ----a-w- c:\windows\system32\crypt32.dll
2011-09-26 09:41 . 2008-07-29 17:59 613376 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 09:41 . 2006-03-02 12:00 22528 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 09:41 . 2006-03-02 12:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-06 14:10 . 2006-03-02 12:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-03-18 17:55 . 2011-08-21 23:28 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}"= "c:\program files\vShare.tv plugin\BarLcher.dll" [2011-06-01 177712]
.
[HKEY_CLASSES_ROOT\clsid\{7ac3e13b-3bca-4158-b330-f66dbb03c1b5}]
[HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher.1]
[HKEY_CLASSES_ROOT\TypeLib\{BB7256DD-EBA9-480B-8441-A00388C2BEC3}]
[HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}"= "c:\program files\vShare.tv plugin\BarLcher.dll" [2011-06-01 177712]
.
[HKEY_CLASSES_ROOT\clsid\{7ac3e13b-3bca-4158-b330-f66dbb03c1b5}]
[HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher.1]
[HKEY_CLASSES_ROOT\TypeLib\{BB7256DD-EBA9-480B-8441-A00388C2BEC3}]
[HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iTV"="c:\program files\iTV\iTV.exe" [2011-11-18 648192]
"VistaStartMenu"="c:\program files\Vista Start Menu\VistaStartMenu.exe" [2011-05-24 2752416]
"S60 PC Suite Tray"="c:\program files\Samsung\Samsung PC Studio 7\PCSuite.exe" [2008-12-05 699392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 16261632]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"GBB36X Configure"="c:\windows\system32\JMRaidTool.exe" [2006-07-12 356352]
"Sunkist2k"="c:\program files\Multimedia Card Reader\shwicon2k.exe" [2004-12-10 139264]
"FUFAXSTM"="c:\program files\Epson Software\FAX Utility\FUFAXSTM.exe" [2009-02-05 843776]
"EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2009-01-12 669520]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1352272]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]
"avp"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe" [2011-04-24 202296]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Samsung.PCSync"="c:\program files\Samsung\Samsung PC Studio 7\PcSync2.exe" [2009-06-04 1294336]
.
c:\documents and settings\xxx\Nabídka Start\Programy\Po spuštění\
Yahoo! Widgets.lnk - c:\program files\Yahoo!\Widgets\YahooWidgets.exe [2008-3-19 4742184]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
AVer HID Receiver.lnk - c:\program files\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe [2011-7-25 159744]
AVerQuick.lnk - c:\program files\Common Files\AVerMedia\AVerQuick\AVerQuick.exe [2011-7-25 651264]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-10-28 10:13 64592 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Google Update"="c:\documents and settings\xxx\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe"
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" -autorun
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe"
"BigDogPath326VMSnap"=c:\windows\VMSnap26.exe
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
"Print2PDF Print Monitor"="c:\program files\Software602\Print2PDF\Print2PDF.exe" /server
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\xxx\\Local Settings\\Data aplikací\\Google\\Chrome\\Application\\chrome.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\ProgDVB\\ProgDvbNet.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
.
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [26.7.2011 17:42 218688]
R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [4.3.2011 12:23 11352]
R2 602XML Updater;602Updater;c:\program files\Common Files\soft602\602updsvc\602updsvc.exe [27.8.2011 16:48 73728]
R2 AVerRemote;AVerRemote;c:\program files\Common Files\AVerMedia\Service\AVerRemote.exe [25.7.2011 21:57 344064]
R2 AVerScheduleService;AVerScheduleService;c:\program files\Common Files\AVerMedia\Service\AVerScheduleService.exe [25.7.2011 21:57 405504]
R2 DVBVRecorder;DVBViewer Recording Service;c:\program files\DVBViewer\DVBVservice.exe [1.9.2011 0:36 617600]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [28.7.2011 0:29 10448]
R2 ProgDVBService;ProgDVB Scheduler Service;c:\program files\ProgDVB\ProgDvbService.exe [12.8.2011 17:29 12736]
R3 appliandMP;appliandMP;c:\windows\system32\drivers\appliand.sys [19.8.2011 18:06 28256]
R3 AVerA706;AVerMedia A706 BDA Service;c:\windows\system32\drivers\AVerA706.sys [25.7.2011 21:56 1169920]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [10.3.2011 17:34 34608]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2.11.2009 19:27 19472]
R3 usbvm328;A4 TECH USB2.0 PC Camera G;c:\windows\system32\drivers\vmcam326av.sys [25.7.2011 17:32 104960]
R3 vvftav326_a4;VC0326 Camera Filter Service A4 TECH;c:\windows\system32\drivers\vvftav326.sys [25.7.2011 17:32 480128]
S0 kkbagta;kkbagta;c:\windows\system32\drivers\cqcmys.sys --> c:\windows\system32\drivers\cqcmys.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 12:16 130384]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [25.7.2011 22:52 136176]
S3 appliand;Applian Network Service;c:\windows\system32\drivers\appliand.sys [19.8.2011 18:06 28256]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [25.7.2011 22:52 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\drivers\SkyNET.sys [21.11.2011 18:21 627288]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 12:16 753504]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'
.
2011-11-23 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-07-16 08:30]
.
2011-11-22 c:\windows\Tasks\Epson Printer Software Downloader.job
- c:\program files\EPSON\EPAPDL\E_SAPDL2.EXE [2009-01-23 13:03]
.
2011-11-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-25 21:51]
.
2011-11-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-25 21:51]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
mStart Page = hxxp://startsear.ch/?aff=1
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Přidat do Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\documents and settings\xxx\Data aplikací\Mozilla\Firefox\Profiles\95zg1wjx.default\
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - about:home
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-23 02:55
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1476)
c:\windows\system32\Ati2evxx.dll
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
- - - - - - - > 'explorer.exe'(4960)
c:\progra~1\WINDOW~2\wmpband.dll
c:\program files\Vista Start Menu\VistaStartMenu.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Samsung\Samsung PC Studio 7\phonebrowser.dll
c:\program files\Samsung\Samsung PC Studio 7\PCSCM_Samsung.dll
c:\program files\Samsung\Samsung PC Studio 7\Lang\PhoneBrowser_eng.nlr
c:\program files\Samsung\Samsung PC Studio 7\Resource\PhoneBrowser_Samsung.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\documents and settings\All Users\Data aplikací\EPSON\EPW!3 SSRP\E_S40ST7.EXE
c:\documents and settings\All Users\Data aplikací\EPSON\EPW!3 SSRP\E_S40RP7.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\RTHDCPL.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\System32\TUProgSt.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
.
**************************************************************************
.
Celkový čas: 2011-11-23 03:00:25 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-11-23 02:00
ComboFix2.txt 2011-11-22 23:58
ComboFix3.txt 2011-11-22 12:10
.
Před spuštěním: Volných bajtů: 65 353 482 240
Po spuštění: Volných bajtů: 65 336 930 304
.
- - End Of File - - DBFCC0AAE587BC4EBD070D3A1D649046

Re: PC nejde vypnout, pouze se restartuje

Napsal: 23 lis 2011 19:50
od Rudy
Ještě jednou spusťte CF tímto skriptem:
Collect::
c:\windows\system32\drivers\cqcmys.sys

Driver::
kkbagta

Re: PC nejde vypnout, pouze se restartuje

Napsal: 23 lis 2011 22:03
od Benton
Děkuji za odpověď. Provedeno, ale bez úspěchu, PC se bohužel stále jen restartuje. Všimnul jsem si ještě jedné podivnosti, a to, že se mi znovu a znovu zdvojuje ikona Internet exploreru tzn. že jednu mám na ploše standardně, ale vždy nejspíš po použití kombofixu se mi na ploše objeví ještě ikona druhá. Nevím jestli to má nějakou vypovídající hodnotu, ale raději to píšu.

A zde je posledení log:

ComboFix 11-11-23.01 - Schwarzer 23.11.2011 21:32:47.8.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1394 [GMT 1:00]
Spuštěný z: c:\documents and settings\xxx\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\xxx\Plocha\CFScript.txt
AV: Kaspersky Internet Security *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-- Předchozí spuštění --
.
Nakažená kopie c:\windows\system32\userinit.exe byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\ServicePackFiles\i386\userinit.exe
.
--------
.
Nakažená kopie c:\windows\system32\userinit.exe byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\ServicePackFiles\i386\userinit.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_kkbagta
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-10-23 do 2011-11-23 )))))))))))))))))))))))))))))))
.
.
2011-11-22 23:33 . 2011-11-22 23:33 -------- d-----w- C:\found.000
2011-11-22 15:55 . 2011-11-22 15:55 -------- d-----w- c:\documents and settings\xxx\Data aplikací\Malwarebytes
2011-11-22 15:55 . 2011-11-22 15:55 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-11-22 15:54 . 2011-11-22 15:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-11-22 15:54 . 2011-08-31 16:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-11-22 01:52 . 2011-11-22 10:44 -------- d-----w- c:\program files\DVB Dream
2011-11-21 21:16 . 2011-11-21 21:16 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Technisat
2011-11-21 21:16 . 2011-11-21 21:16 -------- d-----w- c:\program files\MainConcept
2011-11-21 17:47 . 2003-05-28 14:20 368912 ----a-w- c:\windows\system32\vbar332.dll
2011-11-21 17:47 . 2003-05-28 14:20 252176 ----a-w- c:\windows\system32\msrd2x35.dll
2011-11-21 17:47 . 2011-11-21 21:16 -------- d-----w- c:\program files\TechniSat DVB
2011-11-21 17:47 . 2003-05-28 14:20 24848 ----a-w- c:\windows\system32\msjter35.dll
2011-11-21 17:47 . 2003-05-28 14:20 123664 ----a-w- c:\windows\system32\Msjint35.dll
2011-11-21 17:47 . 2003-05-28 14:20 1045776 ----a-w- c:\windows\system32\msjet35.dll
2011-11-21 17:21 . 2010-05-10 08:09 627288 ----a-w- c:\windows\system32\drivers\SkyNET.sys
2011-11-16 01:17 . 2011-11-16 01:17 -------- d-----w- c:\program files\KASTNER software
2011-11-15 00:38 . 2011-11-16 01:22 -------- d-----w- c:\documents and settings\xxx\Data aplikací\Kastner software
2011-11-15 00:38 . 2011-11-16 01:17 -------- d-----w- c:\documents and settings\All Users\Data aplikací\KASTNER software
2011-11-04 20:45 . 2011-11-04 20:45 -------- d-----w- c:\documents and settings\xxx\Data aplikací\Boilsoft
2011-11-04 20:45 . 2011-11-04 20:45 -------- d-----w- c:\program files\Boilsoft
2011-10-27 20:11 . 2011-10-27 20:11 -------- d-----w- c:\program files\Elaborate Bytes
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-14 23:06 . 2011-07-25 19:29 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-10 14:22 . 2011-07-25 14:48 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-09-28 07:06 . 2006-03-02 12:00 602112 ----a-w- c:\windows\system32\crypt32.dll
2011-09-26 09:41 . 2008-07-29 17:59 613376 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 09:41 . 2006-03-02 12:00 22528 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 09:41 . 2006-03-02 12:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-06 14:10 . 2006-03-02 12:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-03-18 17:55 . 2011-08-21 23:28 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}"= "c:\program files\vShare.tv plugin\BarLcher.dll" [2011-06-01 177712]
.
[HKEY_CLASSES_ROOT\clsid\{7ac3e13b-3bca-4158-b330-f66dbb03c1b5}]
[HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher.1]
[HKEY_CLASSES_ROOT\TypeLib\{BB7256DD-EBA9-480B-8441-A00388C2BEC3}]
[HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}"= "c:\program files\vShare.tv plugin\BarLcher.dll" [2011-06-01 177712]
.
[HKEY_CLASSES_ROOT\clsid\{7ac3e13b-3bca-4158-b330-f66dbb03c1b5}]
[HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher.1]
[HKEY_CLASSES_ROOT\TypeLib\{BB7256DD-EBA9-480B-8441-A00388C2BEC3}]
[HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iTV"="c:\program files\iTV\iTV.exe" [2011-11-18 648192]
"VistaStartMenu"="c:\program files\Vista Start Menu\VistaStartMenu.exe" [2011-05-24 2752416]
"S60 PC Suite Tray"="c:\program files\Samsung\Samsung PC Studio 7\PCSuite.exe" [2008-12-05 699392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 16261632]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"GBB36X Configure"="c:\windows\system32\JMRaidTool.exe" [2006-07-12 356352]
"Sunkist2k"="c:\program files\Multimedia Card Reader\shwicon2k.exe" [2004-12-10 139264]
"FUFAXSTM"="c:\program files\Epson Software\FAX Utility\FUFAXSTM.exe" [2009-02-05 843776]
"EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2009-01-12 669520]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1352272]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]
"avp"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe" [2011-04-24 202296]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Samsung.PCSync"="c:\program files\Samsung\Samsung PC Studio 7\PcSync2.exe" [2009-06-04 1294336]
.
c:\documents and settings\Schwarzer\Nabídka Start\Programy\Po spuštění\
Yahoo! Widgets.lnk - c:\program files\Yahoo!\Widgets\YahooWidgets.exe [2008-3-19 4742184]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
AVer HID Receiver.lnk - c:\program files\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe [2011-7-25 159744]
AVerQuick.lnk - c:\program files\Common Files\AVerMedia\AVerQuick\AVerQuick.exe [2011-7-25 651264]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-10-28 10:13 64592 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Google Update"="c:\documents and settings\Schwarzer\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe"
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" -autorun
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe"
"BigDogPath326VMSnap"=c:\windows\VMSnap26.exe
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
"Print2PDF Print Monitor"="c:\program files\Software602\Print2PDF\Print2PDF.exe" /server
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\Schwarzer\\Local Settings\\Data aplikací\\Google\\Chrome\\Application\\chrome.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\ProgDVB\\ProgDvbNet.exe"=
"c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
.
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [26.7.2011 17:42 218688]
R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [4.3.2011 12:23 11352]
R2 602XML Updater;602Updater;c:\program files\Common Files\soft602\602updsvc\602updsvc.exe [27.8.2011 16:48 73728]
R2 AVerRemote;AVerRemote;c:\program files\Common Files\AVerMedia\Service\AVerRemote.exe [25.7.2011 21:57 344064]
R2 AVerScheduleService;AVerScheduleService;c:\program files\Common Files\AVerMedia\Service\AVerScheduleService.exe [25.7.2011 21:57 405504]
R2 DVBVRecorder;DVBViewer Recording Service;c:\program files\DVBViewer\DVBVservice.exe [1.9.2011 0:36 617600]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [28.7.2011 0:29 10448]
R2 ProgDVBService;ProgDVB Scheduler Service;c:\program files\ProgDVB\ProgDvbService.exe [12.8.2011 17:29 12736]
R3 appliandMP;appliandMP;c:\windows\system32\drivers\appliand.sys [19.8.2011 18:06 28256]
R3 AVerA706;AVerMedia A706 BDA Service;c:\windows\system32\drivers\AVerA706.sys [25.7.2011 21:56 1169920]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [10.3.2011 17:34 34608]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2.11.2009 19:27 19472]
R3 usbvm328;A4 TECH USB2.0 PC Camera G;c:\windows\system32\drivers\vmcam326av.sys [25.7.2011 17:32 104960]
R3 vvftav326_a4;VC0326 Camera Filter Service A4 TECH;c:\windows\system32\drivers\vvftav326.sys [25.7.2011 17:32 480128]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 12:16 130384]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [25.7.2011 22:52 136176]
S3 appliand;Applian Network Service;c:\windows\system32\drivers\appliand.sys [19.8.2011 18:06 28256]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [25.7.2011 22:52 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 SKYNET;TechniSat DVB-PC TV Star PCI;c:\windows\system32\drivers\SkyNET.sys [21.11.2011 18:21 627288]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 12:16 753504]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'
.
2011-11-23 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-07-16 08:30]
.
2011-11-22 c:\windows\Tasks\Epson Printer Software Downloader.job
- c:\program files\EPSON\EPAPDL\E_SAPDL2.EXE [2009-01-23 13:03]
.
2011-11-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-25 21:51]
.
2011-11-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-25 21:51]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
mStart Page = hxxp://startsear.ch/?aff=1
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Přidat do Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\documents and settings\xxx\Data aplikací\Mozilla\Firefox\Profiles\95zg1wjx.default\
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - about:home
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-11-23 21:41
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1416)
c:\windows\system32\Ati2evxx.dll
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
- - - - - - - > 'explorer.exe'(2520)
c:\progra~1\WINDOW~2\wmpband.dll
c:\program files\Vista Start Menu\VistaStartMenu.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Samsung\Samsung PC Studio 7\phonebrowser.dll
c:\program files\Samsung\Samsung PC Studio 7\PCSCM_Samsung.dll
c:\program files\Samsung\Samsung PC Studio 7\Lang\PhoneBrowser_eng.nlr
c:\program files\Samsung\Samsung PC Studio 7\Resource\PhoneBrowser_Samsung.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\documents and settings\All Users\Data aplikací\EPSON\EPW!3 SSRP\E_S40ST7.EXE
c:\documents and settings\All Users\Data aplikací\EPSON\EPW!3 SSRP\E_S40RP7.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\RTHDCPL.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\System32\TUProgSt.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
.
**************************************************************************
.
Celkový čas: 2011-11-23 21:46:37 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-11-23 20:46
ComboFix2.txt 2011-11-23 02:00
ComboFix3.txt 2011-11-22 23:58
ComboFix4.txt 2011-11-22 12:10
.
Před spuštěním: Volných bajtů: 65 247 956 992
Po spuštění: Volných bajtů: 65 227 493 376
.
- - End Of File - - 101E509FB16471795DEA41E780B1ECD7

Re: PC nejde vypnout, pouze se restartuje

Napsal: 23 lis 2011 22:15
od Rudy
Ono tam asi ještě něco bude. Stáhněte a spusťte GMER: http://www.viry.cz/forum/viewtopic.php?f=29&t=62878 a dejte oba logy.

Re: PC nejde vypnout, pouze se restartuje

Napsal: 24 lis 2011 11:28
od Benton
Děkuji za odpověď. Zde jsou zmíněné logy. Ten druhé jel extrémně dlouho ( snad 4 hodiny )

Log 1:

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit quick scan 2011-11-23 22:22:42
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-5 WDC_WD5000AAKS-00A7B0 rev.01.03B01
Running: gmer.exe; Driver: C:\DOCUME~1\SCHWAR~1\LOCALS~1\Temp\fwddapow.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateKey [0xA9E39088]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateValueKey [0xA9E39A38]

Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) IoIsOperationSynchronous

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)

---- EOF - GMER 1.0.15 ----


Log 2:

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-11-24 01:26:20
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-5 WDC_WD5000AAKS-00A7B0 rev.01.03B01
Running: gmer.exe; Driver: C:\DOCUME~1\SCHWAR~1\LOCALS~1\Temp\fwddapow.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwAdjustPrivilegesToken [0xA9E23FBA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwClose [0xA9E248B4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwConnectPort [0xA9E3DAEE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateEvent [0xA9E24E26]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateMutant [0xA9E24D14]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreatePort [0xA9E3DE06]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateProcess [0xA9E25056]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateProcessEx [0xA9E2521E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSection [0xA9E23D76]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSemaphore [0xA9E24F3E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSymbolicLinkObject [0xA9E3F110]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateThread [0xA9E245E6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateWaitablePort [0xA9E3DECE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDebugActiveProcess [0xA9E2553C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeleteKey [0xA9E38084]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeleteValueKey [0xA9E3988E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeviceIoControlFile [0xA9E248F6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDuplicateObject [0xA9E2653C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateKey [0xA9E39088]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateValueKey [0xA9E39A38]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadDriver [0xA9E2562E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadKey [0xA9E38BC0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadKey2 [0xA9E38E1C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwMapViewOfSection [0xA9E3F130]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwNotifyChangeKey [0xA9E3C30A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenEvent [0xA9E24EB8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenMutant [0xA9E24DA0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenProcess [0xA9E241F4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenSection [0xA9E2597E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenSemaphore [0xA9E24FD0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenThread [0xA9E240E8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwPlugPlayControl [0xA9E3F120]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryKey [0xA9E37EB8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryMultipleValueKey [0xA9E39698]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryObject [0xA9E3C500]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQuerySection [0xA9E25EC0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryValueKey [0xA9E39488]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueueApcThread [0xA9E257CE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRenameKey [0xA9E38198]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplaceKey [0xA9E3880C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplyPort [0xA9E3E048]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplyWaitReceivePort [0xA9E3DF96]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRequestWaitReplyPort [0xA9E3E0B4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRestoreKey [0xA9E38A14]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwResumeThread [0xA9E263DE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSaveKey [0xA9E3833E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSaveKeyEx [0xA9E384D4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSaveMergedKeys [0xA9E38670]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSecureConnectPort [0xA9E3DC76]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetContextThread [0xA9E24756]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetInformationToken [0xA9E253E8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetSystemInformation [0xA9E26010]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetValueKey [0xA9E39248]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSuspendProcess [0xA9E26104]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSuspendThread [0xA9E2623E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSystemDebugControl [0xA9E2545E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwTerminateProcess [0xA9E24392]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwTerminateThread [0xA9E242EA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwUnmapViewOfSection [0xA9E25D78]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwWriteVirtualMemory [0xA9E2447C]

Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) IoIsOperationSynchronous

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!FsRtlCheckLockForReadAccess 804EAF84 5 Bytes JMP A9E169F0 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)
.text ntkrnlpa.exe!IoIsOperationSynchronous 804EF912 5 Bytes JMP A9E16DCC \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)
.text ntkrnlpa.exe!ZwCallbackReturn + 2C9C 80504538 12 Bytes [06, DE, E3, A9, 56, 50, E2, ...] {PUSH ES; FSUBRP ST(3), ST; TEST EAX, 0xa9e25056; PUSH DS; PUSH EDX; LOOP 0xffffffffffffffb5}
.text ntkrnlpa.exe!ZwCallbackReturn + 2CAC 80504548 16 Bytes [76, 3D, E2, A9, 3E, 4F, E2, ...]
.text ntkrnlpa.exe!ZwCallbackReturn + 2D68 80504604 12 Bytes [2E, 56, E2, A9, C0, 8B, E3, ...]
.text ntkrnlpa.exe!ZwCallbackReturn + 2DE4 80504680 4 Bytes CALL F2FA28C5
.text ntkrnlpa.exe!ZwCallbackReturn + 2EE4 80504780 16 Bytes [98, 81, E3, A9, 0C, 88, E3, ...]
.text ...
.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xB87B4000, 0x1C5D38, 0xE8000020]
init C:\WINDOWS\System32\Drivers\sunkfilt.sys entry point in "init" section [0xBA3C02E0]

---- User code sections - GMER 1.0.15 ----

? C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] C:\WINDOWS\system32\ntdll.dll time/date stamp mismatch;
.text C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 6AC91765 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ushata.dll (Ushata module/Kaspersky Lab ZAO)
? C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
.text C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] USER32.dll!AlignRects 7E362A78 4 Bytes [E0, 13, 54, 67]
.text C:\Program Files\ProgDVB\ProgDVBService.exe[1716] ntdll.dll!DbgBreakPoint 7C90120E 1 Byte [C3]
.text C:\Program Files\ProgDVB\ProgDVBService.exe[1716] ntdll.dll!DbgUiRemoteBreakin 7C9520EC 5 Bytes JMP 7C9225C8 C:\WINDOWS\system32\ntdll.dll (NT Layer DLL/Microsoft Corporation)
? C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] C:\WINDOWS\system32\ntdll.dll time/date stamp mismatch;
.text C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 6AC91765 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\ushata.dll (Ushata module/Kaspersky Lab ZAO)
? C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
.text C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] USER32.dll!AlignRects 7E362A78 4 Bytes [E0, 13, 54, 67]

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\system32\DRIVERS\tcpip.sys[TDI.SYS!TdiRegisterDeviceObject] [B98EBDC0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\netbt.sys[TDI.SYS!TdiRegisterDeviceObject] [B98EBDC0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlAllocateHeap] 7DFF058C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlFreeHeap] 7DFF05F8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlSizeHeap] 7DFF0664
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlReAllocateHeap] 7DFF06D0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\ADVAPI32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\ADVAPI32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\ADVAPI32.dll [ntdll.dll!RtlReAllocateHeap] 7DFF0370
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\RPCRT4.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\RPCRT4.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\Secur32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\Secur32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!HeapDestroy] 7DFF0520
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!HeapCreate] 7DFF04B4
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\NETAPI32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\NETAPI32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\USER32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\USER32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\GDI32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\GDI32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!HeapCreate] 7DFF04B4
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!HeapDestroy] 7DFF0520
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!HeapDestroy] 7DFF0520
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!HeapCreate] 7DFF04B4
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!HeapCreate] 7DFF04B4
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!HeapDestroy] 7DFF0520
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\SHELL32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\ole32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\userenv.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[996] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlAllocateHeap] 7DFF058C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlFreeHeap] 7DFF05F8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlSizeHeap] 7DFF0664
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlReAllocateHeap] 7DFF06D0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\ADVAPI32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\ADVAPI32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\ADVAPI32.dll [ntdll.dll!RtlReAllocateHeap] 7DFF0370
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\RPCRT4.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\RPCRT4.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\Secur32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\Secur32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!HeapDestroy] 7DFF0520
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!HeapCreate] 7DFF04B4
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\NETAPI32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\NETAPI32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\USER32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\USER32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\GDI32.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\GDI32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!HeapCreate] 7DFF04B4
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!HeapDestroy] 7DFF0520
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!HeapDestroy] 7DFF0520
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!HeapCreate] 7DFF04B4
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!HeapCreate] 7DFF04B4
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!HeapDestroy] 7DFF0520
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SHELL32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\userenv.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\ole32.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!HeapCreate] 7DFF04B4
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!HeapDestroy] 7DFF0520
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\iphlpapi.dll [ntdll.dll!RtlFreeHeap] 7DFF0304
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\iphlpapi.dll [ntdll.dll!RtlAllocateHeap] 7DFF0298
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!CreateThread] 7DFF0448
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!SetErrorMode] 7DFF0D90
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!GetModuleHandleA] 7DFF0C4C
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!GetModuleHandleW] 7DFF0CB8
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!GetProcAddress] 7DFF0D24
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!FreeLibrary] 7DFF0BE0
IAT C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[3348] @ C:\WINDOWS\system32\SAMLIB.dll [KERNEL32.dll!SetUnhandledExceptionFilter] 7DFF0DFC

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00158315a310
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00158315a310@0023d4d0af42 0x95 0xC7 0xDD 0x8C ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00158315a310@bc773736c3f5 0x35 0x0B 0x05 0x22 ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00158315a310 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00158315a310@0023d4d0af42 0x95 0xC7 0xDD 0x8C ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00158315a310@bc773736c3f5 0x35 0x0B 0x05 0x22 ...

---- Files - GMER 1.0.15 ----

File C:\RECYCLER 0 bytes
File C:\RECYCLER\S-1-5-21-1343024091-1614895754-725345543-1003 0 bytes
File C:\RECYCLER\S-1-5-21-1343024091-1614895754-725345543-1003\Dc1.log 62526 bytes
File C:\RECYCLER\S-1-5-21-1343024091-1614895754-725345543-1003\Dc2.exe 6044992 bytes executable
File C:\RECYCLER\S-1-5-21-1343024091-1614895754-725345543-1003\desktop.ini 65 bytes
File C:\RECYCLER\S-1-5-21-1343024091-1614895754-725345543-1003\INFO2 1620 bytes

---- EOF - GMER 1.0.15 ----

Re: PC nejde vypnout, pouze se restartuje

Napsal: 24 lis 2011 18:56
od Rudy
Spusťte znovu ComboFix tímto skriptem:
Collect::
C:\RECYCLER\S-1-5-21-1343024091-1614895754-725345543-1003
C:\RECYCLER\S-1-5-21-1343024091-1614895754-725345543-1003\Dc1.log
C:\RECYCLER\S-1-5-21-1343024091-1614895754-725345543-1003\Dc2.exe
C:\RECYCLER\S-1-5-21-1343024091-1614895754-725345543-1003\desktop.ini
C:\RECYCLER\S-1-5-21-1343024091-1614895754-725345543-1003\INFO2

Re: PC nejde vypnout, pouze se restartuje

Napsal: 25 lis 2011 12:12
od Benton
Děkuji za odpověď a rady. Pomohlo, PC se konečně zase vypíná jak má. Poslední otázka, je tedy v tuto chvíli možné systém považovat a za čistý a nemít strach např. do banky? Moc velké díky.

Re: PC nejde vypnout, pouze se restartuje

Napsal: 25 lis 2011 17:57
od Rudy
PC by již měl být čistý. Přesto bych ale doporučil (vzhledem k nákaze) změnit všechny hesla, která jste přes tento počítač užíval. Nemáte zač!

GMER můžete smazat a CF odinstalujte Start>spustit>(napsat) combofix /uninstall>OK.

Re: PC nejde vypnout, pouze se restartuje

Napsal: 25 lis 2011 19:56
od Benton
Děkuji za odpověď. Vzhledem k tomu, že ihned jak jsem tuto skutečnost zjistil i bezprostředně před ní žádná zásadní hesla na tomto PC nepoužil ( internet Banking atd. ) tak by snad mohlo být vše OK. Zadával jsem pouze hesla do různých for podobný tomuto a ty mám všechny ve správci hesel v Opeře a není v mé moci je všechna změnit jelikož si je už ani nepamatuji, ale to by snad neměl být zásadní problém. Ještě jednou děkuji.

Re: PC nejde vypnout, pouze se restartuje

Napsal: 25 lis 2011 19:58
od Rudy
Myslím, že zásadní problém by to mohl být v přípedě internet bankingu. Některé prohlížeče (třeba Firefox) si hesla ukládají. Taková hesla jsou pak snadnou kořistí útočníka. Nemáte zač!
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz