VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Vir při spuštění Steam.exe a všeho kolem něj

https://forum.viry.cz:443/viewtopic.php?t=120603

Stránka 1 z 1

Vir při spuštění Steam.exe a všeho kolem něj

Napsal: 24 bře 2012 21:07
od StanoMalek
Zdravím všechny. Včera jsem přišel na pc po týdnu a zjistil jsem, že mi to při startu počítače hlásí červa ve Steamu. Kamarád mi doporučil, že si mám stáhnout ComboFix a odeslat sem texťák, že se mi na to mrknete. Tak bych prosil, jestli by jsi na tento log udělal někdo čas a vysvětlil mi co s tým. Děkuji za rychlé odpovědi Stano.

Edit: případně zde z Combofixu: http://www.uloz.to/xM1PNF2/combofix-txt

Kód: Vybrat vše

Logfile of random's system information tool 1.09 (written by random/random)
Run by Stano at 2012-03-24 21:04:46
Microsoft Windows XP Professional Service Pack 3
System drive C: has 27 GB (49%) free of 56 GB
Total RAM: 1023 MB (51% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:04:54, on 24.3.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Ask.com\Updater\Updater.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Stano\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Stano\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Stano\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Stano\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Stano\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Stano\My Documents\Downloads\RSIT.exe
C:\Program Files\trend micro\Stano.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: KMPlayer Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit -login
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe /installquiet
O4 - HKLM\..\Run: [ApnUpdater] "C:\Program Files\Ask.com\Updater\Updater.exe"
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-21-1708537768-1214440339-1417001333-1004\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-1708537768-1214440339-1417001333-1004\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'UpdatusUser')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: RocketDock.lnk = C:\Program Files\RocketDock\RocketDock.exe
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: PHPGeekUtil - Unknown owner - c:\apache\APACHE.EXE
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 7282 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-1214440339-1417001333-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-1214440339-1417001333-1003UA.job
C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Stano\Application Data\Mozilla\Firefox\Profiles\h34m292r.default

prefs.js - "browser.startup.homepage" -  "www.google.cz"

"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2852]
"Description"=RealMedia Plugin
"Path"=C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1662]
"Description"=RealPlayer Version Plugin
"Path"=C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=]
"Description"=
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nppl3260.xpt
nsJSRealPlayerPlugin.xpt

C:\Program Files\Mozilla Firefox\plugins\
npdeployJava1.dll
nppdf32.dll
nppl3260.dll
nprpjplug.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Documents and Settings\Stano\Application Data\Mozilla\Firefox\Profiles\h34m292r.default\extensions\
toolbar@ask.com

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-01-03 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2012-03-03 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-01-17 3855520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
KMPlayer Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2012-01-03 1514152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-03-03 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2012-03-03 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{D4027C7F-154A-4066-A1AD-4243D8127440} - KMPlayer Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2012-01-03 1514152]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2011-10-08 16744256]
"NvMediaCenter"=NvMCTray.dll,NvTaskbarInit -login []
"nwiz"=C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2011-10-08 1632360]
"ApnUpdater"=C:\Program Files\Ask.com\Updater\Updater.exe [2012-01-03 1391272]
"VirtualCloneDrive"=C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [2011-03-07 89456]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-01-18 254696]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2008-07-19 78008]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2012-01-03 37296]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-02 843712]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Steam"=C:\Program Files\Steam\Steam.exe -silent []
"RocketDock"=C:\Program Files\RocketDock\RocketDock.exe [2007-09-02 495616]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2012-02-15 17146504]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
RocketDock.lnk - C:\Program Files\RocketDock\RocketDock.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2010-02-06 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoSMMyPictures"=1
"NoSMHelp"=1
"NoSMConfigurePrograms"=1
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe"="C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe:*:Enabled:Daemonu.exe"
"C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Java\jre6\bin\java.exe"="C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Microsoft Games\Age of Mythology\AoM.eXe"="C:\Program Files\Microsoft Games\Age of Mythology\AoM.eXe:*:Enabled:Age of Mythology"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Microsoft Games\Zoo Tycoon 2\zt.exe"="C:\Program Files\Microsoft Games\Zoo Tycoon 2\zt.exe:*:Enabled:Zoo Tycoon 2 Executable"
"C:\Program Files\Steam\steamapps\stanislavmalek\counter-strike\hl.exe"="C:\Program Files\Steam\steamapps\stanislavmalek\counter-strike\hl.exe:*:Enabled:Counter-Strike"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"VIDC.DIVX"=divx.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=yv12vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.lameacm"=lameACM.acm
"VIDC.FFDS"=ff_vfw.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======List of files/folders created in the last 1 month======

2012-03-24 21:04:47 ----D---- C:\Program Files\trend micro
2012-03-24 21:04:46 ----D---- C:\rsit
2012-03-24 20:47:31 ----A---- C:\Boot.bak
2012-03-24 20:47:19 ----RASHD---- C:\cmdcons
2012-03-24 20:45:13 ----A---- C:\WINDOWS\zip.exe
2012-03-24 20:45:13 ----A---- C:\WINDOWS\SWXCACLS.exe
2012-03-24 20:45:13 ----A---- C:\WINDOWS\SWSC.exe
2012-03-24 20:45:13 ----A---- C:\WINDOWS\SWREG.exe
2012-03-24 20:45:13 ----A---- C:\WINDOWS\sed.exe
2012-03-24 20:45:13 ----A---- C:\WINDOWS\PEV.exe
2012-03-24 20:45:13 ----A---- C:\WINDOWS\NIRCMD.exe
2012-03-24 20:45:13 ----A---- C:\WINDOWS\MBR.exe
2012-03-24 20:45:13 ----A---- C:\WINDOWS\grep.exe
2012-03-24 20:44:58 ----D---- C:\ComboFix
2012-03-24 12:46:21 ----D---- C:\WINDOWS\ERDNT
2012-03-24 12:44:36 ----D---- C:\Qoobox
2012-03-19 23:18:44 ----D---- C:\winnt
2012-03-19 23:18:44 ----D---- C:\phptriad
2012-03-19 23:17:53 ----D---- C:\apache
2012-03-17 12:10:13 ----A---- C:\motd.txt
2012-03-17 12:07:05 ----A---- C:\rules.txt
2012-03-16 16:39:43 ----D---- C:\Program Files\Microsoft.NET
2012-03-15 20:22:19 ----D---- C:\Documents and Settings\Stano\Application Data\PhotoFiltre Studio X
2012-03-15 20:21:57 ----D---- C:\Program Files\PhotoFiltre Studio X
2012-03-12 13:59:10 ----D---- C:\Program Files\ITE
2012-03-11 16:20:44 ----D---- C:\world5
2012-03-11 16:20:44 ----D---- C:\world
2012-03-11 16:20:44 ----D---- C:\Nether
2012-03-11 16:20:43 ----D---- C:\jump
2012-03-11 16:05:55 ----A---- C:\WorldInventories-v.1.2.0-beta.jar
2012-03-11 15:50:48 ----D---- C:\region
2012-03-11 14:18:09 ----A---- C:\minecraft_server.jar
2012-03-07 17:50:06 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2012-03-07 10:29:07 ----A---- C:\WINDOWS\IsUninst.exe
2012-03-05 20:50:11 ----A---- C:\WINDOWS\game.INI
2012-03-04 22:23:37 ----D---- C:\Documents and Settings\Stano\Application Data\Nero
2012-03-03 22:47:26 ----D---- C:\Documents and Settings\Stano\Application Data\Skype
2012-03-03 22:46:08 ----D---- C:\Program Files\Common Files\Skype
2012-03-03 22:45:56 ----RD---- C:\Program Files\Skype
2012-03-03 22:44:59 ----D---- C:\Documents and Settings\All Users\Application Data\Skype
2012-03-03 15:50:36 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2012-03-03 15:50:35 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2012-03-03 15:50:34 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2012-03-03 15:50:33 ----A---- C:\WINDOWS\system32\AvastSS.scr
2012-03-03 15:50:32 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2012-03-03 15:50:32 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2012-03-03 15:50:32 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2012-03-03 15:50:32 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2012-03-03 15:50:15 ----A---- C:\WINDOWS\system32\aswBoot.exe
2012-03-03 15:50:14 ----D---- C:\Program Files\Alwil Software
2012-03-03 15:46:49 ----D---- C:\Program Files\Common Files\Java
2012-03-03 15:46:37 ----A---- C:\WINDOWS\system32\javaws.exe
2012-03-03 15:46:37 ----A---- C:\WINDOWS\system32\javaw.exe
2012-03-03 15:46:37 ----A---- C:\WINDOWS\system32\java.exe
2012-03-03 15:46:12 ----D---- C:\Program Files\Java
2012-03-03 15:41:19 ----D---- C:\Documents and Settings\All Users\Application Data\Sun
2012-03-03 15:41:05 ----A---- C:\WINDOWS\system32\deployJava1.dll
2012-02-25 08:50:55 ----D---- C:\Documents and Settings\Stano\Application Data\pymclevel

======List of files/folders modified in the last 1 month======

2012-03-24 21:04:47 ----RD---- C:\Program Files
2012-03-24 20:58:53 ----D---- C:\WINDOWS\Temp
2012-03-24 20:55:09 ----D---- C:\WINDOWS
2012-03-24 20:55:09 ----A---- C:\WINDOWS\system.ini
2012-03-24 20:54:57 ----D---- C:\WINDOWS\system32\drivers\etc
2012-03-24 20:52:24 ----D---- C:\WINDOWS\system32\drivers
2012-03-24 20:52:24 ----D---- C:\WINDOWS\system32
2012-03-24 20:52:23 ----D---- C:\WINDOWS\AppPatch
2012-03-24 20:52:19 ----D---- C:\Program Files\Common Files
2012-03-24 20:47:53 ----D---- C:\WINDOWS\system32\CatRoot2
2012-03-24 20:47:31 ----RASH---- C:\boot.ini
2012-03-24 20:45:26 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-03-24 19:57:53 ----A---- C:\WINDOWS\NeroDigital.ini
2012-03-24 19:53:55 ----D---- C:\Program Files\Steam
2012-03-24 19:53:18 ----SHD---- C:\WINDOWS\Installer
2012-03-24 19:32:48 ----D---- C:\Documents and Settings
2012-03-24 16:36:33 ----D---- C:\Downloads
2012-03-24 12:46:47 ----D---- C:\WINDOWS\Prefetch
2012-03-23 16:22:19 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2012-03-20 18:43:06 ----D---- C:\Program Files\Mozilla Firefox
2012-03-19 22:02:07 ----D---- C:\Documents and Settings\Stano\Application Data\.minecraft
2012-03-16 17:28:14 ----RSD---- C:\WINDOWS\assembly
2012-03-16 17:28:14 ----D---- C:\WINDOWS\Microsoft.NET
2012-03-16 17:01:42 ----D---- C:\Documents and Settings\Stano\Application Data\uTorrent
2012-03-16 16:45:18 ----D---- C:\WINDOWS\WinSxS
2012-03-16 16:39:51 ----D---- C:\WINDOWS\system32\en-US
2012-03-16 16:39:41 ----D---- C:\WINDOWS\system32\mui
2012-03-16 16:26:40 ----SD---- C:\Documents and Settings\Stano\Application Data\Microsoft
2012-03-15 20:22:23 ----D---- C:\Documents and Settings\Stano\Application Data\Identities
2012-03-14 21:43:35 ----D---- C:\totalcmd
2012-03-13 20:34:27 ----D---- C:\Documents and Settings\Stano\Application Data\Adobe
2012-03-09 17:38:32 ----D---- C:\Program Files\Common Files\Adobe
2012-03-09 17:38:30 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2012-03-09 17:38:16 ----D---- C:\Program Files\Adobe
2012-03-07 18:30:29 ----D---- C:\Program Files\Common Files\Microsoft Shared
2012-03-07 18:30:20 ----HD---- C:\WINDOWS\inf
2012-03-07 18:29:37 ----D---- C:\Program Files\Common Files\System
2012-03-07 18:29:33 ----A---- C:\WINDOWS\win.ini
2012-03-07 17:52:42 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2012-03-07 11:33:52 ----D---- C:\Program Files\Microsoft Games
2012-03-04 07:57:23 ----D---- C:\WINDOWS\system32\config
2012-03-04 01:51:48 ----D---- C:\Program Files\Common Files\Steam
2012-03-03 17:05:12 ----D---- C:\Program Files\Screamer Radio
2012-03-03 16:05:58 ----D---- C:\Program Files\WinRar
2012-02-27 10:59:12 ----D---- C:\Program Files\The KMPlayer

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2009-04-28 44944]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2008-07-19 26944]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2008-07-19 42912]
R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2010-12-16 31088]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2008-11-02 56572]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 Aspi32;Aspi32; C:\WINDOWS\System32\drivers\aspi32.sys [2005-11-21 16512]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2008-07-19 94416]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2008-07-19 23152]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-09-01 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2011-10-08 12791488]
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2012-02-17 130432]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2012-02-17 225232]
R3 VClone;VClone; C:\WINDOWS\system32\DRIVERS\VClone.sys [2011-01-15 30208]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service; C:\WINDOWS\system32\drivers\viahduaa.sys [2012-02-17 2135280]
S1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-09-01 12032]
S3 AMBFilt;AMBFilt; C:\WINDOWS\system32\drivers\AMBFilt.sys [2012-02-17 1656960]
S3 catchme;catchme; \??\C:\DOCUME~1\Stano\LOCALS~1\Temp\catchme.sys []
S3 EagleXNt;EagleXNt; \??\C:\WINDOWS\system32\drivers\EagleXNt.sys []
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-03-18 26176]
S3 mbr;mbr; \??\C:\ComboFix\mbr.sys []
S3 MonFilt;MonFilt; C:\WINDOWS\system32\drivers\MonFilt.sys [2012-02-17 1389056]
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-13 20992]
S3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2010-02-06 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2010-02-06 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2008-07-19 16056]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2008-07-19 147640]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2012-03-03 153376]
R2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\system32\nvsvc32.exe [2011-10-08 298304]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-08 2253120]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2008-07-19 250040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2008-07-19 348344]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 PHPGeekUtil;PHPGeekUtil; c:\apache\APACHE.EXE [2002-01-25 20480]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-02-15 158856]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2012-02-24 489256]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

Re: Vir při spuštění Steam.exe a všeho kolem něj

Napsal: 24 bře 2012 21:24
od Rudy
Log RSIT vykonaný po použití ComboFixu je nám k ničemu, protože CF zahladil všechny stopy po příp. nákaze.

Ještě dočistíme. Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:
KillAll::

Folder::
C:\Program Files\Ask.com

File::
C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-1214440339-1417001333-1003Core.job
C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-1214440339-1417001333-1003UA.job
C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Obrázek

Re: Vir při spuštění Steam.exe a všeho kolem něj

Napsal: 24 bře 2012 21:43
od StanoMalek
Tak hotovo. Zde dodávám log

Kód: Vybrat vše

ComboFix 12-03-22.01 - Stano 24.03.2012  21:31:40.2.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1250.385.1033.18.1023.648 [GMT 1:00]
Running from: c:\documents and settings\Stano\My Documents\Downloads\ComboFix.exe
Command switches used :: c:\documents and settings\Stano\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1227 [VPS 120324-0] *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-1214440339-1417001333-1003Core.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-1214440339-1417001333-1003UA.job"
"c:\windows\Tasks\Scheduled Update for Ask Toolbar.job"
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Ask.com
c:\program files\Ask.com\assets\oobe\b.png
c:\program files\Ask.com\assets\oobe\bl.png
c:\program files\Ask.com\assets\oobe\br.png
c:\program files\Ask.com\assets\oobe\l.png
c:\program files\Ask.com\assets\oobe\pointer.png
c:\program files\Ask.com\assets\oobe\r.png
c:\program files\Ask.com\assets\oobe\t.png
c:\program files\Ask.com\assets\oobe\tl.png
c:\program files\Ask.com\assets\oobe\tr.png
c:\program files\Ask.com\cobrand.ico
c:\program files\Ask.com\config.xml
c:\program files\Ask.com\favicon.ico
c:\program files\Ask.com\fv_d4.ico
c:\program files\Ask.com\GenericAskToolbar.dll
c:\program files\Ask.com\mupcfg.xml
c:\program files\Ask.com\precache.exe
c:\program files\Ask.com\SaUpdate.exe
c:\program files\Ask.com\Updater\config.xml
c:\program files\Ask.com\Updater\Updater.exe
c:\program files\Ask.com\UpdateTask.exe
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-1214440339-1417001333-1003Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-1214440339-1417001333-1003UA.job
c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
.
---- Previous Run -------
.
c:\documents and settings\Default User\~AA7.tmp
c:\documents and settings\Default User\Local Settings\Application Data\reg.exe
c:\documents and settings\Stano\~AA7.tmp
c:\documents and settings\Stano\Local Settings\Application Data\reg.exe
c:\documents and settings\Stano\WINDOWS
c:\documents and settings\UpdatusUser\~AA7.tmp
c:\documents and settings\UpdatusUser\Local Settings\Application Data\Reg.exe
c:\windows\IsUn0405.exe
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\system32\config\systemprofile\~AA7.tmp
.
.
(((((((((((((((((((((((((   Files Created from 2012-02-24 to 2012-03-24  )))))))))))))))))))))))))))))))
.
.
2012-03-24 20:04 . 2012-03-24 20:04	--------	d-----w-	c:\program files\trend micro
2012-03-24 20:04 . 2012-03-24 20:04	--------	d-----w-	C:\rsit
2012-03-24 16:48 . 2012-03-24 17:02	--------	d-----w-	c:\documents and settings\Solar Survival2.1
2012-03-24 16:30 . 2012-03-24 16:47	--------	d-----w-	c:\documents and settings\world5
2012-03-19 22:18 . 2012-03-19 22:18	--------	d-----w-	C:\winnt
2012-03-19 22:18 . 2012-03-19 22:18	--------	d-----w-	C:\phptriad
2012-03-19 22:17 . 2012-03-19 22:18	--------	d-----w-	C:\apache
2012-03-16 15:39 . 2012-03-16 15:39	--------	d-----w-	c:\program files\Microsoft.NET
2012-03-15 19:22 . 2012-03-15 20:04	--------	d-----w-	c:\documents and settings\Stano\Application Data\PhotoFiltre Studio X
2012-03-15 19:21 . 2012-03-15 19:22	--------	d-----w-	c:\program files\PhotoFiltre Studio X
2012-03-13 08:43 . 2012-03-13 08:43	--------	d-----w-	c:\documents and settings\Stano\Local Settings\Application Data\Identities
2012-03-12 12:59 . 2012-03-12 12:59	--------	d-----w-	c:\program files\ITE
2012-03-11 15:20 . 2012-03-19 21:30	--------	d-----w-	C:\world
2012-03-11 15:20 . 2012-03-11 15:20	--------	d-----w-	C:\Nether
2012-03-11 15:20 . 2012-03-11 15:20	--------	d-----w-	C:\jump
2012-03-11 14:50 . 2012-03-11 19:00	--------	d-----w-	C:\region
2012-03-07 16:50 . 2012-03-07 16:50	--------	d-----w-	c:\documents and settings\Stano\Local Settings\Application Data\Microsoft Help
2012-03-07 16:50 . 2012-03-07 17:30	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2012-03-07 09:29 . 1998-01-23 11:22	304128	----a-w-	c:\windows\IsUninst.exe
2012-03-04 21:23 . 2012-03-04 21:23	--------	d-----w-	c:\documents and settings\Stano\Application Data\Nero
2012-03-04 18:21 . 2012-03-04 21:28	--------	d-----w-	c:\documents and settings\Stano\Local Settings\Application Data\LogMeIn Hamachi
2012-03-04 18:17 . 2012-03-04 21:28	--------	d-----w-	c:\documents and settings\LocalService\Local Settings\Application Data\LogMeIn Hamachi
2012-03-03 21:47 . 2012-03-24 19:57	--------	d-----w-	c:\documents and settings\Stano\Application Data\Skype
2012-03-03 21:46 . 2012-03-03 21:46	--------	d-----w-	c:\program files\Common Files\Skype
2012-03-03 21:45 . 2012-03-03 21:48	--------	d-----r-	c:\program files\Skype
2012-03-03 21:44 . 2012-03-03 21:45	--------	d-----w-	c:\documents and settings\All Users\Application Data\Skype
2012-03-03 14:50 . 2008-07-19 15:33	23152	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2012-03-03 14:50 . 2008-07-19 15:32	42912	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2012-03-03 14:50 . 2008-07-19 15:32	26944	----a-w-	c:\windows\system32\drivers\aavmker4.sys
2012-03-03 14:50 . 2008-07-19 15:30	94392	----a-w-	c:\windows\system32\AvastSS.scr
2012-03-03 14:50 . 2008-07-19 15:37	20560	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2012-03-03 14:50 . 2008-07-19 15:37	94416	----a-w-	c:\windows\system32\drivers\aswmon2.sys
2012-03-03 14:50 . 2008-07-19 15:35	78416	----a-w-	c:\windows\system32\drivers\aswSP.sys
2012-03-03 14:50 . 2008-01-17 17:34	93264	----a-w-	c:\windows\system32\drivers\aswmon.sys
2012-03-03 14:50 . 2008-07-19 15:43	1163960	----a-w-	c:\windows\system32\aswBoot.exe
2012-03-03 14:50 . 2004-01-09 10:13	380928	----a-w-	c:\windows\system32\actskin4.ocx
2012-03-03 14:50 . 2012-03-03 14:50	--------	d-----w-	c:\program files\Alwil Software
2012-03-03 14:46 . 2012-03-03 14:46	--------	d-----w-	c:\program files\Common Files\Java
2012-03-03 14:46 . 2012-03-03 14:46	73728	----a-w-	c:\windows\system32\javacpl.cpl
2012-03-03 14:46 . 2012-03-03 14:46	--------	d-----w-	c:\program files\Java
2012-03-03 14:41 . 2012-03-03 14:46	476904	----a-w-	c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2012-03-03 14:41 . 2012-03-03 14:46	472808	----a-w-	c:\windows\system32\deployJava1.dll
2012-03-01 13:03 . 2008-04-14 04:42	26624	----a-w-	c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2012-02-25 07:50 . 2012-02-25 07:50	--------	d-----w-	c:\documents and settings\Stano\Application Data\pymclevel
2012-02-25 07:50 . 2012-02-25 07:50	--------	d-----w-	c:\documents and settings\Stano\Local Settings\Application Data\MCEdit
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-17 11:50 . 2012-02-17 11:50	225232	----a-w-	c:\windows\system32\drivers\Rtenicxp.sys
2012-02-17 11:50 . 2012-02-17 11:50	100896	----a-w-	c:\windows\system32\RTNUninst32.dll
2012-02-17 11:50 . 2012-02-17 11:49	80416	----a-w-	c:\windows\system32\RtNicProp32.dll
2012-02-17 11:49 . 2012-02-17 11:49	130432	----a-w-	c:\windows\system32\drivers\Rtnicxp.sys
2012-02-17 11:47 . 2012-02-17 11:47	2135280	----a-w-	c:\windows\system32\drivers\viahduaa.sys
2012-02-17 11:47 . 2012-02-17 11:47	1656960	----a-w-	c:\windows\system32\drivers\Ambfilt.sys
2012-02-17 11:47 . 2012-02-17 11:47	1389056	----a-w-	c:\windows\system32\drivers\Monfilt.sys
2012-02-20 07:29 . 2012-02-17 11:31	134104	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2010-02-05 . 68F06FE0021B01E670AF37B8C5964FDF . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\tcpip.sys
.
[-] 2010-02-05 . F46B0A14F18667CCCFFE962B87558BF7 . 1430528 . . [6.00.2900.2180] . . c:\windows\explorer.exe
.
[-] 2010-02-05 . C951DB3D9B6EF3CF4B82454D30A8BF59 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((   SnapShot@2012-03-24_19.55.08   )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-03-24 20:37 . 2012-03-24 20:37	16384              c:\windows\Temp\Perflib_Perfdata_7c0.dat
+ 2012-03-24 20:37 . 2012-03-24 20:37	16384              c:\windows\Temp\Perflib_Perfdata_278.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\Steam\Steam.exe" [BU]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-02-15 17146504]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-10-08 16744256]
"NvMediaCenter"="NvMCTray.dll" [2011-10-08 203072]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2011-10-08 1632360]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2008-04-14 99840]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
RocketDock.lnk - c:\program files\RocketDock\RocketDock.exe [2012-2-17 495616]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Mythology\\AoM.eXe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"=
"c:\\Program Files\\Steam\\steamapps\\stanislavmalek\\counter-strike\\hl.exe"=
.
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [3/3/2012 3:50 PM 78416]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [3/3/2012 3:50 PM 20560]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2/17/2012 12:27 PM 2253120]
R2 PHPGeekUtil;PHPGeekUtil;c:\apache\Apache.exe [1/25/2002 5:30 AM 20480]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2/17/2012 12:47 PM 2135280]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2/15/2012 1:30 PM 158856]
S3 AMBFilt;AMBFilt;c:\windows\system32\drivers\Ambfilt.sys [2/17/2012 12:47 PM 1656960]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
TCP: DhcpNameServer = 192.168.1.1 10.0.0.1
FF - ProfilePath - c:\documents and settings\Stano\Application Data\Mozilla\Firefox\Profiles\h34m292r.default\
FF - prefs.js: browser.startup.homepage - www.google.cz
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-ApnUpdater - c:\program files\Ask.com\Updater\Updater.exe
AddRemove-{79A765E1-C399-405B-85AF-466F52E918B0} - c:\program files\Ask.com\Updater\Updater.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-03-24 21:38
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...  
.
scanning hidden autostart entries ... 
.
scanning hidden files ...  
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2212)
c:\program files\RocketDock\RocketDock.dll
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\RunDLL32.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\windows\system32\wscntfy.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Alwil Software\Avast4\setup\avast.setup
.
**************************************************************************
.
Completion time: 2012-03-24  21:41:25 - machine was rebooted
ComboFix-quarantined-files.txt  2012-03-24 20:41
.
Pre-Run: 28.632.051.712 bytes free
Post-Run: 28.618.694.656 bytes free
.
- - End Of File - - 77DE3A70E7EBC9397C821A3B0E015252

Re: Vir při spuštění Steam.exe a všeho kolem něj

Napsal: 24 bře 2012 21:45
od Rudy
Vše smazáno. Nastala nějaká změna?

Re: Vir při spuštění Steam.exe a všeho kolem něj

Napsal: 24 bře 2012 21:52
od StanoMalek
Změna nastala, už to jede bez problémů. Jen java, když přes ní něco spustím zabírá na procesoru 80ku, ale to bude asi jenom problém v tom, že mám slabší pc.

Mockrát děkuji můžete lock : :thumbsup:

S pozdravem Stano

:closed:

Re: Vir při spuštění Steam.exe a všeho kolem něj

Napsal: 24 bře 2012 22:26
od Rudy
Nemáte zač a zamykám.
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz