VIRY.CZ

Zdravim vas,

v soucasne dobe se nam rozsirily viry pres flesku. Muj PC se sice chova normalne (ani nevim, ze tu viry mam), ale kolega mi dal cistou flesku ani jsem ji neotevrel, jen jsem dal odeslat soubor na jeho flesku a vratil jsem mu ji zavirovanou.

Snazil jsem se udelat log z RISTu, ale pri pokusu o spusteni tohoto souboru se zobrazi chybova hlaska RIST.exe neni platna aplikace typu Win32.

Jak mam tedy postupovat kdyz zatim nelze spustit RIST?

Ahoj,

spustil jsem to pres RUN, po dokonceni mi zustalo okno skeneru, ktere nemohu zavrit normalni cestou.

pozadovany soubor v priloze

na abraka.com mam prejmenovat ten combo fix? prejmenovat hned a nebo jen kdyz nepujde spustit?

ComboFix 09-10-04.01 - User 05.10.2009 19:59.5.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.2047.1439 [GMT 2:00]
Spuštěný z: c:\documents and settings\User\Plocha\abraka.com
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\User\Cookies\index(1).dat

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-09-05 do 2009-10-05 )))))))))))))))))))))))))))))))
.

2009-09-18 08:51 . 2009-09-18 08:51 -------- d-sh--w- c:\documents and settings\Karel Zikmund\PrivacIE
2009-09-09 19:37 . 2009-06-21 21:48 153088 -c----w- c:\windows\system32\dllcache\triedit.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-10 23:04 . 2008-06-20 07:14 -------- d-----w- c:\program files\Microsoft Silverlight
2009-08-05 09:01 . 2007-10-29 12:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-17 19:04 . 2007-10-29 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2007-10-29 12:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2008-06-18 11:56 . 2008-06-18 11:57 32768 --sha-w- c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008061820080619\index(1).dat
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2006-10-01 139322]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-19 68856]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATKHOTKEY"="c:\program files\ATK Hotkey\Hcontrol.exe" [2007-06-29 225280]
"ATKOSD2"="c:\program files\ATKOSD2\ATKOSD2.exe" [2007-07-03 7708672]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 61440]
"Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2006-07-26 90112]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2007-07-10 851968]
"ASUS Camera ScreenSaver"="c:\windows\ASScrProlog.exe" [2008-02-28 37232]
"ASUS Screen Saver Protector"="c:\windows\ASScrPro.exe" [2008-02-28 33136]
"Wireless Console 2"="c:\program files\Wireless Console 2\wcourier.exe" [2007-07-05 1040384]
"OODefragTray"="c:\windows\system32\oodtray.exe" [2007-05-11 2512392]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-11-14 16270848]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Karel Zikmund\Nabˇdka Start\Programy\Po spuçtŘnˇ\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Acer\\ProjectorGateway\\AcerProjectorGateway.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 107256]
R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [6.12.2007 22:03 660768]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [14.5.2009 15:47 731840]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [28.3.2009 23:18 55152]
R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\system32\StkCSrv.exe [28.2.2008 16:32 24576]
R3 ASNDIS5;ASNDIS5 Protocol Driver;c:\progra~1\ATKHOT~1\ASNDIS5.SYS [28.2.2008 16:17 16269]
R3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;c:\windows\system32\drivers\StkCMini.sys [28.2.2008 16:32 1260672]
S2 gupdate1c993b08a607838;Služba Google Update (gupdate1c993b08a607838);c:\program files\Google\Update\GoogleUpdate.exe [21.2.2009 01:11 133104]
S3 Asushwio;Asushwio;c:\windows\system32\drivers\Asushwio.sys [28.2.2008 16:14 5824]
S3 fsssvc;Windows Live Zabezpečení rodiny;c:\program files\Windows Live\Family Safety\fsssvc.exe [6.2.2009 19:08 533360]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - UTIWNJAY
*Deregistered* - utiwnjay

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Obsah adresáře 'Naplánované úlohy'

2009-08-21 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-05-20 17:17]

2009-09-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 15:57]

2009-10-05 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-20 14:46]

2009-09-28 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-20 23:11]

2009-10-05 c:\windows\Tasks\User_Feed_Synchronization-{3607E8A8-277C-41D2-98FA-C4010CC5ACF3}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://google.cz/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&s ... f8&oe=utf8
uInternet Settings,ProxyOverride = <local>;
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Přizpůsobit Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: RF Nástrojová lišta - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Uložit formuláře - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: Vyplnit formulář - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-Po stopách Mayů Screensaver - c:\program files\AWD česká republika s.r.o.\Po
AddRemove-Advanced Outlook Password Recovery - c:\program files\ElcomSoft\AOLPR\uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-05 20:05
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="C47115C00F37A67294E1E069447DBC9E43325C25AF6A5C4787445EF3424E9A1A886DF96F30077557D4AC4EDAC3FE4FE59177AB41FEFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B98088EDD5E5BE2F6E6675D575E7D6A3B98081CA1B2CDA8F31CF2891D97137C955418B1CF3ACCFA6DD8E457764F181E9B1A85704101BA33569B02AD4A8CE1A6890F668562DD2C5C468634DB26CF069A042E2632646DD989321C4B6C5AC907B317B16220BCE6B52A028796F78DA96B2AC96C7D2C44667A581EF270794BF0C20B2B12ACBDC0C5B7A583D14C1595BF4004E48C078FF2E0E3F0CAB7497072A6C4B549C8188329706EB0C120447C7DF67082628970EFCFD3CD4877C662CCF613346107B3AE7502E18E52C9EFA5DF55BB5D2863229BC6933A66F6F8BFFAF1D3E32BE08EF22D002B95BE353804C9CF04FBDA9799591F6F48144C3AB98885A2DA48B7A91FEC026F5B8F1AA942E2BCC4C32A2E98CF78472CCDE51772B6462B0BADF5DAD50A4AD3F71AD32E20AED3C29A20BC96176107111FD5374F2581674637C5A40B2335F7F9AF44EB80B058E8CE91FD2FC223BDD72F51669271FB3E1CE598ED12B3F29BA782900B660796AFF18CCA1100D6F0E9FB88305B886EC12857CE84C6FD314C4CCD2C7972552BB13686D6CE63B06A57FE4AB70BE32D2B688A5278B442ADD6D76824EBABD4CC4E0205FEC18A53C90A5428DE8A1782178185C7098D46AA6AE8E4A6A66ACEDCE743B146F912CB1255B6852619056B8DE1BDD055BAEEBA1A7F24E3D19805EC0DC24F88B9DB40C4A5DFE230CC1BDB86AF2E21A8BAEBAE77803EB36BC6FC4BF339012F78B148FA8F68FEF63C844D7A47E81FE00D186615C521FA3B36789E03B70B46919297A9A3260748CE34CA5900728A5C26A11C331D54168E50A06D0A226CFDBD980E642FCFE704D53BC9AD303EAFBB910DB18DA4F632C8557CADC010D7ADE315DB45A8CAC818B3C6004F53033B0DF66E272945CE065779B03E031E4604FAE1FC663887B18BDDC23E543E734A32798CA6F998318A619A3D8588694B85B9B46FAA3889375E4A47AC61E4B1D941914A1D71FD35D0F155BB7A3BC0D09B6B43A259D9437F05116A40C4DCD168E666FBB8210B21D7BBE5E059EDBE404AFA581DEE42C5ED064E48069D2F5D30488F7D485EE233C37D990B37FBA502D50B677275A69CB214AB874D6A96E61785D85C8C7FBD812D3AC6A7C9418B8777C2EDF2A2B33EB26405A2B7A897C63840504567DFE2BA6FC0CD79384D97554B9A3EEF4315EE8B212483C1F9A8C5AE47137E5D6406629E7239BCFCAF070E0AF9E57133133CF4485841C505FCDFDBAF87CDF49594D2A5932667B65F88A9A4C076D97A7E314C44139D0DF88B05A479924435"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1088)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2009-10-05 20:07
ComboFix-quarantined-files.txt 2009-10-05 18:07

Před spuštěním: 1.876.353.024
Po spuštění: 2.061.066.240

166 --- E O F --- 2009-09-10 21:37

dekuji za dosavadni pomoc, dneska jsme udelali aspon kus prace. Take preji dobrou noc.

posilam log:

Malwarebytes' Anti-Malware 1.41
Verze databáze: 2910
Windows 5.1.2600 Service Pack 3

5.10.2009 21:30:40
mbam-log-2009-10-05 (21-30-40).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 101044
Uplynulý čas: 2 minute(s), 19 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
(Nebyly nalezeny žádné škodlivé položky)

udelal jsem pro jistotu i kompletni test a vida, v rychlem testu to nic nenaslo ale v kompletnim to naslo jeden worm a jeden trojan. Dal jsem oba soubory testovat na virustotal a zde jsou vysledky testu:

http://www.virustotal.com/cs/analisis/b ... 1254774632

http://www.virustotal.com/cs/analisis/2 ... 1254774874

Prikladam sem jeste log z kompletniho testu. Zatim jsem nic nemazal, cekam na tvoje pozehnani.

Malwarebytes' Anti-Malware 1.41
Verze databáze: 2910
Windows 5.1.2600 Service Pack 3

5.10.2009 22:20:59
mbam-log-2009-10-05 (22-20-11).txt

Typ kontroly: Kompletní kontrola (C:\|D:\|)
Zkontrolované objekty: 210109
Uplynulý čas: 29 minute(s), 48 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 2

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\System Volume Information\_restore{B635F3CC-4C72-48EE-B2E3-C85B3B47E59F}\RP6\A0001335.sys (Worm.Agent) -> No action taken.
D:\Dokuments\User\Dokumenty\Dokumenty - D\INSTALACE\Nero vypalovaci programy\NERO 6 od Davida\NERO 6.6.0.8 + cz+keygen\Keygen.exe (Trojan.Agent) -> No action taken.

Ahoj,

mam vymazat oba? (worm i trojan?)

zde je vysledek testu http://www.virustotal.com/cs/analisis/8 ... 1254818623

vir se chova takto:
pokud nekdo ma flesku, kterou zformatoval tak predpokladam, ze neni nakazena. Tuto flesku ja vlozim do USB na svem PC, jen se nacte. Pravym tlacitkem mysi na soubor dam odeslat soubor na flesku (ani ji nemusim otevirat) a flesku odhlasim a vyjmu z USB. Kdyz tuto flesku da kolega do sveho PC a povoli zobrazeni skrytych a systemovych souboru tak vidi, ze vsechny slozhy ktere na flesce jsou tak se chovaji jako skryte a rovnez si vsechny slozky vytvorili duplicitni identicke kopie, ktere maji priponu exe a ty prave nejsou skryte. Kdyz pak znovu dame skryt systemove a skryte soubory, tak se nam ty prave slozky skryji a jejich falesne kopie s priponou exe zustavaji videt a pro bezneho uzivatele se chovaji jako standardni slozky ktere pak po kliknuti siri nakazu. Mam to i na sve flesce a maji to i kolegove v praci. Pri dosavadnich testech jsem zatim nemel flashdisk v PC.

ted jdu udelat ten test co ti jeste dluzim...

Kdyz se pokusim vlozit prilohu tak mi zmizi tlacitko odeslat prispevek tak to skusim na dvakrat a dam prilohu zvlast....


nevim, jak smazat to co nasel MBAM a zda mam mazat jak Worm tak i Trojan. Musim znovu spustit kompletni test abych se dostal k moznosti mazani? V zalozce karantena je pouze Malware.Trace, dam ti to do PrtSc. do stejneho wordu jako PrtSc z flesky.

PrintScr. je na flesce stejny pred pouzitim ComboFix jako po nem, posilam v priloze

Tady je log z ComboFixu i s vlozenou fleskou

ComboFix 09-10-05.01 - User 06.10.2009 11:58.6.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.2047.1384 [GMT 2:00]
Spuštěný z: c:\documents and settings\User\Plocha\abraka.com
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

((((((((((((((((((((((((( Soubory vytvořené od 2009-09-06 do 2009-10-06 )))))))))))))))))))))))))))))))
.

2009-10-05 20:43 . 2001-10-24 10:25 5632 ----a-w- c:\windows\system32\ptpusb.dll
2009-10-05 20:43 . 2008-04-14 06:51 159232 ----a-w- c:\windows\system32\ptpusd.dll
2009-10-05 20:43 . 2008-04-13 22:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2009-10-05 20:43 . 2008-04-13 22:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-10-05 19:26 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-05 19:26 . 2009-10-05 20:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-05 19:26 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-05 17:58 . 2009-10-05 18:07 -------- d-----w- C:\abraka
2009-09-18 08:51 . 2009-09-18 08:51 -------- d-sh--w- c:\documents and settings\Karel Zikmund\PrivacIE
2009-09-09 19:37 . 2009-06-21 21:48 153088 -c----w- c:\windows\system32\dllcache\triedit.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-10 23:04 . 2008-06-20 07:14 -------- d-----w- c:\program files\Microsoft Silverlight
2009-08-05 09:01 . 2007-10-29 12:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-17 19:04 . 2007-10-29 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2007-10-29 12:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2008-06-18 11:56 . 2008-06-18 11:57 32768 --sha-w- c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008061820080619\index(1).dat
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2006-10-01 139322]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-19 68856]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATKHOTKEY"="c:\program files\ATK Hotkey\Hcontrol.exe" [2007-06-29 225280]
"ATKOSD2"="c:\program files\ATKOSD2\ATKOSD2.exe" [2007-07-03 7708672]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 61440]
"Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2006-07-26 90112]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2007-07-10 851968]
"ASUS Camera ScreenSaver"="c:\windows\ASScrProlog.exe" [2008-02-28 37232]
"ASUS Screen Saver Protector"="c:\windows\ASScrPro.exe" [2008-02-28 33136]
"Wireless Console 2"="c:\program files\Wireless Console 2\wcourier.exe" [2007-07-05 1040384]
"OODefragTray"="c:\windows\system32\oodtray.exe" [2007-05-11 2512392]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-11-14 16270848]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Karel Zikmund\Nabˇdka Start\Programy\Po spuçtŘnˇ\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-9-29 49152]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Acer\\ProjectorGateway\\AcerProjectorGateway.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 107256]
R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [6.12.2007 22:03 660768]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [14.5.2009 15:47 731840]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [28.3.2009 23:18 55152]
R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\system32\StkCSrv.exe [28.2.2008 16:32 24576]
R3 ASNDIS5;ASNDIS5 Protocol Driver;c:\progra~1\ATKHOT~1\ASNDIS5.SYS [28.2.2008 16:17 16269]
R3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;c:\windows\system32\drivers\StkCMini.sys [28.2.2008 16:32 1260672]
S2 gupdate1c993b08a607838;Služba Google Update (gupdate1c993b08a607838);c:\program files\Google\Update\GoogleUpdate.exe [21.2.2009 01:11 133104]
S3 Asushwio;Asushwio;c:\windows\system32\drivers\Asushwio.sys [28.2.2008 16:14 5824]
S3 fsssvc;Windows Live Zabezpečení rodiny;c:\program files\Windows Live\Family Safety\fsssvc.exe [6.2.2009 19:08 533360]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - UTIWNJAY
*Deregistered* - utiwnjay

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Obsah adresáře 'Naplánované úlohy'

2009-08-21 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-05-20 17:17]

2009-10-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 15:57]

2009-10-06 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-20 14:46]

2009-10-06 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-20 23:11]

2009-10-06 c:\windows\Tasks\User_Feed_Synchronization-{3607E8A8-277C-41D2-98FA-C4010CC5ACF3}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://google.cz/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&s ... f8&oe=utf8
uInternet Settings,ProxyOverride = <local>;
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Přizpůsobit Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: RF Nástrojová lišta - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Uložit formuláře - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: Vyplnit formulář - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-06 12:01
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="C47115C00F37A67294E1E069447DBC9E43325C25AF6A5C4787445EF3424E9A1A886DF96F30077557D4AC4EDAC3FE4FE59177AB41FEFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B98088EDD5E5BE2F6E6675D575E7D6A3B98081CA1B2CDA8F31CF2891D97137C955418B1CF3ACCFA6DD8E457764F181E9B1A85704101BA33569B02AD4A8CE1A6890F668562DD2C5C468634DB26CF069A042E2632646DD989321C4B6C5AC907B317B16220BCE6B52A028796F78DA96B2AC96C7D2C44667A581EF270794BF0C20B2B12ACBDC0C5B7A583D14C1595BF4004E48C078FF2E0E3F0CAB7497072A6C4B549C8188329706EB0C120447C7DF67082628970EFCFD3CD4877C662CCF613346107B3AE7502E18E52C9EFA5DF55BB5D2863229BC6933A66F6F8BFFAF1D3E32BE08EF22D002B95BE353804C9CF04FBDA9799591F6F48144C3AB98885A2DA48B7A91FEC026F5B8F1AA942E2BCC4C32A2E98CF78472CCDE51772B6462B0BADF5DAD50A4AD3F71AD32E20AED3C29A20BC96176107111FD5374F2581674637C5A40B2335F7F9AF44EB80B058E8CE91FD2FC223BDD72F51669271FB3E1CE598ED12B3F29BA782900B660796AFF18CCA1100D6F0E9FB88305B886EC12857CE84C6FD314C4CCD2C7972552BB13686D6CE63B06A57FE4AB70BE32D2B688A5278B442ADD6D76824EBABD4CC4E0205FEC18A53C90A5428DE8A1782178185C7098D46AA6AE8E4A6A66ACEDCE743B146F912CB1255B6852619056B8DE1BDD055BAEEBA1A7F24E3D19805EC0DC24F88B9DB40C4A5DFE230CC1BDB86AF2E21A8BAEBAE77803EB36BC6FC4BF339012F78B148FA8F68FEF63C844D7A47E81FE00D186615C521FA3B36789E03B70B46919297A9A3260748CE34CA5900728A5C26A11C331D54168E50A06D0A226CFDBD980E642FCFE704D53BC9AD303EAFBB910DB18DA4F632C8557CADC010D7ADE315DB45A8CAC818B3C6004F53033B0DF66E272945CE065779B03E031E4604FAE1FC663887B18BDDC23E543E734A32798CA6F998318A619A3D8588694B85B9B46FAA3889375E4A47AC61E4B1D941914A1D71FD35D0F155BB7A3BC0D09B6B43A259D9437F05116A40C4DCD168E666FBB8210B21D7BBE5E059EDBE404AFA581DEE42C5ED064E48069D2F5D30488F7D485EE233C37D990B37FBA502D50B677275A69CB214AB874D6A96E61785D85C8C7FBD812D3AC6A7C9418B8777C2EDF2A2B33EB26405A2B7A897C63840504567DFE2BA6FC0CD79384D97554B9A3EEF4315EE8B212483C1F9A8C5AE47137E5D6406629E7239BCFCAF070E0AF9E57133133CF4485841C505FCDFDBAF87CDF49594D2A5932667B65F88A9A4C076D97A7E314C44139D0DF88B05A479924435"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1088)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(5892)
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2009-10-06 12:03
ComboFix-quarantined-files.txt 2009-10-06 10:03
ComboFix2.txt 2009-10-05 18:07

Před spuštěním: 2.020.864.000
Po spuštění: 1.999.618.048

174 --- E O F --- 2009-09-10 21:37

aha pripona doc neni povolena tak jsem to jeste zabalil a uz je to tady

Provedl jsem znovu kompletni test MBAM i s fleskou a nalezl 4 viry. PrtSc jsem dal k nahlednuti do prilohy nize posilam jeste log jestli vam pomuze k lepsi orientaci. Mam smazat vsechny 4 vyskyty?

Malwarebytes' Anti-Malware 1.41
Verze databáze: 2910
Windows 5.1.2600 Service Pack 3

6.10.2009 14:01:16
mbam-log-2009-10-06 (14-00-57).txt

Typ kontroly: Kompletní kontrola (C:\|D:\|E:\|F:\|H:\|I:\|)
Zkontrolované objekty: 209683
Uplynulý čas: 29 minute(s), 31 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 4

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\System Volume Information\_restore{B635F3CC-4C72-48EE-B2E3-C85B3B47E59F}\RP6\A0001335.sys (Worm.Agent) -> No action taken.
C:\System Volume Information\_restore{B635F3CC-4C72-48EE-B2E3-C85B3B47E59F}\RP6\A0001394.sys (Worm.Agent) -> No action taken.
C:\System Volume Information\_restore{B635F3CC-4C72-48EE-B2E3-C85B3B47E59F}\RP6\A0001482.sys (Worm.Agent) -> No action taken.
D:\Dokuments\User\Dokumenty\Dokumenty - D\INSTALACE\Nero vypalovaci programy\NERO 6 od Davida\NERO 6.6.0.8 + cz+keygen\Keygen.exe (Trojan.Agent) -> No action taken.

flesku mam na G, ted jdu na fog z Gmeru.

potrebujes jeste neco ode me doplnit k tem registrum?

zatim posilam log z rychleho testu a jdu pokracovat dal dle tvych predchozich instrukci:

GMER 1.0.15.15125 - http://www.gmer.net
Rootkit quick scan 2009-10-06 17:29:57
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\User\LOCALS~1\Temp\pxtdqpoc.sys


---- System - GMER 1.0.15 ----

SSDT spci.sys ZwEnumerateKey [0xBA6C8CA2]
SSDT spci.sys ZwEnumerateValueKey [0xBA6C9030]

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 8A6531F8

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)

Device \FileSystem\Fastfat \Fat 852DE1F8

AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\Tcpip \Device\Ip epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Tcpip \Device\Udp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Tcpip \Device\RawIp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

---- Threads - GMER 1.0.15 ----

Thread System [4:524] 88753930

---- EOF - GMER 1.0.15 ----

Posilam dlouhy log z Gmeru:

GMER 1.0.15.15125 - http://www.gmer.net
Rootkit scan 2009-10-06 21:59:10
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\User\LOCALS~1\Temp\pxtdqpoc.sys


---- System - GMER 1.0.15 ----

SSDT 887558A0 ZwAssignProcessToJobObject
SSDT spci.sys ZwCreateKey [0xBA6AB0E0]
SSDT spci.sys ZwEnumerateKey [0xBA6C8CA2]
SSDT spci.sys ZwEnumerateValueKey [0xBA6C9030]
SSDT spci.sys ZwOpenKey [0xBA6AB0C0]
SSDT 88754CB0 ZwOpenProcess
SSDT 887550D0 ZwOpenThread
SSDT spci.sys ZwQueryKey [0xBA6C9108]
SSDT spci.sys ZwQueryValueKey [0xBA6C8F88]
SSDT spci.sys ZwSetValueKey [0xBA6C919A]
SSDT 887556D0 ZwSuspendProcess
SSDT 887554F0 ZwSuspendThread
SSDT 88754EE0 ZwTerminateProcess
SSDT 88755310 ZwTerminateThread

INT 0x62 ? 8A654BF8
INT 0x63 ? 8A402E90
INT 0x83 ? 8A654BF8
INT 0x83 ? 8A654BF8
INT 0x83 ? 8A654BF8
INT 0x94 ? 8A402E90
INT 0xA4 ? 8A402E90

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 8A6531F8

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)

Device \FileSystem\Fastfat \FatCdrom 852DE1F8

AttachedDevice \Driver\Tcpip \Device\Ip epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device \Driver\PCI_PNP9174 \Device\00000050 spci.sys
Device \Driver\usbohci \Device\USBPDO-0 8A4011F8
Device \Driver\usbohci \Device\USBPDO-1 8A4011F8
Device \Driver\dmio \Device\DmControl\DmIoDaemon 8A5E41F8
Device \Driver\dmio \Device\DmControl\DmConfig 8A5E41F8
Device \Driver\dmio \Device\DmControl\DmPnP 8A5E41F8
Device \Driver\dmio \Device\DmControl\DmInfo 8A5E41F8
Device \Driver\usbehci \Device\USBPDO-2 8A4001F8

AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)

Device \Driver\Ftdisk \Device\HarddiskVolume1 8A6551F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 8A6551F8
Device \Driver\Cdrom \Device\CdRom0 8A4051F8
Device \Driver\Cdrom \Device\CdRom1 8A4051F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [BA5FFB40] atapi.sys[unknown section]
Device \Driver\atapi \Device\Ide\IdePort0 [BA5FFB40] atapi.sys[unknown section]
Device \Driver\atapi \Device\Ide\IdePort1 [BA5FFB40] atapi.sys[unknown section]
Device \Driver\atapi \Device\Ide\IdePort2 [BA5FFB40] atapi.sys[unknown section]
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e [BA5FFB40] atapi.sys[unknown section]
Device \Driver\sptd \Device\3554759174 spci.sys
Device \Driver\NetBT \Device\NetBT_Tcpip_{2F781D77-E554-41C3-BA38-C70F4CFA8681} 8A0AD500
Device \Driver\NetBT \Device\NetBt_Wins_Export 8A0AD500
Device \Driver\usbstor \Device\00000085 8A125500
Device \Driver\NetBT \Device\NetbiosSmb 8A0AD500
Device \Driver\usbstor \Device\00000086 8A125500
Device \Driver\NetBT \Device\NetBT_Tcpip_{28AD002F-48E3-4629-9243-C93E0834CBB0} 8A0AD500

AttachedDevice \Driver\Tcpip \Device\Udp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Tcpip \Device\RawIp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)

Device \Driver\usbohci \Device\USBFDO-0 8A4011F8
Device \Driver\usbohci \Device\USBFDO-1 8A4011F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 89FBF500
Device \Driver\usbehci \Device\USBFDO-2 8A4001F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 89FBF500
Device \Driver\Ftdisk \Device\FtControl 8A6551F8
Device \Driver\a6xx7r1i \Device\Scsi\a6xx7r1i1 8A36F468
Device \Driver\a6xx7r1i \Device\Scsi\a6xx7r1i1Port3Path0Target0Lun0 8A36F468
Device \FileSystem\Fastfat \Fat 852DE1F8

AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET)

Device \FileSystem\Cdfs \Cdfs 8A09E500

---- Threads - GMER 1.0.15 ----

Thread System [4:524] 88753930

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xA3 0x91 0x3A 0xEE ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xF4 0xCD 0xE1 0x14 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x55 0x4E 0xDB 0xC1 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xA3 0x91 0x3A 0xEE ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xF4 0xCD 0xE1 0x14 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x55 0x4E 0xDB 0xC1 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xA3 0x91 0x3A 0xEE ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xF4 0xCD 0xE1 0x14 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x55 0x4E 0xDB 0xC1 ...
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG10.00.00.01WORKSTATION C47115C00F37A67294E1E069447DBC9E43325C25AF6A5C4787445EF3424E9A1A886DF96F30077557D4AC4EDAC3FE4FE59177AB41FEFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B98088EDD5E5BE2F6E6675D575E7D6A3B98081CA1B2CDA8F31CF2891D97137C955418B1CF3ACCFA6DD8E457764F181E9B1A85704101BA33569B02AD4A8CE1A6890F668562DD2C5C468634DB26CF069A042E2632646DD989321C4B6C5AC907B317B16220BCE6B52A028796F78DA96B2AC96C7D2C44667A581EF270794BF0C20B2B12ACBDC0C5B7A583D14C1595BF4004E48C078FF2E0E3F0CAB7497072A6C4B549C8188329706EB0C120447C7DF67082628970EFCFD3CD4877C662CCF613346107B3AE7502E18E52C9EFA5DF55BB5D2863229BC6933A66F6F8BFFAF1D3E32BE08EF22D002B95BE353804C9CF04FBDA9799591F6F48144C3AB98885A2DA48B7A91FEC026F5B8F1AA942E2BCC4C32A2E98CF78472CCDE51772B6462B0BADF5DAD50A4AD3F71AD32E20AED3C29A20BC96176107111FD5374F2581674637C5A40B2335F7F9AF44EB80B058E8CE91FD2FC223BDD72F51669271FB3E1CE598ED12B3F29BA782900B660796AFF18CCA1100D6F0E9FB88305B886EC12857CE84C6FD314C4CCD2C7972552BB13686D6CE63B

---- EOF - GMER 1.0.15 ----

toto je poznamkovy blok co vytvoril vypis.bat nevim, co jsi myslel tim vloz ho do kodu tak ho alespon vkladam sem.

Věpis CESTY slo§ky svazku WS_311M
S‚riov‚ źˇslo svazku je 0000-0000
G:\
DSC00320.JPG
1 schuzka.exe
autorun.inf.exe
DSS_FLDA.exe
DSS_FLDB.exe
DSS_FLDC.exe
DSS_FLDD.exe
DSS_FLDE.exe
MUSIC.exe
vypis.txt
vypis.bat

Neexistujˇ podadres ýe

nerozumim teto informaci k registrum: K registrum, koukni do karanteny, a dej kopmlpetni screen nebo uloz log, at jde videt cela cesta

pro jistotu prikladam log z kompletniho testu, staci to tak a je to co jsi chtel?

Malwarebytes' Anti-Malware 1.41
Verze databáze: 2910
Windows 5.1.2600 Service Pack 3

6.10.2009 14:01:16
mbam-log-2009-10-06 (14-00-57).txt

Typ kontroly: Kompletní kontrola (C:\|D:\|E:\|F:\|H:\|I:\|)
Zkontrolované objekty: 209683
Uplynulý čas: 29 minute(s), 31 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 4

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\System Volume Information\_restore{B635F3CC-4C72-48EE-B2E3-C85B3B47E59F}\RP6\A0001335.sys (Worm.Agent) -> No action taken.
C:\System Volume Information\_restore{B635F3CC-4C72-48EE-B2E3-C85B3B47E59F}\RP6\A0001394.sys (Worm.Agent) -> No action taken.
C:\System Volume Information\_restore{B635F3CC-4C72-48EE-B2E3-C85B3B47E59F}\RP6\A0001482.sys (Worm.Agent) -> No action taken.
D:\Dokuments\User\Dokumenty\Dokumenty - D\INSTALACE\Nero vypalovaci programy\NERO 6 od Davida\NERO 6.6.0.8 + cz+keygen\Keygen.exe (Trojan.Agent) -> No action taken.