Prosím o radu s virem "Win32:Rootkit-gen"

[Dejvi23]

Dobý den. Prosím Vás o radu s virem "Win32:Rootkit-gen" . Vše jsem udělal podle vaší předešlé rady a program ComboFix me vyhodil dokument ve kterém bylo :

ComboFix 10-02-12.01 - Osina 17.02.2010 16:24:26.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3583.3144 [GMT 1:00]
Spuštěný z: c:\documents and settings\Osina\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100217-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-01-17 do 2010-02-17 )))))))))))))))))))))))))))))))
.

2010-02-17 15:20 . 2010-02-17 15:28 792064 ----a-w- c:\windows\system32\drivers\kivmtym.sys
2010-02-17 15:10 . 2008-04-13 23:16 10880 -c--a-w- c:\windows\system32\dllcache\ndisip.sys
2010-02-17 15:10 . 2008-04-13 23:16 10880 ----a-w- c:\windows\system32\drivers\ndisip.sys
2010-02-17 15:09 . 2008-04-13 23:16 85248 -c--a-w- c:\windows\system32\dllcache\nabtsfec.sys
2010-02-17 15:09 . 2008-04-13 23:16 85248 ----a-w- c:\windows\system32\drivers\nabtsfec.sys
2010-02-17 15:07 . 2008-04-13 23:10 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys
2010-02-17 15:07 . 2008-04-13 23:10 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
2010-02-17 15:07 . 2008-04-13 23:11 8576 -c--a-w- c:\windows\system32\dllcache\i2omgmt.sys
2010-02-17 15:07 . 2008-04-13 23:11 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys
2010-02-17 15:07 . 2008-04-13 23:11 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-02-17 15:07 . 2008-04-13 23:11 8192 ----a-w- c:\windows\system32\drivers\changer.sys
2010-02-15 18:38 . 2010-02-15 18:38 -------- d-----w- c:\program files\Call of Duty
2010-02-15 17:53 . 2010-02-15 17:53 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-02-14 18:18 . 2010-02-14 18:30 69 ----a-w- c:\documents and settings\Osina\jagex_runescape_preferences2.dat
2010-02-14 18:17 . 2010-02-14 18:18 41 ----a-w- c:\documents and settings\Osina\jagex_runescape_preferences.dat
2010-02-14 18:17 . 2010-02-14 18:17 -------- d-----w- c:\windows\.jagex_cache_32
2010-02-14 18:17 . 2010-02-14 18:17 -------- d-----w- c:\windows\Sun
2010-02-14 18:17 . 2010-02-14 18:17 -------- d-----w- c:\program files\Common Files\Java
2010-02-14 18:17 . 2010-02-14 18:16 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-14 18:16 . 2010-02-14 18:16 -------- d-----w- c:\program files\Java
2010-02-14 18:15 . 2010-02-14 18:15 919840 ----a-w- C:\JavaSetup6u18-rv.exe
2010-02-02 14:26 . 2009-10-25 07:14 73728 ----a-w- c:\windows\system\vdremote.dll
2010-02-02 14:26 . 2009-10-25 07:13 61440 ----a-w- c:\windows\system\vdsvrlnk.dll
2010-01-25 16:13 . 2010-01-25 16:19 -------- d-----w- C:\TERASOFT
2010-01-25 16:12 . 1998-04-11 23:00 91677 ----a-w- c:\windows\SETUPTS.EXE
2010-01-25 16:12 . 1993-05-11 23:00 398416 ----a-w- c:\windows\system\VBRUN300.DLL
2010-01-25 16:12 . 1993-04-27 23:00 7008 ----a-w- c:\windows\system\SETUPKIT.DLL
2010-01-20 18:06 . 2010-01-20 18:14 -------- d-----w- c:\program files\HyCam2
2010-01-18 15:39 . 2005-02-09 10:59 14165 ----a-w- c:\windows\system32\drivers\Pclepci.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-17 15:21 . 2009-11-09 13:40 17408 ----a-w- c:\windows\system32\rpcnetp.exe
2010-02-17 15:21 . 2009-11-09 17:15 56680 ----a-w- c:\windows\system32\rpcnet.dll
2010-02-14 14:02 . 2001-10-25 12:00 46394 ----a-w- c:\windows\system32\perfc005.dat
2010-02-14 14:02 . 2001-10-25 12:00 310228 ----a-w- c:\windows\system32\perfh005.dat
2010-02-05 16:26 . 2009-11-09 14:12 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-14 15:32 . 2010-01-14 15:32 -------- d-----w- c:\program files\Creative
2010-01-12 19:33 . 2009-11-22 15:09 -------- d-----w- c:\program files\GameSpy Arcade
2009-12-31 16:50 . 2004-08-03 21:14 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-29 12:48 . 2009-12-29 12:39 -------- d-----w- c:\program files\Scorpions WinCheater
2009-12-28 18:49 . 2009-12-28 18:48 -------- d-----w- c:\program files\Audacity
2009-12-25 22:52 . 2009-11-22 16:49 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-12-21 19:08 . 2004-08-17 13:49 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-21 15:41 . 2009-11-15 13:15 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-12-17 07:42 . 2009-11-09 12:50 343552 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:10 . 2004-08-17 13:49 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-09 10:11 . 2004-08-17 13:45 2147328 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-09 10:11 . 2004-08-17 15:45 2025984 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2004-08-03 21:15 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:14 . 2004-08-17 13:49 1294336 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 17:14 . 2004-08-17 15:49 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:09 . 2001-10-25 12:00 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:09 . 2001-10-24 12:25 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:09 . 2004-08-17 15:49 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:09 . 2004-08-17 13:49 11264 ----a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:09 . 2004-08-17 13:49 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-11-24 23:54 . 2009-11-10 10:23 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2009-11-10 10:23 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:50 . 2009-11-10 10:23 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-11-24 23:50 . 2009-11-10 10:23 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2009-11-10 10:23 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2009-11-10 10:23 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2009-11-10 10:23 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2009-11-10 10:23 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2009-11-10 10:23 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-21 16:03 . 2004-08-17 13:49 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-05-19 12:37 1144712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-05-19 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-05-19 1144712]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-04-24 203928]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-11 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-04-15 13750272]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-04-15 86016]
"nwiz"="nwiz.exe" [2009-04-15 1657376]
"MsgTranAgt"="c:\program files\ASUS\ATK Hotkey\MsgTranAgt.exe" [2008-08-18 117304]
"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-08-18 98304]
"ATKHOTKEY"="c:\program files\ASUS\ATK Hotkey\HControl.exe" [2009-03-20 174648]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMedia.exe" [2009-04-20 159744]
"ATKOSD2"="c:\program files\ASUS\ATKOSD2\ATKOSD2.exe" [2009-03-04 8392704]
"Wireless Console 3"="c:\program files\ASUS\Wireless Console 3\wcourier.exe" [2009-04-17 1593344]
"RTHDCPL"="RTHDCPL.EXE" [2009-03-24 17567744]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-04-21 534528]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"QuickTime Task"="c:\quick time player\qttask.exe" [2009-05-26 413696]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Osina\Nabˇdka Start\Programy\Po spuçtŘnˇ\
monnid32.exe [2008-4-14 28160]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\ICQ6.5\\ICQ.exe"=
"d:\\Hry\\Vietcong\\vietcong.exe"=
"d:\\Hry\\Metin2\\metin2.bin"=
"d:\\Hry\\Metin2\\metin2client.bin"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"d:\\Hry\\Vietcong 2\\Vietcong2\\vc2ded.exe"=
"d:\\Hry\\Counter strike 1.6\\hl.exe"=
"d:\\Hry\\Counter strike 1.6\\hlds.exe"=
"d:\\Hry\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"d:\\Hry\\Dungeon siege\\DungeonSiege.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [10.11.2009 11:23 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [10.11.2009 11:23 20560]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [13.11.2009 15:19 222456]
R3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\drivers\ETD.sys [9.11.2009 15:23 89856]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [11.11.2009 9:57 721904]

--- Ostatní služby/ovladače v paměti ---

*Deregistered* - kivmtym
.
Obsah adresáře 'Naplánované úlohy'

2010-01-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-02-17 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-05-19 12:37]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {FC11A119-C2F7-46F4-9E32-937ABA26816E} - file:///E:/CDVIEWER/CdViewer.cab
FF - ProfilePath - c:\documents and settings\Osina\Data aplikací\Mozilla\Firefox\Profiles\ajpczea6.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/
FF - prefs.js: keyword.URL - hxxp://www.bigseekpro.com/search/toolbar/hyper ... 51E42A}?q=
FF - plugin: c:\quick time player\Plugins\npqtplugin.dll
FF - plugin: c:\quick time player\Plugins\npqtplugin2.dll
FF - plugin: c:\quick time player\Plugins\npqtplugin3.dll
FF - plugin: c:\quick time player\Plugins\npqtplugin4.dll
FF - plugin: c:\quick time player\Plugins\npqtplugin5.dll
FF - plugin: c:\quick time player\Plugins\npqtplugin6.dll
FF - plugin: c:\quick time player\Plugins\npqtplugin7.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-DesetiPrsty - d:\desetiprsty\pmqUnInstall.exe
AddRemove-DungeonSiege 1.0 - d:\hry\UNINSTAL.EXE
AddRemove-HyperCam Toolbar - c:\program files\HyperCam Toolbar\UninstallToolbar.exe
AddRemove-Vietcong 2 - d:\hry\Vietcong 2\Vietcong2\uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-17 16:28
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\kivmtym]

.
Celkový čas: 2010-02-17 16:29:39
ComboFix-quarantined-files.txt 2010-02-17 15:29

Před spuštěním: Volných bajtů: 95 271 280 640
Po spuštění: Volných bajtů: 97 704 452 096

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 95D5BF0360FCBC3A89F65007475D0E10


Naléhavě prosím o pomoc. Mám nový notebook a nerad bych s ním měl už zezačátku nějaké problémy. Předem děkuji za odpověď.

[stell]

zdravim
Pri tejto akcii je nutné mať ComboFix na ploche.

Vypni>FIREWALL>Antivir>Antispyware>vsetko rezidentne.

Otvor Notepad (Poznámkový blok) a zkopíruj do neho celý zeleny tex:

Kód: Vybrat vše

KILLALL::
File::
c:\program files\Ask.com
c:\documents and settings\Osina\Nabídka Start\Programy\Po spuštění\monnid32.exe
c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\kivmtym]
Driver::
kivmtym

Potom klik na Subor -> Uložiť ako.. .. -> Ako je Názov souboru tak do toho riadku napiš:CFScript.txt
Typ súboru tak tam vyberies *všetky súbory
A ulož ho na plochu.> Pozor CFScript.txt>Neotvarat a nemoze byt ani>CFScript.txt.txt A Urobis Toto :


Po skonceni skenu vlož log čo ComboFix vytvorí