VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

PC je zavirovaný, ale antivir nic nehlásí

https://forum.viry.cz:443/viewtopic.php?t=98531

Stránka 1 z 2

PC je zavirovaný, ale antivir nic nehlásí

Napsal: 05 bře 2010 11:58
od korda
Prosím o pomoc.
Uživatel dostal emailem zprávu, že je zavirovaný virem Email-Worm.Win32.NetSky.q
Když z kontroluju antivirem, tak nic nenajde a tváří se , že je vše OK.
Když mám tento PC spuštěn a je připojen do netu, tak chce pořád zapisovat na disketovku.
Když připojím FLASHku na tomto PC a pak jí vyndám, a pak ji připojím na můj PC tak mi antivir ihned zahlásí, že E:\_.vbs napaden virem WIN32/AutoRun.Agent.TQ červ

Zde je log z RSIT:

Logfile of random's system information tool 1.06 (written by random/random)
Run by MŠ Stěbořice at 2010-03-05 11:45:46
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 141 GB (93%) free of 153 GB
Total RAM: 503 MB (37% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:45:48, on 5.3.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\algv.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\MŠ Stěbořice\Plocha\RSIT.exe
C:\Program Files\trend micro\MŠ Stěbořice.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
F2 - REG:system.ini: Shell=explorer.exe,algv.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [algv.exe] C:\WINDOWS\system32\algv.exe
O4 - HKLM\..\Run: [x.exe] "C:\WINDOWS\system32\algv.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 6943533142
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

--
End of file - 3177 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-11-16 2054360]
"algv.exe"=C:\WINDOWS\system32\algv.exe [2009-07-12 1282048]
"x.exe"=C:\WINDOWS\system32\algv.exe [2009-07-12 1282048]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2006-03-02 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\algv.exe]
C:\WINDOWS\system32\algv.exe [2009-07-12 1282048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe [2006-03-02 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
C:\WINDOWS\system32\hkcmd.exe [2005-11-28 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
C:\WINDOWS\system32\igfxpers.exe [2005-11-28 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
C:\WINDOWS\system32\igfxtray.exe [2005-11-28 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe [2007-08-03 63048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
C:\WINDOWS\RTHDCPL.EXE [2007-07-05 16380416]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe [2007-10-23 524288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
C:\WINDOWS\SkyTel.EXE [2007-06-15 1826816]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\x.exe]
C:\WINDOWS\system32\algv.exe [2009-07-12 1282048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^LUMIX Simple Viewer.lnk]
C:\PROGRA~1\PANASO~1\LUMIXS~1\PHLEAU~1.EXE [2005-11-14 57344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-11-28 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LMIinit]
C:\WINDOWS\system32\LMIinit.dll [2009-10-05 87352]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-03-05 11:44:19 ----D---- C:\rsit
2010-03-05 11:44:19 ----D---- C:\Program Files\trend micro
2010-03-05 11:39:12 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Panasonic
2010-03-05 11:39:10 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Macromedia
2010-03-05 11:39:10 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Lavasoft
2010-03-05 11:39:10 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\InstallShield
2010-03-05 11:39:09 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Ahead
2010-03-05 11:39:09 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Adobe
2010-03-05 11:36:22 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\ESET
2010-03-05 11:36:13 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Identities
2010-03-05 11:36:06 ----SD---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Microsoft
2010-03-05 11:29:42 ----ASH---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\desktop.ini
2010-03-05 11:29:24 ----D---- C:\ZALOHA
2010-03-05 10:26:49 ----A---- C:\WINDOWS\system32\muweb.dll
2010-03-05 10:26:49 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2010-03-05 10:26:49 ----A---- C:\WINDOWS\system32\mucltui.dll
2010-03-05 10:22:40 ----D---- C:\Program Files\ESET
2010-03-05 10:22:40 ----D---- C:\Documents and Settings\All Users\Data aplikací\ESET
2010-03-05 09:43:56 ----A---- C:\WINDOWS\ntbtlog.txt
2010-03-04 10:34:42 ----D---- C:\WINDOWS\pss
2010-02-22 15:06:52 ----ASH---- C:\WINDOWS\system32\algv.exe

======List of files/folders modified in the last 1 months======

2010-03-05 11:45:47 ----D---- C:\WINDOWS\Temp
2010-03-05 11:45:20 ----D---- C:\WINDOWS\Prefetch
2010-03-05 11:44:19 ----RD---- C:\Program Files
2010-03-05 11:42:59 ----D---- C:\WINDOWS
2010-03-05 11:42:13 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-03-05 11:36:16 ----SHD---- C:\WINDOWS\Installer
2010-03-05 11:36:14 ----A---- C:\WINDOWS\OEWABLog.txt
2010-03-05 11:36:05 ----D---- C:\Documents and Settings
2010-03-05 10:31:11 ----SH---- C:\boot.ini
2010-03-05 10:31:11 ----A---- C:\WINDOWS\win.ini
2010-03-05 10:31:11 ----A---- C:\WINDOWS\system.ini
2010-03-05 10:26:50 ----D---- C:\WINDOWS\system32
2010-03-05 10:26:49 ----HD---- C:\WINDOWS\inf
2010-03-05 10:23:21 ----D---- C:\WINDOWS\system32\drivers
2010-03-05 10:23:09 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-05 10:15:54 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-03-05 09:36:07 ----D---- C:\Program Files\LogMeIn
2010-03-04 18:12:32 ----SHD---- C:\RECYCLER
2010-02-10 10:01:52 ----A---- C:\WINDOWS\imsins.BAK
2010-02-10 10:01:44 ----RSHDC---- C:\WINDOWS\system32\dllcache

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-11-16 108792]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2009-11-16 55768]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2006-03-02 39936]
R2 DgiVecp;DgiVecp; \??\C:\WINDOWS\system32\Drivers\DgiVecp.sys []
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-11-16 116520]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2009-12-18 135048]
R2 LMIInfo;LogMeIn Kernel Information Provider; \??\C:\Program Files\LogMeIn\x86\RaInfo.sys []
R2 LMIRfsDriver;LogMeIn Remote File System Driver; \??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys []
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2010-01-08 33096]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-11-28 1353820]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-07-18 4547584]
R3 lmimirr;lmimirr; C:\WINDOWS\system32\DRIVERS\lmimirr.sys [2007-08-03 10144]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2007-08-07 98944]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-17 14848]
S2 SSPORT;SSPORT; \??\C:\WINDOWS\system32\Drivers\SSPORT.sys []
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 LMIRfsClientNP;LMIRfsClientNP; C:\WINDOWS\system32\drivers\LMIRfsClientNP.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-11-16 735960]
R2 LMIMaint;LogMeIn Maintenance Service; C:\Program Files\LogMeIn\x86\RaMaint.exe [2009-10-05 116032]
R2 LogMeIn;LogMeIn; C:\Program Files\LogMeIn\x86\LogMeIn.exe [2007-08-03 63040]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-11-16 20680]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Re: PC je zavirovaný, ale antivir nic nehlásí

Napsal: 05 bře 2010 12:11
od korda
Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.5.0.50 2010.03.05 -
AhnLab-V3 5.0.0.2 2010.03.05 -
AntiVir 8.2.1.180 2010.03.05 -
Antiy-AVL 2.0.3.7 2010.03.05 -
Authentium 5.2.0.5 2010.03.05 W32/Trojan2.JCYL
Avast 4.8.1351.0 2010.03.04 Win32:AutoRun-BFK
Avast5 5.0.332.0 2010.03.04 Win32:AutoRun-BFK
AVG 9.0.0.730 2010.03.05 -
BitDefender 7.2 2010.03.05 -
CAT-QuickHeal 10.00 2010.03.05 Worm.AutoRun.axkm
ClamAV 0.96.0.0-git 2010.03.05 -
Comodo 4091 2010.02.28 -
DrWeb 5.0.1.12222 2010.03.05 Win32.HLLW.Autoruner.10185
eSafe 7.0.17.0 2010.03.04 -
eTrust-Vet 35.2.7341 2010.03.05 -
F-Prot 4.5.1.85 2010.03.04 W32/Trojan2.JCYL
F-Secure 9.0.15370.0 2010.03.05 -
Fortinet 4.0.14.0 2010.03.04 -
GData 19 2010.03.05 -
Ikarus T3.1.1.80.0 2010.03.05 -
Jiangmin 13.0.900 2010.03.05 -
K7AntiVirus 7.10.990 2010.03.04 -
Kaspersky 7.0.0.125 2010.03.05 -
McAfee 5910 2010.03.04 -
McAfee+Artemis 5910 2010.03.04 -
McAfee-GW-Edition 6.8.5 2010.03.05 -
Microsoft 1.5502 2010.03.05 -
NOD32 4917 2010.03.05 -
Norman 6.04.08 2010.03.04 -
nProtect 2009.1.8.0 2010.03.05 -
Panda 10.0.2.2 2010.03.04 -
PCTools 7.0.3.5 2010.03.04 -
Prevx 3.0 2010.03.05 Medium Risk Malware
Rising 22.37.04.04 2010.03.05 -
Sophos 4.51.0 2010.03.05 -
Sunbelt 5757 2010.03.05 -
Symantec 20091.2.0.41 2010.03.05 Suspicious.Insight
TheHacker 6.5.1.7.221 2010.03.05 -
TrendMicro 9.120.0.1004 2010.03.05 -
VBA32 3.12.12.2 2010.03.05 Trojan-Clicker.Win32.VBiframe.vr
ViRobot 2010.3.5.2214 2010.03.05 Trojan.Win32.Clicker.3583981
VirusBuster 5.0.27.0 2010.03.04 Trojan.CL.VBiframe.R
Rozšiřující informace
File size: 1282048 bytes
MD5...: aee76022d5f76bd9de76df7fc5f5e1ec
SHA1..: f7cc3b3c257e21a8b1c3ec449c4e0546a72f6dd9
SHA256: 6ad18acd9621867497a79de264af22343c807145e39f0d506401e1560401de72
ssdeep: 24576:gUl8U9Sv4t0WhD6vQr317sHlLagdLWE/+:TlBnDDB4b

PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x35d8
timedatestamp.....: 0x46eb1144 (Fri Sep 14 22:55:00 2007)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x8546e 0x86000 6.73 9cc38575e78364c6047fcde06ecec40a
.rdata 0x87000 0x9bc7 0xa000 5.28 63f5742d9434413721e9335374a72eaa
.data 0x91000 0x6820c 0x1e000 4.77 60e0be06b0477c85b59ab9e09b6c3c97
.rsrc 0xfa000 0x805b8 0x81000 3.81 e7d20089b49aa1c5635495c62a2149ce
.reloc 0x17b000 0x8cc2 0x9000 6.13 df57466822876970eb740c157ac676ce

( 13 imports )
> KERNEL32.dll: CreateThread, TerminateThread, CreateEventA, WaitForSingleObject, SetEvent, GetDriveTypeA, DeviceIoControl, ResetEvent, QueryPerformanceFrequency, QueryPerformanceCounter, OpenFile, VirtualLock, VirtualProtect, GetSystemTimeAsFileTime, SetEnvironmentVariableW, FileTimeToSystemTime, FileTimeToLocalFileTime, FreeLibrary, LoadLibraryA, GetProcAddress, FindResourceA, ExitProcess, LocalFree, SetEndOfFile, CreateFileA, SetStdHandle, SetEnvironmentVariableA, LoadResource, LockResource, VirtualAlloc, GetModuleHandleA, GetCommandLineA, SetThreadPriority, SetConsoleTitleA, AllocConsole, GetModuleFileNameA, GetTempPathA, GetSystemDirectoryA, GetWindowsDirectoryA, GetVersionExA, FindFirstFileA, FindClose, FindNextFileA, GetFileAttributesA, DeleteFileA, SetFileAttributesA, CopyFileA, SetCurrentDirectoryA, GetCurrentDirectoryA, CreateDirectoryA, RemoveDirectoryA, Sleep, MulDiv, InterlockedDecrement, MultiByteToWideChar, CreateProcessA, CloseHandle, CreatePipe, GetLastError, ReadFile, WriteFile, PeekNamedPipe, GetCurrentThreadId, EnterCriticalSection, InitializeCriticalSection, InterlockedExchange, DeleteCriticalSection, LeaveCriticalSection, HeapAlloc, HeapFree, GetVersion, InterlockedIncrement, RtlUnwind, TerminateProcess, GetCurrentProcess, IsBadReadPtr, GetTimeZoneInformation, GetSystemTime, GetLocalTime, RaiseException, HeapReAlloc, HeapSize, GetEnvironmentVariableA, HeapDestroy, HeapCreate, VirtualFree, IsBadWritePtr, TlsSetValue, TlsAlloc, TlsFree, SetLastError, TlsGetValue, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStrings, GetEnvironmentStringsW, LCMapStringA, LCMapStringW, FlushFileBuffers, SetFilePointer, SetUnhandledExceptionFilter, GetCPInfo, GetACP, GetOEMCP, GetStringTypeA, GetStringTypeW, IsBadCodePtr, CompareStringA, CompareStringW
> USER32.dll: SetCapture, RegisterClassA, LoadIconA, IsIconic, PostThreadMessageA, SetWindowLongA, DialogBoxParamA, SendDlgItemMessageA, SetForegroundWindow, GetDlgItem, GetWindowTextA, SetTimer, EndDialog, ChangeDisplaySettingsA, ReleaseDC, CreatePopupMenu, EnableWindow, MoveWindow, LoadCursorA, SetCursor, BeginPaint, DrawEdge, EndPaint, ReleaseCapture, FillRect, InvalidateRect, ShowWindow, SetWindowTextA, SetActiveWindow, SetMenu, DestroyMenu, GetMenu, AdjustWindowRect, CreateMenu, CharLowerBuffA, AppendMenuA, PostMessageA, DestroyWindow, GetScrollInfo, SetScrollPos, IsWindowEnabled, SetScrollInfo, GetFocus, GetScrollPos, CallWindowProcA, CreateWindowExA, GetClientRect, GetDesktopWindow, ClientToScreen, SetCursorPos, GetCursorPos, ValidateRect, DefWindowProcA, GetWindowRect, GetDC, SendMessageA, SetFocus, PeekMessageA, MsgWaitForMultipleObjects, GetWindowLongA, GetParent, IsDialogMessageA, TranslateMessage, DispatchMessageA, GetActiveWindow, MessageBoxA, KillTimer, UnregisterClassA, GetForegroundWindow
> OPENGL32.dll: wglDeleteContext, wglCreateContext, wglShareLists, glVertex2i, glBegin, wglGetProcAddress, wglMakeCurrent, glBindTexture, glCallLists, glRasterPos2i, glListBase, glEnd, glDisable, glScissor, glTexEnvi, glReadPixels, glDrawPixels, glTexParameteri, glTexImage2D, glGenTextures, glDeleteTextures, glEnable, glViewport, glMatrixMode, glLoadIdentity, glOrtho, glAlphaFunc, glColor3ub, glPixelMapfv, glDeleteLists, glGenLists, wglUseFontBitmapsA, glTexCoord2f
> WSOCK32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> WINMM.dll: waveOutClose, waveOutPrepareHeader, waveOutUnprepareHeader, waveOutWrite, waveOutReset, waveOutGetPosition, waveInAddBuffer, waveInPrepareHeader, waveInUnprepareHeader, waveInGetDevCapsA, waveInGetNumDevs, waveInStart, waveInOpen, waveInClose, waveInReset, waveOutOpen, timeEndPeriod, mixerGetControlDetailsA, mixerGetLineControlsA, mixerGetLineInfoA, mixerSetControlDetails, mixerOpen, mixerGetNumDevs, mixerClose, waveOutGetNumDevs, mciSendCommandA, mciGetErrorStringA, waveOutGetDevCapsA, timeBeginPeriod, timeKillEvent, timeSetEvent, timeGetTime
> COMCTL32.dll: ImageList_Create, ImageList_Destroy, _TrackMouseEvent, InitCommonControlsEx, ImageList_AddMasked
> GDI32.dll: SelectObject, GetTextExtentPoint32A, CreateCompatibleDC, DeleteDC, GetStockObject, GetTextMetricsA, SetDIBits, CreateCompatibleBitmap, CreateSolidBrush, BitBlt, StretchBlt, ExtTextOutA, SetTextColor, SetBkMode, SetPixelFormat, ChoosePixelFormat, SwapBuffers, GetTextFaceA, DeleteObject, AddFontResourceA, CreateFontA, GetDeviceCaps, CreateFontIndirectA, Ellipse, Rectangle, Polyline, CreatePen, CreateDIBSection
> comdlg32.dll: ChooseColorA, GetOpenFileNameA, GetSaveFileNameA, ChooseFontA
> SHELL32.dll: SHGetMalloc, SHBrowseForFolderA, SHGetPathFromIDListA, ShellExecuteA
> ole32.dll: OleSetContainedObject, OleCreate, CoCreateInstance, CoUninitialize, CoInitialize, CLSIDFromString
> OLEAUT32.dll: -, -, -, -, -, -
> ADVAPI32.dll: RegCloseKey, RegOpenKeyA, RegEnumKeyA, RegOpenKeyExA, RegQueryValueExA
> MSACM32.dll: acmStreamConvert, acmStreamUnprepareHeader, acmStreamClose, acmFormatSuggest, acmStreamOpen, acmStreamSize, acmStreamPrepareHeader

( 2 exports )
_bbWinMain@0, runtimeGetRuntime

RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

<a href='http://info.prevx.com/aboutprogramtext. ... 000AD36CAF' target='_blank'>http://info.prevx.com/aboutprogramtext. ... AD36CAF</a>

Re: PC je zavirovaný, ale antivir nic nehlásí

Napsal: 05 bře 2010 12:31
od korda
Zde je ten soubor

Re: PC je zavirovaný, ale antivir nic nehlásí

Napsal: 05 bře 2010 12:36
od korda
OK
jasně

Re: PC je zavirovaný, ale antivir nic nehlásí

Napsal: 05 bře 2010 13:03
od korda
doufám, že se mi povedlo to poslat jako soukromou zprávu, ještě jsem to nikdy takto neposílal, myslím soukromou zprávu.
Za chvíli pošlu ty logy

Re: PC je zavirovaný, ale antivir nic nehlásí

Napsal: 05 bře 2010 13:06
od korda
Logfile of random's system information tool 1.06 (written by random/random)
Run by MŠ Stěbořice at 2010-03-05 13:05:27
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 141 GB (93%) free of 153 GB
Total RAM: 503 MB (42% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:05:31, on 5.3.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\MŠ Stěbořice\Plocha\RSIT.exe
C:\Program Files\trend micro\MŠ Stěbořice.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
F2 - REG:system.ini: Shell=explorer.exe,algv.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 6943533142
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

--
End of file - 3279 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-11-16 2054360]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2006-03-02 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe [2006-03-02 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
C:\WINDOWS\system32\hkcmd.exe [2005-11-28 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
C:\WINDOWS\system32\igfxpers.exe [2005-11-28 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
C:\WINDOWS\system32\igfxtray.exe [2005-11-28 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe [2007-08-03 63048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
C:\WINDOWS\RTHDCPL.EXE [2007-07-05 16380416]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe [2007-10-23 524288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
C:\WINDOWS\SkyTel.EXE [2007-06-15 1826816]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^LUMIX Simple Viewer.lnk]
C:\PROGRA~1\PANASO~1\LUMIXS~1\PHLEAU~1.EXE [2005-11-14 57344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-11-28 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LMIinit]
C:\WINDOWS\system32\LMIinit.dll [2009-10-05 87352]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-03-05 11:44:19 ----D---- C:\rsit
2010-03-05 11:44:19 ----D---- C:\Program Files\trend micro
2010-03-05 11:39:12 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Panasonic
2010-03-05 11:39:10 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Macromedia
2010-03-05 11:39:10 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Lavasoft
2010-03-05 11:39:10 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\InstallShield
2010-03-05 11:39:09 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Ahead
2010-03-05 11:39:09 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Adobe
2010-03-05 11:36:22 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\ESET
2010-03-05 11:36:13 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Identities
2010-03-05 11:36:06 ----SD---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Microsoft
2010-03-05 11:29:42 ----ASH---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\desktop.ini
2010-03-05 11:29:24 ----D---- C:\ZALOHA
2010-03-05 10:26:49 ----A---- C:\WINDOWS\system32\muweb.dll
2010-03-05 10:26:49 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2010-03-05 10:26:49 ----A---- C:\WINDOWS\system32\mucltui.dll
2010-03-05 10:22:40 ----D---- C:\Program Files\ESET
2010-03-05 10:22:40 ----D---- C:\Documents and Settings\All Users\Data aplikací\ESET
2010-03-05 09:43:56 ----A---- C:\WINDOWS\ntbtlog.txt
2010-03-04 10:34:42 ----D---- C:\WINDOWS\pss

======List of files/folders modified in the last 1 months======

2010-03-05 13:04:19 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-03-05 13:04:05 ----D---- C:\WINDOWS\Temp
2010-03-05 12:52:52 ----D---- C:\WINDOWS\system32
2010-03-05 12:52:51 ----D---- C:\WINDOWS\system32\drivers
2010-03-05 12:24:06 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-05 12:23:25 ----D---- C:\WINDOWS\Prefetch
2010-03-05 11:44:19 ----RD---- C:\Program Files
2010-03-05 11:42:59 ----D---- C:\WINDOWS
2010-03-05 11:36:16 ----SHD---- C:\WINDOWS\Installer
2010-03-05 11:36:14 ----A---- C:\WINDOWS\OEWABLog.txt
2010-03-05 11:36:05 ----D---- C:\Documents and Settings
2010-03-05 10:31:11 ----SH---- C:\boot.ini
2010-03-05 10:31:11 ----A---- C:\WINDOWS\win.ini
2010-03-05 10:31:11 ----A---- C:\WINDOWS\system.ini
2010-03-05 10:26:49 ----HD---- C:\WINDOWS\inf
2010-03-05 10:15:54 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-03-05 09:36:07 ----D---- C:\Program Files\LogMeIn
2010-03-04 18:12:32 ----SHD---- C:\RECYCLER
2010-02-10 10:01:52 ----A---- C:\WINDOWS\imsins.BAK
2010-02-10 10:01:44 ----RSHDC---- C:\WINDOWS\system32\dllcache

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-11-16 108792]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2009-11-16 55768]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2006-03-02 39936]
R1 uzexnjq5;AVZ-RK Kernel Driver; \??\C:\WINDOWS\system32\Drivers\uzexnjq5.sys []
R2 DgiVecp;DgiVecp; \??\C:\WINDOWS\system32\Drivers\DgiVecp.sys []
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-11-16 116520]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2009-12-18 135048]
R2 LMIInfo;LogMeIn Kernel Information Provider; \??\C:\Program Files\LogMeIn\x86\RaInfo.sys []
R2 LMIRfsDriver;LogMeIn Remote File System Driver; \??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys []
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2010-01-08 33096]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-11-28 1353820]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-07-18 4547584]
R3 lmimirr;lmimirr; C:\WINDOWS\system32\DRIVERS\lmimirr.sys [2007-08-03 10144]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2007-08-07 98944]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-17 14848]
S2 SSPORT;SSPORT; \??\C:\WINDOWS\system32\Drivers\SSPORT.sys []
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 LMIRfsClientNP;LMIRfsClientNP; C:\WINDOWS\system32\drivers\LMIRfsClientNP.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-11-16 735960]
R2 LMIMaint;LogMeIn Maintenance Service; C:\Program Files\LogMeIn\x86\RaMaint.exe [2009-10-05 116032]
R2 LogMeIn;LogMeIn; C:\Program Files\LogMeIn\x86\LogMeIn.exe [2007-08-03 63040]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-11-16 20680]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Re: PC je zavirovaný, ale antivir nic nehlásí

Napsal: 05 bře 2010 13:10
od korda
další log

Re: PC je zavirovaný, ale antivir nic nehlásí

Napsal: 05 bře 2010 13:37
od korda
ComboFix 10-03-04.05 - MŠ Stěbořice 05.03.2010 13:26:07.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.503.211 [GMT 1:00]
Spuštěný z: c:\documents and settings\MŠ Stěbořice\Plocha\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((( Soubory vytvořené od 2010-02-05 do 2010-03-05 )))))))))))))))))))))))))))))))
.

2010-03-05 11:51 . 2010-03-05 11:51 11264 ----a-w- c:\windows\system32\drivers\uzexnjq5.sys
2010-03-05 11:51 . 2010-03-05 11:51 509108 ----a-w- C:\quarantine.zip
2010-03-05 10:44 . 2010-03-05 12:05 -------- d-----w- c:\program files\trend micro
2010-03-05 10:44 . 2010-03-05 10:44 -------- d-----w- C:\rsit
2010-03-05 10:36 . 2010-03-05 10:39 -------- d-----w- c:\documents and settings\MŠ Stěbořice
2010-03-05 10:29 . 2010-03-05 10:38 -------- d-----w- C:\ZALOHA
2010-03-05 09:26 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-03-05 09:26 . 2009-08-06 18:23 215920 ----a-w- c:\windows\system32\muweb.dll
2010-03-05 09:22 . 2010-03-05 09:22 -------- d-----w- c:\program files\ESET
2010-03-05 08:47 . 2010-03-05 10:36 -------- d-----w- c:\documents and settings\MŠ

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-05 08:36 . 2008-04-07 11:37 -------- d-----w- c:\program files\LogMeIn
2010-01-08 07:13 . 2010-01-08 07:13 33096 ----a-w- c:\windows\system32\drivers\epfwndis.sys
2010-01-05 09:58 . 2006-03-02 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
2010-01-05 09:57 . 2006-03-02 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 09:57 . 2006-03-02 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-12-31 16:14 . 2006-03-02 12:00 352640 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-18 14:02 . 2009-12-18 14:02 135048 ----a-w- c:\windows\system32\drivers\epfw.sys
2009-12-17 08:00 . 2008-03-31 05:12 343552 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:37 . 2006-03-02 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-11 09:59 . 2006-03-02 12:00 93258 ----a-w- c:\windows\system32\perfc005.dat
2009-12-11 09:59 . 2006-03-02 12:00 457874 ----a-w- c:\windows\system32\perfh005.dat
2009-12-09 10:28 . 2004-08-17 15:45 2059904 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-09 10:28 . 2006-03-02 12:00 2182528 ----a-w- c:\windows\system32\ntoskrnl.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-11-16 2054360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-10-05 05:09 87352 ----a-w- c:\windows\system32\LMIinit.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^LUMIX Simple Viewer.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\LUMIX Simple Viewer.lnk
backup=c:\windows\pss\LUMIX Simple Viewer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 10:43 69632 ------r- c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2006-03-02 12:00 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
2005-11-28 05:52 77824 ----a-r- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
2005-11-28 05:55 118784 ----a-r- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
2005-11-28 05:55 98304 ----a-r- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
2007-08-03 13:09 63048 ----a-w- c:\program files\LogMeIn\x86\LogMeInSystray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 13:57 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2007-07-05 08:08 16380416 ------r- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
2007-10-23 04:11 524288 ----a-w- c:\windows\Samsung\PanelMgr\SSMMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
2007-06-15 08:45 1826816 ------r- c:\windows\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16.11.2009 9:03 108792]
R1 uzexnjq5;AVZ-RK Kernel Driver;c:\windows\system32\drivers\uzexnjq5.sys [5.3.2010 12:51 11264]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [16.11.2009 9:04 735960]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [3.8.2007 14:09 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [7.4.2008 12:38 47640]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]

--- Ostatní služby/ovladače v paměti ---

*Deregistered* - utexnjq5
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-05 13:29
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Hints\M*`]
@Allowed: (2) (S-1-5-21-1644491937-2139871995-725345543-1007)
"PictureSource"="c:\\Documents and Settings\\All Users\\Data aplikací\\Microsoft\\User Account Pictures\\Default Pictures\\start.bmp"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(928)
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
.
Celkový čas: 2010-03-05 13:30:41
ComboFix-quarantined-files.txt 2010-03-05 12:30

Před spuštěním: Volných bajtů: 148 071 821 312
Po spuštění: Volných bajtů: 148 080 132 096

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 854972B0ABFD03C9C80E77A7CBD2A79C

Re: PC je zavirovaný, ale antivir nic nehlásí

Napsal: 05 bře 2010 13:40
od korda
jinak se mi zdá, že PC už je OK. Na diketovku nesahá ani nevyskakuje po naběhnutí žádné okno a po spuštění je vše tak ja má být. Apoň dle mého názoru.
Mám poslat odkaz ještě na ten soubour co nepřišel?

Re: PC je zavirovaný, ale antivir nic nehlásí

Napsal: 05 bře 2010 13:44
od korda
jen po restartu mi pořád hledá nový hardware

Re: PC je zavirovaný, ale antivir nic nehlásí

Napsal: 05 bře 2010 13:56
od korda
Logfile of random's system information tool 1.06 (written by random/random)
Run by MŠ Stěbořice at 2010-03-05 13:55:16
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 141 GB (93%) free of 153 GB
Total RAM: 503 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:55:20, on 5.3.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\MŠ Stěbořice\Plocha\RSIT.exe
C:\Program Files\trend micro\MŠ Stěbořice.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 6943533142
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

--
End of file - 2925 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-11-16 2054360]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2006-03-02 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe [2006-03-02 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
C:\WINDOWS\system32\hkcmd.exe [2005-11-28 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
C:\WINDOWS\system32\igfxpers.exe [2005-11-28 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
C:\WINDOWS\system32\igfxtray.exe [2005-11-28 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe [2007-08-03 63048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
C:\WINDOWS\RTHDCPL.EXE [2007-07-05 16380416]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe [2007-10-23 524288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
C:\WINDOWS\SkyTel.EXE [2007-06-15 1826816]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^LUMIX Simple Viewer.lnk]
C:\PROGRA~1\PANASO~1\LUMIXS~1\PHLEAU~1.EXE [2005-11-14 57344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-11-28 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LMIinit]
C:\WINDOWS\system32\LMIinit.dll [2009-10-05 87352]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-03-05 13:30:43 ----D---- C:\WINDOWS\temp
2010-03-05 13:30:41 ----A---- C:\ComboFix.txt
2010-03-05 13:25:18 ----A---- C:\Boot.bak
2010-03-05 13:25:13 ----RASHD---- C:\cmdcons
2010-03-05 13:24:28 ----A---- C:\WINDOWS\NIRCMD.exe
2010-03-05 13:24:28 ----A---- C:\WINDOWS\MBR.exe
2010-03-05 13:24:25 ----A---- C:\WINDOWS\zip.exe
2010-03-05 13:24:25 ----A---- C:\WINDOWS\SWREG.exe
2010-03-05 13:24:25 ----A---- C:\WINDOWS\PEV.exe
2010-03-05 13:24:24 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-03-05 13:24:24 ----A---- C:\WINDOWS\SWSC.exe
2010-03-05 13:24:24 ----A---- C:\WINDOWS\sed.exe
2010-03-05 13:24:24 ----A---- C:\WINDOWS\grep.exe
2010-03-05 13:24:19 ----D---- C:\WINDOWS\ERDNT
2010-03-05 13:23:13 ----D---- C:\Qoobox
2010-03-05 11:44:19 ----D---- C:\rsit
2010-03-05 11:44:19 ----D---- C:\Program Files\trend micro
2010-03-05 11:39:12 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Panasonic
2010-03-05 11:39:10 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Macromedia
2010-03-05 11:39:10 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Lavasoft
2010-03-05 11:39:10 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\InstallShield
2010-03-05 11:39:09 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Ahead
2010-03-05 11:39:09 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Adobe
2010-03-05 11:36:22 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\ESET
2010-03-05 11:36:13 ----D---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Identities
2010-03-05 11:36:06 ----SD---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\Microsoft
2010-03-05 11:29:42 ----ASH---- C:\Documents and Settings\MŠ Stěbořice\Data aplikací\desktop.ini
2010-03-05 11:29:24 ----D---- C:\ZALOHA
2010-03-05 10:26:49 ----A---- C:\WINDOWS\system32\muweb.dll
2010-03-05 10:26:49 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2010-03-05 10:26:49 ----A---- C:\WINDOWS\system32\mucltui.dll
2010-03-05 10:22:40 ----D---- C:\Program Files\ESET
2010-03-05 10:22:40 ----D---- C:\Documents and Settings\All Users\Data aplikací\ESET
2010-03-05 09:43:56 ----A---- C:\WINDOWS\ntbtlog.txt
2010-03-04 10:34:42 ----D---- C:\WINDOWS\pss

======List of files/folders modified in the last 1 months======

2010-03-05 13:54:15 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-03-05 13:52:11 ----D---- C:\WINDOWS\system32\drivers
2010-03-05 13:30:43 ----D---- C:\WINDOWS
2010-03-05 13:29:24 ----A---- C:\WINDOWS\system.ini
2010-03-05 13:28:00 ----D---- C:\WINDOWS\system32
2010-03-05 13:28:00 ----D---- C:\WINDOWS\AppPatch
2010-03-05 13:27:54 ----D---- C:\Program Files\Common Files
2010-03-05 13:25:59 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-05 13:25:18 ----RASH---- C:\boot.ini
2010-03-05 13:23:06 ----D---- C:\WINDOWS\Prefetch
2010-03-05 11:44:19 ----RD---- C:\Program Files
2010-03-05 11:36:16 ----SHD---- C:\WINDOWS\Installer
2010-03-05 11:36:14 ----A---- C:\WINDOWS\OEWABLog.txt
2010-03-05 11:36:05 ----D---- C:\Documents and Settings
2010-03-05 10:31:11 ----A---- C:\WINDOWS\win.ini
2010-03-05 10:26:49 ----HD---- C:\WINDOWS\inf
2010-03-05 10:15:54 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2010-03-05 09:36:07 ----D---- C:\Program Files\LogMeIn
2010-02-10 10:01:52 ----A---- C:\WINDOWS\imsins.BAK
2010-02-10 10:01:44 ----RSHDC---- C:\WINDOWS\system32\dllcache

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-11-16 108792]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2009-11-16 55768]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2006-03-02 39936]
R2 DgiVecp;DgiVecp; \??\C:\WINDOWS\system32\Drivers\DgiVecp.sys []
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-11-16 116520]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2009-12-18 135048]
R2 LMIInfo;LogMeIn Kernel Information Provider; \??\C:\Program Files\LogMeIn\x86\RaInfo.sys []
R2 LMIRfsDriver;LogMeIn Remote File System Driver; \??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys []
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2010-01-08 33096]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-11-28 1353820]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-07-18 4547584]
R3 lmimirr;lmimirr; C:\WINDOWS\system32\DRIVERS\lmimirr.sys [2007-08-03 10144]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2007-08-07 98944]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-17 14848]
S2 SSPORT;SSPORT; \??\C:\WINDOWS\system32\Drivers\SSPORT.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\MSTBOI~1\LOCALS~1\Temp\catchme.sys []
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 LMIRfsClientNP;LMIRfsClientNP; C:\WINDOWS\system32\drivers\LMIRfsClientNP.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-11-16 735960]
R2 LMIMaint;LogMeIn Maintenance Service; C:\Program Files\LogMeIn\x86\RaMaint.exe [2009-10-05 116032]
R2 LogMeIn;LogMeIn; C:\Program Files\LogMeIn\x86\LogMeIn.exe [2007-08-03 63040]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-11-16 20680]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Re: PC je zavirovaný, ale antivir nic nehlásí

Napsal: 05 bře 2010 14:00
od korda
poslal jsem odkaz na ten soubor. přišlo něco?

Re: PC je zavirovaný, ale antivir nic nehlásí

Napsal: 05 bře 2010 14:16
od korda
Díky moc za pomoc a úspěšný boj tímto šmejdem v PC z naší mateřské školy.

SP3 tam budu za chvíli instalovat.
Vše vypadá že je OK.
Ještě jednou moc děkuji.

Re: PC je zavirovaný, ale antivir nic nehlásí

Napsal: 05 bře 2010 14:38
od korda
OK

Re: PC je zavirovaný, ale antivir nic nehlásí

Napsal: 21 led 2011 10:10
od sokolus
Dobry den. Mam zrejme stejny problem. Dalo by se s tim neco delat? Neustale mi sama nacita diketova jednotka a RAM dostava zabrat. (algv.exe)
Všechny časy jsou v UTC+01:00
Stránka 1 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz