Preventivka po nalezeni viru

[JaRon]

pouzi CFScript:

Kód: Vybrat vše

Driver::
bpewrje

[Keyz]

CFScript log:

Kód: Vybrat vše

Driver::
bpewrje

ComboFix 12-03-01.02 - Keyz 03.03.2012 19:26:48.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.3327.2430 [GMT 1:00]
Spuštěný z: c:\documents and settings\Keyz\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Keyz\Plocha\CFScript.txt
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_BPEWRJE
-------\Service_bpewrje
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-02-03 do 2012-03-03 )))))))))))))))))))))))))))))))
.
.
2012-03-02 11:36 . 2012-03-02 11:36 -------- d-----w- C:\TDSSKiller_Quarantine
2012-02-28 21:59 . 2012-02-29 15:30 -------- d---a-w- C:\SUPER_PI
2012-02-28 12:42 . 2012-02-28 12:48 -------- d-----w- C:\rsit
2012-02-27 20:13 . 2012-02-27 20:14 -------- d-----w- C:\d750
2012-02-27 16:42 . 2012-02-29 23:20 -------- d-----w- C:\Fraps
2012-02-27 16:31 . 2012-02-27 16:31 -------- d-----w- C:\5ed85a56149ad6b36373a902d330b8
2012-02-27 10:46 . 2012-02-27 19:41 -------- d-----w- C:\down
2012-02-27 00:15 . 2012-03-03 00:21 -------- d-----r- C:\Program Files
2012-02-27 00:12 . 2012-02-27 00:07 -------- d---a-w- C:\Documents and Settings
2012-02-27 00:09 . 2012-02-27 10:11 -------- d-----w- C:\totalcmd
2012-02-27 00:06 . 2012-02-27 00:06 -------- d-----w- C:\NVIDIA
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-19 13:12 . 2011-12-19 13:12 104752 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys
2011-12-19 13:11 . 2011-12-19 13:11 116016 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys
2011-12-19 13:11 . 2011-12-19 13:11 135472 ----a-w- c:\windows\system32\VBoxNetFltNobj.dll
2011-12-19 08:53 . 2011-12-19 08:53 81920 ------w- c:\windows\system32\ieencode.dll
2012-02-16 14:53 . 2012-03-02 17:26 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-03-02_14.21.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-03-03 18:31 . 2012-03-03 18:31 16384 c:\windows\Temp\Perflib_Perfdata_7a8.dat
+ 2012-03-02 17:29 . 2012-03-02 17:29 31156 c:\windows\system32\mlfcache.dat
+ 2012-03-03 00:21 . 2011-12-19 13:11 91440 c:\windows\system32\DRVSTORE\VBoxUSBMon_F8EEC1D967F6D4E84915E841CD3614700E7ECF38\VBoxUSBMon.sys
+ 2012-03-03 00:21 . 2011-12-19 13:11 82736 c:\windows\system32\DRVSTORE\VBoxUSB_931D1F0B7F6A290E67947696A5C487C7024329E0\VBoxUSB.sys
+ 2012-03-03 00:21 . 2011-12-19 13:11 91440 c:\windows\system32\drivers\VBoxUSBMon.sys
+ 2012-03-02 17:28 . 2012-03-02 17:28 27136 c:\windows\Installer\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}\AppleSoftwareUpdateIco.exe
+ 2012-03-03 00:22 . 2011-12-19 13:11 158512 c:\windows\system32\DRVSTORE\VBoxDrv_FE4F374721CAEB5A61A56200D2EC5BD55683CB49\VBoxDrv.sys
+ 2012-03-03 00:22 . 2011-12-19 13:11 158512 c:\windows\system32\drivers\VBoxDrv.sys
+ 2012-03-02 18:17 . 2012-03-02 18:17 739840 c:\windows\Installer\d8746d.msi
+ 2012-03-02 17:29 . 2012-03-02 17:29 897024 c:\windows\Installer\{F2AF3E5D-9697-485C-A5AC-E2B9468C446A}\SafariIco.exe
+ 2012-03-02 17:29 . 2012-03-02 17:29 3470848 c:\windows\Installer\abc188.msi
+ 2012-03-02 17:28 . 2012-03-02 17:28 1530368 c:\windows\Installer\abc184.msi
+ 2012-03-02 17:28 . 2012-03-02 17:28 1769984 c:\windows\Installer\abc17f.msi
+ 2012-03-03 00:22 . 2012-03-03 00:22 1050624 c:\windows\Installer\a28ffa.msi
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{687578b9-7132-4a7a-80e4-30ee31099e03}"= "c:\program files\uTorrentControl2\prxtbuTor.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{687578b9-7132-4a7a-80e4-30ee31099e03}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{687578b9-7132-4a7a-80e4-30ee31099e03}]
2011-05-09 08:49 176936 ----a-w- c:\program files\uTorrentControl2\prxtbuTor.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{687578b9-7132-4a7a-80e4-30ee31099e03}"= "c:\program files\uTorrentControl2\prxtbuTor.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{687578b9-7132-4a7a-80e4-30ee31099e03}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{687578B9-7132-4A7A-80E4-30EE31099E03}"= "c:\program files\uTorrentControl2\prxtbuTor.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{687578b9-7132-4a7a-80e4-30ee31099e03}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemExplorerAutoStart"="c:\program files\System Explorer\SystemExplorer.exe" [2012-02-21 2630800]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2006-03-02 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-03-02 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2006-03-02 455168]
"RTHDCPL"="RTHDCPL.EXE" [2009-05-21 17881600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2012-02-10 15494464]
"NvMediaCenter"="NvMCTray.dll" [2012-02-10 108352]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2012-02-10 1634112]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-08-10 1313640]
"Copperhead"="c:\program files\Razer\Copperhead\razerhid.exe" [2005-11-25 155648]
"Six Engine"="c:\program files\ASUS\EPU-6 Engine\SixEngine.exe" [2009-05-25 6017024]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Windows Search.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Update Checker]
2008-12-11 12:45 114688 ----a-w- c:\program files\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2012-02-13 08:06 3481408 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Drive Xpert]
2009-02-02 09:39 10231808 ----a-w- c:\program files\ASUS\Drive Xpert\DriveXpert.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launch As Cmd Runner]
2008-06-17 10:09 376832 ----a-w- c:\program files\ASUS\AI Direct Link\AsCmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launch Direct Link]
2008-12-09 17:54 1212416 ----a-w- c:\program files\ASUS\AI Direct Link\AsShare.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2012-02-09 06:06 312376 ----a-w- c:\program files\PowerISO\PWRISOVM.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2012-02-27 16:54 1242448 ----a-w- c:\program files\Steam\Steam.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Veetle\\Player\\VeetleNet.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Origin Games\\Mass Effect 3 Demo\\Binaries\\Win32\\MassEffect3Demo.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"c:\\Program Files\\The Witcher 2\\bin\\witcher2.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6511:TCP"= 6511:TCP:nuhyk
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R0 mrdd;Marvell Removable Disk Control Driver;c:\windows\system32\drivers\mrdd.sys [27.2.2012 0:52 18984]
R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [9.2.2009 3:30 152616]
R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [27.2.2012 21:57 24408]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [27.2.2012 17:50 242240]
R1 VBoxDrv;VirtualBox Service;c:\windows\system32\drivers\VBoxDrv.sys [3.3.2012 1:22 158512]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\drivers\VBoxUSBMon.sys [3.3.2012 1:21 91440]
R2 57xx SteelVine Manager;57xx SteelVine;c:\program files\ASUS\Drive Xpert\SteelVine.exe [2.2.2009 10:37 1286144]
R2 AsSysCtrlService;ASUS System Control Service;c:\program files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [27.2.2012 0:54 90112]
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\asus.sys\config\DVMExportService.exe [17.7.2009 15:25 319488]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [27.2.2012 1:07 2348352]
R3 skfilt;skfilt;c:\windows\system32\drivers\skfilt.SYS [27.2.2012 15:29 1670016]
R3 SystemExplorerHelpService;System Explorer Service;c:\program files\System Explorer\service\SystemExplorerService.exe [27.2.2012 17:44 536208]
R3 UsbFltr;Razer Copperhead Driver;c:\windows\system32\drivers\copperhd.sys [27.2.2012 17:54 11596]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\drivers\VBoxNetAdp.sys [19.12.2011 14:12 104752]
R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\drivers\VBoxNetFlt.sys [19.12.2011 14:11 116016]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [27.2.2012 0:54 1684736]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [27.2.2012 15:30 79360]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [27.2.2012 1:10 13192]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [27.2.2012 1:10 8456]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [26.2.2012 22:44 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Obsah adresáře 'Naplánované úlohy'
.
2012-03-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57]
.
2012-02-27 c:\windows\Tasks\Microsoft_Hardware_Launch_IType_exe.job
- c:\program files\Microsoft IntelliType Pro\itype.exe [2011-08-10 15:39]
.
.
------- Doplňkový sken -------
.
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
FF - ProfilePath - c:\documents and settings\Keyz\Data aplikací\Mozilla\Firefox\Profiles\1tt64q5f.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-03-03 19:32
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(3020)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Creative\Shared Files\CTAudSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RunDLL32.exe
c:\program files\Microsoft IntelliType Pro\dpupdchk.exe
c:\program files\Razer\Copperhead\razertra.exe
c:\program files\Razer\Copperhead\razerofa.exe
.
**************************************************************************
.
Celkový čas: 2012-03-03 19:34:10 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-03-03 18:34
ComboFix2.txt 2012-03-02 14:24
.
Před spuštěním: Volných bajtů: 468 673 036 288
Po spuštění: Volných bajtů: 468 601 843 712
.
- - End Of File - - 67DE05E813FF75DD99A00ADFC70D4A6C

-Mohu smazat Složku C:\TDSSKiller_Quarantine?

[JaRon]

log vypada OK
zlozku mozes zmazat

[Keyz]

Dobře díky moc za pomoc.

[JaRon]

rado sa stalo