PC sekne hned po nacitani do WIN

Zpráva

tension182 · #1 Příspěvek od **tension182** » 20 črc 2010 11:22

Dobry den, mam taky problem, ihned po nacitani do windowsu mi sekne PC a nejde spustit ziadne subory s koncovkou .exe. Mam problem dostat sa i do nudzoveho rezimu, pretoze, po restarte PC mi nejde klavesnica (ta sa spusti zaroven so spustenim windowsu), takze si neviem dat rady, ako sa dostat do nudzoveho rezimu, zrejme mam nejaky virus, avast mi raz stihol vyhodit ze bol najdeny malware, ale potom to hned seklo. Prosim o nejake rady

edit: ten avast mi vyhodil nasledujuce:
Nazov suboru: C:\WINDOWS\SYSTEM32\NTDLL.DLL
Nazov vzorky: Win32:Rootkit-gen [Rtk]
Typ malwaru: Rootkit

stihlo sa mi podarit, este nez sekol PC kliknut na odstranit, alebo presunut do truhly, ale vypisalo mi, ze to neni mozne

tension182 · #2 Příspěvek od **tension182** » 20 črc 2010 11:42

nemam tym padom vlastne ani moznost dat sem log z hijackthis

#3 Příspěvek od **JaRon** » 20 črc 2010 12:19

bootni PC z CD http://www.viry.cz/forum/viewtopic.php?f=29&t=66880 a odvir ho - vyber AV necham na Tebe

tension182 · #4 Příspěvek od **tension182** » 20 črc 2010 12:39

tak podarilo sa mi spojazdnit klavesnicu od kamarata, dostal som sa do nudzoveho rezimu a pomocou obnovy systemu som to napravil, vsetko funguje, ale i tak prihodim o chvilku radsej log pre kontrolu

tension182 · #5 Příspěvek od **tension182** » 20 črc 2010 12:55

tak problem sa mi nakoniec nepodarilo az tak odstranit, virus ostal v PC a neviem si dat rady s jeho odstranenim

Logfile of random's system information tool 1.08 (written by random/random)
Run by MERCURY at 2010-07-20 13:51:45
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 4 GB (10%) free of 38 GB
Total RAM: 3582 MB (79% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:51:58, on 20.7.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\GIGABYTE\GEST\gest.exe
C:\Program Files\Cyberlink\Shared Files\brs.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Vtune\TBPanel.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\DNA\btdna.exe
C:\program files\steam\steam.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Documents and Settings\MERCURY\Local Settings\Application Data\Google\Update\1.2.183.29\GoogleCrashHandler.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\GIGABYTE\GEST\GSvr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Documents and Settings\MERCURY\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\MERCURY\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\MERCURY\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\MERCURY\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\MERCURY\My Documents\Downloads\RSIT.exe
C:\Program Files\trend micro\MERCURY.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://search13.net/search.php?clid=486&q=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search13.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search13.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search13.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search13.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search13.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search13.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [GEST] C:\Program Files\GIGABYTE\GEST\RUN.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TBPanel] C:\Program Files\Vtune\TBPanel.exe /A
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\MERCURY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: StylishProfile - {14CD42DD-ABCD-3586-DCAB-40E3693E3737} - C:\Program Files\Stylish Profile\ct.htm (file missing)
O9 - Extra 'Tools' menuitem: StylishProfile - {14CD42DD-ABCD-3586-DCAB-40E3693E3737} - C:\Program Files\Stylish Profile\ct.htm (file missing)
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe (file missing)
O9 - Extra button: Cool Hand Poker - {00000000-0000-0000-0000-000000000000} - C:\MicroGaming\Poker\coolhandMPP\MPPoker.exe (HKCU)
O9 - Extra button: UltimateBet - {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\Documents and Settings\MERCURY\Start Menu\Programs\UltimateBet\UltimateBet.lnk (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: UltimateBet - {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\Documents and Settings\MERCURY\Start Menu\Programs\UltimateBet\UltimateBet.lnk (file missing) (HKCU)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\GEST\GSvr.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 8413 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1251739525.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-515967899-688789844-725345543-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-515967899-688789844-725345543-1003UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"GEST"=C:\Program Files\GIGABYTE\GEST\RUN.exe [2007-12-14 236040]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-02-13 16857600]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"RemoteControl8"=C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [2008-03-20 83240]
"PDVD8LanguageShortcut"=C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [2007-12-14 50472]
"BDRegion"=C:\Program Files\Cyberlink\Shared Files\brs.exe [2008-08-08 91432]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2008-08-04 36352]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792]
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe [2003-04-07 188416]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-05-26 413696]
"nwiz"=nwiz.exe /installquiet []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2010-03-16 110696]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2010-03-16 13670504]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]
"TBPanel"=C:\Program Files\Vtune\TBPanel.exe [2008-10-21 2154496]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-12-10 216520]
"BitTorrent DNA"=C:\Program Files\DNA\btdna.exe [2009-11-13 323392]
"Steam"=c:\program files\steam\steam.exe [2010-05-07 1238352]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2010-05-13 26192168]
"Google Update"=C:\Documents and Settings\MERCURY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-07-10 136176]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
hp psc 1000 series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2008-09-05 200064]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=0xFF000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe"="C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe:*:Enabled:CyberLink PowerDVD 8.0"
"D:\Games\COD5\CoDWaW.exe"="D:\Games\COD5\CoDWaW.exe:*:Enabled:Call of Duty(R): World at War Campaign/Coop"
"D:\Games\Counter Strike\cstrike.exe"="D:\Games\Counter Strike\cstrike.exe:*:Enabled:Counter-Strike Launcher"
"D:\Games\Counter Strike\hl.exe"="D:\Games\Counter Strike\hl.exe:*:Enabled:Half-Life Launcher"
"D:\Games\KONAMI\Pro Evolution Soccer 2009\pes2009.exe"="D:\Games\KONAMI\Pro Evolution Soccer 2009\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009"
"D:\Games\EA Sports\FIFA 09\FIFA09.exe"="D:\Games\EA Sports\FIFA 09\FIFA09.exe:*:Enabled:FIFA09"
"D:\Games\Call of Duty 5\CoDWaW.exe"="D:\Games\Call of Duty 5\CoDWaW.exe:*:Enabled:Call of Duty(R): World at War Campaign/Coop"
"C:\Program Files\mIRC\mirc.exe"="C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Program Files\B2BPOKER\NoiQpoker\jre\bin\javaw.exe"="C:\Program Files\B2BPOKER\NoiQpoker\jre\bin\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"C:\Program Files\SopCast\SopCast.exe"="C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast"
"D:\Program Files\Steam\steamapps\lamc0r\counter-strike\hl.exe"="D:\Program Files\Steam\steamapps\lamc0r\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\QIP Infium\infium.exe"="C:\Program Files\QIP Infium\infium.exe:*:Enabled:QIP Infium"
"C:\Program Files\Hamachi\hamachi.exe"="C:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"D:\Program Files\Steam\Steam.exe"="D:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"="C:\Program Files\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"D:\Games\Football Manager 2009\fm.exe"="D:\Games\Football Manager 2009\fm.exe:*:Disabled:Football Manager 2009"
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\Program Files\Steam\steamapps\chalanko\counter-strike\hl.exe"="C:\Program Files\Steam\steamapps\chalanko\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"D:\Games\CS\hl.exe"="D:\Games\CS\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Steam\steamapps\_dare_\counter-strike\hl.exe"="C:\Program Files\Steam\steamapps\_dare_\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Steam\steamapps\koivusaku\counter-strike\hl.exe"="C:\Program Files\Steam\steamapps\koivusaku\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Steam\steamapps\tomike434\counter-strike\hl.exe"="C:\Program Files\Steam\steamapps\tomike434\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Documents and Settings\MERCURY\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe"="C:\Documents and Settings\MERCURY\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe:*:Enabled:Main program for Octoshape client"
"D:\Games\Left 4 Dead\left4dead.exe"="D:\Games\Left 4 Dead\left4dead.exe:*:Enabled:left4dead"
"C:\Program Files\ICQ6\ICQ.exe"="C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Steam\steamapps\durexo\counter-strike\hl.exe"="C:\Program Files\Steam\steamapps\durexo\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\SopCast\adv\SopAdver.exe"="C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\Program Files\Steam\steamapps\ph4nt0m7780\counter-strike\hl.exe"="C:\Program Files\Steam\steamapps\ph4nt0m7780\counter-strike\hl.exe:*:Enabled:Counter-Strike"
"C:\Program Files\Steam\steamapps\kapo454\counter-strike\hl.exe"="C:\Program Files\Steam\steamapps\kapo454\counter-strike\hl.exe:*:Enabled:Counter-Strike"
"C:\Program Files\Steam\steamapps\chaser_182\counter-strike source\hl2.exe"="C:\Program Files\Steam\steamapps\chaser_182\counter-strike source\hl2.exe:*:Enabled:Counter-Strike: Source"
"C:\Program Files\Steam\steamapps\chaser_182\counter-strike\hl.exe"="C:\Program Files\Steam\steamapps\chaser_182\counter-strike\hl.exe:*:Enabled:Counter-Strike"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\GIGABYTE\GEST\run.exe"="C:\Program Files\GIGABYTE\GEST\run.exe:*:Enabled:update"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe"="C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe:*:Enabled:CyberLink PowerDVD 8.0"

======List of files/folders created in the last 1 months======

2010-07-20 13:51:45 ----D---- C:\rsit
2010-07-20 13:51:45 ----D---- C:\Program Files\trend micro
2010-07-20 13:19:33 ----A---- C:\WINDOWS\ntbtlog.txt
2010-07-14 19:50:14 ----HDC---- C:\WINDOWS\$NtUninstallKB2229593$
2010-07-13 16:46:12 ----D---- C:\Program Files\Native Instruments
2010-07-04 13:06:32 ----D---- C:\Documents and Settings\MERCURY\Application Data\TS3Client
2010-07-04 13:05:15 ----D---- C:\Program Files\TeamSpeak 3 Client

======List of files/folders modified in the last 1 months======

2010-07-20 13:51:45 ----RD---- C:\Program Files
2010-07-20 13:50:45 ----D---- C:\Documents and Settings\MERCURY\Application Data\Skype
2010-07-20 13:50:32 ----A---- C:\WINDOWS\wincmd.ini
2010-07-20 13:50:24 ----D---- C:\WINDOWS\Temp
2010-07-20 13:50:13 ----D---- C:\WINDOWS\system32\CatRoot2
2010-07-20 13:49:29 ----D---- C:\Program Files\Steam
2010-07-20 13:49:28 ----D---- C:\Program Files\DNA
2010-07-20 13:49:28 ----D---- C:\Documents and Settings\MERCURY\Application Data\DNA
2010-07-20 13:33:29 ----D---- C:\Documents and Settings\MERCURY\Application Data\skypePM
2010-07-20 13:33:25 ----D---- C:\WINDOWS\Prefetch
2010-07-20 13:26:49 ----D---- C:\WINDOWS\system32\config
2010-07-20 13:25:59 ----D---- C:\WINDOWS\system32\wbem
2010-07-20 13:25:57 ----D---- C:\WINDOWS\Registration
2010-07-20 13:20:38 ----D---- C:\Documents and Settings
2010-07-20 13:19:33 ----D---- C:\WINDOWS
2010-07-20 02:08:57 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-07-19 17:29:20 ----D---- C:\Documents and Settings\MERCURY\Application Data\Microgaming
2010-07-15 16:49:00 ----A---- C:\WINDOWS\NeroDigital.ini
2010-07-14 19:50:21 ----HD---- C:\WINDOWS\inf
2010-07-14 19:50:16 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-07-14 19:50:16 ----D---- C:\WINDOWS\system32
2010-07-14 19:49:41 ----HD---- C:\WINDOWS\$hf_mig$
2010-07-10 17:59:11 ----SD---- C:\WINDOWS\Tasks
2010-07-10 13:12:55 ----SHD---- C:\WINDOWS\Installer
2010-07-10 13:12:48 ----D---- C:\Program Files\Opera
2010-07-08 21:09:57 ----D---- C:\Documents and Settings\MERCURY\Application Data\BitTorrent
2010-07-08 15:08:44 ----D---- C:\Program Files\X-ray Anti-Cheat
2010-07-05 18:08:17 ----D---- C:\Program Files\Pokerkings
2010-07-02 21:39:05 ----A---- C:\WINDOWS\system32\MRT.exe
2010-06-23 20:06:40 ----D---- C:\WINDOWS\Microsoft.NET
2010-06-23 20:06:38 ----RSD---- C:\WINDOWS\assembly
2010-06-23 16:38:07 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-06-23 16:37:47 ----D---- C:\WINDOWS\WinSxS

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2007-03-08 43528]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2008-12-25 717296]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2004-10-08 35840]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 36096]
R1 ISODrive;ISO DVD/CD-ROM Device Driver; \??\C:\Program Files\UltraISO\drivers\ISODrive.sys []
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-03 14848]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; \??\C:\Program Files\CyberLink\PowerDVD8\000.fcl []
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-11-25 94160]
R2 TBPanel;TBPanel; C:\WINDOWS\system32\drivers\TBPanel.sys [2007-03-16 12256]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
R3 ET5Drv;ET5Drv; \??\C:\WINDOWS\system32\Drivers\ET5Drv.sys []
R3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys []
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-02-14 4676096]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2010-03-16 10232352]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2009-07-28 47360]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-01-03 105856]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
S3 a4bdlgn5;a4bdlgn5; C:\WINDOWS\system32\drivers\a4bdlgn5.sys []
S3 Cardex;Cardex; \??\C:\WINDOWS\system32\drivers\TBPANEL.SYS []
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2010-02-24 25280]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2003-04-07 51024]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2003-04-07 16080]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2003-04-07 21456]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2010-03-16 154216]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-02-11 66872]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
R3 GEST Service;GEST Service for program management.; C:\Program Files\GIGABYTE\GEST\GSvr.exe [2007-12-14 47624]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2003-04-07 65795]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

tension182 · #6 Příspěvek od **tension182** » 20 črc 2010 13:11

prikladam log z combofix

ComboFix 10-07-19.02 - MERCURY 20.07.2010 14:02:19.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1033.18.3582.3026 [GMT 2:00]
Running from: c:\documents and settings\MERCURY\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100719-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\MERCURY\Application Data\inst.exe
C:\WGASetup.exe
c:\windows\system32\Ijl11.dll
c:\windows\system32\vbpng1.dll

.
((((((((((((((((((((((((( Files Created from 2010-06-20 to 2010-07-20 )))))))))))))))))))))))))))))))
.

2010-07-20 11:51 . 2010-07-20 11:52 -------- d-----w- C:\rsit
2010-07-20 11:51 . 2010-07-20 11:51 -------- d-----w- c:\program files\trend micro
2010-07-20 11:25 . 2010-07-20 11:25 -------- d-----w- c:\windows\system32\wbem\Repository
2010-07-20 11:20 . 2010-07-20 11:23 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft
2010-07-20 11:20 . 2010-07-20 11:23 -------- d-s---w- c:\documents and settings\Administrator
2010-07-13 14:46 . 2010-07-13 14:46 -------- d-----w- c:\program files\Native Instruments
2010-07-10 15:59 . 2010-07-10 15:59 -------- d-----w- c:\documents and settings\MERCURY\Local Settings\Application Data\Temp
2010-07-10 15:59 . 2010-07-10 15:59 -------- d-----w- c:\documents and settings\MERCURY\Local Settings\Application Data\Google
2010-07-04 11:06 . 2010-07-04 11:13 -------- d-----w- c:\documents and settings\MERCURY\Application Data\TS3Client
2010-07-04 11:05 . 2010-07-04 11:05 -------- d-----w- c:\program files\TeamSpeak 3 Client

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-20 11:56 . 2008-11-24 23:10 16608 ----a-w- c:\windows\gdrv.sys
2010-07-20 11:56 . 2010-01-27 19:20 -------- d-----w- c:\documents and settings\MERCURY\Application Data\Skype
2010-07-20 11:56 . 2009-01-07 18:16 -------- d-----w- c:\documents and settings\MERCURY\Application Data\DNA
2010-07-20 11:49 . 2009-08-17 19:46 -------- d-----w- c:\program files\Steam
2010-07-20 11:49 . 2009-01-07 18:16 -------- d-----w- c:\program files\DNA
2010-07-20 11:33 . 2010-01-27 19:24 -------- d-----w- c:\documents and settings\MERCURY\Application Data\skypePM
2010-07-19 15:29 . 2009-03-05 15:18 -------- d-----w- c:\documents and settings\MERCURY\Application Data\Microgaming
2010-07-10 11:12 . 2008-12-25 10:34 -------- d-----w- c:\program files\Opera
2010-07-08 19:09 . 2009-01-07 18:16 -------- d-----w- c:\documents and settings\MERCURY\Application Data\BitTorrent
2010-07-08 13:08 . 2009-09-13 12:40 -------- d-----w- c:\program files\X-ray Anti-Cheat
2010-07-05 16:08 . 2010-01-18 17:30 -------- d-----w- c:\program files\Pokerkings
2010-06-14 14:30 . 2008-11-24 22:48 743936 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-13 15:14 . 2009-07-14 12:30 -------- d-----w- c:\program files\SunPoker
2010-05-02 05:56 . 2004-08-04 12:00 1850880 ----a-w- c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TBPanel"="c:\program files\Vtune\TBPanel.exe" [2008-10-21 2154496]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-10 216520]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-13 323392]
"Steam"="c:\program files\steam\steam.exe" [2010-05-07 1238352]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]
"Google Update"="c:\documents and settings\MERCURY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-07-10 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="c:\program files\GIGABYTE\GEST\RUN.exe" [2007-12-14 236040]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-13 16857600]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-08-08 91432]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-03 36352]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2003-04-07 188416]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-03-16 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-03-16 13670504]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
hp psc 1000 series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-4-6 147456]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"d:\\Games\\Call of Duty 5\\CoDWaW.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\B2BPOKER\\NoiQpoker\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Steam\\steamapps\\chalanko\\counter-strike\\hl.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Steam\\steamapps\\_dare_\\counter-strike\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\koivusaku\\counter-strike\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\tomike434\\counter-strike\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\durexo\\counter-strike\\hl.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Steam\\steamapps\\ph4nt0m7780\\counter-strike\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\kapo454\\counter-strike\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\chaser_182\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\chaser_182\\counter-strike\\hl.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\GIGABYTE\\GEST\\run.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [25.11.2008 1:19 114768]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\CyberLink\PowerDVD8\000.fcl [27.6.2008 17:50 61424]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [25.11.2008 1:19 20560]
S3 GEST Service;GEST Service for program management.;c:\program files\GIGABYTE\GEST\GSvr.exe [25.11.2008 1:11 47624]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [25.12.2008 19:55 717296]
.
Contents of the 'Scheduled Tasks' folder

2009-12-03 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series5E771253C1676EBED677BF361FDFC537825E15B8251739525.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 22:52]

2010-07-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-515967899-688789844-725345543-1003Core.job
- c:\documents and settings\MERCURY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-07-10 15:59]

2010-07-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-515967899-688789844-725345543-1003UA.job
- c:\documents and settings\MERCURY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-07-10 15:59]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.facebook.com/
uDefault_Search_URL = hxxp://search13.net/
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://search13.net/
uCustomizeSearch = hxxp://search13.net/
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{14CD42DD-ABCD-3586-DCAB-40E3693E3737} - c:\program files\Stylish Profile\ct.htm
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-nwiz - nwiz.exe

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl"
.
Completion time: 2010-07-20 14:07:21
ComboFix-quarantined-files.txt 2010-07-20 12:07

Pre-Run: 3 847 536 640 bytes free
Post-Run: 3 994 480 640 voľných bajtov

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - C7383D83296162B0BF17ABFDB2BB789F

tension182 · #7 Příspěvek od **tension182** » 20 črc 2010 15:23

nic?

#8 Příspěvek od **riffman** » 20 črc 2010 19:03

zaskocim za kolegu (na zadost usera)

http://www.esagelab.com/files/bootkit_remover.rar

stahnout, rozbalit na plochu, spustit

po spusteni klik pravym mysidlem do okna, zvolit moznost Vybrat vse, CTRL+C a sem do odpovedi CTRL+V (tim mi sem plesknete log)

tension182 · #9 Příspěvek od **tension182** » 20 črc 2010 22:11

Bootkit Remover version 1.0.0.1
(c) 2009 eSage Lab
www.esagelab.com

\\.\C: -> \\.\PhysicalDrive0
MD5: 6def5ffcbcdbdb4082f1015625e597bd
\\.\D: -> \\.\PhysicalDrive0
\\.\E: -> \\.\PhysicalDrive0

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)

Press any key to quit...

#10 Příspěvek od **riffman** » 20 črc 2010 22:17

stahnete MBR

presunte mbr.exe do adresare C:\Windows

dalsi postup jest nasledujici:

Start/Spustit a do chlivecku napiste cmd a stisk Enter.

vybafne na vas okenko prikazoveho radku; vy nadatlujte rucne prikaz:

mbr.exe -f

a stisknete Enter

Po provedeni operace restartujte a spustte mbr jeste jednou, jiz normalne a vlozte sem log

tension182 · #11 Příspěvek od **tension182** » 20 črc 2010 22:22

postupoval som podla tohto a neviem ktory log sem mam pridat

#12 Příspěvek od **riffman** » 20 črc 2010 22:24

ten, co se vytvori

pokud se nevytvori, je bud tam, kde je mbr stazen, nebo ve slozce C:\Windows\system32, jeho nazev je tusim log.txt, pripadne mbr.txt

tension182 · #13 Příspěvek od **tension182** » 20 črc 2010 22:25

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

toto???

#14 Příspěvek od **riffman** » 20 črc 2010 22:26

ano, toto...jeste se pocitac po startu chova nesystematicky?

tension182 · #15 Příspěvek od **tension182** » 21 črc 2010 06:37

zda sa ze vsetko je v pohode, jedno velke diky, ste tu borci

VIRY.CZ

PC sekne hned po nacitani do WIN

PC sekne hned po nacitani do WIN

Re: PC sekne hned po nacitani do WIN

Re: PC sekne hned po nacitani do WIN

Re: PC sekne hned po nacitani do WIN

Re: PC sekne hned po nacitani do WIN

Re: PC sekne hned po nacitani do WIN

Re: PC sekne hned po nacitani do WIN

Re: PC sekne hned po nacitani do WIN

Re: PC sekne hned po nacitani do WIN

Re: PC sekne hned po nacitani do WIN

Re: PC sekne hned po nacitani do WIN

Re: PC sekne hned po nacitani do WIN

Re: PC sekne hned po nacitani do WIN

Re: PC sekne hned po nacitani do WIN

Re: PC sekne hned po nacitani do WIN