Internet jede ale tak napul.

[Damned]

Zkusíme opravit celkové připojení.

Stáhni si WinsockXPFix
http://www.snapfiles.com/get/winsockxpfix.html
a ulož si soubor na plochu. Poklepej na WinsockXPFix , klikni na tlačítko Fix
a poté povol restart PC.
Můžeš si udělat i napřed zálohu.
Návod:
http://www.cit.cornell.edu/computer/sec ... tures.html

[Reklama]

[Cerb]

No mam ho porad uz jsem zoufaly nikdy bych si nemyslel ze bude tak slozite se zbavit jednoho trojana.

[Damned]

To bude spíše rootkit. Avast! ti funguje?

Je mi ale divný, že ho nemůžeme najít. Bude asi v některém programu.

Z tohoto odkazu: http://www.mwti.net/products/mwav/mwavdownload.asp si stáhni MWAV. Aktualizuj ho.
Je tam tlačítko Síťová aktivita, zmáčkni ho a ukáže se seznam přístupů k síti. Soubor-->Uložit a zprávu v texťáku sem přilož.
Pak zaškrtni kontrolu na spyware, otestovat všechny soubory a otestuj PC. Po skončení mi sem přilož log v archívu.

[Cerb]

MWAV
Sitova aktivita

A avast sice spustim ale neda se mi jakoby tam k hodinam proste kdyz ho potom zavru tak se zavre misto toho aby zustal spusteny do doby nez ho vypnu.

[Damned]

Odinstaluj si FireFox, smaž i složky po něm. Pak proveď sken MbAM a oprav. Já zatím zkontroluju log z MWAV.

[Damned]

Zatím:

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found,
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
pak klik empty selected.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache,
cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer,
Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

[Damned]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad
a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\SOFTWARE\Wget]
[-HKEY_CURRENT_USER\Software\Microsoft\OLE]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Drivers]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations]


Ulož si ho jako na Plochu jako fix.reg a jako typ všechny soubory , najdi tento soubor na Ploše a poklepáním ho spusť. Budeš dotázán na přidání hodnoty do registru. Schval.
*****************************************************************************************************************************************
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
c:\windows\ativpsrm.bin
c:\windows\system32\emptyregdb.dat
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys

FileLook::
c:\windows\system32\nvusmb.exe

Driver::
catchme



Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT (HJT přejmenuj na Tříšť.exe) a popiš chování počítače

[Cerb]

Jen upozornuju ze jsem musel restart pocitace abych to sem dal protoze po cisticim procesu ComboFixem internet prestal fungovat to same se deje kdyz to vycistim MBAM.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:45:56, on 8.8.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5508)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
c:\Program Files\trend micro\T926A~1.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 1531 bytes



ComboFix 09-08-07.09 - Administrator 08.08.2009 23:41.7.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.739 [GMT 1:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt

FILE ::
"c:\docume~1\ADMINI~1\LOCALS~1\Temp\catchme.sys"
"c:\windows\ativpsrm.bin"
"c:\windows\system32\emptyregdb.dat"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\ativpsrm.bin
c:\windows\regedit.com
c:\windows\system32\emptyregdb.dat
c:\windows\system32\taskmgr.com

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CATCHME
-------\Service_catchme


((((((((((((((((((((((((( Files Created from 2009-07-08 to 2009-08-08 )))))))))))))))))))))))))))))))
.

2009-08-08 18:54 . 2009-08-08 18:54 -------- d---a-w- c:\windows\system32\runouce.exe
2009-08-08 18:53 . 2009-08-08 18:53 632064 ----a-w- c:\windows\system32\msvcr80.dll
2009-08-08 18:53 . 2009-08-08 18:53 554240 ----a-w- c:\windows\system32\msvcp80.dll
2009-08-08 18:53 . 2009-08-08 18:53 34048 ----a-w- c:\windows\system32\eEmpty.exe
2009-08-08 18:53 . 2008-05-03 12:00 146432 ----a-w- c:\windows\R.COM
2009-08-08 18:53 . 2008-05-03 12:00 135680 ----a-w- c:\windows\system32\T.COM
2009-08-08 18:53 . 2009-08-08 18:53 -------- d-----w- c:\program files\Common Files\MicroWorld
2009-08-08 18:53 . 2009-08-08 18:53 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\MicroWorld
2009-08-08 18:28 . 2009-08-08 18:28 -------- d-----w- C:\Logs
2009-08-08 18:16 . 2008-03-20 18:39 26368 ----a-w- c:\windows\system32\dllcache\usbstor.sys
2009-08-08 16:41 . 2009-08-08 16:41 578560 ----a-w- c:\windows\system32\dllcache\user32.dll
2009-08-08 16:41 . 2009-08-08 16:41 -------- d-----w- c:\windows\ERUNT
2009-08-08 12:10 . 2009-08-08 12:10 -------- d-----w- c:\documents and settings\Administrator\DoctorWeb
2009-08-08 01:06 . 2008-08-08 06:04 545 ----a-w- c:\windows\UC.PIF
2009-08-08 01:06 . 2008-08-08 06:04 545 ----a-w- c:\windows\RAR.PIF
2009-08-08 01:06 . 2008-08-08 06:04 545 ----a-w- c:\windows\PKZIP.PIF
2009-08-08 01:06 . 2008-08-08 06:04 545 ----a-w- c:\windows\PKUNZIP.PIF
2009-08-08 01:06 . 2008-08-08 06:04 545 ----a-w- c:\windows\NOCLOSE.PIF
2009-08-08 01:06 . 2008-08-08 06:04 545 ----a-w- c:\windows\LHA.PIF
2009-08-08 01:06 . 2008-08-08 06:04 545 ----a-w- c:\windows\ARJ.PIF
2009-08-08 00:19 . 2009-08-08 00:19 -------- d-----w- C:\rsit
2009-08-07 20:12 . 2009-02-05 20:06 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-08-07 20:12 . 2009-02-05 20:06 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-08-07 20:12 . 2009-02-05 20:05 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-08-07 20:12 . 2009-02-05 20:08 93296 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-08-07 20:12 . 2009-02-05 20:08 94032 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-08-07 20:12 . 2009-02-05 20:07 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-08-07 20:12 . 2009-02-05 20:07 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-08-07 20:12 . 2009-02-05 20:04 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-08-07 20:11 . 2009-02-05 20:11 1256296 ----a-w- c:\windows\system32\aswBoot.exe
2009-08-07 20:11 . 2003-03-18 19:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2009-08-07 20:11 . 2003-03-18 18:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2009-08-07 20:11 . 2003-02-21 02:42 348160 ----a-w- c:\windows\system32\MSVCR71.dll
2009-08-07 19:03 . 2009-08-08 18:28 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2009-08-07 18:22 . 2009-08-07 18:22 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Opera
2009-08-07 18:20 . 2009-08-07 18:20 0 ----a-w- c:\windows\nsreg.dat
2009-08-07 18:20 . 2009-08-07 18:20 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-08-07 18:09 . 2009-08-07 20:15 -------- d-----w- c:\program files\trend micro
2009-08-07 16:51 . 2009-08-07 16:51 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Google
2009-08-07 16:51 . 2009-08-07 16:51 -------- d-----w- c:\program files\Google
2009-08-07 16:51 . 2009-08-07 16:51 1962544 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2009-08-07 16:51 . 2009-08-07 16:51 1886320 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\NOS\Adobe_Downloads\GoogleToolbarInstaller_en_signed.exe
2009-08-07 16:51 . 2009-08-07 17:20 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\NOS
2009-08-07 16:51 . 2009-08-07 17:07 -------- d-----w- c:\program files\NOS
2009-08-07 16:39 . 2009-08-07 16:39 -------- d-----w- c:\windows\system32\xircom
2009-08-07 16:39 . 2009-08-07 16:39 -------- d-----w- c:\windows\system32\wbem\snmp
2009-08-07 16:39 . 2009-08-07 16:39 -------- d-----w- c:\program files\microsoft frontpage
2009-08-07 16:34 . 2001-08-17 13:59 3072 ----a-w- c:\windows\system32\drivers\audstub.sys
2009-08-07 16:34 . 2008-03-21 01:36 21504 ----a-w- c:\windows\system32\hidserv.dll
2009-08-07 16:33 . 2008-03-20 19:33 57600 ----a-w- c:\windows\system32\drivers\redbook.sys
2009-08-07 16:32 . 2008-03-21 01:36 74240 ----a-w- c:\windows\system32\usbui.dll
2009-08-07 16:30 . 2009-08-07 16:30 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-08-07 16:30 . 2009-08-03 12:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-07 16:30 . 2009-08-07 16:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-07 16:30 . 2009-08-07 16:30 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-08-07 16:30 . 2009-08-03 12:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-07 16:28 . 2006-06-19 03:37 36864 ----a-w- c:\windows\system32\drivers\AmdK8.sys
2009-08-07 16:27 . 2009-08-07 16:27 -------- d-----w- C:\D
2009-08-07 16:27 . 2009-08-07 16:26 -------- d--h--w- c:\documents and settings\Default User.WINDOWS
2009-08-07 16:27 . 2009-08-07 15:38 -------- d-----w- c:\documents and settings\All Users.WINDOWS
2009-08-07 16:20 . 2009-08-07 16:20 -------- d-----w- c:\documents and settings\Administrator\Application Data\Ventrilo
2009-08-07 16:18 . 2009-08-07 16:18 -------- d-----w- c:\windows\system32\Lang
2009-08-07 16:16 . 2008-01-03 14:10 105856 ----a-r- c:\windows\system32\drivers\Rtenicxp.sys
2009-08-07 16:13 . 2008-04-10 08:52 16861184 ------r- c:\windows\RTHDCPL.exe
2009-08-07 16:13 . 2007-06-28 08:44 2165760 ------r- c:\windows\MicCal.exe
2009-08-07 16:13 . 2005-05-03 10:43 69632 ------r- c:\windows\Alcmtr.exe
2009-08-07 16:13 . 2006-05-04 08:26 2808832 ------r- c:\windows\alcwzrd.exe
2009-08-07 16:13 . 2009-08-07 16:13 -------- d-----w- c:\program files\Realtek
2009-08-07 16:12 . 2009-08-07 16:12 315392 ----a-w- c:\windows\HideWin.exe
2009-08-07 16:12 . 2008-03-05 10:07 520192 ------r- c:\windows\RtlExUpd.dll
2009-08-07 16:12 . 2009-08-07 16:12 -------- dc----w- c:\windows\system32\DRVSTORE
2009-08-07 16:12 . 2009-08-07 16:12 -------- d-----w- c:\program files\AMD
2009-08-07 16:11 . 2009-08-07 16:11 -------- d-----w- c:\documents and settings\Administrator\Application Data\InstallShield
2009-08-07 16:11 . 2008-01-10 06:30 442368 ----a-r- c:\windows\system32\nvusmb.exe
2009-08-07 16:11 . 2008-03-06 15:23 442368 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-08-07 16:05 . 2009-08-07 20:13 -------- d-sh--w- c:\windows\Installer
2009-08-07 16:05 . 2009-08-07 21:37 -------- d-----r- C:\Program Files
2009-08-07 16:03 . 2009-08-08 22:41 -------- d-----w- c:\windows\system32\CatRoot2
2009-08-07 16:03 . 2009-08-07 16:03 -------- d-----w- c:\windows\system32\CatRoot
2009-08-07 16:02 . 2009-08-07 16:29 -------- d--h--w- c:\documents and settings\Default User
2009-08-07 16:02 . 2009-08-07 16:04 -------- d-----w- c:\documents and settings\All Users
2009-08-07 16:02 . 2009-08-07 15:40 -------- d-----w- C:\Documents and Settings

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-08 17:25 . 2009-08-08 17:25 4980 ----a-w- c:\windows\system32\drivers\etc.rar
2009-08-08 16:22 . 2009-08-07 15:38 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-08-08 16:22 . 2009-08-07 15:38 2850 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2009-08-07 16:13 . 2009-08-07 15:45 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-07 16:12 . 2009-08-07 15:45 -------- d-----w- c:\program files\Common Files\InstallShield
2009-08-07 15:38 . 2009-08-07 15:38 8738 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

--- c:\windows\system32\nvusmb.exe ---
Company: NVIDIA Corporation
File Description: NVIDIA Uninstaller Utility
File Version: 1 , 3 , 1 , 0
Product Name: NVIDIA Corporation
Copyright: (C) NVIDIA Corporation. All rights reserved.
Original Filename: ------
File size: 442368
Created time: 2009-08-07 16:11
Modified time: 2008-01-10 06:30
MD5: 95F6F5AB023B7696C242EFC07892DA69
SHA1: 2C86A76D882D587CE2E6677BCE9DA57F9B94A88F


------- Sigcheck -------

[-] 2008-05-03 12:00 361344 37D8387CBD4437C55F454209BE10EF11 c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-08-08_16.49.43 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-08 18:16 . 2008-03-20 18:39 26368 c:\windows\system32\drivers\USBSTOR.SYS
+ 2009-08-08 22:42 . 2009-08-08 22:42 8192 c:\windows\ERDNT\subs\Users\00000006\UsrClass.dat
+ 2009-08-08 22:42 . 2009-08-08 22:42 8192 c:\windows\ERDNT\subs\Users\00000004\UsrClass.dat
+ 2009-08-08 22:42 . 2009-08-08 22:42 8192 c:\windows\ERDNT\subs\Users\00000002\UsrClass.dat
+ 2009-08-08 22:42 . 2009-08-08 22:42 266240 c:\windows\ERDNT\subs\Users\00000005\NTUSER.DAT
+ 2009-08-08 22:42 . 2009-08-08 22:42 913408 c:\windows\ERDNT\subs\Users\00000003\NTUSER.DAT
+ 2009-08-08 22:42 . 2009-08-08 22:42 266240 c:\windows\ERDNT\subs\Users\00000001\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [8/7/2009 9:12 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [8/7/2009 9:12 PM 20560]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-08 23:43
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(704)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
d:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-08-08 23:44 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-08 22:44
ComboFix2.txt 2009-08-08 16:50
ComboFix3.txt 2009-08-07 21:30

Pre-Run: 22 354 636 800 bytes free
Post-Run: 22 401 839 104 bytes free

210

[Cerb]

A co tenhle navod http://www.myantispyware.com/2007/11/06 ... nschanger/ nepomohl by ti v nem nejak ty rady uz jsem to predtim jeste pred reinstalem zkousel ale nepomohlo to neexistuje nejake treba i drasticke reseni napr. uplne nejaky kompletni format disku ktery by smazal vsechno i stim otravnym virem proste udelal bych cokoli abych se toho zbavil uz jsem i uvazoval ze si koupim novy harddisk.Uz je to 3 dny co mi radis jak na to obdivuju tvoji trpelivost a taky ti za to moc diky .Pokracuje to nase snazeni aspon dobre nebo porad stojime na mrtvem bode?

[Damned]

Ted čtu asi dvacátej návod. Skoro Všechny vychází z rootkita TDSSserv.sys. Jenže ty tam ani podle RSIT, ani podle ComboFixu nemáš ani jeden ze souborů, které vytváří, nebo ho způsobují.
Prohlídl jsem celý sken MWAV, a ani jedna součást co označil ???? (Když nezná, nebo neodpovídá verzi co zná MWAV) není nikde jako parazit.
*****************************************************************************************************************************************
Stáhni si HostsXpert
- rozbal tento program do vlastní složky/adresáře a spusť ho:
- pak klikni na tlačítko Restore MS Hosts File (plocha napravo nesmí být šedá a na prvním tlačítku musí být napsaná tato volba )
- vyskočí ti hláška na potvrzení, klikni na OK
- pokud by ti program vyhodil chybovou hlášku: ERROR: Cannot create file C:\WINDOWS\system32\DRIVERS\ETC\hosts
tak klikni tlačítko Make Writeable? a pak teprve klikni na tlačítko Restore MS Hosts File
- po proběhnutí pak klikni na tlačítko Make ReadOnly?
- ukončí program a restartuj Pc
*****************************************************************************************************************************************
Stáhni si GMER. Rozbal ho na Plochu a spusť ho. Automaticky se rozběhne úvodní sken. Po skončení vpravo dole "Save..." a zkopíruj mi sem log.
Pokud ti poví, že našel rootkita, klikni na NO.
Zaškrtni v pravé části Všechny políčka, včetně ADS a všech disků co máš a spusť ho tlačítkem "Scan".
Po skončení mi sem opět dej log.
*****************************************************************************************************************************************
Červené soubory zkontroluj na Virustotalu a vlož sem odkaz na výsledek.
Pokud ho nenajdeš, dej si zobrazit skryté a systémové soubory. Pokud ti nabídne, že soubor už kontroloval,
nech ho zkontrolovat znovu, a počkej až se objeví "Dokončeno" a výsledek.Potom sem zkopíruj adresní řádek.

C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\alg.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe

[Cerb]

Podle virus totalu ani jeden soubor co jsem mel zkontrolovat nebyl infikovany.

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-08-09 11:45:34
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xAE0776B8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xAE077574]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xAE077A52]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xAE07714C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xAE07764E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xAE07708C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xAE0770F0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xAE07776E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xAE07772E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xAE0778AE]

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\services.exe[744] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00380002
IAT C:\WINDOWS\system32\services.exe[744] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 00380000

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

---- EOF - GMER 1.0.15 ----

wscntfy
File size: 13824 bytes
MD5...: 142c8ec82139c554f3c9bf4c2dd8692d
SHA1..: 036bce5b536ab1eb39fa6e256a6d8344bca642ff
SHA256: aa071fbc4c503774170a28c4daebe9a13b83d3a1ebbb10d1c13c0d8700419472
ssdeep: 192:JhOvF5FnNbUW94QtMXREaELt2y1PT6zu7R3bolyk+gahQQMnvLAIguynlm8W
DAPE:7wvnNQWzk5ELt7P/hkQqLdeTWkPW/

PEiD..: -
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x27f2
timedatestamp.....: 0x47e26e21 (Thu Mar 20 14:01:05 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x27e0 0x2800 6.16 2ff3063344a58ef1d0f9ac7ad9e940a3
.data 0x4000 0x6c 0x200 0.62 a46ea3afddd245a4720f45eb859ddfbf
.rsrc 0x5000 0x6e0 0x800 3.99 75f5f7ac86956fda9205c6b9376fd723

( 5 imports )
> msvcrt.dll: __p__commode, __p__fmode, __set_app_type, _except_handler3, _controlfp, _adjust_fdiv, __setusermatherr, _initterm, __wgetmainargs, _wcmdln, exit, _cexit, _XcptFilter, _exit, _c_exit
> KERNEL32.dll: GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, GetUserDefaultUILanguage, GetLocaleInfoW, CreateProcessW, GetProcessHeap, HeapFree, HeapAlloc, LoadLibraryExW, GetStartupInfoW, GetModuleHandleA, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetLastError, CreateMutexW, CloseHandle, FormatMessageW, CreateEventW, GetCurrentProcessId
> USER32.dll: PeekMessageW, DispatchMessageW, MsgWaitForMultipleObjects, RegisterWindowMessageW, LoadStringW, LoadImageW, PostQuitMessage, PostMessageW, DestroyMenu, TrackPopupMenu, SetMenuDefaultItem, SetMenuItemInfoW, AppendMenuW, CreatePopupMenu, SetForegroundWindow, GetCursorPos, DefWindowProcW, CreateWindowExW, LoadCursorW, LoadIconW, ShowWindow, RegisterClassExW
> SHELL32.dll: SHGetFolderPathW, ShellExecuteW, Shell_NotifyIconW
> RPCRT4.dll: RpcBindingFromStringBindingW, RpcStringBindingComposeW, RpcBindingFree, RpcSsDestroyClientContext, NdrClientCall2, RpcStringFreeW

( 0 exports )

PDFiD.: -
RDS...: NSRL Reference Data Set
-

alg
File size: 44544 bytes
MD5...: 1e90b499478527ebf6349cc86413a9a1
SHA1..: c2122b1fe2582e32ad83c47ab969d8d90a68308a
SHA256: 364c73cabf058fc3ef48700ce34c8464a1f97e3a35dd147432cfa956dbc09d2b
ssdeep: 768:JDrYRshvXDMFvm59eQ/hAsr2Zbzf2y2H3:JDrRvX0vm5bKZbCy2H3

PEiD..: -
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x5bc6
timedatestamp.....: 0x47e2710a (Thu Mar 20 14:13:30 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x8806 0x8a00 6.13 92220c8a55436091adbb9ddd02954ae6
.data 0xa000 0x320 0x200 2.85 ca52308e532d327e469e1a9721bd1bbc
.rsrc 0xb000 0x1c08 0x1e00 5.27 7ec7719c6cfced8f4a8ab56f7d56766b

( 8 imports )
> msvcrt.dll: _adjust_fdiv, __p__commode, __p__fmode, memmove, _wcsicmp, __setusermatherr, _initterm, __wgetmainargs, _wcmdln, exit, _cexit, _XcptFilter, _exit, _c_exit, _purecall, __CxxFrameHandler, __2@YAPAXI@Z, __set_app_type, _except_handler3, __dllonexit, _onexit, _controlfp, isdigit, __3@YAXPAX@Z
> ATL.DLL: -, -, -, -, -, -
> ADVAPI32.dll: RegOpenKeyExW, RegEnumKeyExW, RegQueryValueExW, StartServiceCtrlDispatcherW, RegNotifyChangeKeyValue, RegisterServiceCtrlHandlerW, SetServiceStatus, RegCloseKey, SystemFunction036
> KERNEL32.dll: GetStartupInfoW, GetModuleHandleA, CreateThread, UnhandledExceptionFilter, TerminateProcess, GetSystemTimeAsFileTime, CreateTimerQueueTimer, ReadFile, GetCurrentProcessId, WriteFile, BindIoCompletionCallback, UnregisterWait, RegisterWaitForSingleObject, HeapAlloc, DeleteTimerQueueTimer, GetProcessHeap, HeapFree, DuplicateHandle, GetCurrentProcess, QueryPerformanceCounter, GetTickCount, SetUnhandledExceptionFilter, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, GetLastError, CreateTimerQueue, DeleteCriticalSection, InterlockedIncrement, InterlockedDecrement, DeleteTimerQueueEx, CloseHandle, Sleep, WaitForMultipleObjects, CreateEventW, WaitForSingleObject, SetEvent, GetCurrentThreadId
> ole32.dll: CoCreateInstance, CoTaskMemFree, CoTaskMemAlloc, CoUninitialize, CoInitializeEx, CLSIDFromString
> OLEAUT32.dll: -, -
> WSOCK32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> WS2_32.dll: WSAEnumNetworkEvents, WSAConnect, WSAEventSelect, WSASocketW

( 0 exports )

PDFiD.: -
RDS...: NSRL Reference Data Set
-

spoolsv
File size: 57856 bytes
MD5...: 037b1c61e298180a43a6401a6d12bd76
SHA1..: c4f5cdf3356ac2620cefb2d2654f8137c563b6a8
SHA256: bdd2da4654858f0f8b527722fcf669ef02818dc933d6104552dbc104850e411c
ssdeep: 768:bE4EVpgSavIlAMm1yMvsCeq+H8O+j8f1b1mDV3D+JMG/dXuEJigo:KgSplAM
mxUC/OUVIE1go

PEiD..: -
TrID..: File type identification
Win64 Executable Generic (59.6%)
Win32 Executable MS Visual C++ (generic) (26.2%)
Win32 Executable Generic (5.9%)
Win32 Dynamic Link Library (generic) (5.2%)
Generic Win/DOS Executable (1.3%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x461b
timedatestamp.....: 0x47e277b7 (Thu Mar 20 14:41:59 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xba70 0xbc00 5.96 ca1842e0cdc19607595bf14dc8a2e169
.data 0xd000 0x13b4 0x1400 2.24 887444c39cada5bd753c428783e0009b
.rsrc 0xf000 0xc68 0xe00 6.18 6dc55158ba4fb73e8d72e4530bcde4ad

( 6 imports )
> ADVAPI32.dll: SetServiceStatus, RegQueryValueExW, AllocateAndInitializeSid, FreeSid, InitializeSecurityDescriptor, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, GetLengthSid, InitializeAcl, AddAccessAllowedAce, AddAccessDeniedAce, GetAce, SetSecurityDescriptorDacl, GetSecurityDescriptorLength, MakeSelfRelativeSD, RegDisablePredefinedCache, RegOpenKeyExW, RegCloseKey, RegisterServiceCtrlHandlerExW, StartServiceCtrlDispatcherW
> GDI32.dll: bMakePathNameW, GdiInitSpool, GdiGetSpoolMessage
> KERNEL32.dll: GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, GetCurrentProcessId, SetUnhandledExceptionFilter, GetModuleHandleA, GetCurrentThreadId, GetTickCount, UnhandledExceptionFilter, QueryPerformanceCounter, FreeLibrary, InterlockedExchange, GetModuleHandleW, GetLastError, ExitThread, CloseHandle, WaitForSingleObject, CreateEventW, CreateThread, ExitProcess, Sleep, OpenEventW, LoadLibraryA, InitializeCriticalSection, LocalFree, LocalAlloc, SetEvent, LeaveCriticalSection, EnterCriticalSection, SetLastError, OpenProcess, InterlockedIncrement, RaiseException, InterlockedDecrement, GetProcAddress, GetSystemDirectoryW
> msvcrt.dll: __initenv, _exit, __getmainargs, _initterm, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, _controlfp, _XcptFilter, wcsrchr, wcslen, _c_exit, _stricmp, _wcsnicmp, _except_handler3
> ntdll.dll: RtlValidRelativeSecurityDescriptor
> RPCRT4.dll: RpcServerRegisterIf2, I_RpcBindingIsClientLocal, I_RpcSessionStrictContextHandle, RpcRaiseException, RpcImpersonateClient, RpcRevertToSelf, NdrServerCall2, RpcServerUseProtseqEpA, I_RpcSsDontSerializeContext, RpcMgmtSetServerStackSize, RpcServerListen

( 12 exports )
YDriverUnloadComplete, YEndDocPrinter, YFlushPrinter, YGetPrinter, YGetPrinterDriver2, YGetPrinterDriverDirectory, YReadPrinter, YSeekPrinter, YSetJob, YSetPort, YSplReadPrinter, YWritePrinter

PDFiD.: -
RDS...: NSRL Reference Data Set
-

svchost
File size: 14336 bytes
MD5...: 0b3290fb3815f5f6553e198642bb7e07
SHA1..: a65b544e67a74f5ff02f69d024d51c838bb7e424
SHA256: b96833dd40d07d88862772c686f7161d7dbbec20128d930c9fb427eb3d4413eb
ssdeep: 384:XDvi+JmG6yqlCRaJt4RHS5LutGJae7g9VAqnpWCZbW:XNcG6xlCRaJKGOA7c
7

PEiD..: -
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x2509
timedatestamp.....: 0x47e276a8 (Thu Mar 20 14:37:28 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2c00 0x2c00 6.29 f057656fa23ab728c966aee2c047f315
.data 0x4000 0x210 0x200 1.62 cbd504e46c836e09e8faabdcfbabaec2
.rsrc 0x5000 0x408 0x600 2.51 102650c99a5eb54a9698354192ccd55f

( 4 imports )
> ADVAPI32.dll: RegQueryValueExW, SetSecurityDescriptorDacl, SetEntriesInAclW, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, InitializeSecurityDescriptor, GetTokenInformation, OpenProcessToken, OpenThreadToken, SetServiceStatus, RegisterServiceCtrlHandlerW, RegCloseKey, RegOpenKeyExW, StartServiceCtrlDispatcherW
> KERNEL32.dll: HeapFree, GetLastError, WideCharToMultiByte, lstrlenW, LocalFree, GetCurrentProcess, GetCurrentThread, GetProcAddress, LoadLibraryExW, LeaveCriticalSection, HeapAlloc, EnterCriticalSection, LCMapStringW, FreeLibrary, lstrcpyW, ExpandEnvironmentStringsW, lstrcmpiW, ExitProcess, GetCommandLineW, InitializeCriticalSection, GetProcessHeap, SetErrorMode, SetUnhandledExceptionFilter, RegisterWaitForSingleObject, InterlockedCompareExchange, LoadLibraryA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, UnhandledExceptionFilter, LocalAlloc, lstrcmpW, DelayLoadFailureHook
> ntdll.dll: NtQuerySecurityObject, RtlFreeHeap, NtOpenKey, wcscat, wcscpy, RtlAllocateHeap, RtlCompareUnicodeString, RtlInitUnicodeString, RtlInitializeSid, RtlLengthRequiredSid, RtlSubAuthoritySid, NtClose, RtlSubAuthorityCountSid, RtlGetDaclSecurityDescriptor, RtlQueryInformationAcl, RtlGetAce, RtlImageNtHeader, wcslen, RtlUnhandledExceptionFilter, RtlCopySid
> RPCRT4.dll: RpcServerUnregisterIfEx, RpcMgmtWaitServerListen, RpcMgmtSetServerStackSize, RpcServerUnregisterIf, RpcServerListen, RpcServerUseProtseqEpW, RpcServerRegisterIf, I_RpcMapWin32Status, RpcMgmtStopServerListening

( 0 exports )

PDFiD.: -
RDS...: NSRL Reference Data Set
-

[Damned]

Start--> > Spustit a do řádku vlož celý tento řádek:

Kód: Vybrat vše

regedit /e "c:\regla.txt" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run"

Klikni na OK.
V "C:\" se ti objeví texťák "regla.txt", zkopíruj mi ho sem.
****************************************************************************************************************************************
Start--> > Spustit a do řádku vlož celý tento řádek:

Kód: Vybrat vše

regedit /e "c:\regl.txt" "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run"

Klikni na OK.
V "C:\" se ti objeví texťák "regl.txt", zkopíruj mi ho sem.
*****************************************************************************************************************************************

Ještě vydrž, poslal jsem to ke konzultaci.