nno zacina to byt zaujimave.. Po spusteni GMERu mi to hned vybehla hlaska na ten rootkit - postupovl som podla pokynov, ale aj tak mi ca. po minute nabehla hlaska WIN, ze program GMER prestal pracovat a musi byt ukonceny. Nesledne modra obrazovka s chybovym hlasenim a restart systemu. Toto som absolvoval 3x, pricom vsetky programy co sa dali som povypinal... Prikladam aj zobrazenie podrobnosti chyboveho hlasenia.
Takze som spustil len DDS - ten zbehol bez problemov. Logy prikladam.
Hlasenie WIN po predcasnom ukonceni GMERu:
Podpis problému:
Název události problému: BlueScreen
Verze operačního systému: 6.0.6002.2.2.0.768.3
ID národního prostředí: 1029
Další informace o problému:
BCCode: 50
BCP1: A24D8000
BCP2: 00000000
BCP3: 8E1EFD3D
BCP4: 00000000
OS Version: 6_0_6002
Service Pack: 2_0
Product: 768_1
Soubory umožňující popis problému:
C:\Windows\Minidump\Mini123109-02.dmp
C:\Users\tpd\AppData\Local\Temp\WER-53461-0.sysdata.xml
C:\Users\tpd\AppData\Local\Temp\WER270.tmp.version.txt
Přečtěte si prohlášení o zásadách ochrany osobních údajů:
http://go.microsoft.com/fwlink/?linkid= ... cid=0x0405Attach-file:
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-12-01.01)
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 13.2.2008 22:49:01
System Uptime: 31.12.2009 11:03:49 (0 hours ago)
Motherboard: Quanta | | 30D2
Processor: Intel(R) Core(TM)2 Duo CPU T5450 @ 1.66GHz | U2E1 | 1667/667mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 140 GiB total, 22,455 GiB free.
D: is FIXED (NTFS) - 9 GiB total, 2,089 GiB free.
E: is CDROM ()
==== Disabled Device Manager Items =============
Class GUID: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Description: HP Photosmart C4500
Device ID: ROOT\IMAGE\0000
Manufacturer: Hewlett-Packard
Name: HP Photosmart C4500
PNP Device ID: ROOT\IMAGE\0000
Service: StillCam
Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}
Description: Photosmart C4500 series
Device ID: ROOT\MULTIFUNCTION\0000
Manufacturer: HP
Name: Photosmart C4500 series
PNP Device ID: ROOT\MULTIFUNCTION\0000
Service:
==== System Restore Points ===================
==== Installed Programs ======================
32 Bit HP CIO Components Installer
AAA Logo 2009 Home Edition 3.0 Free Trial
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe AIR
Adobe Anchor Service CS4
Adobe Bridge CS4
Adobe CMaps CS4
Adobe Color EU Extra Settings CS4
Adobe Color JA Extra Settings CS4
Adobe Color NA Recommended Settings CS4
Adobe CSI CS4
Adobe Default Language CS4
Adobe Device Central CS4
Adobe Drive CS4
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS4
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Fonts All
Adobe Illustrator 10 Tryout
Adobe Illustrator CS4
Adobe InDesign CS4
Adobe InDesign CS4 Application Feature Set Files (Roman)
Adobe InDesign CS4 Common Base Files
Adobe InDesign CS4 Icon Handler
Adobe Linguistics CS4
Adobe Media Player
Adobe Output Module
Adobe PDF Library Files CS4
Adobe Photoshop CS
Adobe Reader 8 - Czech
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe SGM CS4
Adobe Shockwave Player
Adobe Shockwave Player 11.5
Adobe SING CS4
Adobe SVG Viewer 3.0
Adobe Type Support CS4
Adobe Update Manager CS4
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS4
AdobeColorCommonSetCMYK
AdobeColorCommonSetRGB
Amazon MP3 Downloader 1.0.3
Apple Mobile Device Support
Apple Software Update
Asistent pro přihlášení ke službě Windows Live
AuthenTec Fingerprint Sensor Minimum Install
avast! Antivirus
Balík Compatibility Pack pre systém Office 2007
Balíček ovladače systému Windows - MobileTop (sshpmdm) Modem (02/23/2007 2.5.0.0)
Balíček ovladače systému Windows - MobileTop (sshpusb) USB (02/23/2007 2.5.0.0)
Balíček ovladače systému Windows - Nokia pccsmcfd (10/12/2007 6.85.4.0)
BS.Player FREE
CCleaner
Connect
CyberLink YouCam
DigitalPersona Personal 3.0.0
DVD Suite
ESU for Microsoft Vista
Free Audio CD Burner version 1.2
Free Studio version 4.2
Free Video to Flash Converter version 4.1
Free Video to Mp3 Converter version 3.1
Free YouTube to iPod Converter version 3.1
Free YouTube to MP3 Converter version 3.2
Google Earth
Google Chrome
Google Talk Plugin
Google Toolbar for Internet Explorer
Hauppauge MCE XP/Vista Software Encoder (2.0.25149)
Hewlett-Packard Active Check
Hewlett-Packard Asset Agent for Health Check
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Customer Experience Enhancements
HP Doc Viewer
HP Easy Setup - Frontend
HP Help and Support
HP Integrated Module with Bluetooth wireless technology 6.0.1.5500
HP Photosmart C4500 All-In-One Driver 12.0 Rel .4
HP Quick Launch Buttons 6.30 E1
HP QuickPlay 3.6
HP QuickTouch 1.00 C4
HP Update
HP User Guides 0087
HP Wireless Assistant
ICQ6.5
Intel® Matrix Storage Manager
iTunes
Java(TM) 6 Update 2
kuler
LabelPrint
LightScribe System Software 1.10.13.1
Môj CEWE Fotosvet
Microsoft .NET Framework 3.5 Language Pack SP1 - csy
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 – jazyková sada – CSY
Microsoft Office 2000 Professional
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Motorola SM56 Data Fax Modem
MSCU for Microsoft Vista
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
neroxml
Network
Nástroj pro odesílání služby Windows Live
NVIDIA Drivers
PC Connectivity Solution
PDF Settings CS4
Photoshop Camera Raw
Power2Go
PowerDirector
PS_AIO_04_C4580_Software_Min
QuickPlay SlingPlayer 0.4.4
QuickTime
Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
Realtek High Definition Audio Driver
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
SAMSUNG Mobile Composite Device Software
Samsung Mobile Modem Device Software
SAMSUNG Mobile Modem Driver Set
Samsung Mobile phone USB driver Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung New PC Studio
Samsung New PC Studio USB Driver Installer
SAMSUNG PC Share Manager
SAMSUNG USB Mobile Device Software
SamsungConnectivityCableDriver
Scan
Skype™ 3.8
Slovník EN-SK
Spybot - Search & Destroy
Suite Shared Configuration CS4
Synaptics Pointing Device Driver
Toolbox
TuneUp Utilities 2009
Uninstall 1.0.0.1
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
vixy converter uninstall
WaterWorks (Sorted)
Winamp (remove only)
Windows Live Sync
WinRAR archivátor
Zoner Photo Studio 10
==== End Of File ===========================
DDS-file:
DDS (Ver_09-12-01.01) - NTFSx86
Run by tpd at 11:07:49,20 on źt 31.12.2009
Internet Explorer: 8.0.6001.18865
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.2046.1281 [GMT 1:00]
AV: avast! antivirus 4.8.1290 [VPS 081121-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: Spybot - Search and Destroy *enabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: avast! antivirus 4.8.1290 [VPS 081121-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\DigitalPersona\Bin\DpHostW.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\FsUsbExService.Exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
C:\Program Files\DigitalPersona\Bin\DpAgent.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\TUProgSt.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\iashost.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\tpd\Desktop\dds.scr
C:\Windows\system32\conime.exe
============== Pseudo HJT Report ===============
uStart Page =
hxxp://www.google.com/uSearch Page =
uSearch Bar =
mStart Page =
hxxp://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptopmDefault_Page_URL =
hxxp://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptopuURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
uURLSearchHooks: H - No File
BHO: Podpora odkazu pro Adobe PDF Reader: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
BHO: Pomocník pro přihlášení ke službě Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
TB: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No File
TB: iMesh MediaBar: {b7d3e479-cc68-42b5-a338-938ece35f419} -
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
TB: {EEE6C35B-6118-11DC-9C72-001320C79847} - No File
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
mRun: [DpAgent] c:\program files\digitalpersona\bin\dpagent.exe
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Send image to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: WikiKomentáře Google... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {E59EB121-F339-4851-A3BA-FE49C35617C2} - c:\program files\icq6.5\ICQ.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} -
hxxp://download.eset.com/special/eos/OnlineScanner.cabDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} -
hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cabDPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} -
hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -
hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cabDPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} -
hxxp://fpdownload2.macromedia.com/get/s ... wflash.cabTCP: {4C9B5CBD-E035-4A78-8014-BCB4721F2096} = 192.168.1.1
TCP: {4DFA776A-027C-413D-A84B-81658F00062B} = 208.67.220.220,208.67.222.222
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
LSA: Notification Packages = scecli DPPWDFLT
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
============= SERVICES / DRIVERS ===============
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-6-22 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-6-22 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2008-6-22 53328]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2008-8-3 138680]
R2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-12-17 233472]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2008-8-3 254040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2008-8-3 352920]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2009-12-17 36608]
S3 FontCache;Mezipaměť písem Windows;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-8-3 21504]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\drivers\ss_bbus.sys [2009-12-17 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\drivers\ss_bmdfl.sys [2009-12-17 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\drivers\ss_bmdm.sys [2009-12-17 121856]
S3 WiselinkPro;SAMSUNG WiselinkPro Service;c:\program files\samsung\samsung pc share manager\WiselinkPro.exe [2009-1-8 4136960]
S3 WSDPrintDevice;Podpora tisku WSD prostřednictvím funkce UMB;c:\windows\system32\drivers\WSDPrint.sys [2008-8-3 16896]
=============== Created Last 30 ================
2009-12-31 09:39:27 234965237 ----a-w- c:\windows\MEMORY.DMP
2009-12-27 14:49:25 0 d---a-w- c:\windows\VDLL.DLL
2009-12-27 14:49:25 0 d---a-w- c:\windows\system32\runouce.exe
2009-12-27 14:49:25 0 d---a-w- c:\windows\rundll16.exe
2009-12-27 14:49:25 0 d---a-w- c:\windows\RUNDL132.EXE
2009-12-27 14:49:25 0 d---a-w- c:\windows\logo1_.exe
2009-12-27 14:49:25 0 d---a-w- c:\windows\logo_1.exe
2009-12-27 14:45:01 54 ----a-w- c:\windows\Lic.xxx
2009-12-27 14:44:15 632064 ----a-w- c:\windows\system32\msvcr80.dll
2009-12-27 14:44:14 554240 ----a-w- c:\windows\system32\msvcp80.dll
2009-12-27 14:44:13 522 ----a-w- c:\windows\system32\Microsoft.VC80.CRT.manifest
2009-12-27 14:44:13 34048 ----a-w- c:\windows\system32\eEmpty.exe
2009-12-27 14:44:08 0 d-----w- c:\program files\common files\MicroWorld
2009-12-27 14:44:07 0 d-----w- c:\programdata\MicroWorld
2009-12-24 19:42:18 714752 ----a-w- c:\windows\system32\drivers\kufwysj.sys
2009-12-17 20:42:08 0 d-----w- c:\program files\MarkAny
2009-12-17 00:40:21 0 d-----w- c:\programdata\PC Suite
2009-12-17 00:38:21 90624 ----a-w- c:\windows\system32\nmwcdcls.dll
2009-12-17 00:38:18 21632 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2009-12-17 00:38:00 14976 ----a-w- c:\windows\system32\drivers\ss_bmdfl.sys
2009-12-17 00:38:00 121856 ----a-w- c:\windows\system32\drivers\ss_bmdm.sys
2009-12-17 00:38:00 12160 ----a-w- c:\windows\system32\drivers\ss_bcmnt.sys
2009-12-17 00:38:00 12160 ----a-w- c:\windows\system32\drivers\ss_bcm.sys
2009-12-17 00:37:59 90112 ----a-w- c:\windows\system32\drivers\ss_bbus.sys
2009-12-17 00:37:59 12160 ----a-w- c:\windows\system32\drivers\ss_bwhnt.sys
2009-12-17 00:37:59 12160 ----a-w- c:\windows\system32\drivers\ss_bwh.sys
2009-12-17 00:37:31 0 d-----w- c:\windows\system32\Samsung_USB_Drivers
2009-12-17 00:36:25 36608 ----a-w- c:\windows\system32\FsUsbExDisk.Sys
2009-12-17 00:36:25 233472 ----a-w- c:\windows\system32\FsUsbExService.Exe
2009-12-17 00:36:25 110592 ----a-w- c:\windows\system32\FsUsbExDevice.Dll
2009-12-17 00:36:08 0 d-----w- c:\users\tpd\appdata\roaming\Samsung
2009-12-17 00:35:35 0 d-----w- c:\program files\PC Connectivity Solution
2009-12-11 22:51:02 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-12-11 22:50:54 411648 ----a-w- c:\windows\system32\drivers\http.sys
2009-12-11 22:50:53 30720 ----a-w- c:\windows\system32\httpapi.dll
2009-12-11 06:00:05 0 d-----w- c:\program files\Windows Portable Devices
2009-12-11 05:58:56 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-12-10 23:33:38 81920 ----a-w- c:\windows\system32\wpdbusenum.dll
2009-12-10 23:32:33 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2009-12-10 23:32:33 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2009-12-10 23:32:33 234496 ----a-w- c:\windows\system32\oleacc.dll
2009-12-09 20:23:35 0 d-----w- c:\windows\system32\eu-ES
2009-12-09 20:23:35 0 d-----w- c:\windows\system32\ca-ES
2009-12-09 20:23:34 0 d-----w- c:\windows\system32\vi-VN
2009-12-09 19:52:13 0 d-----w- c:\windows\system32\EventProviders
2009-12-05 09:38:49 0 d-----w- c:\program files\TuneUp Utilities 2009
2009-12-05 07:50:52 0 d-----w- c:\program files\CCleaner
==================== Find3M ====================
2009-12-31 09:56:26 6396 ----a-w- c:\windows\bthservsdp.dat
2009-12-31 09:47:26 598838 ----a-w- c:\windows\system32\perfh005.dat
2009-12-31 09:47:26 115014 ----a-w- c:\windows\system32\perfc005.dat
2009-12-28 16:36:49 51200 ----a-w- c:\windows\inf\infpub.dat
2009-12-28 16:36:49 143360 ----a-w- c:\windows\inf\infstrng.dat
2009-12-17 00:43:48 143360 ----a-w- c:\windows\inf\infstor.dat
2009-12-11 05:59:35 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-12-09 20:04:37 37665 ----a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont
2009-12-05 09:40:23 603904 ----a-w- c:\windows\system32\TUProgSt.exe
2009-12-05 09:40:07 360192 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-11-21 06:40:20 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-21 06:34:39 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-11-21 06:34:39 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-11-21 04:59:58 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-18 17:35:19 60884 ----a-w- c:\windows\fonts\Pristina LET Plain_1.0.ttf
2009-11-18 17:33:48 76824 ----a-w- c:\windows\fonts\Pristina.ttf
2009-11-02 19:42:06 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-29 09:17:42 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-07 11:36:36 243712 ----a-w- c:\windows\system32\rastls.dll
2008-09-20 11:27:27 706536 ----a-w- c:\program files\setup_Moj_CeWe_Fotosvet.exe
2008-09-04 21:17:37 174 --sha-w- c:\program files\desktop.ini
2008-04-23 10:22:38 18391162 ----a-w- c:\program files\waterworks_sorted.exe
2007-11-28 10:43:55 34724 ----a-w- c:\windows\inf\perflib\0405\perfd.dat
2007-11-28 10:43:55 34724 ----a-w- c:\windows\inf\perflib\0405\perfc.dat
2007-11-28 10:43:55 286912 ----a-w- c:\windows\inf\perflib\0405\perfi.dat
2007-11-28 10:43:55 286912 ----a-w- c:\windows\inf\perflib\0405\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2008-06-20 22:07:17 22 --sha-w- c:\windows\sminst\HPCD.sys
============= FINISH: 11:09:06,50 ===============
Takze sa mi to s tym GMERom predsa len podarilo - pripajam LOG c. 2 (scenovanie po hlaseni rootkotu):
GMER 1.0.15.15281 -
http://www.gmer.netRootkit scan 2009-12-31 12:12:14
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\tpd\AppData\Local\Temp\uwldipow.sys
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 86A20C70
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
Device \Driver\BTHUSB \Device\00000079 bthport.sys (Ovladač sběrnice Bluetooth/Microsoft Corporation)
AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
Device \Driver\BTHUSB \Device\0000007b bthport.sys (Ovladač sběrnice Bluetooth/Microsoft Corporation)
---- Services - GMER 1.0.15 ----
Service (*** hidden *** ) [BOOT] kufwysj <-- ROOTKIT !!!
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001e37a95d91
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001e37a95d91@001e3a4bc6f3 0xB3 0xFC 0x4C 0xE8 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001e37a95d91@0018afcfc1c1 0x69 0xDF 0xAC 0xDC ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001e37a95d91@00119f557663 0xA2 0x4B 0x96 0xBB ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001e37a95d91@002186e9c9de 0xBF 0x2A 0xB6 0x50 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001e37a95d91@a00798413a3a 0xE7 0x04 0xDE 0x75 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\kufwysj@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\kufwysj@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\kufwysj@ErrorControl 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\kufwysj@Group Boot Bus Extender
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001e37a95d91 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001e37a95d91@001e3a4bc6f3 0xB3 0xFC 0x4C 0xE8 ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001e37a95d91@0018afcfc1c1 0x69 0xDF 0xAC 0xDC ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001e37a95d91@00119f557663 0xA2 0x4B 0x96 0xBB ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001e37a95d91@002186e9c9de 0xBF 0x2A 0xB6 0x50 ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001e37a95d91@a00798413a3a 0xE7 0x04 0xDE 0x75 ...
Reg HKLM\SYSTEM\ControlSet003\Services\kufwysj@Type 1
Reg HKLM\SYSTEM\ControlSet003\Services\kufwysj@Start 0
Reg HKLM\SYSTEM\ControlSet003\Services\kufwysj@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet003\Services\kufwysj@Group Boot Bus Extender
---- EOF - GMER 1.0.15 ----
