PROSÍM O KONTROLU LOGU

[KOTY.]

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:46:39, on 2.6.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Users\Kocian\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ULBZSQAG\HiJackThis[1].exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: Nakido - Nakido - C:\Program Files\Nakido\nakido.exe
O23 - Service: @C:\Program Files\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files\Nero\Update\NASvc.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Ubersoldier 2 Drivers Auto Removal (pr2anmub) (pr2anmub) - City Interactive Sp z o.o. - C:\Windows\system32\pr2anmub.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

--
End of file - 7963 bytes

[Reklama]

[Žbeky]

Odinstaluj:
Spybot S&D
Mcafee security scan
Daemon tools toolbar
ICQ Toolbar

Nahoď nějaký normální antivir, třeba Avast

Fixni:

Kód: Vybrat vše

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[KOTY.]

Děkuji Ti, jsem začatečník tak mi to bude chvíli trvat, ale snad to zvládnu :)

[KOTY.]

tak tady je ten log...

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Verze databáze: 6798

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

7.6.2011 19:30:58
mbam-log-2011-06-07 (19-30-47).txt

Typ: Rychlá kontrola
Kontrolované objekty: 147097
Uplynulý čas: 5 minut, 8 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 1
Infikované hodnoty v registru: 1
Infikované datové položky v registru: 1
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> No action taken.

Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\bak_Application (Hijacker.Application) -> Value: bak_Application -> No action taken.

Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\Application (Hijacker.Application) -> Bad: (http://www.helpmeopen.com/?n=app&ext=%s) Good: (http://shell.windows.com/fileassoc/%04x ... r.asp?Ext=%s) -> No action taken.

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

[Žbeky]

- Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Nějaké problémy?

[KOTY.]

no těch problémů je víc... noťas reaguje podstatně pomaleji, občas zamrzne nebo nejde rozklikat žádná ikona, potom je nemožný restart musím ho vypnout na tvrdo. jo a někdy se mi samovolně zmnění vzhled win... tím myslím spodní lištu startu... jinak teď mi háže avast pořád že byl nalezen rootkit mbr://./physicaldrive0 doporučeně dám smazat a restartovat a při restartu se mi spustí avast test který mi najde toto:
c:/programdata/avast/arpot/13c9d3-790-0.dat je infikován virem ALUREON-C@MBR (RTK) a možnosti jsou smazat, ignorovat dát do trezoru raději jsem to zatím nechal jak to je než to sem napíšu

[Žbeky]

Stáhni si MBR Rootkit Detektor
- ulož si ho přímo na disk C a spusť ho
- za chvíli se ti vytvoří jeho log (mbr.log) vlož sem celý jeho obsah.

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[KOTY.]

ok hned ráno se na to vrhnu... jinak s tím malwerem je problém ty 3 problémy nejdou odstranit jakmile dám odstranit tak se ten program sekne a píše že neodpovídá... zkoušel jsem víkrát a děje se pořád to samé...

[KOTY.]

tak nakonec se přez mbam podařilo ty 3 problémy odstranit, nicméně nevím kde najdu ten log...

jinak tady je log z mbr:
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.1.7600 Disk: WDC_WD1600BEVT-22ZCT0 rev.11.01A11 -> Harddisk0\DR0 -> \Device\Ide\IdePort0 P0T0L0-0

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
detected disk devices:
\Device\Ide\IdeDeviceP0T0L0-0 -> \??\IDE#DiskWDC_WD1600BEVT-22ZCT0___________________11.01A11#5&1a9f9fc9&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
user != kernel MBR !!!
sectors 312581806 (+255): user != kernel

ale s tím combofixem je taky problém kdykoli ho spustím tak v průběhu testu vyhodí modré okno kde je napsané něco ve stylu dumping physical memory... celé přečíst to nestihnu během 3 vteřin se noťas restartuje... já z toho snad vyrostu

[jaro3]

Log by měl být na systémovém disku nejspíše C:\ombofix.txt

Stáhni si aswMBR:
http://public.avast.com/~gmerek/aswMBR.htm
na svojí plochu.Poklepej na aswMBR.exe. Klikni na Scan.
Po skenu klikni na aswASW.log a ulož si ho na plochu , vlož sem celý obsak toho logu.

+
Stáhni Bootkit Remover

-ulož na plochu
-spusť
- pak klikni do černého okna a zkopíruj sem výsledek, případně dej screen

[KOTY.]

tak ten log z mbam jsem našl přímo v programu ve složce protokolů, ale je jich tady víc tak tady hodím všechny...








Malwarebytes' Anti-Malware 1.51.0.1200
http://www.malwarebytes.org

Verze databáze: 6798

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

7.6.2011 21:22:38
mbam-log-2011-06-07 (21-22-38).txt

Typ: Rychlá kontrola
Kontrolované objekty: 146834
Uplynulý čas: 5 minut, 5 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 1
Infikované hodnoty v registru: 1
Infikované datové položky v registru: 1
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.

Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\bak_Application (Hijacker.Application) -> Value: bak_Application -> Quarantined and deleted successfully.

Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\Application (Hijacker.Application) -> Bad: (http://www.helpmeopen.com/?n=app&ext=%s) Good: (http://shell.windows.com/fileassoc/%04x ... r.asp?Ext=%s) -> Quarantined and deleted successfully.

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)






Malwarebytes' Anti-Malware 1.51.0.1200
http://www.malwarebytes.org

Verze databáze: 6826

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

10.6.2011 16:01:20
mbam-log-2011-06-10 (16-01-20).txt

Typ: Rychlá kontrola
Kontrolované objekty: 0
Uplynulý čas: 7 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)









18:49:13 Kocian MESSAGE Protection started successfully
18:49:19 Kocian MESSAGE IP Protection started successfully
18:51:25 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49507, Process: svchost.exe)
18:51:25 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49508, Process: svchost.exe)
18:51:25 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49509, Process: svchost.exe)
19:22:39 Kocian MESSAGE Protection started successfully
19:22:47 Kocian MESSAGE IP Protection started successfully
19:25:06 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49168, Process: svchost.exe)
19:25:06 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49169, Process: svchost.exe)
19:25:06 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49170, Process: svchost.exe)
19:38:08 Kocian MESSAGE Protection started successfully
19:38:14 Kocian MESSAGE IP Protection started successfully
19:38:59 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49467, Process: svchost.exe)
19:38:59 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49469, Process: svchost.exe)
19:38:59 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49466, Process: svchost.exe)
20:05:06 Kocian MESSAGE Protection started successfully
20:05:11 Kocian MESSAGE IP Protection started successfully
20:05:17 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49174, Process: svchost.exe)
20:05:17 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49175, Process: svchost.exe)
20:05:17 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49176, Process: svchost.exe)
20:15:10 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49189, Process: svchost.exe)
20:15:10 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49190, Process: svchost.exe)
20:15:10 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49191, Process: svchost.exe)
20:43:29 Kocian MESSAGE Protection started successfully
20:43:35 Kocian MESSAGE IP Protection started successfully
20:43:40 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49169, Process: svchost.exe)
20:43:40 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49170, Process: svchost.exe)
20:43:40 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49171, Process: svchost.exe)
20:53:49 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49582, Process: svchost.exe)
20:53:49 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49583, Process: svchost.exe)
20:53:49 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49584, Process: svchost.exe)
21:10:23 Kocian MESSAGE Protection started successfully
21:10:29 Kocian MESSAGE IP Protection started successfully
21:10:58 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49168, Process: svchost.exe)
21:10:58 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49169, Process: svchost.exe)
21:10:58 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49170, Process: svchost.exe)
21:59:15 Kocian MESSAGE Protection started successfully
21:59:21 Kocian MESSAGE IP Protection started successfully
21:59:58 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49168, Process: svchost.exe)
21:59:58 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49169, Process: svchost.exe)
21:59:58 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49170, Process: svchost.exe)
22:10:02 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49840, Process: svchost.exe)
22:10:02 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49841, Process: svchost.exe)
22:10:02 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49842, Process: svchost.exe)
22:18:11 Kocian IP-BLOCK 208.73.210.125 (Type: outgoing, Port: 50021, Process: avastsvc.exe)
22:18:11 Kocian IP-BLOCK 208.73.210.125 (Type: outgoing, Port: 50022, Process: avastsvc.exe)





08:43:21 Kocian MESSAGE Protection started successfully
08:43:27 Kocian MESSAGE IP Protection started successfully
08:43:56 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49173, Process: svchost.exe)
08:43:56 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49174, Process: svchost.exe)
08:43:56 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49175, Process: svchost.exe)
08:53:49 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49196, Process: svchost.exe)
08:53:50 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49197, Process: svchost.exe)
08:53:50 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49198, Process: svchost.exe)
09:08:50 Kocian MESSAGE Protection started successfully
09:08:56 Kocian MESSAGE IP Protection started successfully
09:09:41 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49203, Process: svchost.exe)
09:09:42 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49204, Process: svchost.exe)
09:09:42 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49205, Process: svchost.exe)
09:19:51 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49418, Process: svchost.exe)
09:19:51 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49419, Process: svchost.exe)
09:19:51 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49420, Process: svchost.exe)
09:44:49 Kocian MESSAGE Protection started successfully
09:44:54 Kocian MESSAGE IP Protection started successfully
09:45:32 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49168, Process: svchost.exe)
09:45:32 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49169, Process: svchost.exe)
09:45:32 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49170, Process: svchost.exe)
09:52:41 Kocian MESSAGE IP Protection stopped
10:05:58 Kocian MESSAGE Protection started successfully
10:06:04 Kocian MESSAGE IP Protection started successfully
10:06:10 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49172, Process: svchost.exe)
10:06:10 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49173, Process: svchost.exe)
10:06:10 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49174, Process: svchost.exe)
10:12:23 Kocian MESSAGE Protection started successfully
10:12:29 Kocian MESSAGE IP Protection started successfully
10:12:43 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49200, Process: svchost.exe)
10:12:43 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49201, Process: svchost.exe)
10:12:43 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49202, Process: svchost.exe)
10:15:48 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49406, Process: iexplore.exe)
10:15:48 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49407, Process: iexplore.exe)
10:22:45 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49534, Process: svchost.exe)
10:22:45 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49535, Process: svchost.exe)
10:22:45 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49536, Process: svchost.exe)
12:44:02 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49556, Process: iexplore.exe)
12:44:02 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49558, Process: iexplore.exe)
21:14:29 Kocian MESSAGE Protection started successfully
21:14:35 Kocian MESSAGE IP Protection started successfully
21:14:56 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49173, Process: svchost.exe)
21:14:56 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49174, Process: svchost.exe)
21:14:56 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49175, Process: svchost.exe)
21:22:07 Kocian MESSAGE Protection started successfully
21:22:14 Kocian MESSAGE IP Protection started successfully
21:22:43 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49234, Process: svchost.exe)
21:22:43 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49235, Process: svchost.exe)
21:25:39 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49303, Process: firefox.exe)
21:25:39 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49304, Process: firefox.exe)
21:25:39 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49305, Process: firefox.exe)
21:32:45 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49334, Process: svchost.exe)
21:32:45 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49335, Process: svchost.exe)
21:32:45 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49333, Process: svchost.exe)
21:50:48 Kocian MESSAGE Protection started successfully
21:50:56 Kocian MESSAGE IP Protection started successfully
21:51:31 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49206, Process: svchost.exe)
21:51:31 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49207, Process: svchost.exe)
21:51:31 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49208, Process: svchost.exe)







15:29:56 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49218, Process: svchost.exe)
15:30:12 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49223, Process: firefox.exe)
15:30:12 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49222, Process: firefox.exe)
15:30:12 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49224, Process: firefox.exe)
15:33:36 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49391, Process: svchost.exe)
15:33:36 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49390, Process: svchost.exe)
15:33:36 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49392, Process: svchost.exe)
18:51:20 Kocian MESSAGE Protection started successfully
18:51:26 Kocian MESSAGE IP Protection started successfully
18:51:56 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49234, Process: svchost.exe)
18:51:56 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49235, Process: svchost.exe)
18:51:56 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49236, Process: svchost.exe)
18:54:45 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49255, Process: iexplore.exe)
18:54:45 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49256, Process: iexplore.exe)
19:01:59 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49492, Process: svchost.exe)
19:01:59 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49493, Process: svchost.exe)
19:01:59 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49494, Process: svchost.exe)
20:11:07 Kocian MESSAGE Protection started successfully
20:11:13 Kocian MESSAGE IP Protection started successfully
20:11:58 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49253, Process: svchost.exe)
20:11:58 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49252, Process: svchost.exe)
20:11:58 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49254, Process: svchost.exe)
20:16:07 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49292, Process: firefox.exe)
20:16:07 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49291, Process: firefox.exe)
20:16:07 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49293, Process: firefox.exe)
20:22:02 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49359, Process: svchost.exe)
20:22:02 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49360, Process: svchost.exe)
20:22:02 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49361, Process: svchost.exe)
20:38:48 Kocian MESSAGE Protection started successfully
20:38:54 Kocian MESSAGE IP Protection started successfully
20:39:39 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49200, Process: svchost.exe)
20:39:39 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49201, Process: svchost.exe)
20:39:39 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49202, Process: svchost.exe)
20:42:36 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49229, Process: firefox.exe)
20:42:36 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49230, Process: firefox.exe)
20:42:36 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49231, Process: firefox.exe)
20:49:50 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49275, Process: svchost.exe)
20:49:50 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49276, Process: svchost.exe)
21:08:03 Kocian MESSAGE Protection started successfully
21:08:08 Kocian MESSAGE IP Protection started successfully
21:08:38 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49275, Process: svchost.exe)
21:08:38 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49276, Process: svchost.exe)
21:08:38 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49277, Process: svchost.exe)
21:18:31 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49283, Process: svchost.exe)
21:18:31 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49284, Process: svchost.exe)
21:18:31 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49285, Process: svchost.exe)
22:53:44 Kocian MESSAGE Protection started successfully
22:53:49 Kocian MESSAGE IP Protection started successfully
22:54:19 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49268, Process: svchost.exe)
22:54:19 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49269, Process: svchost.exe)
22:57:08 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49345, Process: firefox.exe)
22:57:08 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49346, Process: firefox.exe)
22:57:08 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49347, Process: firefox.exe)
23:04:22 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49360, Process: svchost.exe)
23:04:22 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49361, Process: svchost.exe)
23:23:27 Kocian MESSAGE Protection started successfully
23:23:35 Kocian MESSAGE IP Protection started successfully
23:24:18 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49260, Process: svchost.exe)
23:24:18 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49261, Process: svchost.exe)
23:24:18 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49262, Process: svchost.exe)
23:27:07 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49267, Process: firefox.exe)
23:27:07 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49268, Process: firefox.exe)
23:34:29 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49281, Process: svchost.exe)
23:34:29 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49282, Process: svchost.exe)
23:34:29 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49283, Process: svchost.exe)






15:54:25 Kocian MESSAGE Protection started successfully
15:54:30 Kocian MESSAGE IP Protection started successfully
15:54:44 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49175, Process: svchost.exe)
15:54:44 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49176, Process: svchost.exe)
15:54:44 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49177, Process: svchost.exe)
15:55:30 Kocian MESSAGE Scheduled update executed successfully
15:58:19 Kocian MESSAGE IP Protection stopped
15:58:22 Kocian MESSAGE Database updated successfully
15:58:25 Kocian MESSAGE IP Protection started successfully
16:04:48 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49750, Process: svchost.exe)
16:04:48 Kocian IP-BLOCK 95.143.193.138 (Type: outgoing, Port: 49751, Process: svchost.exe)







tady je ten log z mbr:

aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
Run date: 2011-06-09 15:40:05
-----------------------------
15:40:05.212 OS Version: Windows 6.1.7600
15:40:05.212 Number of processors: 2 586 0x301
15:40:05.228 ComputerName: KOCIAN-PC UserName: Kocian
15:40:05.914 Initialize success
15:40:09.892 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdePort0
15:40:09.908 Disk 0 Vendor: WDC_WD1600BEVT-22ZCT0 11.01A11 Size: 152627MB BusType: 11
15:40:09.908 Device \Device\Ide\IdeDeviceP0T0L0-0 -> \??\IDE#DiskWDC_WD1600BEVT-22ZCT0___________________11.01A11#5&1a9f9fc9&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} not found
15:40:11.936 Disk 0 MBR read successfully
15:40:11.936 Disk 0 MBR scan
15:40:11.951 Disk 0 TDL4@MBR code has been found
15:40:11.951 Disk 0 Windows 7 default MBR code found via API
15:40:11.967 Disk 0 MBR hidden
15:40:11.983 Disk 0 MBR [TDL4] **ROOTKIT**
15:40:11.983 Disk 0 trace - called modules:
15:40:11.998 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x85b7059f]<<
15:40:11.998 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85b49030]
15:40:12.014 3 CLASSPNP.SYS[8886059e] -> nt!IofCallDriver -> [0x859fc400]
15:40:12.014 5 ACPI.sys[833373b2] -> nt!IofCallDriver -> \IdeDeviceP0T0L0-0[0x859ea908]
15:40:12.029 \Driver\atapi[0x85b49738] -> IRP_MJ_CREATE -> 0x85b7059f
15:40:12.045 Scan finished successfully
16:04:42.038 Disk 0 MBR has been saved successfully to "C:\Users\Kocian\Desktop\MBR.dat"
16:04:42.038 The log file has been saved successfully to "C:\Users\Kocian\Desktop\aswMBR.txt"


nevím jak sem dostat ten screen z toho bootkitu takže by se hodila rada :)

[KOTY.]

jinak se omlouvám za to zdržování... dřív jsem se k tomu nemohl dost...