Zdravim vsechny, potreboval bych help s jednim asi virem (rootkitem).
Nainstaloval jsem si AVG8 a po kompletnim scanu PC mi to vyhodilo, ze v c:\windows\system32\drivers se ukryva rootkit, ktery se maskuje za skrytou systemovou sluzbu. Po odstraneni AVGckem a restartu PC tam je znova, akorat pod jinym nazvem. Napr. auol9nyi.sys a pak bkfmg2xe.
Nevedel by nekdo, jak se toho zbavit? Pravdepodobne tam je jeste nejaky dalsi program, ktery si hlida smazani te sluzby a pak ji tam hodi znovu.
Nevim, jestli prikladat log z HJT, kdyz tak ho tady hodim.
Diky
Nelze odstranit rootkit z PC
Nelze odstranit rootkit z PC
MB: ASUS Striker II Formula, CPU: Intel Core™ 2 Duo 3,16GHz, CPU Cooler: Zalman CNPS8700 LED, RAM: 2x1GB Corsair Dominator 1066 MHz DDR II, GPU: ASUS ATI Radeon HD 5770 DDR3 1GB, HDD: WD CG 500GB SATA 300, HDD2: WD CG 2TB SATA 300, Zdroj: Corsair 650W
-
Pic
- Moderátor
-
Guru Level 13
- Příspěvky: 23292
- Registrován: září 06
- Bydliště: Východní Čechy
- Pohlaví:
- Stav:
Offline
Re: Nelze odstranit rootkit z PC
Vlož log a požádej o kontrolu.
Přečti si pravidla tohoto fóra! Přečetl jsi si nejprve manuál? Piš tak, abychom Ti rozuměli! Na SZ neodpovídám na požadavky řešení Vašich problémů s PC!
Nic není dokonalé, ani člověk!
Nic není dokonalé, ani člověk!
-
richchie
- Master Level 9.5
- Příspěvky: 8738
- Registrován: listopad 06
- Bydliště: ano
- Pohlaví:
- Stav:
Offline
Re: Nelze odstranit rootkit z PC
Samozřejmě log a na vyzkoušení
http://www.slunecnice.cz/sw/f-secure-blacklight/
a novější verze
http://www.f-secure.com/security_center/
http://www.slunecnice.cz/sw/f-secure-blacklight/
a novější verze
http://www.f-secure.com/security_center/
Naposledy upravil(a) richchie dne 19 úno 2009 18:03, celkem upraveno 1 x.
Re: Nelze odstranit rootkit z PC
Log z HJT
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:55:42, on 19.2.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\xampp\apache\bin\apache.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\xampp\mysql\bin\mysqld-nt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\program files\powerstrip\pstrip.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\aaa\Warcraft III\w3dr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\aaa\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\xampp\apache\bin\apache.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox 3 Beta 2\firefox.exe
C:\Documents and Settings\Vasek\Plocha\Downloads\hijackthis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [w3dr.exe] C:\aaa\Warcraft III\w3dr.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apache2.2 - Apache Software Foundation - C:\xampp\apache\bin\apache.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: mysql - Unknown owner - C:\xampp\mysql\bin\mysqld-nt.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\aaa\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
--
End of file - 6233 bytes
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:55:42, on 19.2.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\xampp\apache\bin\apache.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\Explorer.EXE
C:\xampp\mysql\bin\mysqld-nt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\program files\powerstrip\pstrip.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\aaa\Warcraft III\w3dr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\aaa\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\xampp\apache\bin\apache.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox 3 Beta 2\firefox.exe
C:\Documents and Settings\Vasek\Plocha\Downloads\hijackthis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [w3dr.exe] C:\aaa\Warcraft III\w3dr.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apache2.2 - Apache Software Foundation - C:\xampp\apache\bin\apache.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: mysql - Unknown owner - C:\xampp\mysql\bin\mysqld-nt.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\aaa\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
--
End of file - 6233 bytes
MB: ASUS Striker II Formula, CPU: Intel Core™ 2 Duo 3,16GHz, CPU Cooler: Zalman CNPS8700 LED, RAM: 2x1GB Corsair Dominator 1066 MHz DDR II, GPU: ASUS ATI Radeon HD 5770 DDR3 1GB, HDD: WD CG 500GB SATA 300, HDD2: WD CG 2TB SATA 300, Zdroj: Corsair 650W
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43293
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Nelze odstranit rootkit z PC
Vypni rez. ochranu u AVG.
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Re: Nelze odstranit rootkit z PC
Log z ComboFixu:
ComboFix 09-02-18.01 - Vasek 2009-02-19 21:58:13.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.1022.520 [GMT 1:00]
Spuštěný z: c:\documents and settings\Vasek\Plocha\ComboFix.exe
AV: AVG Anti-Virus *On-access scanning disabled* (Updated)
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\d3d8caps.dat
c:\windows\system32\mdm.exe
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_HDUSB
((((((((((((((((((((((((( Soubory vytvořené od 2009-01-19 do 2009-02-19 )))))))))))))))))))))))))))))))
.
2009-02-19 22:02 . 2009-02-19 22:02 16,384 --a----t- c:\temp\Perflib_Perfdata_7c0.dat
2009-02-18 18:09 . 2009-02-18 18:09 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\teamspeak2
2009-02-16 19:28 . 2009-02-16 19:28 <DIR> d-------- c:\windows\Eurobattle.net Installer
2009-02-14 16:51 . 2009-02-14 16:51 95 --a------ C:\a.ini
2009-02-14 15:19 . 2009-02-14 15:19 <DIR> d-------- c:\program files\Photo DVD Creator
2009-02-14 15:19 . 2009-02-14 16:54 <DIR> d-------- C:\PhotoDVD
2009-02-14 10:41 . 2009-02-14 10:41 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\ATI
2009-02-14 10:41 . 2009-02-14 10:41 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\ATI
2009-02-14 10:39 . 2009-02-14 10:39 0 --a------ c:\windows\ativpsrm.bin
2009-02-13 22:29 . 2009-02-18 10:21 <DIR> d--h----- C:\$AVG8.VAULT$
2009-02-13 22:09 . 2009-02-19 04:05 <DIR> d-------- c:\windows\system32\drivers\Avg
2009-02-13 22:09 . 2009-02-13 22:09 <DIR> d-------- c:\program files\AVG
2009-02-13 22:09 . 2009-02-19 17:37 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\avg8
2009-02-13 22:09 . 2009-02-13 22:09 325,128 --a------ c:\windows\system32\drivers\avgldx86.sys
2009-02-13 22:09 . 2009-02-13 22:09 107,272 --a------ c:\windows\system32\drivers\avgtdix.sys
2009-02-13 22:09 . 2009-02-13 22:09 12,552 --a------ c:\windows\system32\drivers\avgrkx86.sys
2009-02-13 22:09 . 2009-02-13 22:09 10,520 --a------ c:\windows\system32\avgrsstx.dll
2009-02-13 20:44 . 2009-02-13 22:10 8,192 --a------ c:\documents and settings\bubrle
2009-02-08 14:20 . 2009-02-08 14:20 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Anvsoft
2009-02-03 20:39 . 2009-02-03 17:40 45,568 --a------ c:\windows\UniFish3.exe
2009-01-31 17:22 . 2009-01-31 17:22 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\BSplayer Pro
2009-01-31 10:40 . 2009-01-31 10:43 139,264 --a------ c:\windows\War3Unin.exe
2009-01-31 10:40 . 2009-01-31 10:45 65,987 --a------ c:\windows\War3Unin.dat
2009-01-31 10:40 . 2009-01-31 10:43 2,829 --a------ c:\windows\War3Unin.pif
2009-01-30 23:39 . 2004-12-02 18:20 1,843,200 --a------ c:\windows\system32\NCTAudioFile2.dll
2009-01-30 23:39 . 2002-01-05 15:37 344,064 --a------ c:\windows\system32\msvcr70.dll
2009-01-30 23:39 . 2004-05-20 13:07 335,872 --a------ c:\windows\system32\NCTAudioVisualization2.dll
2009-01-30 23:39 . 2004-08-25 13:53 311,296 --a------ c:\windows\system32\NCTAudioRecord2.dll
2009-01-28 19:38 . 2009-01-28 19:52 486 --a------ c:\windows\my.ini
2009-01-25 17:59 . 2009-01-31 00:06 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\MyPhoneExplorer
2009-01-23 20:14 . 2009-02-17 19:47 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\AIMP
2009-01-21 19:41 . 2009-02-14 10:10 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\uTorrent
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-19 20:19 --------- d-----w c:\program files\Mozilla Firefox 3 Beta 2
2009-02-19 17:03 --------- d-----w c:\program files\Steam
2009-02-17 22:49 --------- d-----w c:\program files\Mozilla Thunderbird
2009-02-14 17:41 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-14 17:41 --------- d-----w c:\documents and settings\Vasek\Data aplikací\ChessBase
2009-02-14 17:39 --------- d-----w c:\program files\Common Files\Adobe
2009-02-14 09:36 --------- d-----w c:\program files\ATI Technologies
2009-02-01 17:44 --------- d-----w c:\documents and settings\Vasek\Data aplikací\ICQ
2009-01-23 19:11 --------- d-----w c:\program files\Astonsoft
2009-01-15 16:02 --------- d-----w c:\program files\FLVPlayer
2009-01-14 07:14 3,455,488 ----a-w c:\windows\system32\drivers\ati2mtag.sys
2009-01-14 03:43 53,248 ----a-w c:\windows\system32\drivers\ati2erec.dll
2009-01-11 12:35 --------- d-----w c:\documents and settings\Vasek\Data aplikací\Ventrilo
2009-01-09 13:12 --------- d-----w c:\program files\Common Files\DirectX
2009-01-08 19:56 --------- d-----w c:\program files\Ashampoo
2009-01-08 19:56 --------- d-----w c:\documents and settings\Vasek\Data aplikací\Ashampoo
2009-01-08 19:56 --------- d-----w c:\documents and settings\All Users\Data aplikací\ashampoo
2009-01-07 17:55 --------- d-----w c:\documents and settings\Vasek\Data aplikací\365dni
2009-01-07 16:47 --------- d-----w c:\documents and settings\Vasek\Data aplikací\Hamachi
2009-01-07 15:27 25,280 ----a-w c:\windows\system32\drivers\hamachi.sys
2009-01-01 13:26 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-12-29 18:39 --------- d-----w c:\documents and settings\Vasek\Data aplikací\FastStone
2008-12-21 10:37 --------- d-----w c:\program files\ICQToolbar
2008-12-21 10:22 --------- d-----w c:\program files\ICQ6
1999-04-07 17:54 99,840 ----a-w c:\program files\Common Files\IRAABOUT.DLL
1998-12-09 03:08 70,144 ----a-w c:\program files\Common Files\IRAMDMTR.DLL
1998-12-09 03:08 48,640 ----a-w c:\program files\Common Files\IRALPTTR.DLL
1998-12-09 03:08 31,744 ----a-w c:\program files\Common Files\IRAWEBTR.DLL
1998-12-09 03:08 186,368 ----a-w c:\program files\Common Files\IRAREG.DLL
1998-12-09 03:08 17,920 ----a-w c:\program files\Common Files\IRASRIAL.DLL
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PowerStrip"="c:\program files\powerstrip\pstrip.exe" [2006-05-10 2010112]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-13 1601304]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"w3dr.exe"="c:\aaa\Warcraft III\w3dr.exe" [2008-08-03 61440]
"SoundMan"="SOUNDMAN.EXE" [2004-11-02 c:\windows\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2004-11-29 c:\windows\ALCWZRD.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-02-13 22:09 10520 c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1018965224-486438452-1843927889-5577\Scripts\Logon\0\0]
"Script"=u:\aw_scanner\AW_scanner.ex /AUTO
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^InterVideo WinCinema Manager.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\InterVideo WinCinema Manager.lnk
backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Port pro program Symantec Fax Starter Edition.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Port pro program Symantec Fax Starter Edition.lnk
backup=c:\windows\pss\Port pro program Symantec Fax Starter Edition.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Vasek^Nabídka Start^Programy^Po spuštění^WinMySQLadmin.lnk]
path=c:\documents and settings\Vasek\Nabídka Start\Programy\Po spuštění\WinMySQLadmin.lnk
backup=c:\windows\pss\WinMySQLadmin.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
--a------ 2007-02-28 23:06 2321600 c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2008-11-23 01:36 203720 c:\aaa\Alcohol Soft\Alcohol 120\AxCmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2004-12-07 20:10 344064 c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2008-04-14 04:22 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a------ 2004-08-22 17:05 81920 c:\program files\D-Tools\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
--a------ 2008-12-21 11:21 173304 c:\program files\ICQ6\ICQ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerStrip]
--a------ 2006-05-10 18:37 2010112 c:\program files\PowerStrip\pstrip.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
--a------ 2008-02-20 16:19 356352 c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-11-10 05:43 136600 c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
--a------ 2008-05-02 05:15 15872 c:\program files\Unlocker\UnlockerAssistant.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
--------- 2008-04-14 04:22 110592 c:\windows\system32\bthprops.cpl
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
--a------ 2001-12-26 13:12 472576 c:\windows\mHotkey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zástupce stránky vlastností sběrnice High Definition Audio]
--------- 2004-08-12 16:45 61952 c:\windows\system32\Hdaudpropshortcut.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\InterVideo\\DVD6\\WinDVD.exe"=
"c:\\xampp\\apache\\bin\\apache.exe"=
"c:\\aaa\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\Steam\\steamapps\\cw.scud@seznam.cz\\counter-strike\\hl.exe"=
"c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\aaa\\cs 1.6\\cstrike.exe"=
"c:\\aaa\\cs 1.6\\hl.exe"=
"c:\\Program Files\\zFTPServer\\zFTPServer.exe"=
"c:\\Program Files\\zFTPServer Administration\\zFTPServerAdmin.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\aaa\\cs 1.6\\hltv.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\aaa\\cs 1.6\\hlds.exe"=
"c:\\Documents and Settings\\Vasek\\Plocha\\Miranda IM\\miranda32.exe"=
"c:\\aaa\\EA GAMES\\Need for Speed Underground 2\\speed2.exe"=
"c:\\aaa\\RollerCoaster Tycoon\\rct.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Steam\\steamapps\\cw.scud@seznam.cz\\half-life blue shift\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\cw.scud@seznam.cz\\half-life\\hl.exe"=
"c:\\Program Files\\Mozilla Firefox 3 Beta 2\\firefox.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"3145:TCP"= 3145:TCP:3145
"3145:UDP"= 3145:UDP:3145
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-02-13 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-02-13 325128]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-02-13 107272]
R2 Apache2.2;Apache2.2;c:\xampp\apache\bin\apache.exe [2007-03-05 16896]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-02-13 903960]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-02-13 298264]
R2 PStrip;PStrip;c:\windows\system32\drivers\PStrip.sys [2004-11-09 21968]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2002-09-23 69120]
R3 Slazldrv;SmartLink AMR_PCI Driver;c:\windows\system32\drivers\slazldrv.sys [2007-05-30 223112]
S2 RPCHE;Remote Procedure Call (RPCE);c:\program files\Common Files\Microsoft Shared\Speech\csvd.exe [2009-01-31 11573248]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2008-08-18 13352]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Vasek\Data aplikací\Mozilla\Firefox\Profiles\448bag67.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - component: c:\documents and settings\Vasek\Data aplikací\Mozilla\Firefox\Profiles\448bag67.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}\components\nstidy.dll
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
.
------- Asociace souborů -------
.
txtfile="c:\program files\PSPad editor\PSPad.exe" "%1"
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-19 22:03:38
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(760)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\xampp\mysql\bin\mysqld-nt.exe
c:\windows\system32\slserv.exe
c:\aaa\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Celkový čas: 2009-02-19 22:07:04 - počítač byl restartován [Vasek]
ComboFix-quarantined-files.txt 2009-02-19 21:07:02
Před spuštěním: Volných bajtů: 30,844,321,792
Po spuštění: Volných bajtů: 31,442,894,848
253 --- E O F --- 2009-02-11 16:21:56
ComboFix 09-02-18.01 - Vasek 2009-02-19 21:58:13.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.1022.520 [GMT 1:00]
Spuštěný z: c:\documents and settings\Vasek\Plocha\ComboFix.exe
AV: AVG Anti-Virus *On-access scanning disabled* (Updated)
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\d3d8caps.dat
c:\windows\system32\mdm.exe
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_HDUSB
((((((((((((((((((((((((( Soubory vytvořené od 2009-01-19 do 2009-02-19 )))))))))))))))))))))))))))))))
.
2009-02-19 22:02 . 2009-02-19 22:02 16,384 --a----t- c:\temp\Perflib_Perfdata_7c0.dat
2009-02-18 18:09 . 2009-02-18 18:09 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\teamspeak2
2009-02-16 19:28 . 2009-02-16 19:28 <DIR> d-------- c:\windows\Eurobattle.net Installer
2009-02-14 16:51 . 2009-02-14 16:51 95 --a------ C:\a.ini
2009-02-14 15:19 . 2009-02-14 15:19 <DIR> d-------- c:\program files\Photo DVD Creator
2009-02-14 15:19 . 2009-02-14 16:54 <DIR> d-------- C:\PhotoDVD
2009-02-14 10:41 . 2009-02-14 10:41 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\ATI
2009-02-14 10:41 . 2009-02-14 10:41 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\ATI
2009-02-14 10:39 . 2009-02-14 10:39 0 --a------ c:\windows\ativpsrm.bin
2009-02-13 22:29 . 2009-02-18 10:21 <DIR> d--h----- C:\$AVG8.VAULT$
2009-02-13 22:09 . 2009-02-19 04:05 <DIR> d-------- c:\windows\system32\drivers\Avg
2009-02-13 22:09 . 2009-02-13 22:09 <DIR> d-------- c:\program files\AVG
2009-02-13 22:09 . 2009-02-19 17:37 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\avg8
2009-02-13 22:09 . 2009-02-13 22:09 325,128 --a------ c:\windows\system32\drivers\avgldx86.sys
2009-02-13 22:09 . 2009-02-13 22:09 107,272 --a------ c:\windows\system32\drivers\avgtdix.sys
2009-02-13 22:09 . 2009-02-13 22:09 12,552 --a------ c:\windows\system32\drivers\avgrkx86.sys
2009-02-13 22:09 . 2009-02-13 22:09 10,520 --a------ c:\windows\system32\avgrsstx.dll
2009-02-13 20:44 . 2009-02-13 22:10 8,192 --a------ c:\documents and settings\bubrle
2009-02-08 14:20 . 2009-02-08 14:20 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Anvsoft
2009-02-03 20:39 . 2009-02-03 17:40 45,568 --a------ c:\windows\UniFish3.exe
2009-01-31 17:22 . 2009-01-31 17:22 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\BSplayer Pro
2009-01-31 10:40 . 2009-01-31 10:43 139,264 --a------ c:\windows\War3Unin.exe
2009-01-31 10:40 . 2009-01-31 10:45 65,987 --a------ c:\windows\War3Unin.dat
2009-01-31 10:40 . 2009-01-31 10:43 2,829 --a------ c:\windows\War3Unin.pif
2009-01-30 23:39 . 2004-12-02 18:20 1,843,200 --a------ c:\windows\system32\NCTAudioFile2.dll
2009-01-30 23:39 . 2002-01-05 15:37 344,064 --a------ c:\windows\system32\msvcr70.dll
2009-01-30 23:39 . 2004-05-20 13:07 335,872 --a------ c:\windows\system32\NCTAudioVisualization2.dll
2009-01-30 23:39 . 2004-08-25 13:53 311,296 --a------ c:\windows\system32\NCTAudioRecord2.dll
2009-01-28 19:38 . 2009-01-28 19:52 486 --a------ c:\windows\my.ini
2009-01-25 17:59 . 2009-01-31 00:06 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\MyPhoneExplorer
2009-01-23 20:14 . 2009-02-17 19:47 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\AIMP
2009-01-21 19:41 . 2009-02-14 10:10 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\uTorrent
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-19 20:19 --------- d-----w c:\program files\Mozilla Firefox 3 Beta 2
2009-02-19 17:03 --------- d-----w c:\program files\Steam
2009-02-17 22:49 --------- d-----w c:\program files\Mozilla Thunderbird
2009-02-14 17:41 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-14 17:41 --------- d-----w c:\documents and settings\Vasek\Data aplikací\ChessBase
2009-02-14 17:39 --------- d-----w c:\program files\Common Files\Adobe
2009-02-14 09:36 --------- d-----w c:\program files\ATI Technologies
2009-02-01 17:44 --------- d-----w c:\documents and settings\Vasek\Data aplikací\ICQ
2009-01-23 19:11 --------- d-----w c:\program files\Astonsoft
2009-01-15 16:02 --------- d-----w c:\program files\FLVPlayer
2009-01-14 07:14 3,455,488 ----a-w c:\windows\system32\drivers\ati2mtag.sys
2009-01-14 03:43 53,248 ----a-w c:\windows\system32\drivers\ati2erec.dll
2009-01-11 12:35 --------- d-----w c:\documents and settings\Vasek\Data aplikací\Ventrilo
2009-01-09 13:12 --------- d-----w c:\program files\Common Files\DirectX
2009-01-08 19:56 --------- d-----w c:\program files\Ashampoo
2009-01-08 19:56 --------- d-----w c:\documents and settings\Vasek\Data aplikací\Ashampoo
2009-01-08 19:56 --------- d-----w c:\documents and settings\All Users\Data aplikací\ashampoo
2009-01-07 17:55 --------- d-----w c:\documents and settings\Vasek\Data aplikací\365dni
2009-01-07 16:47 --------- d-----w c:\documents and settings\Vasek\Data aplikací\Hamachi
2009-01-07 15:27 25,280 ----a-w c:\windows\system32\drivers\hamachi.sys
2009-01-01 13:26 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-12-29 18:39 --------- d-----w c:\documents and settings\Vasek\Data aplikací\FastStone
2008-12-21 10:37 --------- d-----w c:\program files\ICQToolbar
2008-12-21 10:22 --------- d-----w c:\program files\ICQ6
1999-04-07 17:54 99,840 ----a-w c:\program files\Common Files\IRAABOUT.DLL
1998-12-09 03:08 70,144 ----a-w c:\program files\Common Files\IRAMDMTR.DLL
1998-12-09 03:08 48,640 ----a-w c:\program files\Common Files\IRALPTTR.DLL
1998-12-09 03:08 31,744 ----a-w c:\program files\Common Files\IRAWEBTR.DLL
1998-12-09 03:08 186,368 ----a-w c:\program files\Common Files\IRAREG.DLL
1998-12-09 03:08 17,920 ----a-w c:\program files\Common Files\IRASRIAL.DLL
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PowerStrip"="c:\program files\powerstrip\pstrip.exe" [2006-05-10 2010112]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-13 1601304]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"w3dr.exe"="c:\aaa\Warcraft III\w3dr.exe" [2008-08-03 61440]
"SoundMan"="SOUNDMAN.EXE" [2004-11-02 c:\windows\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2004-11-29 c:\windows\ALCWZRD.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-02-13 22:09 10520 c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1018965224-486438452-1843927889-5577\Scripts\Logon\0\0]
"Script"=u:\aw_scanner\AW_scanner.ex /AUTO
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^InterVideo WinCinema Manager.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\InterVideo WinCinema Manager.lnk
backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Port pro program Symantec Fax Starter Edition.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Port pro program Symantec Fax Starter Edition.lnk
backup=c:\windows\pss\Port pro program Symantec Fax Starter Edition.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Vasek^Nabídka Start^Programy^Po spuštění^WinMySQLadmin.lnk]
path=c:\documents and settings\Vasek\Nabídka Start\Programy\Po spuštění\WinMySQLadmin.lnk
backup=c:\windows\pss\WinMySQLadmin.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
--a------ 2007-02-28 23:06 2321600 c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2008-11-23 01:36 203720 c:\aaa\Alcohol Soft\Alcohol 120\AxCmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2004-12-07 20:10 344064 c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2008-04-14 04:22 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a------ 2004-08-22 17:05 81920 c:\program files\D-Tools\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
--a------ 2008-12-21 11:21 173304 c:\program files\ICQ6\ICQ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerStrip]
--a------ 2006-05-10 18:37 2010112 c:\program files\PowerStrip\pstrip.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
--a------ 2008-02-20 16:19 356352 c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-11-10 05:43 136600 c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
--a------ 2008-05-02 05:15 15872 c:\program files\Unlocker\UnlockerAssistant.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
--------- 2008-04-14 04:22 110592 c:\windows\system32\bthprops.cpl
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
--a------ 2001-12-26 13:12 472576 c:\windows\mHotkey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zástupce stránky vlastností sběrnice High Definition Audio]
--------- 2004-08-12 16:45 61952 c:\windows\system32\Hdaudpropshortcut.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\InterVideo\\DVD6\\WinDVD.exe"=
"c:\\xampp\\apache\\bin\\apache.exe"=
"c:\\aaa\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\Steam\\steamapps\\cw.scud@seznam.cz\\counter-strike\\hl.exe"=
"c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\aaa\\cs 1.6\\cstrike.exe"=
"c:\\aaa\\cs 1.6\\hl.exe"=
"c:\\Program Files\\zFTPServer\\zFTPServer.exe"=
"c:\\Program Files\\zFTPServer Administration\\zFTPServerAdmin.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\aaa\\cs 1.6\\hltv.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\aaa\\cs 1.6\\hlds.exe"=
"c:\\Documents and Settings\\Vasek\\Plocha\\Miranda IM\\miranda32.exe"=
"c:\\aaa\\EA GAMES\\Need for Speed Underground 2\\speed2.exe"=
"c:\\aaa\\RollerCoaster Tycoon\\rct.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Steam\\steamapps\\cw.scud@seznam.cz\\half-life blue shift\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\cw.scud@seznam.cz\\half-life\\hl.exe"=
"c:\\Program Files\\Mozilla Firefox 3 Beta 2\\firefox.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"3145:TCP"= 3145:TCP:3145
"3145:UDP"= 3145:UDP:3145
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-02-13 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-02-13 325128]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-02-13 107272]
R2 Apache2.2;Apache2.2;c:\xampp\apache\bin\apache.exe [2007-03-05 16896]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-02-13 903960]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-02-13 298264]
R2 PStrip;PStrip;c:\windows\system32\drivers\PStrip.sys [2004-11-09 21968]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2002-09-23 69120]
R3 Slazldrv;SmartLink AMR_PCI Driver;c:\windows\system32\drivers\slazldrv.sys [2007-05-30 223112]
S2 RPCHE;Remote Procedure Call (RPCE);c:\program files\Common Files\Microsoft Shared\Speech\csvd.exe [2009-01-31 11573248]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2008-08-18 13352]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Vasek\Data aplikací\Mozilla\Firefox\Profiles\448bag67.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - component: c:\documents and settings\Vasek\Data aplikací\Mozilla\Firefox\Profiles\448bag67.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}\components\nstidy.dll
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
.
------- Asociace souborů -------
.
txtfile="c:\program files\PSPad editor\PSPad.exe" "%1"
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-19 22:03:38
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(760)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\AVG\AVG8\avgam.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\xampp\mysql\bin\mysqld-nt.exe
c:\windows\system32\slserv.exe
c:\aaa\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Celkový čas: 2009-02-19 22:07:04 - počítač byl restartován [Vasek]
ComboFix-quarantined-files.txt 2009-02-19 21:07:02
Před spuštěním: Volných bajtů: 30,844,321,792
Po spuštění: Volných bajtů: 31,442,894,848
253 --- E O F --- 2009-02-11 16:21:56
MB: ASUS Striker II Formula, CPU: Intel Core™ 2 Duo 3,16GHz, CPU Cooler: Zalman CNPS8700 LED, RAM: 2x1GB Corsair Dominator 1066 MHz DDR II, GPU: ASUS ATI Radeon HD 5770 DDR3 1GB, HDD: WD CG 500GB SATA 300, HDD2: WD CG 2TB SATA 300, Zdroj: Corsair 650W
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43293
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Nelze odstranit rootkit z PC
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE
Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT
Toto otestuj na Virustotal
C:\a.ini
Vlož sem pak odkaz výsledku.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE
Kód: Vybrat vše
File::
c:\windows\ativpsrm.bin
Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT
Toto otestuj na Virustotal
C:\a.ini
Vlož sem pak odkaz výsledku.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Re: Nelze odstranit rootkit z PC
Log z ComboFix:
ComboFix 09-02-18.01 - Vasek 2009-02-20 19:12:25.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.1022.457 [GMT 1:00]
Spuštěný z: c:\documents and settings\Vasek\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Vasek\Plocha\CFScript.txt
AV: AVG Anti-Virus *On-access scanning disabled* (Updated)
* Vytvořen nový Bod Obnovení
FILE ::
c:\windows\ativpsrm.bin
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\ativpsrm.bin
.
((((((((((((((((((((((((( Soubory vytvořené od 2009-01-20 do 2009-02-20 )))))))))))))))))))))))))))))))
.
2009-02-19 22:02 . 2009-02-19 22:02 16,384 --a----t- c:\temp\Perflib_Perfdata_7c0.dat
2009-02-18 18:09 . 2009-02-18 18:09 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\teamspeak2
2009-02-16 19:28 . 2009-02-16 19:28 <DIR> d-------- c:\windows\Eurobattle.net Installer
2009-02-14 16:51 . 2009-02-14 16:51 95 --a------ C:\a.ini
2009-02-14 15:19 . 2009-02-14 15:19 <DIR> d-------- c:\program files\Photo DVD Creator
2009-02-14 15:19 . 2009-02-14 16:54 <DIR> d-------- C:\PhotoDVD
2009-02-14 10:41 . 2009-02-14 10:41 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\ATI
2009-02-14 10:41 . 2009-02-14 10:41 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\ATI
2009-02-13 22:29 . 2009-02-20 10:18 <DIR> d--h----- C:\$AVG8.VAULT$
2009-02-13 22:09 . 2009-02-20 12:05 <DIR> d-------- c:\windows\system32\drivers\Avg
2009-02-13 22:09 . 2009-02-13 22:09 <DIR> d-------- c:\program files\AVG
2009-02-13 22:09 . 2009-02-19 17:37 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\avg8
2009-02-13 22:09 . 2009-02-13 22:09 325,128 --a------ c:\windows\system32\drivers\avgldx86.sys
2009-02-13 22:09 . 2009-02-13 22:09 107,272 --a------ c:\windows\system32\drivers\avgtdix.sys
2009-02-13 22:09 . 2009-02-13 22:09 12,552 --a------ c:\windows\system32\drivers\avgrkx86.sys
2009-02-13 22:09 . 2009-02-13 22:09 10,520 --a------ c:\windows\system32\avgrsstx.dll
2009-02-13 20:44 . 2009-02-13 22:10 8,192 --a------ c:\documents and settings\bubrle
2009-02-08 14:20 . 2009-02-08 14:20 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Anvsoft
2009-02-03 20:39 . 2009-02-03 17:40 45,568 --a------ c:\windows\UniFish3.exe
2009-01-31 17:22 . 2009-01-31 17:22 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\BSplayer Pro
2009-01-31 10:40 . 2009-01-31 10:43 139,264 --a------ c:\windows\War3Unin.exe
2009-01-31 10:40 . 2009-01-31 10:45 65,987 --a------ c:\windows\War3Unin.dat
2009-01-31 10:40 . 2009-01-31 10:43 2,829 --a------ c:\windows\War3Unin.pif
2009-01-30 23:39 . 2004-12-02 18:20 1,843,200 --a------ c:\windows\system32\NCTAudioFile2.dll
2009-01-30 23:39 . 2002-01-05 15:37 344,064 --a------ c:\windows\system32\msvcr70.dll
2009-01-30 23:39 . 2004-05-20 13:07 335,872 --a------ c:\windows\system32\NCTAudioVisualization2.dll
2009-01-30 23:39 . 2004-08-25 13:53 311,296 --a------ c:\windows\system32\NCTAudioRecord2.dll
2009-01-28 19:38 . 2009-01-28 19:52 486 --a------ c:\windows\my.ini
2009-01-25 17:59 . 2009-01-31 00:06 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\MyPhoneExplorer
2009-01-23 20:14 . 2009-02-17 19:47 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\AIMP
2009-01-21 19:41 . 2009-02-14 10:10 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\uTorrent
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-20 16:18 --------- d-----w c:\program files\Mozilla Firefox 3 Beta 2
2009-02-19 17:03 --------- d-----w c:\program files\Steam
2009-02-17 22:49 --------- d-----w c:\program files\Mozilla Thunderbird
2009-02-14 17:41 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-14 17:41 --------- d-----w c:\documents and settings\Vasek\Data aplikací\ChessBase
2009-02-14 17:39 --------- d-----w c:\program files\Common Files\Adobe
2009-02-14 09:36 --------- d-----w c:\program files\ATI Technologies
2009-02-01 17:44 --------- d-----w c:\documents and settings\Vasek\Data aplikací\ICQ
2009-01-23 19:11 --------- d-----w c:\program files\Astonsoft
2009-01-15 16:02 --------- d-----w c:\program files\FLVPlayer
2009-01-14 07:14 3,455,488 ----a-w c:\windows\system32\drivers\ati2mtag.sys
2009-01-14 05:46 11,591,680 ----a-w c:\windows\system32\atioglxx.dll
2009-01-14 04:53 286,720 ----a-w c:\windows\system32\atiok3x2.dll
2009-01-14 04:49 425,984 ----a-w c:\windows\system32\ATIDEMGX.dll
2009-01-14 04:47 323,584 ----a-w c:\windows\system32\ati2dvag.dll
2009-01-14 04:36 26,112 ----a-w c:\windows\system32\Ati2mdxx.exe
2009-01-14 04:36 196,608 ----a-w c:\windows\system32\atipdlxx.dll
2009-01-14 04:36 151,552 ----a-w c:\windows\system32\Oemdspif.dll
2009-01-14 04:35 43,520 ----a-w c:\windows\system32\ati2edxx.dll
2009-01-14 04:35 155,648 ----a-w c:\windows\system32\ati2evxx.dll
2009-01-14 04:34 598,016 ----a-w c:\windows\system32\ati2evxx.exe
2009-01-14 04:32 53,248 ----a-w c:\windows\system32\ATIDDC.DLL
2009-01-14 04:22 4,009,152 ----a-w c:\windows\system32\ati3duag.dll
2009-01-14 04:05 2,500,224 ----a-w c:\windows\system32\ativvaxx.dll
2009-01-14 03:50 48,640 ----a-w c:\windows\system32\amdpcom32.dll
2009-01-14 03:45 401,408 ----a-w c:\windows\system32\atikvmag.dll
2009-01-14 03:44 17,408 ----a-w c:\windows\system32\atitvo32.dll
2009-01-14 03:44 110,592 ----a-w c:\windows\system32\atiadlxx.dll
2009-01-14 03:43 53,248 ----a-w c:\windows\system32\drivers\ati2erec.dll
2009-01-14 03:37 577,536 ----a-w c:\windows\system32\ati2cqag.dll
2009-01-14 03:37 307,200 ----a-w c:\windows\system32\atiiiexx.dll
2009-01-13 20:05 593,920 ------w c:\windows\system32\ati2sgag.exe
2009-01-11 12:35 --------- d-----w c:\documents and settings\Vasek\Data aplikací\Ventrilo
2009-01-09 13:12 --------- d-----w c:\program files\Common Files\DirectX
2009-01-08 19:56 --------- d-----w c:\program files\Ashampoo
2009-01-08 19:56 --------- d-----w c:\documents and settings\Vasek\Data aplikací\Ashampoo
2009-01-08 19:56 --------- d-----w c:\documents and settings\All Users\Data aplikací\ashampoo
2009-01-07 17:55 --------- d-----w c:\documents and settings\Vasek\Data aplikací\365dni
2009-01-07 16:47 --------- d-----w c:\documents and settings\Vasek\Data aplikací\Hamachi
2009-01-07 15:27 25,280 ----a-w c:\windows\system32\drivers\hamachi.sys
2009-01-01 13:26 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-12-29 18:39 --------- d-----w c:\documents and settings\Vasek\Data aplikací\FastStone
2008-12-21 10:37 --------- d-----w c:\program files\ICQToolbar
2008-12-21 10:22 --------- d-----w c:\program files\ICQ6
2008-12-20 23:03 826,368 ----a-w c:\windows\system32\wininet.dll
1999-04-07 17:54 99,840 ----a-w c:\program files\Common Files\IRAABOUT.DLL
1998-12-09 03:08 70,144 ----a-w c:\program files\Common Files\IRAMDMTR.DLL
1998-12-09 03:08 48,640 ----a-w c:\program files\Common Files\IRALPTTR.DLL
1998-12-09 03:08 31,744 ----a-w c:\program files\Common Files\IRAWEBTR.DLL
1998-12-09 03:08 186,368 ----a-w c:\program files\Common Files\IRAREG.DLL
1998-12-09 03:08 17,920 ----a-w c:\program files\Common Files\IRASRIAL.DLL
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PowerStrip"="c:\program files\powerstrip\pstrip.exe" [2006-05-10 2010112]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-13 1601304]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-14 171008]
"SoundMan"="SOUNDMAN.EXE" [2004-11-02 c:\windows\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2004-11-29 c:\windows\ALCWZRD.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-02-13 22:09 10520 c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1018965224-486438452-1843927889-5577\Scripts\Logon\0\0]
"Script"=u:\aw_scanner\AW_scanner.ex /AUTO
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^InterVideo WinCinema Manager.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\InterVideo WinCinema Manager.lnk
backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Port pro program Symantec Fax Starter Edition.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Port pro program Symantec Fax Starter Edition.lnk
backup=c:\windows\pss\Port pro program Symantec Fax Starter Edition.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Vasek^Nabídka Start^Programy^Po spuštění^WinMySQLadmin.lnk]
path=c:\documents and settings\Vasek\Nabídka Start\Programy\Po spuštění\WinMySQLadmin.lnk
backup=c:\windows\pss\WinMySQLadmin.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
--a------ 2007-02-28 23:06 2321600 c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2008-11-23 01:36 203720 c:\aaa\Alcohol Soft\Alcohol 120\AxCmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2004-12-07 20:10 344064 c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2008-04-14 04:22 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a------ 2004-08-22 17:05 81920 c:\program files\D-Tools\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
--a------ 2008-12-21 11:21 173304 c:\program files\ICQ6\ICQ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerStrip]
--a------ 2006-05-10 18:37 2010112 c:\program files\PowerStrip\pstrip.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
--a------ 2008-02-20 16:19 356352 c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-11-10 05:43 136600 c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
--a------ 2008-05-02 05:15 15872 c:\program files\Unlocker\UnlockerAssistant.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w3dr.exe]
--a------ 2008-08-03 16:38 61440 c:\aaa\Warcraft III\W3DR.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
--------- 2008-04-14 04:22 110592 c:\windows\system32\bthprops.cpl
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
--a------ 2001-12-26 13:12 472576 c:\windows\mHotkey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zástupce stránky vlastností sběrnice High Definition Audio]
--------- 2004-08-12 16:45 61952 c:\windows\system32\Hdaudpropshortcut.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"Bonjour Service"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\InterVideo\\DVD6\\WinDVD.exe"=
"c:\\xampp\\apache\\bin\\apache.exe"=
"c:\\aaa\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\Steam\\steamapps\\cw.scud@seznam.cz\\counter-strike\\hl.exe"=
"c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\aaa\\cs 1.6\\cstrike.exe"=
"c:\\aaa\\cs 1.6\\hl.exe"=
"c:\\Program Files\\zFTPServer\\zFTPServer.exe"=
"c:\\Program Files\\zFTPServer Administration\\zFTPServerAdmin.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\aaa\\cs 1.6\\hltv.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\aaa\\cs 1.6\\hlds.exe"=
"c:\\Documents and Settings\\Vasek\\Plocha\\Miranda IM\\miranda32.exe"=
"c:\\aaa\\EA GAMES\\Need for Speed Underground 2\\speed2.exe"=
"c:\\aaa\\RollerCoaster Tycoon\\rct.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Steam\\steamapps\\cw.scud@seznam.cz\\half-life blue shift\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\cw.scud@seznam.cz\\half-life\\hl.exe"=
"c:\\Program Files\\Mozilla Firefox 3 Beta 2\\firefox.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"3145:TCP"= 3145:TCP:3145
"3145:UDP"= 3145:UDP:3145
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-02-13 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-02-13 325128]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-02-13 107272]
R2 Apache2.2;Apache2.2;c:\xampp\apache\bin\apache.exe [2007-03-05 16896]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-02-13 903960]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-02-13 298264]
R2 PStrip;PStrip;c:\windows\system32\drivers\PStrip.sys [2004-11-09 21968]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2002-09-23 69120]
R3 Slazldrv;SmartLink AMR_PCI Driver;c:\windows\system32\drivers\slazldrv.sys [2007-05-30 223112]
S2 RPCHE;Remote Procedure Call (RPCE);c:\program files\Common Files\Microsoft Shared\Speech\csvd.exe [2009-01-31 11573248]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2008-08-18 13352]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Vasek\Data aplikací\Mozilla\Firefox\Profiles\448bag67.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - component: c:\documents and settings\Vasek\Data aplikací\Mozilla\Firefox\Profiles\448bag67.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}\components\nstidy.dll
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-20 19:14:52
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(760)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2009-02-20 19:17:17
ComboFix-quarantined-files.txt 2009-02-20 18:16:26
ComboFix2.txt 2009-02-19 21:07:06
Před spuštěním: Volných bajtů: 31 433 900 032
Po spuštění: Volných bajtů: 31,420,862,464
254 --- E O F --- 2009-02-11 16:21:56
Log z HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:19:37, on 20.2.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\xampp\apache\bin\apache.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\xampp\mysql\bin\mysqld-nt.exe
C:\WINDOWS\system32\slserv.exe
C:\aaa\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\xampp\apache\bin\apache.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\PS pad\PSPad.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Documents and Settings\Vasek\Plocha\Miranda IM\miranda32.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Vasek\Plocha\Downloads\hijackthis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apache2.2 - Apache Software Foundation - C:\xampp\apache\bin\apache.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: mysql - Unknown owner - C:\xampp\mysql\bin\mysqld-nt.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\aaa\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
--
End of file - 5606 bytes
Ten soubor a.ini je v poradku, je to konfigurace Photo DVD Creator, na VirusTotal to melo vysledek 0/39.
ComboFix 09-02-18.01 - Vasek 2009-02-20 19:12:25.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.1022.457 [GMT 1:00]
Spuštěný z: c:\documents and settings\Vasek\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Vasek\Plocha\CFScript.txt
AV: AVG Anti-Virus *On-access scanning disabled* (Updated)
* Vytvořen nový Bod Obnovení
FILE ::
c:\windows\ativpsrm.bin
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\ativpsrm.bin
.
((((((((((((((((((((((((( Soubory vytvořené od 2009-01-20 do 2009-02-20 )))))))))))))))))))))))))))))))
.
2009-02-19 22:02 . 2009-02-19 22:02 16,384 --a----t- c:\temp\Perflib_Perfdata_7c0.dat
2009-02-18 18:09 . 2009-02-18 18:09 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\teamspeak2
2009-02-16 19:28 . 2009-02-16 19:28 <DIR> d-------- c:\windows\Eurobattle.net Installer
2009-02-14 16:51 . 2009-02-14 16:51 95 --a------ C:\a.ini
2009-02-14 15:19 . 2009-02-14 15:19 <DIR> d-------- c:\program files\Photo DVD Creator
2009-02-14 15:19 . 2009-02-14 16:54 <DIR> d-------- C:\PhotoDVD
2009-02-14 10:41 . 2009-02-14 10:41 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\ATI
2009-02-14 10:41 . 2009-02-14 10:41 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\ATI
2009-02-13 22:29 . 2009-02-20 10:18 <DIR> d--h----- C:\$AVG8.VAULT$
2009-02-13 22:09 . 2009-02-20 12:05 <DIR> d-------- c:\windows\system32\drivers\Avg
2009-02-13 22:09 . 2009-02-13 22:09 <DIR> d-------- c:\program files\AVG
2009-02-13 22:09 . 2009-02-19 17:37 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\avg8
2009-02-13 22:09 . 2009-02-13 22:09 325,128 --a------ c:\windows\system32\drivers\avgldx86.sys
2009-02-13 22:09 . 2009-02-13 22:09 107,272 --a------ c:\windows\system32\drivers\avgtdix.sys
2009-02-13 22:09 . 2009-02-13 22:09 12,552 --a------ c:\windows\system32\drivers\avgrkx86.sys
2009-02-13 22:09 . 2009-02-13 22:09 10,520 --a------ c:\windows\system32\avgrsstx.dll
2009-02-13 20:44 . 2009-02-13 22:10 8,192 --a------ c:\documents and settings\bubrle
2009-02-08 14:20 . 2009-02-08 14:20 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Anvsoft
2009-02-03 20:39 . 2009-02-03 17:40 45,568 --a------ c:\windows\UniFish3.exe
2009-01-31 17:22 . 2009-01-31 17:22 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\BSplayer Pro
2009-01-31 10:40 . 2009-01-31 10:43 139,264 --a------ c:\windows\War3Unin.exe
2009-01-31 10:40 . 2009-01-31 10:45 65,987 --a------ c:\windows\War3Unin.dat
2009-01-31 10:40 . 2009-01-31 10:43 2,829 --a------ c:\windows\War3Unin.pif
2009-01-30 23:39 . 2004-12-02 18:20 1,843,200 --a------ c:\windows\system32\NCTAudioFile2.dll
2009-01-30 23:39 . 2002-01-05 15:37 344,064 --a------ c:\windows\system32\msvcr70.dll
2009-01-30 23:39 . 2004-05-20 13:07 335,872 --a------ c:\windows\system32\NCTAudioVisualization2.dll
2009-01-30 23:39 . 2004-08-25 13:53 311,296 --a------ c:\windows\system32\NCTAudioRecord2.dll
2009-01-28 19:38 . 2009-01-28 19:52 486 --a------ c:\windows\my.ini
2009-01-25 17:59 . 2009-01-31 00:06 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\MyPhoneExplorer
2009-01-23 20:14 . 2009-02-17 19:47 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\AIMP
2009-01-21 19:41 . 2009-02-14 10:10 <DIR> d-------- c:\documents and settings\Vasek\Data aplikací\uTorrent
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-20 16:18 --------- d-----w c:\program files\Mozilla Firefox 3 Beta 2
2009-02-19 17:03 --------- d-----w c:\program files\Steam
2009-02-17 22:49 --------- d-----w c:\program files\Mozilla Thunderbird
2009-02-14 17:41 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-14 17:41 --------- d-----w c:\documents and settings\Vasek\Data aplikací\ChessBase
2009-02-14 17:39 --------- d-----w c:\program files\Common Files\Adobe
2009-02-14 09:36 --------- d-----w c:\program files\ATI Technologies
2009-02-01 17:44 --------- d-----w c:\documents and settings\Vasek\Data aplikací\ICQ
2009-01-23 19:11 --------- d-----w c:\program files\Astonsoft
2009-01-15 16:02 --------- d-----w c:\program files\FLVPlayer
2009-01-14 07:14 3,455,488 ----a-w c:\windows\system32\drivers\ati2mtag.sys
2009-01-14 05:46 11,591,680 ----a-w c:\windows\system32\atioglxx.dll
2009-01-14 04:53 286,720 ----a-w c:\windows\system32\atiok3x2.dll
2009-01-14 04:49 425,984 ----a-w c:\windows\system32\ATIDEMGX.dll
2009-01-14 04:47 323,584 ----a-w c:\windows\system32\ati2dvag.dll
2009-01-14 04:36 26,112 ----a-w c:\windows\system32\Ati2mdxx.exe
2009-01-14 04:36 196,608 ----a-w c:\windows\system32\atipdlxx.dll
2009-01-14 04:36 151,552 ----a-w c:\windows\system32\Oemdspif.dll
2009-01-14 04:35 43,520 ----a-w c:\windows\system32\ati2edxx.dll
2009-01-14 04:35 155,648 ----a-w c:\windows\system32\ati2evxx.dll
2009-01-14 04:34 598,016 ----a-w c:\windows\system32\ati2evxx.exe
2009-01-14 04:32 53,248 ----a-w c:\windows\system32\ATIDDC.DLL
2009-01-14 04:22 4,009,152 ----a-w c:\windows\system32\ati3duag.dll
2009-01-14 04:05 2,500,224 ----a-w c:\windows\system32\ativvaxx.dll
2009-01-14 03:50 48,640 ----a-w c:\windows\system32\amdpcom32.dll
2009-01-14 03:45 401,408 ----a-w c:\windows\system32\atikvmag.dll
2009-01-14 03:44 17,408 ----a-w c:\windows\system32\atitvo32.dll
2009-01-14 03:44 110,592 ----a-w c:\windows\system32\atiadlxx.dll
2009-01-14 03:43 53,248 ----a-w c:\windows\system32\drivers\ati2erec.dll
2009-01-14 03:37 577,536 ----a-w c:\windows\system32\ati2cqag.dll
2009-01-14 03:37 307,200 ----a-w c:\windows\system32\atiiiexx.dll
2009-01-13 20:05 593,920 ------w c:\windows\system32\ati2sgag.exe
2009-01-11 12:35 --------- d-----w c:\documents and settings\Vasek\Data aplikací\Ventrilo
2009-01-09 13:12 --------- d-----w c:\program files\Common Files\DirectX
2009-01-08 19:56 --------- d-----w c:\program files\Ashampoo
2009-01-08 19:56 --------- d-----w c:\documents and settings\Vasek\Data aplikací\Ashampoo
2009-01-08 19:56 --------- d-----w c:\documents and settings\All Users\Data aplikací\ashampoo
2009-01-07 17:55 --------- d-----w c:\documents and settings\Vasek\Data aplikací\365dni
2009-01-07 16:47 --------- d-----w c:\documents and settings\Vasek\Data aplikací\Hamachi
2009-01-07 15:27 25,280 ----a-w c:\windows\system32\drivers\hamachi.sys
2009-01-01 13:26 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-12-29 18:39 --------- d-----w c:\documents and settings\Vasek\Data aplikací\FastStone
2008-12-21 10:37 --------- d-----w c:\program files\ICQToolbar
2008-12-21 10:22 --------- d-----w c:\program files\ICQ6
2008-12-20 23:03 826,368 ----a-w c:\windows\system32\wininet.dll
1999-04-07 17:54 99,840 ----a-w c:\program files\Common Files\IRAABOUT.DLL
1998-12-09 03:08 70,144 ----a-w c:\program files\Common Files\IRAMDMTR.DLL
1998-12-09 03:08 48,640 ----a-w c:\program files\Common Files\IRALPTTR.DLL
1998-12-09 03:08 31,744 ----a-w c:\program files\Common Files\IRAWEBTR.DLL
1998-12-09 03:08 186,368 ----a-w c:\program files\Common Files\IRAREG.DLL
1998-12-09 03:08 17,920 ----a-w c:\program files\Common Files\IRASRIAL.DLL
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PowerStrip"="c:\program files\powerstrip\pstrip.exe" [2006-05-10 2010112]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-13 1601304]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-14 171008]
"SoundMan"="SOUNDMAN.EXE" [2004-11-02 c:\windows\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2004-11-29 c:\windows\ALCWZRD.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-02-13 22:09 10520 c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1018965224-486438452-1843927889-5577\Scripts\Logon\0\0]
"Script"=u:\aw_scanner\AW_scanner.ex /AUTO
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^InterVideo WinCinema Manager.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\InterVideo WinCinema Manager.lnk
backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Port pro program Symantec Fax Starter Edition.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Port pro program Symantec Fax Starter Edition.lnk
backup=c:\windows\pss\Port pro program Symantec Fax Starter Edition.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Vasek^Nabídka Start^Programy^Po spuštění^WinMySQLadmin.lnk]
path=c:\documents and settings\Vasek\Nabídka Start\Programy\Po spuštění\WinMySQLadmin.lnk
backup=c:\windows\pss\WinMySQLadmin.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
--a------ 2007-02-28 23:06 2321600 c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
--a------ 2008-11-23 01:36 203720 c:\aaa\Alcohol Soft\Alcohol 120\AxCmd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2004-12-07 20:10 344064 c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2008-04-14 04:22 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a------ 2004-08-22 17:05 81920 c:\program files\D-Tools\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
--a------ 2008-12-21 11:21 173304 c:\program files\ICQ6\ICQ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerStrip]
--a------ 2006-05-10 18:37 2010112 c:\program files\PowerStrip\pstrip.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
--a------ 2008-02-20 16:19 356352 c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-11-10 05:43 136600 c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
--a------ 2008-05-02 05:15 15872 c:\program files\Unlocker\UnlockerAssistant.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\w3dr.exe]
--a------ 2008-08-03 16:38 61440 c:\aaa\Warcraft III\W3DR.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
--------- 2008-04-14 04:22 110592 c:\windows\system32\bthprops.cpl
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
--a------ 2001-12-26 13:12 472576 c:\windows\mHotkey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zástupce stránky vlastností sběrnice High Definition Audio]
--------- 2004-08-12 16:45 61952 c:\windows\system32\Hdaudpropshortcut.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"Bonjour Service"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\InterVideo\\DVD6\\WinDVD.exe"=
"c:\\xampp\\apache\\bin\\apache.exe"=
"c:\\aaa\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\Steam\\steamapps\\cw.scud@seznam.cz\\counter-strike\\hl.exe"=
"c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\aaa\\cs 1.6\\cstrike.exe"=
"c:\\aaa\\cs 1.6\\hl.exe"=
"c:\\Program Files\\zFTPServer\\zFTPServer.exe"=
"c:\\Program Files\\zFTPServer Administration\\zFTPServerAdmin.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\aaa\\cs 1.6\\hltv.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\aaa\\cs 1.6\\hlds.exe"=
"c:\\Documents and Settings\\Vasek\\Plocha\\Miranda IM\\miranda32.exe"=
"c:\\aaa\\EA GAMES\\Need for Speed Underground 2\\speed2.exe"=
"c:\\aaa\\RollerCoaster Tycoon\\rct.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Steam\\steamapps\\cw.scud@seznam.cz\\half-life blue shift\\hl.exe"=
"c:\\Program Files\\Steam\\steamapps\\cw.scud@seznam.cz\\half-life\\hl.exe"=
"c:\\Program Files\\Mozilla Firefox 3 Beta 2\\firefox.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"3145:TCP"= 3145:TCP:3145
"3145:UDP"= 3145:UDP:3145
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-02-13 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-02-13 325128]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-02-13 107272]
R2 Apache2.2;Apache2.2;c:\xampp\apache\bin\apache.exe [2007-03-05 16896]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-02-13 903960]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-02-13 298264]
R2 PStrip;PStrip;c:\windows\system32\drivers\PStrip.sys [2004-11-09 21968]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2002-09-23 69120]
R3 Slazldrv;SmartLink AMR_PCI Driver;c:\windows\system32\drivers\slazldrv.sys [2007-05-30 223112]
S2 RPCHE;Remote Procedure Call (RPCE);c:\program files\Common Files\Microsoft Shared\Speech\csvd.exe [2009-01-31 11573248]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2008-08-18 13352]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Vasek\Data aplikací\Mozilla\Firefox\Profiles\448bag67.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - component: c:\documents and settings\Vasek\Data aplikací\Mozilla\Firefox\Profiles\448bag67.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}\components\nstidy.dll
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox 3 Beta 2\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-20 19:14:52
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(760)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2009-02-20 19:17:17
ComboFix-quarantined-files.txt 2009-02-20 18:16:26
ComboFix2.txt 2009-02-19 21:07:06
Před spuštěním: Volných bajtů: 31 433 900 032
Po spuštění: Volných bajtů: 31,420,862,464
254 --- E O F --- 2009-02-11 16:21:56
Log z HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:19:37, on 20.2.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\xampp\apache\bin\apache.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\xampp\mysql\bin\mysqld-nt.exe
C:\WINDOWS\system32\slserv.exe
C:\aaa\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\xampp\apache\bin\apache.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\PS pad\PSPad.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Documents and Settings\Vasek\Plocha\Miranda IM\miranda32.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Vasek\Plocha\Downloads\hijackthis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apache2.2 - Apache Software Foundation - C:\xampp\apache\bin\apache.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: mysql - Unknown owner - C:\xampp\mysql\bin\mysqld-nt.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\aaa\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
--
End of file - 5606 bytes
Ten soubor a.ini je v poradku, je to konfigurace Photo DVD Creator, na VirusTotal to melo vysledek 0/39.
MB: ASUS Striker II Formula, CPU: Intel Core™ 2 Duo 3,16GHz, CPU Cooler: Zalman CNPS8700 LED, RAM: 2x1GB Corsair Dominator 1066 MHz DDR II, GPU: ASUS ATI Radeon HD 5770 DDR3 1GB, HDD: WD CG 500GB SATA 300, HDD2: WD CG 2TB SATA 300, Zdroj: Corsair 650W
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43293
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Nelze odstranit rootkit z PC
Logy O.K.
ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u
takže jestli nejsou problémy,tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš
pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj AVG, následně T-Cleaner smaž a zapni si AVG.
Pokud nejsou problémy , je to vše.
ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u
takže jestli nejsou problémy,tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš
pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj AVG, následně T-Cleaner smaž a zapni si AVG.
Pokud nejsou problémy , je to vše.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Zpět na “Viry, antiviry, firewally…”
Kdo je online
Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 7 hostů