Kontrola logu HJK-Virus TCAV

[letadloaero]

Log pouze v režimu nouze.
ComboFix 08-04-13.2 - PC1 14.04.2008 7:51:21.1 - NTFSx86 NETWORK
Microsoft Windows 2000 Professional 5.0.2195.4.1250.1.1029.18.195 [GMT 2:00]
Running from: C:\Documents and Settings\PC1\Plocha\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINNT\regedit.com
C:\WINNT\system32\taskmgr.com
C:\WINNT\Web\default.htt

.
((((((((((((((((((((((((( Files Created from 2008-03-14 to 2008-04-14 )))))))))))))))))))))))))))))))
.

2008-04-14 07:51 . 14.04.08 07:51 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_1ec.dat
2008-04-11 07:37 . 11.04.08 07:37 <DIR> d-------- C:\WINNT\ERUNT
2008-04-11 07:26 . 11.04.08 11:28 <DIR> d-------- C:\SDFix
2008-04-11 07:04 . 11.04.08 07:04 3,189 -ra------ C:\WINNT\system32\drivers\vreadmem.sys
2008-04-11 07:00 . 11.04.08 07:00 <DIR> d-a------ C:\WINNT\zts2.exe
2008-04-11 07:00 . 11.04.08 07:00 <DIR> d-a------ C:\WINNT\system32\vcmgcd32.dll
2008-04-11 07:00 . 11.04.08 07:00 <DIR> d-a------ C:\WINNT\system32\iifgfgf.dll
2008-04-11 07:00 . 11.04.08 07:00 <DIR> d-a------ C:\WINNT\rundll16.exe
2008-04-11 07:00 . 11.04.08 07:00 <DIR> d-a------ C:\WINNT\rundl132.dll
2008-04-11 07:00 . 11.04.08 07:00 <DIR> d-a------ C:\WINNT\logo1_.exe
2008-04-11 06:58 . 11.04.08 06:58 26 --a------ C:\WINNT\Lic.xxx
2008-04-11 06:57 . 19.06.03 12:05 87,824 --a------ C:\WINNT\system32\T.COM
2008-04-11 06:57 . 19.06.03 12:05 74,512 --a------ C:\WINNT\R.COM
2008-04-10 14:22 . 10.04.08 14:22 <DIR> d-------- C:\Program Files\CCleaner
2008-04-10 11:01 . 11.04.08 11:27 <DIR> d-------- C:\Hijack
2008-04-10 09:49 . 10.04.08 09:49 <DIR> d--hs---- C:\INCINERATE
2008-04-07 08:06 . 07.04.08 08:06 0 --a------ C:\WINNT\vpc32.INI

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-10 12:23 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2008-04-10 07:44 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-04-09 10:10 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-04-09 09:45 --------- d-----w C:\Program Files\OpenOffice.org1.1.2
2007-02-01 10:22 271 ---h--w C:\Program Files\desktop.ini
2007-02-01 10:22 22,034 ---h--w C:\Program Files\folder.htt
2000-12-12 09:17 100,432 ------w C:\Program Files\Win2000PPAHotfix.exe
2000-03-20 00:00 32,528 ----a-w C:\WINNT\inf\wbfirdma.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" [20.03.00 02:00 20752 C:\WINNT\system32\internat.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" [20.03.00 02:00 20752 C:\WINNT\system32\internat.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [19.06.03 12:05 188688]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Iomega Startup Options"=C:\Program Files\Iomega\Common\ImgStart.exe
"Iomega Drive Icons"=C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
"vptray"=C:\PROGRA~1\SYMANT~1\VPTray.exe
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

R0 ppa;Ovladač filtru paralelního portu Iomega;C:\WINNT\system32\DRIVERS\ppa.sys [19.06.03 12:05 ]
R3 ELNK3;3Com EtherLink III;C:\WINNT\system32\DRIVERS\elnk3.sys [25.09.99 04:16 ]
S3 {DEF85C80-216A-43ab-AF70-1665EDBE2780};{DEF85C80-216A-43ab-AF70-1665EDBE2780};C:\WINNT\TEMP\7.tmp []
S3 atirage;atirage;C:\WINNT\system32\DRIVERS\atiragem.sys [08.03.00 19:59 ]
S3 ES1370;Creative AudioPCI (ES1370), SB PCI 64/128 (WDM);C:\WINNT\system32\drivers\ES1370MP.sys [13.11.99 00:12 ]
S3 FTCUSB;FTCUSB.SYS FT2232C IO test driver;C:\WINNT\system32\drivers\ftcusb.sys []
S3 VReadMemDriver;VReadMemDriver;C:\WINNT\system32\drivers\vreadmem.sys [11.04.08 07:04 ]

.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-14 07:52:56
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\{DEF85C80-216A-43ab-AF70-1665EDBE2780}]
"ImagePath"="\??\C:\WINNT\TEMP\7.tmp"
.
Completion time: 14.04.2008 7:53:52
ComboFix-quarantined-files.txt 2008-04-14 05:53:25

Adresářů: 13 Volných bajtů: 867,160,064
Adresářů: 16 Volných bajtů: 860,471,296

[Reklama]

[Baron Prášil]

použij nejprve Dr. Web CureIt http://www.viry.cz/forum/viewtopic.php?t=47721
vše co najde nech smazat

potom stáhni MBR http://www2.gmer.net/mbr/mbr.exe
ulož na disk C:\ dvojklikem spusť>vytvoří se log mbr.log a ten vlož sem

potom si otevři Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok)
Zkopíruj do něj následující text označený zeleně:

Kód: Vybrat vše

File::
C:\WINNT\vpc32.INI
C:\WINNT\TEMP\7.tmp

Driver::
"{DEF85C80-216A-43ab-AF70-1665EDBE2780}"

Registry::
[-HKEY_LOCAL_MACHINE\system\ControlSet002\Services\{DEF85C80-216A-43ab-AF70-1665EDBE2780}]

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť

- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

[letadloaero]

Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
MBR rootkit code detected !
malicious code @ sector 0x60d3de size 0x1ca !
copy of MBR has been found in sector 62 !
MBR rootkit infection detected ! Use: "mbr.exe -f" to fix.



ComboFix 08-04-13.2 - PC1 2008-04-14 14:19:40.4 - NTFSx86 MINIMAL
Microsoft Windows 2000 Professional 5.0.2195.4.1250.1.1029.18.197 [GMT 2:00]
Running from: C:\Documents and Settings\PC1\Plocha\ComboFix.exe
Command switches used :: C:\Documents and Settings\PC1\Plocha\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINNT\TEMP\7.tmp
C:\WINNT\vpc32.INI
.

((((((((((((((((((((((((( Files Created from 2008-03-14 to 2008-04-14 )))))))))))))))))))))))))))))))
.

2008-04-14 14:19 . 08-04-14 14:19 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_180.dat
2008-04-14 14:09 . 08-04-14 14:09 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_178.dat
2008-04-14 10:57 . 08-04-14 14:06 <DIR> d-------- C:\Documents and Settings\PC1\DoctorWeb
2008-04-11 07:37 . 08-04-11 07:37 <DIR> d-------- C:\WINNT\ERUNT
2008-04-11 07:26 . 08-04-14 13:57 <DIR> d-------- C:\SDFix
2008-04-11 07:04 . 08-04-11 07:04 3,189 -ra------ C:\WINNT\system32\drivers\vreadmem.sys
2008-04-11 07:00 . 08-04-11 07:00 <DIR> d-a------ C:\WINNT\zts2.exe
2008-04-11 07:00 . 08-04-11 07:00 <DIR> d-a------ C:\WINNT\system32\vcmgcd32.dll
2008-04-11 07:00 . 08-04-11 07:00 <DIR> d-a------ C:\WINNT\system32\iifgfgf.dll
2008-04-11 07:00 . 08-04-11 07:00 <DIR> d-a------ C:\WINNT\rundll16.exe
2008-04-11 07:00 . 08-04-11 07:00 <DIR> d-a------ C:\WINNT\rundl132.dll
2008-04-11 07:00 . 08-04-11 07:00 <DIR> d-a------ C:\WINNT\logo1_.exe
2008-04-11 06:58 . 08-04-11 06:58 26 --a------ C:\WINNT\Lic.xxx
2008-04-11 06:57 . 03-06-19 12:05 87,824 --a------ C:\WINNT\system32\T.COM
2008-04-11 06:57 . 03-06-19 12:05 74,512 --a------ C:\WINNT\R.COM
2008-04-10 14:22 . 08-04-10 14:22 <DIR> d-------- C:\Program Files\CCleaner
2008-04-10 11:01 . 08-04-11 11:27 <DIR> d-------- C:\Hijack
2008-04-10 09:49 . 08-04-10 09:49 <DIR> d--hs---- C:\INCINERATE

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-14 12:00 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2008-04-10 07:44 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-04-09 10:10 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-04-09 09:45 --------- d-----w C:\Program Files\OpenOffice.org1.1.2
2007-02-01 10:22 271 ---h--w C:\Program Files\desktop.ini
2007-02-01 10:22 22,034 ---h--w C:\Program Files\folder.htt
2000-12-12 09:17 100,432 ------w C:\Program Files\Win2000PPAHotfix.exe
2000-03-20 00:00 32,528 ----a-w C:\WINNT\inf\wbfirdma.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" [00-03-20 02:00 20752 C:\WINNT\system32\internat.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-19 12:05 111888 C:\WINNT\system32\mobsync.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" [00-03-20 02:00 20752 C:\WINNT\system32\internat.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [03-06-19 12:05 188688]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Iomega Startup Options"=C:\Program Files\Iomega\Common\ImgStart.exe
"Iomega Drive Icons"=C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
"vptray"=C:\PROGRA~1\SYMANT~1\VPTray.exe
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

R0 ppa;Ovladač filtru paralelního portu Iomega;C:\WINNT\system32\DRIVERS\ppa.sys [03-06-19 12:05 ]
S3 atirage;atirage;C:\WINNT\system32\DRIVERS\atiragem.sys [00-03-08 19:59 ]
S3 ELNK3;3Com EtherLink III;C:\WINNT\system32\DRIVERS\elnk3.sys [99-09-25 04:16 ]
S3 ES1370;Creative AudioPCI (ES1370), SB PCI 64/128 (WDM);C:\WINNT\system32\drivers\ES1370MP.sys [99-11-13 00:12 ]
S3 FTCUSB;FTCUSB.SYS FT2232C IO test driver;C:\WINNT\system32\drivers\ftcusb.sys []
S3 VReadMemDriver;VReadMemDriver;C:\WINNT\system32\drivers\vreadmem.sys [08-04-11 07:04 ]

.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-14 14:21:17
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-14 14:22:12
ComboFix-quarantined-files.txt 2008-04-14 12:21:45

Adresářů: 12 Volných bajtů: 918,507,520
Adresářů: 15 Volných bajtů: 912,809,984