antivirus 2009

[solky]

Caute mohli by ste sa mo pozriet na log
ComboFix 08-11-10.01 - kadzer 2008-11-11 13:22:20.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.565 [GMT 1:00]
Running from: c:\documents and settings\kadzer\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\kadzer\Favorites\Download programs.url
c:\documents and settings\kadzer\Favorites\Games.url
c:\documents and settings\kadzer\Favorites\Translator.url
c:\documents and settings\kadzer\Favorites\Videos.url
c:\documents and settings\kadzer\Start Menu\Programs\Download programs.url
c:\documents and settings\kadzer\Start Menu\Programs\Games.url
c:\documents and settings\kadzer\Start Menu\Programs\Translator.url
c:\documents and settings\kadzer\Start Menu\Programs\Videos.url
c:\program files\Antivirus 2009
c:\program files\Antivirus 2009\av2009.exe
c:\windows\system32\ieupdates.exe

.
((((((((((((((((((((((((( Files Created from 2008-10-11 to 2008-11-11 )))))))))))))))))))))))))))))))
.

2008-11-05 21:21 . 2008-11-05 21:21 <DIR> d-------- c:\program files\iOrgSoft
2008-10-30 16:08 . 2004-08-03 23:01 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2008-10-30 16:08 . 2004-08-03 23:01 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys
2008-10-28 19:47 . 2008-10-28 19:47 <DIR> d-------- c:\documents and settings\kadzer\Application Data\Leadertech
2008-10-28 19:29 . 2008-03-05 15:56 3,786,760 --a------ c:\windows\system32\D3DX9_37.dll
2008-10-28 19:29 . 2007-07-19 18:14 3,727,720 --a------ c:\windows\system32\d3dx9_35.dll
2008-10-28 19:28 . 2007-05-16 16:45 3,497,832 --a------ c:\windows\system32\d3dx9_34.dll
2008-10-28 19:28 . 2007-03-12 16:42 3,495,784 --a------ c:\windows\system32\d3dx9_33.dll
2008-10-28 19:28 . 2006-11-29 13:06 3,426,072 --a------ c:\windows\system32\d3dx9_32.dll
2008-10-28 19:28 . 2006-09-28 16:05 2,414,360 --a------ c:\windows\system32\d3dx9_31.dll
2008-10-28 19:28 . 2005-05-26 15:34 2,297,552 --a------ c:\windows\system32\d3dx9_26.dll
2008-10-28 19:28 . 2007-04-04 18:53 81,768 --a------ c:\windows\system32\xinput1_3.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-28 18:29 --------- d-----w c:\program files\EA Sports
2008-10-20 18:56 --------- d-----w c:\documents and settings\kadzer\Application Data\ICQ
2008-10-03 15:01 --------- d-----w c:\documents and settings\kadzer\Application Data\dvdcss
2008-09-24 21:30 --------- d-----w c:\documents and settings\kadzer\Application Data\Skype
2008-09-24 21:03 --------- d--h--w c:\program files\InstallShield Installation Information
2008-09-24 21:03 --------- d-----w c:\program files\ICQ6
2008-09-24 21:02 --------- d-----w c:\program files\ICQ6Toolbar
2008-09-24 21:02 --------- d-----w c:\documents and settings\All Users\Application Data\ICQ
2008-05-20 08:25 332,800 --sha-r c:\documents and settings\kadzer\wget.exe
2008-03-03 12:41 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2008-05-19 19:12 332,800 --sha-r c:\windows\wget.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FreeRAM XP"="c:\programs\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" [2006-03-22 1591808]
"DAEMON Tools"="c:\programs\DAEMON Tools\daemon.exe" [2007-08-16 167368]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 495616]
"ICQ"="c:\program files\ICQ6\ICQ.exe" [2008-09-01 173304]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-20 86016]
"nod32kui"="c:\programs\Eset\nod32kui.exe" [2008-03-01 950664]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-24 487424]
"FineReader7NewsReaderPro"="c:\program files\ABBYY FineReader 7.0 Professional Edition\ABBYYNewsReader.exe" [2004-12-16 290816]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
"nwiz"="nwiz.exe" [2006-07-20 c:\windows\system32\nwiz.exe]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-07-27 c:\windows\system32\CHDAudPropShortcut.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"msacm.divxa32"= divxa32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-26 12:12 161328 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-02-01 17:22 21898024 c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-01-15 23:54 37376 c:\programs\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programs\\SiSoftware\\SiSoftware Sandra Lite 2005.SR2a\\sandra.exe"=
"c:\\Programs\\SiSoftware\\SiSoftware Sandra Lite 2005.SR2a\\RpcSandraSrv.exe"=
"c:\\Programs\\SiSoftware\\SiSoftware Sandra Lite 2005.SR2a\\RpcDataSrv.exe"=
"c:\\Programs\\Valve\\hl.exe"=
"c:\\Programs\\kadzer\\Desktop\\sdc212\\StrongDC.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=

R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2008-06-10 222456]
R3 PSched;QoS Packet Scheduler;c:\windows\system32\DRIVERS\psched.sys [2004-08-03 69120]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dd19be32-2d7f-11dd-8ace-001636d51d98}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL thG.exe

*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-ICQ Lite - c:\program files\ICQLite\ICQLite.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\kadzer\Application Data\Mozilla\Firefox\Profiles\bioba3ga.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.zoznam.sk
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-11 13:24:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-11-11 13:24:52
ComboFix-quarantined-files.txt 2008-11-11 12:24:45

Pre-Run: 3 582 869 504 bytes free
Post-Run: 4,562,165,760 bytes free

131 --- E O F --- 2008-03-03 12:00:59

[Reklama]

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dd19be32-2d7f-11dd-8ace-001636d51d98}]


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT