PC-HELP.CZ

Dobrý..mam PC s podobnym problemem jak zde http://www.pc-help.cz/viewtopic.php?t=17836
Tady je vypis po projeti programem MWAV:

Soubor C:\Program Files\Eset\infected\2KB2MTCA.NQF//PE-Crypt.XorPE//PE_Patch.UPX//UPX indentifikován jako "not-a-virus:FraudTool.Win32.Agent.n". Provedené akce: Ponecháno, neodstraněno!.
Soubor C:\Program Files\Eset\infected\APEXLVCA.NQF//PE-Crypt.XorPE indentifikován jako "not-virus:Hoax.Win32.Renos.aol". Provedené akce: Ponecháno, neodstraněno!.
Soubor C:\Program Files\Eset\infected\CRCHNZAA.NQF//PE-Crypt.XorPE//PE_Patch.UPX//UPX indentifikován jako "not-a-virus:FraudTool.Win32.XPAntivirus.ld". Provedené akce: Ponecháno, neodstraněno!.
Soubor C:\Program Files\Eset\infected\M13NL1AA.NQF//PE-Crypt.XorPE je infikovaný virem Trojan-Downloader.Win32.FraudLoad.gen !! Provedené akce: Ponecháno, neodstraněno!.
Soubor C:\Program Files\Eset\infected\OATLYZDA.NQF//PE-Crypt.XorPE//stream//data0005 indentifikován jako "not-a-virus:AdWare.Win32.OneStep.c". Provedené akce: Ponecháno, neodstraněno!.
Soubor C:\Program Files\Eset\infected\SWKWZUAA.NQF//PE-Crypt.XorPE je infikovaný virem Trojan-Downloader.Win32.FraudLoad.gen !! Provedené akce: Ponecháno, neodstraněno!.
Soubor C:\Program Files\Eset\infected\UP3LPXAA.NQF//PE-Crypt.XorPE indentifikován jako "not-a-virus:FraudTool.Win32.VirusIsolator.l". Provedené akce: Ponecháno, neodstraněno!.
Soubor C:\Program Files\Eset\infected\VUY2I4AA.NQF//PE-Crypt.XorPE/3.exe indentifikován jako "not-a-virus:FraudTool.Win32.WinAntiVirus.x". Provedené akce: Ponecháno, neodstraněno!.


A zde je po programu Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:15: VIRUS ALERT!, on 2008-07-17
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:9202;https=localhost:9202;socks=Localhost:9203
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre1.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: QXK Olive - {CC7A93B7-2698-4A5F-A745-3074CB042395} - C:\WINDOWS\kgxmotapexd.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre1.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre1.dll
O3 - Toolbar: qndsfmao - {9BAB10CC-0EE5-4B15-9017-B7AF2326724D} - C:\WINDOWS\qndsfmao.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Easy-WebPrint - Náhled - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Přidat na seznam k tisku - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint - Tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Vysokorychlostní tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\ntdll64.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ntdll64.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {7545D8C8-F53C-4E2F-8FA0-D248EF4A6E61} - http://scanner.vav-scan.com/setup/setup.cab
O21 - SSODL: kvxqmtre - {74470686-DC36-4E20-804C-C987AD73DA77} - C:\WINDOWS\kvxqmtre.dll
O21 - SSODL: evgratsm - {77B59537-2C76-432E-BF23-4C558BB39892} - C:\WINDOWS\evgratsm.dll
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6531 bytes


Děkuji za jakoukoliv pomoc. Zbyna05

Ahoj,

fixni v HijackThis:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2


Pouzi Avenger s tymto skriptom:




Potom fixni:

O2 - BHO: QXK Olive - {CC7A93B7-2698-4A5F-A745-3074CB042395} - C:\WINDOWS\kgxmotapexd.dll (file missing)
O3 - Toolbar: qndsfmao - {9BAB10CC-0EE5-4B15-9017-B7AF2326724D} - C:\WINDOWS\qndsfmao.dll (file missing)
O21 - SSODL: kvxqmtre - {74470686-DC36-4E20-804C-C987AD73DA77} - C:\WINDOWS\kvxqmtre.dll (file missing)
O21 - SSODL: evgratsm - {77B59537-2C76-432E-BF23-4C558BB39892} - C:\WINDOWS\evgratsm.dll (file missing)

To prvni sem fixnul, ale prosim popiste mi co mam delat stim avangerem...neumim snim..staci jen v bodech.diky

uz vim..maly moment..

Uz sem to udelal..ale napsalo mi to ze nejde vymazat registr(stejne to ty soubory smazalo) situaci mi to nevyresilo..mam tu dat opet vypis?

Davam tu znovu vypis..jesi to neco pomohlo..uz nevyskakuji chybove tabulky..ale porad se nejde pripojit k internrtu.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:38: VIRUS ALERT!, on 2008-07-17
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:9202;https=localhost:9202;socks=Localhost:9203
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre1.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre1.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre1.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Easy-WebPrint - Náhled - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Přidat na seznam k tisku - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint - Tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Vysokorychlostní tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\ntdll64.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\ntdll64.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {7545D8C8-F53C-4E2F-8FA0-D248EF4A6E61} - http://scanner.vav-scan.com/setup/setup.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6709 bytes

Poslite log z ComboFixu a prilozte ako prilohu log zo SysInspectoru.

ComboFix 08-07-15.4 - STANICE 2008-07-18 5:56:30.11 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.1633 [GMT 2:00]
Running from: C:\Documents and Settings\STANICE\Plocha\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\STANICE\Oblíbené položky\Error Cleaner.url
C:\Documents and Settings\STANICE\Oblíbené položky\Privacy Protector.url
C:\Documents and Settings\STANICE\Oblíbené položky\Spyware&Malware Protection.url
C:\Documents and Settings\STANICE\Plocha\Error Cleaner.url
C:\Documents and Settings\STANICE\Plocha\Privacy Protector.url
C:\Documents and Settings\STANICE\Plocha\Spyware&Malware Protection.url
C:\WINDOWS\kvxqmtre.dll
C:\WINDOWS\regedit.com
C:\WINDOWS\system32\taskmgr.com
.
---- Previous Run -------
.
C:\Documents and Settings\STANICE\Oblíbené položky\Error Cleaner.url
C:\Documents and Settings\STANICE\Oblíbené položky\Privacy Protector.url
C:\Documents and Settings\STANICE\Oblíbené položky\Spyware&Malware Protection.url
C:\Documents and Settings\STANICE\Plocha\Error Cleaner.url
C:\Documents and Settings\STANICE\Plocha\Privacy Protector.url
C:\Documents and Settings\STANICE\Plocha\Spyware&Malware Protection.url

.
((((((((((((((((((((((((( Files Created from 2008-06-18 to 2008-07-18 )))))))))))))))))))))))))))))))
.

2008-07-17 10:15 . 2008-07-17 10:15 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-17 09:57 . 2008-07-17 10:12 0 --a------ C:\23990098.$$$
2008-07-17 08:42 . 2007-10-29 14:00 147,968 --a------ C:\WINDOWS\R.COM
2008-07-17 08:42 . 2007-10-29 14:00 137,216 --a------ C:\WINDOWS\system32\T.COM
2008-07-17 08:42 . 2008-07-17 08:42 26 --a------ C:\WINDOWS\Lic.xxx
2008-07-17 08:32 . 2008-07-17 08:32 <DIR> d-------- C:\Program Files\CCleaner
2008-07-17 06:54 . 2008-07-17 06:54 <DIR> d-------- C:\Program Files\Alwil Software
2008-07-14 23:13 . 2008-07-14 23:13 30,208 --a------ C:\WINDOWS\system32\ntdll64.dll
2008-07-14 23:04 . 2008-07-14 23:04 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-07-14 22:37 . 2008-07-14 22:37 <DIR> d--hs---- C:\found.000
2008-07-14 19:08 . 2008-07-14 18:40 102,400 --a------ C:\WINDOWS\agpqlrfm.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-15 14:48 --------- d-----w C:\Documents and Settings\STANICE\Data aplikací\MegauploadToolbar
2008-07-14 14:36 --------- d-----w C:\Program Files\TrackMania Nations ESWC
2008-07-09 16:05 --------- d-----w C:\Program Files\RTL
2008-07-09 16:03 --------- d-----w C:\Program Files\Skispringen 2006 Demo
2008-07-09 16:03 --------- d-----w C:\Program Files\GameSpy Arcade
2008-07-07 17:02 163 ----a-w C:\rs_unp.bat
2008-07-07 16:07 --------- d-----w C:\Program Files\RapidSpool
2008-07-03 17:17 --------- d-----w C:\Program Files\free-downloads.net
2008-06-20 17:42 247,296 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-14 18:00 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-10 16:04 --------- d-----w C:\Program Files\Conduit
2008-06-10 16:04 --------- d-----w C:\Program Files\Alcohol Soft
2008-06-10 16:02 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys.12653074
2008-06-05 15:49 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-06-05 15:44 --------- d-----w C:\Program Files\THQ
2008-05-19 15:26 --------- d-----w C:\Program Files\Winferno
2008-05-07 05:16 1,290,240 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-21 07:03 660,480 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-19 18:15 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2007-12-25 12:59 1,336,031 ----a-w C:\Program Files\wrar371cz.exe
.

((((((((((((((((((((((((((((( snapshot@2008-07-14_21.07.41.50 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-17 06:34:14 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat
- 2008-03-31 16:14:42 46,196 ----a-w C:\WINDOWS\system32\perfc005.dat
+ 2008-07-18 03:57:33 46,196 ----a-w C:\WINDOWS\system32\perfc005.dat
- 2008-03-31 16:14:42 40,128 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-07-18 03:57:33 40,128 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-03-31 16:14:42 309,990 ----a-w C:\WINDOWS\system32\perfh005.dat
+ 2008-07-18 03:57:33 309,990 ----a-w C:\WINDOWS\system32\perfh005.dat
- 2008-03-31 16:14:42 311,740 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-07-18 03:57:33 311,740 ----a-w C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}]
2008-07-03 19:17 1569304 --a------ C:\Program Files\free-downloads.net\tbfre1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "C:\Program Files\free-downloads.net\tbfre1.dll" [2008-07-03 19:17 1569304]

[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "C:\Program Files\free-downloads.net\tbfre1.dll" [2008-07-03 19:17 1569304]

[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2007-10-29 14:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 11:21 153136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 18:43 8466432]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 18:43 81920]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-12-20 17:44 917504]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-30 01:14 155648]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-03-21 14:19 69632]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 16:57 153136]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 10:08 16380416 C:\WINDOWS\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2007-06-28 18:43 1626112 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2007-10-29 14:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Filiago-DSL\\recv.exe"=
"C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"C:\\Program Files\\THQ\\MotoGP URT 3 Demo\\motogp_demo.exe"=

R1 Cinemsup;Cinemsup;C:\WINDOWS\system32\drivers\Cinemsup.sys [2002-07-19 09:10]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2007-10-29 14:00]
R3 SKYNET;TechniSat DVB-PC TV Star PCI;C:\WINDOWS\system32\DRIVERS\SkyNET.SYS [2006-03-14 03:22]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
"2008-05-19 15:26:28 C:\WINDOWS\Tasks\rpc.job"
- C:\Program Files\Winferno\RegistryPowerCleaner\RegPowerClean.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-18 05:58:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
log z ComboFixu:
PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
Completion time: 2008-07-18 5:58:39
ComboFix-quarantined-files.txt 2008-07-18 03:58:36
ComboFix2.txt 2008-07-15 14:13:18
ComboFix3.txt 2008-07-14 21:17:49
ComboFix4.txt 2008-07-14 20:57:52
ComboFix5.txt 2008-07-16 13:56:30

Adresářů: 10, Volných bajtů: 221,376,270,336
Adresářů: 13, Volných bajtů: 221,476,044,800

150 --- E O F --- 2008-07-09 16:00:50

Pouzite Avenger s tymto skriptom:



Zalohu backup.zip z C:\Avenger mi, prosim, poslite na kosacik[at]gmail.com, vdaka.

po Avengeru:

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\agpqlrfm.exe" deleted successfully.
File "C:\rs_unp.bat" deleted successfully.
File "C:\WINDOWS\Tasks\rpc.job" deleted successfully.
Folder "C:\Program Files\Winferno" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Zalohu posilam. Jestli tu mam hodit jeste jakykoliv vypis, tak napiste. Dekuji

Ok, uspesne zmazane. Ako sa sprava pocitac?

jo neslo mi to odeslat na ten tvuj mail... ozvi se kdyztak na zbyna.t@seznam.cz