PC-HELP.CZ

Dobrý den,
Avast mi našel Win32:RustNT [Rtk].
Poraďte mi, prosím, jak se ho zbavit.
Děkuji.

výpis z Malwarebytes' Anti-Malware

Malwarebytes' Anti-Malware 1.42
Verze databáze: 3438
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

27.12.2009 14:14:48
mbam-log-2009-12-27 (14-14-45).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 143229
Uplynulý čas: 5 minute(s), 4 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 2
Infikované adresáře: 0
Infikované soubory: 3

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BITS\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemRoot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> No action taken.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemroot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> No action taken.

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\WINDOWS\system32\drivers\ef98948b.sys (Rootkit.Rustock) -> No action taken.
C:\Documents and Settings\stuf\Data aplikací\wiaserva.log (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\h@tkeysh@@k.dll (Trojan.Agent) -> No action taken.


výpis z HiJackThis

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 14:01:48, on 27.12.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\ITE\ITE IT8212 ATA RAID Controller\RaidMgr.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9999
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: (no name) - {3C6301ED-0F78-4AF2-8150-D9C052361A8E} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {EBBFE27C-BDF0-11D2-BBE5-00609419F467} - (no file)
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [ToolBoxFX] "C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /DropDisc
O4 - HKCU\..\Run: [OEXPRESS] C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: RAID Manager.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Vytvořit mobilní oblíbenou položku… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - (no file)
O9 - Extra 'Tools' menuitem: Translator Settings - {CC963627-B1DC-40E0-B52A-CF21EE748449} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - (no file)
O9 - Extra 'Tools' menuitem: &Dictionary - {CC963627-B1DC-40E0-B52A-CF21EE748450} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - (no file)
O9 - Extra 'Tools' menuitem: Translate Marked Text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - (no file)
O9 - Extra 'Tools' menuitem: Translate Web Page - {CC963627-B1DC-40E0-B52A-CF21EE748452} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [java_sun] Java (Sun)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {e8f628b5-259a-4734-97ee-ba914d7be941} (Driver Agent ActiveX Control) - http://www.driveragent.com/files/driveragent.cab
O18 - Protocol: skyline - {3A4F9195-65A8-11D5-85C1-0001023952C1} - C:\Program Files\Skyline\TerraExplorer\TerraExplorerX.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswupdsv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus (avast! antivirus) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner (avast! mail scanner) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner (avast! web scanner) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Služba inteligentního přenosu na pozadí (BITS) (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (javaquickstarterservice) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Automatické aktualizace (wuauserv) - Unknown owner - C:\WINDOWS\

--
End of file - 9743 bytes

1.Spusť HJT (HijackThis), vypni prohlížeče, odpoj se od internetu a fixni (spustit HJT, "Do a system scan only",
zatrhnout políčko před hodnotou, zmáčknout "Fix checked" a poté "Ano"):

O2 - BHO: (no name) - {3C6301ED-0F78-4AF2-8150-D9C052361A8E} - (no file)
O2 - BHO: (no name) - {EBBFE27C-BDF0-11D2-BBE5-00609419F467} - (no file)
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - (no file)
O9 - Extra 'Tools' menuitem: Translator Settings - {CC963627-B1DC-40E0-B52A-CF21EE748449} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - (no file)
O9 - Extra 'Tools' menuitem: &Dictionary - {CC963627-B1DC-40E0-B52A-CF21EE748450} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - (no file)
O9 - Extra 'Tools' menuitem: Translate Marked Text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - (no file)
O9 - Extra 'Tools' menuitem: Translate Web Page - {CC963627-B1DC-40E0-B52A-CF21EE748452} - (no file)
*****************************************************************************************************************************************
2. Vypni si Body obnovení a po chvíli si je opět zapni.
*****************************************************************************************************************************************
3. Spusť znovu MbAM a dej Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Konec

Vypni rezidentní štít antiviru (pokud máš tak i antispyware).
Stáhni si ComboFix (by sUBs)
nebo ComboFix (subs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

vše pro vedeno, ale
MbAM vyžadoval restart po vyčištění, tak jsem jej nechal skenovat znova, a tady dávám výsledek druhého skenu
ComboFix taky restartoval počítač, což asi nevadí, ale po restartu mi najel AVAST, tak nevím, jestli ho mám pustit taky znova.

MbAM

Malwarebytes' Anti-Malware 1.42
Verze databáze: 3438
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

27.12.2009 17:21:31
mbam-log-2009-12-27 (17-21-31).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 142993
Uplynulý čas: 4 minute(s), 16 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 2
Infikované adresáře: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BITS\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemRoot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemroot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully.

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
(Nebyly nalezeny žádné škodlivé položky)

ComboFix

ComboFix 09-12-26.05 - stuf 27.12.2009 17:31:12.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1532 [GMT 1:00]
Spuštěný z: c:\documents and settings\stuf\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 091227-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\install.exe
c:\windows\regedit.com
c:\windows\system32\taskmgr.com
c:\windows\system32\tmp13.tmp
c:\windows\system32\tmp14.tmp
E:\x.txt

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_IPRIP
-------\Service_Iprip


((((((((((((((((((((((((( Soubory vytvořené od 2009-11-27 do 2009-12-27 )))))))))))))))))))))))))))))))
.

2009-12-27 13:08 . 2009-12-03 15:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-27 13:08 . 2009-12-27 13:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-27 13:08 . 2009-12-03 15:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-27 13:01 . 2009-12-27 13:01 -------- d-----w- c:\program files\TrendMicro
2009-12-25 21:55 . 2009-12-25 21:55 -------- d-----w- c:\program files\Microsoft Games
2009-12-23 15:56 . 2009-12-23 15:56 -------- d-----w- c:\program files\Skyline
2009-12-10 22:34 . 2009-12-10 22:34 -------- d-sh--w- c:\documents and settings\stuf\PrivacIE
2009-12-04 06:10 . 2009-12-04 06:10 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-12-04 06:09 . 2009-12-04 06:09 -------- d-sh--w- c:\documents and settings\stuf\IETldCache
2009-12-03 21:09 . 2009-12-03 21:11 -------- dc-h--w- c:\windows\ie8
2009-12-02 10:13 . 2009-11-24 23:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-12-02 10:13 . 2009-11-24 23:49 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-12-02 10:13 . 2009-11-24 23:47 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-12-02 10:13 . 2009-11-24 23:51 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-12-02 10:13 . 2009-11-24 23:47 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-12-02 10:13 . 2009-09-15 11:56 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-12-02 10:13 . 2009-09-15 11:55 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-12-02 10:13 . 2009-09-15 11:55 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-12-02 10:13 . 2009-11-24 23:54 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-12-02 10:13 . 2009-12-02 10:13 -------- d-----w- c:\program files\Alwil Software
2009-11-30 14:06 . 2004-02-26 23:00 962612 ----a-w- c:\windows\system32\mfc42d.dll
2009-11-30 14:06 . 2007-12-17 16:14 12400 ----a-w- c:\windows\system32\drivers\AsIO.sys
2009-11-30 14:06 . 2006-01-10 15:50 24576 ----a-w- c:\windows\system32\AsIO.dll
2009-11-30 13:48 . 2007-08-07 08:28 28272 ----a-w- c:\windows\system32\NicCo2.dll
2009-11-30 13:00 . 2009-11-30 13:00 -------- d-----w- c:\program files\NVIDIA Corporation
2009-11-30 12:59 . 2009-08-06 06:50 2189856 ----a-w- c:\windows\system32\nvcuvid.dll
2009-11-30 12:59 . 2009-08-06 06:50 1706528 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-11-30 12:59 . 2009-08-06 06:50 1597690 ----a-w- c:\windows\system32\nvdata.bin
2009-11-30 12:38 . 2009-11-30 12:38 23600 ----a-w- c:\windows\system32\drivers\TVICHW32.SYS
2009-11-30 12:27 . 2009-11-30 12:27 -------- d-----w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-27 10:40 . 2005-10-21 08:30 -------- d-----w- c:\program files\GExperts
2009-12-02 09:49 . 2005-10-20 07:35 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-02 09:49 . 2009-03-08 09:02 -------- d-----w- c:\program files\ASUS
2009-12-01 07:03 . 2004-08-18 12:00 520974 ----a-w- c:\windows\system32\perfh005.dat
2009-12-01 07:03 . 2004-08-18 12:00 114570 ----a-w- c:\windows\system32\perfc005.dat
2009-11-30 13:52 . 2007-11-08 10:58 -------- d-----w- c:\program files\Common Files\Logitech
2009-11-30 13:51 . 2005-10-20 07:32 -------- d-----w- c:\program files\Intel
2009-11-23 07:59 . 2009-11-23 06:52 -------- d-----r- c:\program files\Skype
2009-11-23 06:56 . 2009-11-23 06:56 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-11-23 06:52 . 2009-11-23 06:52 -------- d-----w- c:\program files\Common Files\Skype
2009-11-14 16:16 . 2009-11-14 16:16 -------- d-----w- c:\program files\BWMeter
2004-10-01 14:00 . 2009-03-12 18:51 40960 ----a-w- c:\program files\Uninstall_CDS.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IW_Drop_Icon"="c:\program files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe" [2006-02-16 1346560]
"OEXPRESS"="c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE" [2008-11-23 26624]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-18 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-18 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-18 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-18 455168]
"RTHDCPL"="RTHDCPL.EXE" [2008-11-17 17676288]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-10-06 53248]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-15 198160]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-08-05 1657376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-06 13877248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-08-06 86016]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-10-09 100888]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
RAID Manager.lnk - c:\program files\ITE\ITE IT8212 ATA RAID Controller\RaidMgr.exe [2009-3-7 724992]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wdfloadgroup]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"%windir%\\system32\\sessmgr.exe"=
"e:\\Valve\\hl.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Hry\\Volejbal\\volley.exe"=
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Disabled:ActiveSync Application
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Disabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Disabled:ActiveSync RAPI Manager
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Disabled:ActiveSync Service

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 iteraid;ITERAID_Service_Install;c:\windows\system32\drivers\iteraid.sys [7.3.2009 20:51 24971]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12.3.2009 21:20 721904]
R1 aswsp;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2.12.2009 11:13 114768]
R1 vobiw;vobiw;c:\windows\system32\drivers\vobIW.sys [1.9.2004 14:50 188416]
R2 aswfsblk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2.12.2009 11:13 20560]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [23.12.2008 16:35 50704]
R3 cdrdrv;Cdrdrv;c:\windows\system32\drivers\Cdrdrv.sys [10.2.2005 11:55 62976]
S1 ef98948b;ef98948b;c:\windows\system32\drivers\ef98948b.sys --> c:\windows\system32\drivers\ef98948b.sys [?]
S1 prodrv04;Star Force copy protection driver v4;c:\windows\system32\drivers\prodrv04.sys [1.9.2007 15:23 114496]
S3 DVC;USB DVC Svc;c:\windows\system32\drivers\DVC.sys [23.12.2005 11:15 38604]
S3 gMouPS2;PS2 Scroll Mouse Device;c:\windows\system32\DRIVERS\gMouPS2.sys --> c:\windows\system32\DRIVERS\gMouPS2.sys [?]
S3 tvichw32;TVICHW32;c:\windows\system32\drivers\TVICHW32.SYS [30.11.2009 13:38 23600]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [11.7.2008 1:28 47128]
S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [10.7.2008 2:49 242712]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [11.7.2008 1:28 369688]
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
uInternet Settings,ProxyServer = http=127.0.0.1:9999
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
FF - ProfilePath - c:\documents and settings\stuf\Data aplikací\Mozilla\Firefox\Profiles\5strzfk6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - component: c:\documents and settings\stuf\Data aplikací\Mozilla\Firefox\Profiles\5strzfk6.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\components\XpcomOpusConnector.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npagent.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-Start WingMan Profiler - (no file)
SafeBoot-AVG Anti-Spyware Driver
SafeBoot-AVG Anti-Spyware Guard



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-27 17:38
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys prosync1.sys hal.dll atapi.sys spwg.sys >>UNKNOWN [0x8A39C938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf763bf28
\Driver\ACPI -> ACPI.sys @ 0xf7495cb8
\Driver\atapi -> prosync1.sys @ 0xf798f661
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e6686
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e6686
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
NDIS: Intel(R) PRO/1000 PM Network Connection -> SendCompleteHandler -> NDIS.sys @ 0xf7a37bb0
PacketIndicateHandler -> NDIS.sys @ 0xf7a26a0d
SendHandler -> NDIS.sys @ 0xf7a3ab40
user & kernel MBR OK

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1644491937-1326574676-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{55DA0DEC-F7AB-2F73-E77E-FE7D81472175}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="811E086BFCF2AC880BF48C0D1EA6BD0EBBFA29C76DC4C64FD0D8BB74764FBFE77CECD5E628B8A76962CC2B19D74942A6271C971D59625FDB0F3231E82484B99A2C8BE8EF8C325E091C903E0A0697A8F5D7AA02AEFD09C9B81224A6763F4F685DA2E2A67AE9C4462D0C69747D79C0FD76822AFC5CDBD44B338DB03AE0975868763791565102C7F42E4AAFDD5F84E972B49ED2035BF7D84E2EFB0CEDC284C0FDBA03E7A1129C07A778FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E667A9C6AECB7A5D1407A9C6AECB7A5D1407A6A0AC4980AC7933AD12419156B379243317C0647573497262C473E53F58BCDCB182AC023F5D1A84F04660D3BB5D5290324D82062A2CB2AAC91CFC6FB80D9853DC54B196E3E344FE805C87F59C4B2B8A67CE16127DEAE5751E4350E415A32DFADEE04C9736935F6B6DC01186E6579E5F83267E1FCEB1F93751043902C2EEA7ED8C4AB30357A750388D133DEA0D4A6B72FE10A3150178A3E69BD56854B6B2D8D8FC6981AC6CD423E6F8292CDB05E4F43D937FD0B4F92DC113F769F1BF6728357C8C49B13D1DBF048E8D8A66E6C659C2483E18B50D252D52D925204E7AD17C5630DA29A72F968345596CF3D46CD14E7F354234E48571CF7970A691D90F75D0F8DA4D7CA75409ADDC06F9D6C52026DEF8B5A460D65750D9001EC28556DC553AFD7A8B6BDA4EA9BFE4E55F56EC0CCA1B22903160E68F3889504185FDE595F842E92181514E16B0309A5F0B4BDF8C49051323F4A75312258DFB48BD2C91426CE3E6F25FBC74775B6960ED2DC219522E9386DB42604012958B35397E75C73B3F12BFAA19F1A212E8C8BB9EBA7DF6E20B335A3D2EE8B51B0B9855AA1FF5D5300532E614676991582021D693ED6FBB95F64112DE15D19D0A8DC45748BA7CF2A4D59B7111C64D5F15C8B7008342C10E188B91556C14E04912A68CDB55B109356D4D1C1717F57E8C61AEC6A9397A50F76CE46B6EA58C10EAB665662723A4549A380AF536AE790E80ADA3FBE7129BAB68E32609CADBA50C19D35DB89F9CFC498301305B4FF61AC6023D7B7AF481ED18B12BF41A00F84AB6511624DFD2BB6484321CE7F7069E64A13F2A0F57B08C7E0F8A3DF9C14376A626717FD4AC6E91CAD952305D67A3ECA74F4BDD3B1C1C4E1F3C0CE96216EEE32D23BDE40D62C842E34F6E38BF3C96BA78B29998E0C8DA756580B65761A204E4152BDC72EF39D707A5A0F681C0796E752EE383EE64CD3A4229F06A7EAC662430D8EF5AA3A5DDB92BCABA40311B19609CE5AEC8C82E11260D8855EF2BFB5516923557264C576EAC0F544003BB880845C7809188E0AAECAF3FE42A6F7E8F5545E82DFA1310B30294278408DC6DC8A71A2020C048C64C308FD7E22179EDA64241A8"
"OODLED02.00.00.02WSSV"="C033BD5806BEE57EBF765A6D2D2CBEB65CA6A1BCC6E7889179AC34D1E333FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B9808A2D97226D213B5558EDD5E5BE2F6E6673AAEAAB79DC67D42FE0E9DDAC42089404404D595B95EC9186F86804E053D12A0F923060C5CB714EB4188FE09664D7D622D18036142DFEAF32584BD3E6719A752D28855A650EB3E42B8A6A74EF619D9FC14FDD082214DF19614AB7F9C80C952065CBAA5871A9EE6AAD92D69DA82785C74E985727DF276138649F200DB1917DB825F7BD3334E320B4DCCC366638E865AF053E07255454D168D08354FF36CEC9E54DB6E94B176ABBB156C7A96200D8038E1A7A52D141BE9D4BA44344D5D2A5B0DC8849B6D0D10B21E334841C64EEA486FF774CDD348EB0740DE29902F987616A974BE6F3A568B94EA9A23ED162F05E30F277A396A83A3825A1091D37F276AF40D2DA5BBA8214E43EF05763977852D7DB9A9AD2A49DA20E03BA911E69C109174E41087B23C8431510F6DEB41B31B2AE326FB37471E6834C60EC9ED1C38DDEBB4EEFA666ECA1B01FA3D94E48766BCB5869CDF73196949288112519E245620EB7882907A6B8086FE9904FE737000BB7EFCFC5AF18F809F367D1AE7D398D2E7FBA705B9AD08DAE9E031FEF35F4743EAA4813A34777C8B110D508D77ECF35BCC7750F49F1D8A2DEB4EE4E080A337C8A4407059F9FD9686C6CFAFE7AC8116706A2D1F61B21D9B9E39E4FD6F7371D2FAC5DA4D73FDB0F8C4EF96F5387A5941E75DE2EA6F26B246A901B6680362AA109AACF0BC3AD570A0683CEBA2A297721EEC4ACF2AD5701AFB1C774637892467C6BB3F760A6C5952F0EB61CD585DFD7D37FBD51FF7E24CC0909A53109D0456F33646E6D02263261EAF1B9BB05EB36B62FB68AC721675B9C83C9AD0FD7586584F7DF410D917879E50081625FA1F85E2B840D57CDC67027C099B67B0F2BB3C4E2CA4D7AADF9E56651A0854C207A9C529CE3BBE77E6F3909A0DB02034C21061A0739353ABA41264E4DFA19BB725B07C49258872540C673FDF125DB5253738C77ABE979E8B5EF157CA392B8A4E978B44127328904EBC12BBDA0BEA71CD8D9CD3CD60E2C5C7365DE788F2DF91D496364B94A0FB11A4DBE7CB5F1F866CFE76CB80CC590929E0CB1BE5D10FDDF31D4A4DD7A64C4D3C18C3004884283F960B9674D8F0E285FA5AB01533A0C0A74DFBD4953E6446C4AF71BE181CA4B48BB14A876D0075673645BC6A5946327123084B48F3EAA815F45DF98C0EC8DF87C0541956ADAADB875A611672992887BC1B66682AF55C99714E0C80E266E098179EEA5683D3A0E794988077B72D78E5F2BE7CB577C7A79A4AAAD4D868C90FF58DC33264051F42A09879A6739C0B6A56991E"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(2424)
c:\documents and settings\All Users\Data aplikací\LangSoft\TrnOEH.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\System32\snmp.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\RTHDCPL.EXE
c:\program files\Microsoft ActiveSync\Wcescomm.exe
c:\progra~1\MICROS~4\rapimgr.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2009-12-27 17:42:44 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-12-27 16:42

Před spuštěním: Volných bajtů: 26 270 945 280
Po spuštění: Volných bajtů: 26 184 589 312

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 65BBFDBD92CA11F64958D45468AB992B

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
c:\windows\system32\ezsidmv.dat
c:\windows\system32\drivers\ef98948b.sys
C:\Documents and Settings\stuf\Data aplikací\wiaserva.log
C:\WINDOWS\system32\h@tkeysh@@k.dll

Driver::
ef98948b;ef98948b
ef98948b

Rootkit::
c:\windows\system32\drivers\ef98948b.sys




Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix, oprava může trvat i déle než 10 minut. ! Nech ComboFix dokončit svou práci !
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT a popiš chování počítače

ComboFix

ComboFix 09-12-26.05 - stuf 27.12.2009 18:21:50.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2047.1521 [GMT 1:00]
Spuštěný z: c:\documents and settings\stuf\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\stuf\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 091227-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\documents and settings\stuf\Data aplikací\wiaserva.log"
"c:\windows\system32\drivers\ef98948b.sys"
"c:\windows\system32\ezsidmv.dat"
"c:\windows\system32\h@tkeysh@@k.dll"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ezsidmv.dat

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ef98948b


((((((((((((((((((((((((( Soubory vytvořené od 2009-11-27 do 2009-12-27 )))))))))))))))))))))))))))))))
.

2009-12-27 16:59 . 2009-12-27 17:02 -------- d-----w- c:\windows\ie8updates
2009-12-27 16:50 . 2009-06-21 21:48 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-12-27 16:50 . 2009-10-29 07:43 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-12-27 16:49 . 2009-10-29 07:43 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-12-27 16:49 . 2009-07-10 13:28 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-12-27 13:08 . 2009-12-03 15:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-27 13:08 . 2009-12-27 13:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-27 13:08 . 2009-12-03 15:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-27 13:01 . 2009-12-27 13:01 -------- d-----w- c:\program files\TrendMicro
2009-12-25 21:55 . 2009-12-25 21:55 -------- d-----w- c:\program files\Microsoft Games
2009-12-23 15:56 . 2009-12-23 15:56 -------- d-----w- c:\program files\Skyline
2009-12-10 22:34 . 2009-12-10 22:34 -------- d-sh--w- c:\documents and settings\stuf\PrivacIE
2009-12-04 06:10 . 2009-12-04 06:10 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-12-04 06:09 . 2009-12-04 06:09 -------- d-sh--w- c:\documents and settings\stuf\IETldCache
2009-12-03 21:09 . 2009-12-03 21:11 -------- dc-h--w- c:\windows\ie8
2009-12-02 10:13 . 2009-11-24 23:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-12-02 10:13 . 2009-11-24 23:49 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-12-02 10:13 . 2009-11-24 23:47 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-12-02 10:13 . 2009-11-24 23:51 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-12-02 10:13 . 2009-11-24 23:47 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-12-02 10:13 . 2009-09-15 11:56 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-12-02 10:13 . 2009-09-15 11:55 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-12-02 10:13 . 2009-09-15 11:55 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-12-02 10:13 . 2009-11-24 23:54 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-12-02 10:13 . 2009-12-02 10:13 -------- d-----w- c:\program files\Alwil Software
2009-11-30 14:06 . 2004-02-26 23:00 962612 ----a-w- c:\windows\system32\mfc42d.dll
2009-11-30 14:06 . 2007-12-17 16:14 12400 ----a-w- c:\windows\system32\drivers\AsIO.sys
2009-11-30 14:06 . 2006-01-10 15:50 24576 ----a-w- c:\windows\system32\AsIO.dll
2009-11-30 13:48 . 2007-08-07 08:28 28272 ----a-w- c:\windows\system32\NicCo2.dll
2009-11-30 13:00 . 2009-11-30 13:00 -------- d-----w- c:\program files\NVIDIA Corporation
2009-11-30 12:59 . 2009-08-06 06:50 2189856 ----a-w- c:\windows\system32\nvcuvid.dll
2009-11-30 12:59 . 2009-08-06 06:50 1706528 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-11-30 12:59 . 2009-08-06 06:50 1597690 ----a-w- c:\windows\system32\nvdata.bin
2009-11-30 12:38 . 2009-11-30 12:38 23600 ----a-w- c:\windows\system32\drivers\TVICHW32.SYS
2009-11-30 12:27 . 2009-11-30 12:27 -------- d-----w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-27 17:06 . 2004-08-18 12:00 520974 ----a-w- c:\windows\system32\perfh005.dat
2009-12-27 17:06 . 2004-08-18 12:00 114570 ----a-w- c:\windows\system32\perfc005.dat
2009-12-27 10:40 . 2005-10-21 08:30 -------- d-----w- c:\program files\GExperts
2009-12-02 09:49 . 2005-10-20 07:35 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-02 09:49 . 2009-03-08 09:02 -------- d-----w- c:\program files\ASUS
2009-11-30 13:52 . 2007-11-08 10:58 -------- d-----w- c:\program files\Common Files\Logitech
2009-11-30 13:51 . 2005-10-20 07:32 -------- d-----w- c:\program files\Intel
2009-11-23 07:59 . 2009-11-23 06:52 -------- d-----r- c:\program files\Skype
2009-11-23 06:52 . 2009-11-23 06:52 -------- d-----w- c:\program files\Common Files\Skype
2009-11-14 16:16 . 2009-11-14 16:16 -------- d-----w- c:\program files\BWMeter
2009-10-29 07:43 . 2004-08-18 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-13 10:34 . 2004-08-18 12:00 271360 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:40 . 2004-08-18 12:00 79872 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:40 . 2004-08-18 12:00 150016 ----a-w- c:\windows\system32\rastls.dll
2004-10-01 14:00 . 2009-03-12 18:51 40960 ----a-w- c:\program files\Uninstall_CDS.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IW_Drop_Icon"="c:\program files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe" [2006-02-16 1346560]
"OEXPRESS"="c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE" [2008-11-23 26624]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-18 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-18 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-18 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-18 455168]
"RTHDCPL"="RTHDCPL.EXE" [2008-11-17 17676288]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-10-06 53248]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-15 198160]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-08-05 1657376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-06 13877248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-08-06 86016]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-10-09 100888]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
RAID Manager.lnk - c:\program files\ITE\ITE IT8212 ATA RAID Controller\RaidMgr.exe [2009-3-7 724992]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wdfloadgroup]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"%windir%\\system32\\sessmgr.exe"=
"e:\\Valve\\hl.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Hry\\Volejbal\\volley.exe"=
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Disabled:ActiveSync Application
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Disabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Disabled:ActiveSync RAPI Manager
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Disabled:ActiveSync Service

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 iteraid;ITERAID_Service_Install;c:\windows\system32\drivers\iteraid.sys [7.3.2009 20:51 24971]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12.3.2009 21:20 721904]
R1 aswsp;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2.12.2009 11:13 114768]
R1 vobiw;vobiw;c:\windows\system32\drivers\vobIW.sys [1.9.2004 14:50 188416]
R2 aswfsblk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2.12.2009 11:13 20560]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [23.12.2008 16:35 50704]
R3 cdrdrv;Cdrdrv;c:\windows\system32\drivers\Cdrdrv.sys [10.2.2005 11:55 62976]
S1 prodrv04;Star Force copy protection driver v4;c:\windows\system32\drivers\prodrv04.sys [1.9.2007 15:23 114496]
S3 DVC;USB DVC Svc;c:\windows\system32\drivers\DVC.sys [23.12.2005 11:15 38604]
S3 gMouPS2;PS2 Scroll Mouse Device;c:\windows\system32\DRIVERS\gMouPS2.sys --> c:\windows\system32\DRIVERS\gMouPS2.sys [?]
S3 tvichw32;TVICHW32;c:\windows\system32\drivers\TVICHW32.SYS [30.11.2009 13:38 23600]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [11.7.2008 1:28 47128]
S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [10.7.2008 2:49 242712]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [11.7.2008 1:28 369688]
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
uInternet Settings,ProxyServer = http=127.0.0.1:9999
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
FF - ProfilePath - c:\documents and settings\stuf\Data aplikací\Mozilla\Firefox\Profiles\5strzfk6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - component: c:\documents and settings\stuf\Data aplikací\Mozilla\Firefox\Profiles\5strzfk6.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\components\XpcomOpusConnector.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npagent.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-27 18:30
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys prosync1.sys hal.dll atapi.sys spsw.sys >>UNKNOWN [0x8A39C938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf763bf28
\Driver\ACPI -> ACPI.sys @ 0xf7495cb8
\Driver\atapi -> prosync1.sys @ 0xf798f661
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
NDIS: Intel(R) PRO/1000 PM Network Connection -> SendCompleteHandler -> NDIS.sys @ 0xf7a37bb0
PacketIndicateHandler -> NDIS.sys @ 0xf7a44a21
SendHandler -> NDIS.sys @ 0xf7a2287b
user & kernel MBR OK

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1644491937-1326574676-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{55DA0DEC-F7AB-2F73-E77E-FE7D81472175}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="811E086BFCF2AC880BF48C0D1EA6BD0EBBFA29C76DC4C64FD0D8BB74764FBFE77CECD5E628B8A76962CC2B19D74942A6271C971D59625FDB0F3231E82484B99A2C8BE8EF8C325E091C903E0A0697A8F5D7AA02AEFD09C9B81224A6763F4F685DA2E2A67AE9C4462D0C69747D79C0FD76822AFC5CDBD44B338DB03AE0975868763791565102C7F42E4AAFDD5F84E972B49ED2035BF7D84E2EFB0CEDC284C0FDBA03E7A1129C07A778FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E667A9C6AECB7A5D1407A9C6AECB7A5D1407A6A0AC4980AC7933AD12419156B379243317C0647573497262C473E53F58BCDCB182AC023F5D1A84F04660D3BB5D5290324D82062A2CB2AAC91CFC6FB80D9853DC54B196E3E344FE805C87F59C4B2B8A67CE16127DEAE5751E4350E415A32DFADEE04C9736935F6B6DC01186E6579E5F83267E1FCEB1F93751043902C2EEA7ED8C4AB30357A750388D133DEA0D4A6B72FE10A3150178A3E69BD56854B6B2D8D8FC6981AC6CD423E6F8292CDB05E4F43D937FD0B4F92DC113F769F1BF6728357C8C49B13D1DBF048E8D8A66E6C659C2483E18B50D252D52D925204E7AD17C5630DA29A72F968345596CF3D46CD14E7F354234E48571CF7970A691D90F75D0F8DA4D7CA75409ADDC06F9D6C52026DEF8B5A460D65750D9001EC28556DC553AFD7A8B6BDA4EA9BFE4E55F56EC0CCA1B22903160E68F3889504185FDE595F842E92181514E16B0309A5F0B4BDF8C49051323F4A75312258DFB48BD2C91426CE3E6F25FBC74775B6960ED2DC219522E9386DB42604012958B35397E75C73B3F12BFAA19F1A212E8C8BB9EBA7DF6E20B335A3D2EE8B51B0B9855AA1FF5D5300532E614676991582021D693ED6FBB95F64112DE15D19D0A8DC45748BA7CF2A4D59B7111C64D5F15C8B7008342C10E188B91556C14E04912A68CDB55B109356D4D1C1717F57E8C61AEC6A9397A50F76CE46B6EA58C10EAB665662723A4549A380AF536AE790E80ADA3FBE7129BAB68E32609CADBA50C19D35DB89F9CFC498301305B4FF61AC6023D7B7AF481ED18B12BF41A00F84AB6511624DFD2BB6484321CE7F7069E64A13F2A0F57B08C7E0F8A3DF9C14376A626717FD4AC6E91CAD952305D67A3ECA74F4BDD3B1C1C4E1F3C0CE96216EEE32D23BDE40D62C842E34F6E38BF3C96BA78B29998E0C8DA756580B65761A204E4152BDC72EF39D707A5A0F681C0796E752EE383EE64CD3A4229F06A7EAC662430D8EF5AA3A5DDB92BCABA40311B19609CE5AEC8C82E11260D8855EF2BFB5516923557264C576EAC0F544003BB880845C7809188E0AAECAF3FE42A6F7E8F5545E82DFA1310B30294278408DC6DC8A71A2020C048C64C308FD7E22179EDA64241A8"
"OODLED02.00.00.02WSSV"="C033BD5806BEE57EBF765A6D2D2CBEB65CA6A1BCC6E7889179AC34D1E333FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B9808A2D97226D213B5558EDD5E5BE2F6E6673AAEAAB79DC67D42FE0E9DDAC42089404404D595B95EC9186F86804E053D12A0F923060C5CB714EB4188FE09664D7D622D18036142DFEAF32584BD3E6719A752D28855A650EB3E42B8A6A74EF619D9FC14FDD082214DF19614AB7F9C80C952065CBAA5871A9EE6AAD92D69DA82785C74E985727DF276138649F200DB1917DB825F7BD3334E320B4DCCC366638E865AF053E07255454D168D08354FF36CEC9E54DB6E94B176ABBB156C7A96200D8038E1A7A52D141BE9D4BA44344D5D2A5B0DC8849B6D0D10B21E334841C64EEA486FF774CDD348EB0740DE29902F987616A974BE6F3A568B94EA9A23ED162F05E30F277A396A83A3825A1091D37F276AF40D2DA5BBA8214E43EF05763977852D7DB9A9AD2A49DA20E03BA911E69C109174E41087B23C8431510F6DEB41B31B2AE326FB37471E6834C60EC9ED1C38DDEBB4EEFA666ECA1B01FA3D94E48766BCB5869CDF73196949288112519E245620EB7882907A6B8086FE9904FE737000BB7EFCFC5AF18F809F367D1AE7D398D2E7FBA705B9AD08DAE9E031FEF35F4743EAA4813A34777C8B110D508D77ECF35BCC7750F49F1D8A2DEB4EE4E080A337C8A4407059F9FD9686C6CFAFE7AC8116706A2D1F61B21D9B9E39E4FD6F7371D2FAC5DA4D73FDB0F8C4EF96F5387A5941E75DE2EA6F26B246A901B6680362AA109AACF0BC3AD570A0683CEBA2A297721EEC4ACF2AD5701AFB1C774637892467C6BB3F760A6C5952F0EB61CD585DFD7D37FBD51FF7E24CC0909A53109D0456F33646E6D02263261EAF1B9BB05EB36B62FB68AC721675B9C83C9AD0FD7586584F7DF410D917879E50081625FA1F85E2B840D57CDC67027C099B67B0F2BB3C4E2CA4D7AADF9E56651A0854C207A9C529CE3BBE77E6F3909A0DB02034C21061A0739353ABA41264E4DFA19BB725B07C49258872540C673FDF125DB5253738C77ABE979E8B5EF157CA392B8A4E978B44127328904EBC12BBDA0BEA71CD8D9CD3CD60E2C5C7365DE788F2DF91D496364B94A0FB11A4DBE7CB5F1F866CFE76CB80CC590929E0CB1BE5D10FDDF31D4A4DD7A64C4D3C18C3004884283F960B9674D8F0E285FA5AB01533A0C0A74DFBD4953E6446C4AF71BE181CA4B48BB14A876D0075673645BC6A5946327123084B48F3EAA815F45DF98C0EC8DF87C0541956ADAADB875A611672992887BC1B66682AF55C99714E0C80E266E098179EEA5683D3A0E794988077B72D78E5F2BE7CB577C7A79A4AAAD4D868C90FF58DC33264051F42A09879A6739C0B6A56991E"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(2280)
c:\documents and settings\All Users\Data aplikací\LangSoft\TrnOEH.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\System32\snmp.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\RTHDCPL.EXE
c:\program files\Microsoft ActiveSync\Wcescomm.exe
c:\progra~1\MICROS~4\rapimgr.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
.
**************************************************************************
.
Celkový čas: 2009-12-27 18:34:47 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-12-27 17:34
ComboFix2.txt 2009-12-27 16:42

Před spuštěním: Volných bajtů: 25 263 910 912
Po spuštění: Volných bajtů: 25 237 573 632

- - End Of File - - 2C3BD0D5382773936BCE2F36E226D535

HiJackThis

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 18:39:55, on 27.12.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\ITE\ITE IT8212 ATA RAID Controller\RaidMgr.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9999
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ToolBoxFX] "C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /DropDisc
O4 - HKCU\..\Run: [OEXPRESS] C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: RAID Manager.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Vytvořit mobilní oblíbenou položku… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [java_sun] Java (Sun)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {e8f628b5-259a-4734-97ee-ba914d7be941} (Driver Agent ActiveX Control) - http://www.driveragent.com/files/driveragent.cab
O18 - Protocol: skyline - {3A4F9195-65A8-11D5-85C1-0001023952C1} - C:\Program Files\Skyline\TerraExplorer\TerraExplorerX.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswupdsv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus (avast! antivirus) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner (avast! mail scanner) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner (avast! web scanner) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (javaquickstarterservice) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe

--
End of file - 8150 bytes

Chování

problém byl v tom, že jednak AVAST hlásil nález (do 15 minut po spuštění počítače), což se zatím neděje; a byl pomalejší internet a prohlížeč občas zatuhl - při delší neaktivitě, .. to teď nezjistím

Spusť HJT (HijackThis), vypni prohlížeče, odpoj se od internetu a fixni (spustit HJT, "Do a system scan only",
zatrhnout políčko před hodnotou, zmáčknout "Fix checked" a poté "Ano"):

O11 - Options group: [java_sun] Java (Sun)
*****************************************************************************************************************************************
Odinstaluj ComboFix ( nutné ) .
ComboFix se odinstaluje takto:
Start-Spustit a zadej Combofix[mezera]/u

Pokud nepůjde a ComboFix je na Ploše, tak Start-->Spustit a do řádku zkopíruj:

(Podle CF community bylo změněno /u na uninstall, pokud je na Ploše, tak daný řetězec)

Pokud ti nepůjde ani to tak najdi a smaž:
C:\327882R2FWJFW
C:\ComboFix
C:\Qoobox
C:\Combofix.txt
a Combofix.exe
Pak si stáhni OTCleanIt.
- Připoj se k internetu a dvojklikem spusť program
- Klikni na tlačítko CleanUp
- Po dokončení povol restart PC
- Po restartu tento nástroj smaž - není určen pro běžné používání

Vyčisti systém CCleanerem a použij i T-Cleaner ( nutné - smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš->spustíš)

(pozn.Pokud máš AVG, avast! nebo Aviru, před stažením T-Cleaneru a po dobu čištění deaktivuj AVG, avast! i Aviru (i rezidenty), následně T-Cleaner smaž a zapni si AVG,avast!, Aviru.)
*****************************************************************************************************************************************
Stáhni si ToolsCleaner2 (by de A.Rothstein & Dj Quiou) na Plochu a spusť ho.

Klikni na Pt. Restauration (obnova) a poté na OK.
Klikni na Corbeille (koš) a poté na OK.
Klikni na Fichiers temp (temp složky) a poté na OK.
Klikni na Recherche (hledání) a nech Cleaner pracovat. Může se během čištění zastavit , ale nech ho pokračovat.
Když program skončí , klikni na Suppression (odstranění) a odstraň nalezené.
Zavři a smaž program.


Kdyby se něco zase objevilo, tak se zastav.
Označ topic za vyřešený (zelená fajfka) a měj se.

děkuji