PC-HELP.CZ

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verze databáze: 5363

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 7.0.5730.13

06.04.2011 23:32:00
mbam-log-2011-04-06 (23-31-44).txt

Typ kontroly: Rychlý test
Testované objekty: 125278
Uplynulý čas: 10 minut, 44 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 3
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

- Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verze databáze: 5363

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 7.0.5730.13

06.04.2011 23:55:00
mbam-log-2011-04-06 (23-55-00).txt

Typ kontroly: Rychlý test
Testované objekty: 125490
Uplynulý čas: 25 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 3
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

no a CombFix uz bezi asi 25 minut a porad nic (Completed Stage 2)

ComboFix 11-04-06.01 - Admin 07.04.2011 0:06:06.1.1 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.2009.1739 [GMT 2:00]
Running from: C:\Documents and Settings\Admin\Đŕáî÷čé ńňîë\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Outdated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *Enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Documents and Settings\All Users\Application Data\jDm24512pFoFb24512
C:\Documents and Settings\All Users\Application Data\jDm24512pFoFb24512\jDm24512pFoFb24512
C:\Documents and Settings\All Users\Application Data\jDm24512pFoFb24512\jDm24512pFoFb24512.exe
C:\WINDOWS\Delete.bat
C:\WINDOWS\system32\Ďóçűđč.scr
C:\WINDOWS\system32\ssField Lines.scr
C:\WINDOWS\system32\ssRibbons.scr
C:\WINDOWS\system32\SYSINTERNALS_BLUESCREEN.SCR

C:\WINDOWS\regedit.exe . . . is infected!!


((((((((((((((((((((((((( Files Created from 2011-03-06 to 2011-04-06 )))))))))))))))))))))))))))))))


2011-04-06 21:25:46 . 2011-04-06 21:26:36 -------- d-----w- C:\Documents and Settings\All Users\Application Data\NortonInstaller
2011-04-06 21:18:27 . 2011-04-06 21:18:27 -------- d-----w- C:\Documents and Settings\Admin\Application Data\Malwarebytes
2011-04-06 21:18:20 . 2010-12-20 16:09:00 38224 ----a-w- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2011-04-06 21:18:19 . 2011-04-06 21:18:19 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2011-04-06 21:18:16 . 2011-04-06 21:18:23 -------- d-----w- C:\Program Files\Malwarebytes' Anti-Malware
2011-04-06 21:18:16 . 2010-12-20 16:08:40 20952 ----a-w- C:\WINDOWS\system32\drivers\mbam.sys
2011-04-02 16:43:47 . 2011-04-02 16:43:55 -------- d-----w- C:\Program Files\CCleaner
2011-04-02 16:38:43 . 2009-02-05 20:08:19 93296 ----a-w- C:\WINDOWS\system32\drivers\aswmon.sys
2011-04-02 16:38:43 . 2009-02-05 20:08:10 94032 ----a-w- C:\WINDOWS\system32\drivers\aswmon2.sys
2011-04-02 16:38:26 . 2009-02-05 20:11:35 1256296 ----a-w- C:\WINDOWS\system32\aswBoot.exe
2011-04-02 16:38:26 . 2004-01-09 08:13:58 380928 ----a-w- C:\WINDOWS\system32\actskin4.ocx
2011-04-02 16:38:24 . 2011-04-02 16:38:24 -------- d-----w- C:\Program Files\Alwil Software
2011-03-27 15:47:21 . 2011-03-27 15:47:21 -------- d-----w- C:\Program Files\MegaFon
2011-03-21 11:59:10 . 2011-03-21 11:59:31 -------- d-----w- C:\Documents and Settings\Admin\Application Data\Media Player Classic
2011-03-08 11:46:06 . 2011-03-08 11:46:06 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Skype


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2011-02-01 11:35:01 . 2011-02-01 11:35:00 717296 ----a-w- C:\WINDOWS\system32\drivers\sptd.sys
2011-02-01 11:34:40 . 2011-02-01 11:34:46 73728 ----a-w- C:\WINDOWS\system32\javacpl.cpl
2011-02-01 11:34:40 . 2011-02-01 11:34:46 410984 ----a-w- C:\WINDOWS\system32\deploytk.dll


------- Sigcheck -------

[-] 2008-12-25 18:58:15 . 6A104BA98D99D53AB0C91825CE659FC6 . 361600 . . [5.1.2600.5625 (xpsp_sp3_qfe.080620-1309)] . . C:\WINDOWS\system32\drivers\tcpip.sys

[-] 2008-12-25 18:59:04 . 7F37BFDC135A7F2459DE89D9A4964F97 . 855040 . . [2001.12.4414.700] . . C:\WINDOWS\system32\comres.dll

[-] 2008-12-25 19:00:35 . A16B512841D703A84F773BD0DCC732DC . 78360 . . [7.2.6001.788 (winmain_oob/wu_wsuswlc(wmbla).081016-1330)] . . C:\WINDOWS\system32\wuauclt.exe

[-] 2008-12-25 19:00:22 . 23B7D3F3F5EC8FEEA75EC381C71CBD5E . 579072 . . [5.1.2600.5512 (xpsp.080413-2105)] . . C:\WINDOWS\system32\user32.dll

[-] 2008-12-25 19:00:25 . B3F3C4C16539F0AC20306E2A56DF6AA6 . 952832 . . [7.00.6000.20935 (vista_ldr.081013-1507)] . . C:\WINDOWS\system32\wininet.dll

[-] 2008-12-25 18:59:10 . 5D1804D43D799F7040AC1C2DF3EE137A . 1721344 . . [6.00.2900.5512 (xpsp.080413-2105)] . . C:\WINDOWS\explorer.exe

[-] 2008-12-25 21:09:22 . E52BB415E3A7106E0308A6EE75219F30 . 1571840 . . [5.1.2600.5512 (xpsp.080413-2111)] . . C:\WINDOWS\system32\sfcfiles.dll

[-] 2008-12-25 18:59:05 . E5EB62A6443A8720F7EC4941C42FAE67 . 30208 . . [5.1.2600.5512 (xpsp.080413-2105)] . . C:\WINDOWS\system32\ctfmon.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VistaIcon"="C:\Program Files\VistaDriveIcon\VistaDrv.exe" [2008-01-02 10:52:02 132096]
"HW_OPENEYE_OUC_MegaFon Internet"="C:\Program Files\MegaFon Internet\UpdateDog\ouc.exe" [2009-04-14 18:28:48 110592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 11:40:44 155648]
"RTHDCPL"="RTHDCPL.EXE" [2009-12-25 16:50:02 18789408]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2009-12-08 09:15:54 141336]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2009-12-08 09:15:06 173592]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2009-12-08 09:15:38 142872]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 09:49:36 35736]
"Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 09:49:34 932288]
"actx.exe"="C:\Program Files\MegaFon\MultiFon\actx.exe" [2009-05-27 15:16:06 5458432]
"avp"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-10-20 16:39:28 340456]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-12-25 18:59:05 30208]
"VistaIcon"="C:\Program Files\VistaDriveIcon\VistaDrv.exe" [2008-01-02 10:52:02 132096]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"IE7_011"="shell32" [X]
"ZZZZ2_FirstLogonSetting"="advpack.dll" [2008-12-25 18:55:26 124928]
"IE7_012"="advpack.dll" [2008-12-25 18:55:26 124928]

C:\Documents and Settings\All Users\ƒ« ˘­®Ą ¬Ą­î\Źŕ®Łŕ ¬¬ë\€˘â®§ Łŕ㧪 \
McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
Translate Client.lnk - C:\Program Files\Translate Client\translateclient.exe [2011-2-19 1650688]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"UpdatesOverride"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [14.10.2009 19:18:34 36880]
R0 sptd;sptd;C:\WINDOWS\system32\drivers\sptd.sys [01.02.2011 13:35:00 717296]
R2 DCService.exe;DCService.exe;C:\Documents and Settings\All Users\Application Data\DatacardService\DCService.exe [08.05.2010 13:48:36 229376]
R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;C:\WINDOWS\system32\StkCSrv.exe [01.02.2011 13:58:30 31248]
R3 huawei_enumerator;huawei_enumerator;C:\WINDOWS\system32\drivers\ew_jubusenum.sys [12.02.2011 19:58:58 70656]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;C:\WINDOWS\system32\drivers\IntcHdmi.sys [01.02.2011 14:04:46 110080]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\drivers\klim5.sys [14.09.2009 12:42:46 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;C:\WINDOWS\system32\drivers\klmouflt.sys [02.10.2009 17:39:44 19472]
R3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;C:\WINDOWS\system32\drivers\StkCMini.sys [01.02.2011 13:58:30 1360016]
S3 Ambfilt;Ambfilt;C:\WINDOWS\system32\drivers\Ambfilt.sys [01.02.2011 14:07:37 1691480]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;C:\WINDOWS\system32\drivers\ew_hwusbdev.sys [12.02.2011 19:58:52 101504]
S3 ewusbnet;HUAWEI USB-NDIS miniport;C:\WINDOWS\system32\drivers\ewusbnet.sys [12.02.2011 19:58:56 117504]
S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe [15.01.2010 14:49:20 227232]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - WUAUSERV


------- Supplementary Scan -------

uStart Page = hxxp://start.drp.su/
IE: &Ýęńďîđň â Microsoft Excel - C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Äîáŕâčňü â Ŕíňč-Áŕííĺđ - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
FF - ProfilePath - C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\nmuhujcg.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: network.proxy.type - 0
FF - Ext: Kaspersky URL Advisor: linkfilter@kaspersky.ru - C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Quick Starter: jqs@sun.com - C:\Program Files\Java\jre6\lib\deploy\jqs\ff


**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-07 01:17:27
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

omlouvám se, tohle je ten správný log:
ComboFix 11-04-06.01 - Admin 07.04.2011 0:06.1.1 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1049.18.2009.1739 [GMT 2:00]
Running from: c:\documents and settings\Admin\Đŕáî÷čé ńňîë\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Outdated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *Enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\jDm24512pFoFb24512
c:\documents and settings\All Users\Application Data\jDm24512pFoFb24512\jDm24512pFoFb24512
c:\documents and settings\All Users\Application Data\jDm24512pFoFb24512\jDm24512pFoFb24512.exe
c:\windows\Delete.bat
c:\windows\system32\Ďóçűđč.scr
c:\windows\system32\ssField Lines.scr
c:\windows\system32\ssRibbons.scr
c:\windows\system32\SYSINTERNALS_BLUESCREEN.SCR
.
c:\windows\regedit.exe . . . is infected!!
.
.
((((((((((((((((((((((((( Files Created from 2011-03-06 to 2011-04-06 )))))))))))))))))))))))))))))))
.
.
2011-04-06 21:25 . 2011-04-06 21:26 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2011-04-06 21:18 . 2011-04-06 21:18 -------- d-----w- c:\documents and settings\Admin\Application Data\Malwarebytes
2011-04-06 21:18 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-06 21:18 . 2011-04-06 21:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-04-06 21:18 . 2011-04-06 21:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-04-06 21:18 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-04-02 16:43 . 2011-04-02 16:43 -------- d-----w- c:\program files\CCleaner
2011-04-02 16:38 . 2009-02-05 20:08 93296 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-04-02 16:38 . 2009-02-05 20:08 94032 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-04-02 16:38 . 2009-02-05 20:11 1256296 ----a-w- c:\windows\system32\aswBoot.exe
2011-04-02 16:38 . 2004-01-09 08:13 380928 ----a-w- c:\windows\system32\actskin4.ocx
2011-04-02 16:38 . 2011-04-02 16:38 -------- d-----w- c:\program files\Alwil Software
2011-03-27 15:47 . 2011-03-27 15:47 -------- d-----w- c:\program files\MegaFon
2011-03-21 11:59 . 2011-03-21 11:59 -------- d-----w- c:\documents and settings\Admin\Application Data\Media Player Classic
2011-03-08 11:46 . 2011-03-08 11:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-01 11:35 . 2011-02-01 11:35 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-02-01 11:34 . 2011-02-01 11:34 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-02-01 11:34 . 2011-02-01 11:34 410984 ----a-w- c:\windows\system32\deploytk.dll
.
.
------- Sigcheck -------
.
[-] 2008-12-25 . 6A104BA98D99D53AB0C91825CE659FC6 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
.
[-] 2008-12-25 18:59 . 7F37BFDC135A7F2459DE89D9A4964F97 . 855040 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll
.
[-] 2008-12-25 . A16B512841D703A84F773BD0DCC732DC . 78360 . . [7.2.6001.788] . . c:\windows\system32\wuauclt.exe
.
[-] 2008-12-25 . 23B7D3F3F5EC8FEEA75EC381C71CBD5E . 579072 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
.
[-] 2008-12-25 . B3F3C4C16539F0AC20306E2A56DF6AA6 . 952832 . . [7.00.6000.20935] . . c:\windows\system32\wininet.dll
.
[-] 2008-12-25 . 5D1804D43D799F7040AC1C2DF3EE137A . 1721344 . . [6.00.2900.5512] . . c:\windows\explorer.exe
.
[-] 2008-12-25 . E52BB415E3A7106E0308A6EE75219F30 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
[-] 2008-12-25 . E5EB62A6443A8720F7EC4941C42FAE67 . 30208 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VistaIcon"="c:\program files\VistaDriveIcon\VistaDrv.exe" [2008-01-02 132096]
"HW_OPENEYE_OUC_MegaFon Internet"="c:\program files\MegaFon Internet\UpdateDog\ouc.exe" [2009-04-14 110592]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]
"RTHDCPL"="RTHDCPL.EXE" [2009-12-25 18789408]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-12-08 141336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-12-08 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-12-08 142872]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"actx.exe"="c:\program files\MegaFon\MultiFon\actx.exe" [2009-05-27 5458432]
"avp"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-10-20 340456]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-12-25 30208]
"VistaIcon"="c:\program files\VistaDriveIcon\VistaDrv.exe" [2008-01-02 132096]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"IE7_011"="shell32" [X]
"ZZZZ2_FirstLogonSetting"="advpack.dll" [2008-12-25 124928]
"IE7_012"="advpack.dll" [2008-12-25 124928]
.
c:\documents and settings\All Users\ƒ« ˘­®Ą ¬Ą­î\Źŕ®Łŕ ¬¬ë\€˘â®§ Łŕ㧪 \
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
Translate Client.lnk - c:\program files\Translate Client\translateclient.exe [2011-2-19 1650688]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"UpdatesOverride"=dword:00000001
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
.
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [14.10.2009 19:18 36880]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [01.02.2011 13:35 717296]
R2 DCService.exe;DCService.exe;c:\documents and settings\All Users\Application Data\DatacardService\DCService.exe [08.05.2010 13:48 229376]
R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\system32\StkCSrv.exe [01.02.2011 13:58 31248]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [12.02.2011 19:58 70656]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [01.02.2011 14:04 110080]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [14.09.2009 12:42 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [02.10.2009 17:39 19472]
R3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;c:\windows\system32\drivers\StkCMini.sys [01.02.2011 13:58 1360016]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [01.02.2011 14:07 1691480]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys [12.02.2011 19:58 101504]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [12.02.2011 19:58 117504]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15.01.2010 14:49 227232]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WUAUSERV
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://start.drp.su/
IE: &Ýęńďîđň â Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Äîáŕâčňü â Ŕíňč-Áŕííĺđ - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\nmuhujcg.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: network.proxy.type - 0
FF - Ext: Kaspersky URL Advisor: linkfilter@kaspersky.ru - c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-07 01:17
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1224)
c:\windows\system32\cscui.dll
.
- - - - - - - > 'explorer.exe'(2980)
c:\windows\system32\SHDOCVW.dll
c:\windows\system32\COMRes.dll
c:\windows\System32\cscui.dll
c:\windows\system32\msi.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
c:\windows\system32\StkCWIA.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\program files\Malwarebytes' Anti-Malware\mbamext.dll
c:\program files\WinRAR\rarext.dll
c:\program files\7-Zip\7-zip.dll
c:\windows\system32\igfxpph.dll
c:\windows\system32\hccutils.DLL
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxsrvc.exe
c:\documents and settings\Admin\Application Data\MegaFon Internet\ouc.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\McAfee Security Scan\2.0.181\McUICnt.exe
.
**************************************************************************
.
Completion time: 2011-04-07 01:51:25 - machine was rebooted
ComboFix-quarantined-files.txt 2011-04-06 23:29
.
Pre-Run: 62 051 885 056 áŕéň ńâîáîäíî
Post-Run: 61 868 912 640 áŕéň ńâîáîäíî
.
- - End Of File - - E01B66FD0BD27B13B20EF05B7272508B

Odinstaluj:
NortonInstaller
McAfee Security Scan
Pokud půjdou..

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT


Upozornění : Může se stát, že po aplikaci skriptu a restartu počítače Windows nenaběhnou, pak znovu restartuj počítač, mačkej F8 a pak zvol poslední známou funkční konfiguraci.


V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému

Toto otestuj na Virustotal
c:\windows\system32\drivers\tcpip.sys
c:\windows\system32\sfcfiles.dll
c:\windows\explorer.exe
c:\windows\system32\wininet.dll
c:\windows\system32\user32.dll
c:\windows\system32\wuauclt.exe
c:\windows\system32\comres.dll
c:\windows\system32\ctfmon.exe

Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/40 , nebo 1/40. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.

Hlásí mi to chybovou hlášku: "Were you trying to run CFScript? The name CFScript appears to be incorrectly spelt"

log z HJT:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:15:33, on 07.04.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20935)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
G:\antiviry\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.drp.su/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Ńńűëęč
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [actx.exe] "C:\Program Files\MegaFon\MultiFon\actx.exe" /dontstart
O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKCU\..\Run: [VistaIcon] C:\Program Files\VistaDriveIcon\VistaDrv.exe
O4 - HKCU\..\Run: [HW_OPENEYE_OUC_MegaFon Internet] "C:\Program Files\MegaFon Internet\UpdateDog\ouc.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [VistaIcon] C:\Program Files\VistaDriveIcon\VistaDrv.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%\System32\rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\custom.inf,NewUserFirstLogonInstall,0 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%\System32\rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\custom.inf,NewUserFirstLogonInstall,0 (User 'Default user')
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O4 - Global Startup: Translate Client.lnk = C:\Program Files\Translate Client\translateclient.exe
O8 - Extra context menu item: &Ýęńďîđň â Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: &Âčđňóŕëüíŕ˙ ęëŕâčŕňóđŕ - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Ďđîâĺđęŕ ńńű&ëîę - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O22 - SharedTaskScheduler: Ďđĺäçŕăđóç÷čę Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Äĺěîí ęýřŕ ęŕňĺăîđčé ęîěďîíĺíňîâ - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: DCService.exe - Unknown owner - C:\Documents and Settings\All Users\Application Data\DatacardService\DCService.exe
O23 - Service: Ćóđíŕë ńîáűňčé (Eventlog) - Ęîđďîđŕöč˙ Ěŕéęđîńîôň - C:\WINDOWS\system32\services.exe
O23 - Service: Ńëóćáŕ COM çŕďčńč ęîěďŕęň-äčńęîâ IMAPI (ImapiService) - Ęîđďîđŕöč˙ Ěŕéęđîńîôň - C:\WINDOWS\system32\imapi.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: Plug and Play (PlugPlay) - Ęîđďîđŕöč˙ Ěŕéęđîńîôň - C:\WINDOWS\system32\services.exe
O23 - Service: Äčńďĺň÷ĺđ ńĺŕíńŕ ńďđŕâęč äë˙ óäŕëĺííîăî đŕáî÷ĺăî ńňîëŕ (RDSessMgr) - Ęîđďîđŕöč˙ Ěŕéęđîńîôň - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Ńěŕđň-ęŕđňű (SCardSvr) - Ęîđďîđŕöč˙ Ěŕéęđîńîôň - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkCSrv.exe
O23 - Service: Ćóđíŕëű č îďîâĺůĺíč˙ ďđîčçâîäčňĺëüíîńňč (SysmonLog) - Ęîđďîđŕöč˙ Ěŕéęđîńîôň - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Telnet (TlntSvr) - Ęîđďîđŕöč˙ Ěŕéęđîńîôň - C:\WINDOWS\system32\tlntsvr.exe
O23 - Service: Ňĺíĺâîĺ ęîďčđîâŕíčĺ ňîěŕ (VSS) - Ęîđďîđŕöč˙ Ěŕéęđîńîôň - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Ŕäŕďňĺđ ďđîčçâîäčňĺëüíîńňč WMI (WmiApSrv) - Ęîđďîđŕöč˙ Ěŕéęđîńîôň - C:\WINDOWS\system32\wbem\wmiapsrv.exe

--
End of file - 6388 bytes

tak tady jsou vysledky z virustotal:
http://www.virustotal.com/file-scan/rep ... 1302170421
http://www.virustotal.com/file-scan/rep ... 1302170114
http://www.virustotal.com/file-scan/rep ... 1302170636
http://www.virustotal.com/file-scan/rep ... 1302170445
http://www.virustotal.com/file-scan/rep ... 1302170767
http://www.virustotal.com/file-scan/rep ... 1302171227
http://www.virustotal.com/file-scan/rep ... 1302171311
http://www.virustotal.com/file-scan/rep ... 1302171436

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod




Vypni si rez.ochrany i firewall.
Stáhni si Dr. Web CureIt
dej update , po aktualizaci dej start.
Tlacitky dole můzeš soubor léčit(systémové soubory), smazat, přesunout nebo přejmenovat


Stáhni si Dial-a-fix
Klikni na kladívko-další možnosti:
SFC scan - Spustí nástroj pro kontrolu systémových souborů (případná potřeba instalačního media Windows).
Klikni na službu a potom na GO.

Bude třeba přepsat soubory windows.

Pak udělej nový sken Combofixem , ten script je v pořádku , ale nyní ho nedělej.

Ok, děkuju

bohužel ale u sebe nemám instalačky. Co myslíte tím "bude potřeba přepsat soubory windows"?