Prosím o preventívnu kontrolu logu Vyřešeno

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
c:\windows\popcreg.dat
c:\windows\popcinfot.dat

Registry::
[-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Toto otestuj na Virustotal
c:\windows\system32\AEE61F1FA7.dll
Vlož sem pak odkaz výsledku.

[Reklama]

[redvo]

ComboFix 09-02-10.02 - Lukáš 2009-02-11 7:19:46.9 - NTFSx86
Systém Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1033.18.766.396 [GMT 1:00]
Running from: c:\documents and settings\Lukáš\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Lukáš\Desktop\CFScript.txt
AV: avast! antivirus 4.7.1098 [VPS 090210-0] *On-access scanning disabled* (Updated)
FW: Kerio Personal Firewall *disabled*
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\windows\popcinfot.dat
c:\windows\popcreg.dat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\popcinfot.dat
c:\windows\popcreg.dat

.
((((((((((((((((((((((((( Files Created from 2009-01-11 to 2009-02-11 )))))))))))))))))))))))))))))))
.

2009-02-10 14:52 . 2009-02-10 14:52 <DIR> d-------- c:\program files\TuneUp Utilities 2008
2009-02-10 14:52 . 2009-02-10 14:52 <DIR> d-------- c:\documents and settings\Lukáš\Application Data\TuneUp Software
2009-02-10 14:52 . 2009-02-10 14:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\TuneUp Software
2009-02-10 14:52 . 2009-02-10 14:52 355,584 --a------ c:\windows\system32\TuneUpDefragService.exe
2009-02-10 14:52 . 2008-05-29 09:28 28,416 --a------ c:\windows\system32\uxtuneup.dll
2009-02-09 21:22 . 2009-02-09 21:22 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-09 21:22 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-09 21:22 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-08 08:22 . 2009-02-08 08:22 <DIR> d----c--- c:\documents and settings\All Users\Application Data\Blizzard
2009-02-07 19:42 . 2009-02-07 19:42 32 --a--c--- c:\documents and settings\All Users\Application Data\ezsid.dat
2009-02-07 19:09 . 2009-02-08 15:57 <DIR> d-------- c:\program files\FlashGet
2009-02-01 17:19 . 2009-02-01 17:19 36,734 --a------ c:\windows\system32\OggDSuninst.exe
2009-02-01 16:49 . 2009-02-01 16:49 <DIR> d-------- c:\program files\Trymedia
2009-01-31 12:35 . 2009-02-10 18:52 <DIR> d-------- c:\program files\TuxPaint
2009-01-31 12:35 . 2009-01-31 13:03 <DIR> d-------- c:\documents and settings\Lukáš\Application Data\TuxPaint
2009-01-30 14:59 . 2009-01-30 16:18 <DIR> d-------- c:\program files\Alawar
2009-01-30 14:59 . 2009-01-30 14:59 <DIR> d----c--- c:\documents and settings\All Users\Application Data\FarmFrenzy2
2009-01-30 14:59 . 2009-01-30 14:59 <DIR> d----c--- c:\documents and settings\All Users\Application Data\AlawarWrapper
2009-01-28 17:50 . 2009-01-28 17:50 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-01-28 17:34 . 2009-01-28 17:50 410,984 --a------ c:\windows\system32\deploytk.dll
2009-01-28 08:26 . 2009-01-28 08:27 <DIR> d-------- c:\program files\GIMPPortable
2009-01-27 18:00 . 2009-01-27 18:00 <DIR> d-------- c:\program files\CCleaner
2009-01-26 11:50 . 2009-01-26 11:50 <DIR> d-------- c:\documents and settings\Lukáš\Application Data\Malwarebytes
2009-01-26 11:50 . 2009-01-26 11:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-26 08:50 . 2009-01-26 08:50 <DIR> d-------- c:\program files\Trend Micro
2009-01-19 15:20 . 2009-01-30 14:04 <DIR> d-------- c:\program files\TallStick
2009-01-19 14:38 . 2009-01-19 14:38 <DIR> d-------- c:\documents and settings\Lukáš\Application Data\Music Recognition
2009-01-12 15:57 . 2008-08-29 13:59 3,883,008 --a------ c:\windows\system32\Tropix2.scr

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-10 19:58 --------- d-----w c:\documents and settings\Lukáš\Application Data\Skype
2009-02-10 18:01 --------- d-----w c:\documents and settings\Lukáš\Application Data\skypePM
2009-02-10 16:31 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-10 13:51 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-02-09 05:14 --------- d-----w c:\program files\SUPERAntiSpyware
2009-02-08 16:10 --------- d-----w c:\program files\3DO
2009-02-08 15:21 17,333 ----a-w c:\windows\system32\drivers\fwdrv.err
2009-02-08 07:29 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
2009-02-02 17:38 --------- d-----w c:\documents and settings\Lukáš\Application Data\ICQ
2009-01-31 11:32 --------- d-----w c:\documents and settings\Lukáš\Application Data\uTorrent
2009-01-30 13:09 --------- d-----w c:\program files\Valve
2009-01-30 13:06 --------- d-----w c:\program files\Zylom Games
2009-01-30 13:05 --------- d-----w c:\program files\Tower Bloxx Deluxe
2009-01-30 13:05 --------- d-----w c:\program files\Image-Line
2009-01-30 13:04 --------- d-----w c:\program files\Sony Ericsson
2009-01-30 13:03 --------- dc----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-01-30 13:02 --------- d-----w c:\program files\Ranch Rush
2009-01-30 12:59 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-30 12:59 --------- d-----w c:\program files\MagicISO
2009-01-30 12:59 --------- d-----w c:\program files\Common Files\InstallShield
2009-01-30 12:57 --------- d-----w c:\program files\VstPlugins
2009-01-30 12:57 --------- d-----w c:\program files\Farm Mania
2009-01-30 12:43 --------- d-----w c:\program files\Alice Greenfingers 2
2009-01-28 16:50 --------- d-----w c:\program files\Java
2009-01-27 17:08 --------- d-----w c:\documents and settings\Lukáš\Application Data\Chessmaster Challenge
2009-01-26 21:22 --------- d-----w c:\program files\Common Files\DVDVideoSoft
2009-01-21 20:28 --------- d-----w c:\program files\Counter-Strike 1.6
2009-01-12 14:57 --------- d-----w c:\documents and settings\Lukáš\Application Data\Zylom
2009-01-05 20:03 --------- d-----w c:\program files\EA GAMES
2009-01-05 19:14 --------- d-----w c:\program files\DAMN NFO Viewer
2009-01-04 14:59 --------- d-----w c:\program files\MagicDisc
2008-12-31 18:50 --------- d-----w c:\documents and settings\Lukáš\Application Data\Microsoft Games
2008-12-31 18:30 --------- d-----w c:\program files\Microsoft Games
2008-12-31 16:56 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Games
2008-12-30 19:54 --------- d-----w c:\program files\Doggie Dash
2008-12-30 19:53 --------- d-----w c:\program files\Snapshot Adventures
2008-12-30 19:53 --------- d-----w c:\program files\Risk
2008-12-30 14:20 --------- d-----w c:\program files\Puzzle Quest
2008-12-30 13:06 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-30 09:03 --------- d-----w c:\documents and settings\Lukáš\Application Data\PlayFirst
2008-12-30 09:03 --------- d-----w c:\documents and settings\All Users\Application Data\PlayFirst
2008-12-29 13:20 --------- d-----w c:\documents and settings\Lukáš\Application Data\iWin
2008-12-29 08:38 --------- dc----w c:\documents and settings\All Users\Application Data\FreshGames
2008-12-29 07:32 --------- d-----w c:\program files\Family Feud Dream Home
2008-12-29 07:31 --------- d-----w c:\program files\Pet Shop Hop
2008-12-29 07:31 --------- d-----w c:\program files\Jet Jumper
2008-12-29 07:31 --------- d-----w c:\program files\Farm Frenzy
2008-12-28 15:24 --------- d-----w c:\documents and settings\All Users\Application Data\InterAction studios
2008-12-28 15:13 --------- d-----w c:\documents and settings\All Users\Application Data\VirtualFarm
2008-12-28 13:48 --------- d-----w c:\documents and settings\Lukáš\Application Data\GetRightToGo
2008-12-27 18:00 --------- d-----w c:\program files\Rollercoaster Rush
2008-12-27 18:00 --------- d-----w c:\program files\Crazy Penguin Catapult
2008-12-27 17:53 --------- d-----w c:\program files\Heavy Weapon
2008-12-27 17:52 --------- d-----w c:\program files\Sallys Salon
2008-12-27 17:52 --------- d-----w c:\program files\Farm Craft
2008-12-27 17:52 --------- d-----w c:\program files\Cooking Academy
2008-12-27 17:51 --------- d-----w c:\program files\Puppy Luv
2008-12-27 16:41 --------- dc----w c:\documents and settings\All Users\Application Data\Fugazo
2008-12-27 13:49 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-12-27 13:49 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-12-27 08:10 --------- d-----w c:\documents and settings\All Users\Application Data\NevoSoft Games
2008-12-26 13:02 --------- d-----w c:\documents and settings\Lukáš\Application Data\Reflexive Ashtons Family Resort
2008-12-26 13:02 --------- d-----w c:\documents and settings\All Users\Application Data\Reflexive Ashtons Family Resort
2008-12-24 20:53 --------- d-----w c:\program files\Media Art
2008-12-18 18:15 --------- d-----w c:\program files\uTorrent
2008-12-18 18:06 --------- d-----w c:\documents and settings\Lukáš\Application Data\DAEMON Tools Pro
2008-12-18 18:06 --------- d-----w c:\documents and settings\Lukáš\Application Data\DAEMON Tools Lite
2008-12-18 18:06 --------- d-----w c:\documents and settings\Lukáš\Application Data\DAEMON Tools
2008-12-18 18:05 --------- dc----w c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2008-12-18 18:05 --------- d-----w c:\program files\DAEMON Tools Lite
2008-12-17 19:32 --------- d-----w c:\documents and settings\Lukáš\Application Data\Hide IP NG
2008-12-17 14:32 1,880 ----a-w c:\documents and settings\Lukáš\Application Data\mindhabits.dat
2008-12-17 08:19 --------- dc----w c:\documents and settings\All Users\Application Data\DigitalChocolate
2008-12-17 07:50 --------- d-----w c:\program files\Google
2008-12-16 09:35 --------- d-----w c:\program files\Xilisoft
2008-12-15 09:43 --------- d-----w c:\program files\1C
2008-12-14 17:53 --------- d-----w c:\program files\DVDVideoSoft
2008-12-13 08:07 --------- d-----w c:\program files\Eidos
2008-12-12 07:06 --------- d-----w c:\program files\DivX
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-04 12:49 2,864 ----a-w c:\windows\system32\winsock.dll
2008-11-29 09:52 161 ----a-w c:\program files\setuplog.txt
2008-11-21 21:47 524,288 ----a-w c:\windows\system32\DivXsm.exe
2008-11-21 21:47 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll
2008-11-21 21:46 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-11-21 21:46 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-11-21 21:44 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe
2008-11-21 21:44 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll
2008-11-17 06:59 2,798 ----a-w c:\windows\system32\ealregsnapshot1.reg
2003-08-29 14:13 1,435,648 ----a-w c:\documents and settings\Lukáš\TeamSpeak.exe
2003-08-29 14:13 1,435,648 ----a-w c:\documents and settings\Lukáš\TeamSpeak.exe
2007-09-26 15:13 80 --sh--r c:\windows\system32\AEE61F1FA7.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-02-10_18.05.44.62 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-11 05:40:53 16,384 ----atw c:\windows\TEMP\Perflib_Perfdata_5b0.dat
+ 2009-02-11 05:41:02 16,384 ----atw c:\windows\TEMP\Perflib_Perfdata_718.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"avast! service GUI component"="c:\program files\Alwil Software\Avast4\ashDisp.exe" [2007-12-04 79224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"tsnp325"="c:\windows\tsnp325.exe" [2006-10-10 270336]
"snp325"="c:\windows\vsnp325.exe" [2006-10-10 827392]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-28 136600]
"FixCamera"="c:\windows\FixCamera.exe" [2007-02-12 20480]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"S3Trayp"="S3Trayp.exe" [2005-10-31 c:\windows\system32\S3Trayp.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-19 c:\windows\RTHDCPL.EXE]
"VTTimer"="VTTimer.exe" [2006-06-16 c:\windows\system32\VTTimer.exe]
"Realtime Audio Engine"="mmrtkrnl.exe" [2007-07-18 c:\windows\system32\mmrtkrnl.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-21 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-02-09 06:14 356352 c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
--a------ 2008-11-30 14:41 172792 c:\program files\ICQ6.5\ICQ.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [2007-08-22 11264]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [2005-12-15 274432]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [2005-12-15 81920]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2006-10-10 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2007-02-27 55024]
R3 PSched;QoS Packet Scheduler;c:\windows\system32\drivers\psched.sys [2006-02-28 69120]
R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [2007-08-22 808448]
R3 SNP325;USB PC Camera (SNPSTD325);c:\windows\system32\drivers\snp325.sys [2007-12-24 10251904]
S3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\DRIVERS\pfc027.sys --> c:\windows\system32\DRIVERS\pfc027.sys [?]
S3 s716bus;Sony Ericsson Device 716 driver (WDM);c:\windows\system32\drivers\s716bus.sys [2008-06-07 83208]
S3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter;c:\windows\system32\drivers\s716mdfl.sys [2008-06-07 15112]
S3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver;c:\windows\system32\drivers\s716mdm.sys [2008-06-07 108552]
S3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s716mgmt.sys [2008-06-07 100360]
S3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS);c:\windows\system32\drivers\s716nd5.sys [2008-06-07 23176]
S3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface;c:\windows\system32\drivers\s716obex.sys [2008-06-07 98568]
S3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM);c:\windows\system32\drivers\s716unic.sys [2008-06-07 98952]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2006-02-16 4096]
S3 w200bus;Sony Ericsson W200 driver (WDM);c:\windows\system32\drivers\w200bus.sys [2008-06-07 61504]
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;c:\windows\system32\drivers\w200mdfl.sys [2008-06-07 9328]
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;c:\windows\system32\drivers\w200mdm.sys [2008-06-07 97056]
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;c:\windows\system32\drivers\w200obex.sys [2008-06-07 86368]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2009-02-11 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 09:09]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://start.icq.com/
mLocal Page = "řxn
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com,
uInternet Settings,ProxyServer = socks=
FF - ProfilePath - c:\documents and settings\Lukáš\Application Data\Mozilla\Firefox\Profiles\bo8yv69j.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.notify.interval - 600000
FF - user.js: content.switch.threshold - 1000000
FF - user.js: nglayout.initialpaint.delay - 600
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-11 07:23:50
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-861567501-1229272821-725345543-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:4d,c9,a8,cb,de,87,cb,49,f6,8b,07,31,db,51,08,49,54,b4,7b,27,d9,2b,02,
88,25,ed,72,bb,c2,9a,aa,ab,e5,eb,b9,b9,77,38,11,a2,17,9a,62,74,e5,9d,80,a9,\
"??"=hex:a6,39,de,02,d4,53,e5,2f,bd,7f,e5,e3,ce,0a,49,e4
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(660)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
Completion time: 2009-02-11 7:26:49
ComboFix-quarantined-files.txt 2009-02-11 06:26:44
ComboFix2.txt 2009-02-10 17:08:02

Pre-Run: 158 257 139 712 bytes free
Post-Run: 19 adresárov, 158,243,418,112 voľných bajtov

262 --- E O F --- 2009-01-14 06:23:36

[redvo]

Soubor AEE61F1FA7.dll přijatý 2009.02.11 07:35:48 (CET)

Antivirus;Verze;Poslední aktualizace;Výsledek
a-squared;4.0.0.93;2009.02.11;-
AhnLab-V3;5.0.0.2;2009.02.11;-
AntiVir;7.9.0.76;2009.02.10;-
Authentium;5.1.0.4;2009.02.11;-
Avast;4.8.1335.0;2009.02.10;-
AVG;8.0.0.229;2009.02.10;-
BitDefender;7.2;2009.02.11;-
CAT-QuickHeal;10.00;2009.02.10;-
ClamAV;0.94.1;2009.02.11;-
Comodo;973;2009.02.10;-
DrWeb;4.44.0.09170;2009.02.11;-
eSafe;7.0.17.0;2009.02.09;-
eTrust-Vet;31.6.6349;2009.02.11;-
F-Prot;4.4.4.56;2009.02.10;-
F-Secure;8.0.14470.0;2009.02.11;-
Fortinet;3.117.0.0;2009.02.11;-
GData;19;2009.02.11;-
Ikarus;T3.1.1.45.0;2009.02.11;-
K7AntiVirus;7.10.626;2009.02.10;-
Kaspersky;7.0.0.125;2009.02.11;-
McAfee;5522;2009.02.10;-
McAfee+Artemis;5522;2009.02.10;-
Microsoft;1.4306;2009.02.10;-
NOD32;3844;2009.02.11;-
Norman;6.00.02;2009.02.09;-
nProtect;2009.1.8.0;2009.02.11;-
Panda;10.0.0.10;2009.02.10;-
PCTools;4.4.2.0;2009.02.10;-
Prevx1;V2;2009.02.11;-
Rising;21.16.20.00;2009.02.11;-
SecureWeb-Gateway;6.7.6;2009.02.11;-
Sophos;4.38.0;2009.02.11;-
Sunbelt;3.2.1851.2;2009.02.10;-
Symantec;10;2009.02.11;-
TheHacker;6.3.1.5.252;2009.02.11;-
TrendMicro;8.700.0.1004;2009.02.11;-
VBA32;3.12.8.12;2009.02.11;-
ViRobot;2009.2.10.1599;2009.02.11;-
VirusBuster;4.5.11.0;2009.02.10;-

Rozšiřující informace
File size: 80 bytes
MD5...: c78535f5d6ea93f5ad6050324a521759
SHA1..: 120fef92e618b3945e107607bc8668faa0ec3c32
SHA256: 8cfad28a0c8159164d00b2eef69ff4a3a9a5a7788d8f71d6b880eff59a4472e6
SHA512: f8a57bd09d164ab0b70679688adbec2db838c7e78fd911cf79909ddaff17e25b<br>b338447daf544cc06b821077e403d9b6dd7d960d646b347517f49ded1ef19868<br>
ssdeep: 3:slxz//tl9qH6QXZtRj:E58H6QX1j<br>
PEiD..: -
TrID..: File type identification<br>MS Flight Simulator Aircraft Performance Info (100.0%)
PEInfo: -

[jaro3]

Vlož ještě nový log z HJT.

[redvo]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:44:18, on 11. 2. 2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\tsnp325.exe
C:\WINDOWS\system32\S3Trayp.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\vsnp325.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\mmrtkrnl.exe
C:\WINDOWS\FixCamera.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=66022
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = "řxn
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com,
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Podpora odkazu pre aplikáciu Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [tsnp325] C:\WINDOWS\tsnp325.exe
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [S3Trayp] S3Trayp.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [snp325] C:\WINDOWS\vsnp325.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [Realtime Audio Engine] "mmrtkrnl.exe" /i
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [avast! service GUI component] C:\Program Files\Alwil Software\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [HP Digital Imaging Monitor] C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Zdroje informácií - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing)
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 7755 bytes

[jaro3]

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll

V nouzovém režimu odstraň celou tuto složku:
c:\ program files\partypoker

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

takže jestli nejsou problémy,tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.

Aktualizuj javu:
Java SE Runtime Environment 6u12
Vyber OS ( předpokládám Windows), zatržítko agree-continue
Vyber:
Windows Offline Installation
jre-6u12-windows-i586-p.exe
Ostatní javy odeber v přidat/odebrat programy.
Vše.

[redvo]

A ešte by som sa chcel spýtať či by sa nedalo niečo spraviť s tým MyWebSearch, lebo nainštalovaný ho nemám, ale na začiatku mi tam vyhadzuje ten error že sa nepodarilo nájsť súbor C://Program/.../MyWebSearch.dll a ja ho v program files nemám, ale keď si čistím PC napr so spybotom tak mi nájde nejaké pozostatky v registroch a tak. A vyhadzuje mi tam chyby. Možno som ho kedysi dávnejšie neodinštaloval ale "natvrdo" vymazal z program files. Takže či by sa to dalo nejako odstrániť.

[jaro3]

Stahni si Avanger
do něj podle navodu:
zadej prikaz z kodu:

Kód: Vybrat vše

Files to delete:
c:\windows\system32\AEE61F1FA7.dll


po restartu log z avengeru, podle mě to tam nemá co dělat...

V exploreru dej vyhledat vše s názvem MyWebSearch, MWSBAR a vlož sem.
Zdálo se , že Combofix vše odstranil viz log z CF:
- - - ORPHANS REMOVED - - - -

MSConfigStartUp-My Web Search Bar - c:\progra~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL
MSConfigStartUp-MyWebSearch Email Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

Ještě Start-Spustit-napiš regedit a v lvém sloupci vyhledej H_KEY_LOCAL_MACHINE-SOFTWARE a
H_KEY_CURRENT_USER-SOFTWARE a celé složky MyWebSearch smaž -pravým klik a vybrat odstranit.

[redvo]

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 3)
Wed Feb 11 11:33:41 2009

11:33:41: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!


//////////////////////////////////////////


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "c:\windows\system32\AEE61F1FA7.dll" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[redvo]

V tých registroch som nič z MyWebSearch nenašiel. A neviem či som dobre pochopil to hľadanie v Exploreri. Ak to malo byť cez štart -> hľadať tak tu je screen. Ak nie ta sa ospravedlňujem a poprosím trošku podrobnejšie opísať

MyWebSearch

Kód: Vybrat vše

http://img144.imageshack.us/my.php?image=screen1eb6.jpg

a na MWSbar mi nenašlo nič

[jaro3]

Můžeš to smazat ve Spybotu/Recovery.
Jinde to asi už není. V exploreru jsem myslel otevřít tento počítač a dát hledat, ale toto by mělo být stejné.

[redvo]

OK hotovo, ďakujem