Prosim o kontrolu logu- pravdepodobne trojsky kon 2nd though

[Damned]

Ať koukám jak koukám, žádnýho viruta tam nevidím. Hlásí ti něco Avira?

Najdi a ručně smaž tyto červené soubory:
c:\windows\Tasks\WGASetup.job
c:\windows\system32\KB905474\wgasetup.exe
c:\program files\taskmanager17.exe a pak nezapomeň vysypat Koš.
*****************************************************************************************************************************************
Odinstaluj ComboFix ( nutné ) .
ComboFix se odinstaluje takto:
Start-Spustit a zadej Combofix[mezera]/uninstall

Stáhni si T-Cleaner ( nutné - smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš->spustíš)

(pozn.Pokud máš AVG nebo Aviru, před stažením T-Cleaneru a po dobu čištění deaktivuj AVG i Aviru (i rezidenty), následně T-Cleaner smaž a zapni si AVG, Aviru.)
*****************************************************************************************************************************************
Poklepej na ikonu OTL na ploše.Ujisti se , že máš všechny ostatní aplikace a prohlížeče zavřeny.
Pod Custom Scans/Fixes do okénka vlož následující text, zobrazený zeleně:

Kód: Vybrat vše

:OTL

:Files
C:\Windows\*.tmp
C:\Windows\System32\*.tmp
C:\Recycler
C:\$RECYCLE.BIN

:Reg

:Commands
[purity]
[emptytemp]
[emptyflash]
[start explorer]
[Reboot]


Poté klikni nahoře na Run Fix. Nech program nerušeně běžet, na konci se provede restart PC.
Po restartu se objeví log , prosím zkopíruj sem celý jeho obsah.
*****************************************************************************************************************************************
Spusť F-Secure Online Scanner

Tento skener je možno použít jen v prohlížeči Internet Explorer! Postupuj podle instrukcí na stránce F-Secure pro správnou instalaci.
Akceptuj licenci.
Po instalaci ActiveX, klikni na Full System Scan. Když je stahování skončeno, automaticky začne sken.
Vyčkej konce skenu, po jeho dobu neprováděj jiné operace ani neklikej myší. Když skončí sken, klikni na tlačítko Automatic clearing (recommended).
Poté klikni na tlačítko Show Report a zkopíruj a vlož sem .

[Reklama]

[mataa]

Ahoj,

zmazala som rucne subory oznacene cervene a vsetko ostatne tiez. Tu je log file po T cleanery:

All processes killed
========== OTL ==========
========== FILES ==========
C:\Windows\SET3.tmp moved successfully.
C:\Windows\SET4.tmp moved successfully.
C:\Windows\SET8.tmp moved successfully.
C:\Windows\System32\CONFIG.TMP moved successfully.
C:\Windows\System32\SET11B.tmp moved successfully.
C:\Windows\System32\SET120.tmp moved successfully.
C:\Windows\System32\SET127.tmp moved successfully.
C:\Windows\System32\SET130.tmp moved successfully.
C:\Windows\System32\SET131.tmp moved successfully.
C:\Windows\System32\SET132.tmp moved successfully.
C:\Windows\System32\SET133.tmp moved successfully.
C:\Windows\System32\SET135.tmp moved successfully.
C:\Windows\System32\SET69.tmp moved successfully.
C:\Windows\System32\SET6A.tmp moved successfully.
C:\Windows\System32\SET6B.tmp moved successfully.
C:\Windows\System32\SET6C.tmp moved successfully.
C:\Windows\System32\SET6D.tmp moved successfully.
C:\Windows\System32\SET6E.tmp moved successfully.
C:\Windows\System32\SET6F.tmp moved successfully.
C:\Windows\System32\SET70.tmp moved successfully.
C:\Windows\System32\SET74.tmp moved successfully.
C:\Windows\System32\SET75.tmp moved successfully.
C:\Windows\System32\SET76.tmp moved successfully.
C:\Windows\System32\SET77.tmp moved successfully.
C:\Windows\System32\SET78.tmp moved successfully.
C:\Windows\System32\SET7C.tmp moved successfully.
C:\Windows\System32\SET7D.tmp moved successfully.
C:\Windows\System32\SET7E.tmp moved successfully.
C:\Windows\System32\SET80.tmp moved successfully.
C:\Windows\System32\SET81.tmp moved successfully.
C:\Windows\System32\SET82.tmp moved successfully.
C:\Windows\System32\SET83.tmp moved successfully.
C:\Windows\System32\SET85.tmp moved successfully.
C:\Windows\System32\SET86.tmp moved successfully.
C:\Windows\System32\SET88.tmp moved successfully.
C:\Windows\System32\SET89.tmp moved successfully.
C:\Windows\System32\SET8A.tmp moved successfully.
C:\Windows\System32\SET8B.tmp moved successfully.
C:\Windows\System32\SET8C.tmp moved successfully.
C:\Windows\System32\SET8F.tmp moved successfully.
C:\Windows\System32\SET90.tmp moved successfully.
C:\Windows\System32\SET91.tmp moved successfully.
C:\Windows\System32\SET92.tmp moved successfully.
C:\Windows\System32\SET93.tmp moved successfully.
C:\Windows\System32\SET95.tmp moved successfully.
C:\Windows\System32\SET96.tmp moved successfully.
C:\Windows\System32\SET97.tmp moved successfully.
C:\Windows\System32\SET98.tmp moved successfully.
C:\Windows\System32\SET99.tmp moved successfully.
C:\Windows\System32\SET9B.tmp moved successfully.
C:\Windows\System32\SET9C.tmp moved successfully.
C:\Windows\System32\SET9D.tmp moved successfully.
C:\Windows\System32\SETC0.tmp moved successfully.
C:\Windows\System32\SETC1.tmp moved successfully.
C:\Windows\System32\SETC2.tmp moved successfully.
C:\Windows\System32\SETC3.tmp moved successfully.
C:\Windows\System32\SETC5.tmp moved successfully.
C:\Windows\System32\SETC6.tmp moved successfully.
C:\Windows\System32\SETF.tmp moved successfully.
C:\Windows\System32\SETFCF.tmp moved successfully.
C:\Windows\System32\SETFD4.tmp moved successfully.
C:\RECYCLER\S-1-5-21-1202660629-1677128483-1957994488-1003\Dc16\Alcohol 120 folder moved successfully.
C:\RECYCLER\S-1-5-21-1202660629-1677128483-1957994488-1003\Dc16 folder moved successfully.
C:\RECYCLER\S-1-5-21-1202660629-1677128483-1957994488-1003 folder moved successfully.
C:\RECYCLER folder moved successfully.
File\Folder C:\$RECYCLE.BIN not found.
========== REGISTRY ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 84 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: mata
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 3015326 bytes
->Java cache emptied: 45282829 bytes
->FireFox cache emptied: 67095001 bytes
->Google Chrome cache emptied: 14314151 bytes
->Flash cache emptied: 105888 bytes

User: miso

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 65670 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 13822200 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 3901440 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 6088059 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 147,00 mb


[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: mata
->Flash cache emptied: 0 bytes

User: miso

User: NetworkService

Total Flash Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.1.36.1 log created on 03112010_225738

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...



A toto je report z internetoveho scanu, ziadny malware nenaslo :

Scanning Report
Friday, March 12, 2010 00:14:41 - 01:34:23

Computer name: MARTINA
Scanning type: Scan system for malware, spyware and rootkits
Target: C:\
No malware found
Statistics
Scanned:

* Files: 30370
* System: 3109
* Not scanned: 9

Actions:

* Disinfected: 0
* Renamed: 0
* Deleted: 0
* Not cleaned: 0
* Submitted: 0

Files not scanned:

* C:\PAGEFILE.SYS
* C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
* C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
* C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
* C:\WINDOWS\SYSTEM32\CONFIG\SAM
* C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM
* C:\SYSTEM VOLUME INFORMATION\MOUNTPOINTMANAGERREMOTEDATABASE
* C:\DOCUMENTS AND SETTINGS\MATA\LOCAL SETTINGS\TEMP\HSPERFDATA_MATA\1804
* C:\DOCUMENTS AND SETTINGS\MATA\LOCAL SETTINGS\TEMP\HSPERFDATA_MATA\2272

Options
Scanning engines:

Scanning options:

* Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML XXX ANI AVB BAT CMD JOB LSP MAP MHT MIF PHP POT SWF WMF NWS TAR
* Use advanced heuristics

[Damned]

Poklepej na ikonu OTL na ploše.Ujisti se , že máš všechny ostatní aplikace a prohlížeče zavřeny.
Pod Custom Scans/Fixes do okénka vlož následující text, zobrazený zeleně:

Kód: Vybrat vše

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=971163"
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&q="
[2010.01.27 08:55:35 | 000,000,000 | ---D | M] (BS Player Toolbar) -- C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}
[2010.03.11 18:06:39 | 000,000,961 | ---- | M] () -- C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\searchplugins\icqplugin-1.xml
[2009.10.16 09:11:36 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\searchplugins\icqplugin-2.xml
[2009.10.28 17:40:40 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\searchplugins\icqplugin-3.xml
[2009.12.02 23:47:31 | 000,000,961 | ---- | M] () -- C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\searchplugins\icqplugin-4.xml
[2009.12.03 00:53:15 | 000,000,961 | ---- | M] () -- C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\searchplugins\icqplugin-5.xml
[2009.12.17 16:12:51 | 000,000,961 | ---- | M] () -- C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\searchplugins\icqplugin-6.xml
[2009.07.24 17:57:54 | 000,000,950 | ---- | M] () -- C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\searchplugins\icqplugin.xml
[2009.12.02 23:29:07 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1202660629-1677128483-1957994488-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} http://www.eset.cz/buxus/docs/OnlineScanner.cab (Reg Error: Key error.)

:Files
C:\Windows\*.tmp
C:\WINDOWS\System32\dllcache\*.tmp
C:\Windows\System32\*.tmp
C:\Recycler
C:\$RECYCLE.BIN
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
C:\Program Files\ESET
C:\Documents and Settings\LocalService\Local Settings\Application Data\ESET
C:\Documents and Settings\All Users\Application Data\ESET
C:\Program Files\Namkha2007_setup.exe
C:\Program Files\WinDjView-0.4.3.exe
C:\WINDOWS\System32\d3d9caps.dat
C:\WINDOWS\tasks\WGASetup.job
C:\WINDOWS\tasks\SA.DAT

:Reg

:Commands
[purity]
[emptytemp]
[emptyflash]
[start explorer]
[Reboot]


Poté klikni nahoře na Run Fix. Nech program nerušeně běžet, na konci se provede restart PC.
Po restartu se objeví log , prosím zkopíruj sem celý jeho obsah.

[mataa]

Ok, tu je vystupny log:

All processes killed
========== OTL ==========
No active process named explorer.exe was found!
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: "chr-greentree_ff&type=971163" removed from browser.search.param.yahoo-fr
Prefs.js: "http://search.icq.com/search/afe_results.php?ch_id=afex&q=" removed from keyword.URL
C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\searchplugin folder moved successfully.
C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\META-INF folder moved successfully.
C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\lib folder moved successfully.
C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\defaults folder moved successfully.
C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\components folder moved successfully.
C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}\chrome folder moved successfully.
C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} folder moved successfully.
C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\searchplugins\icqplugin-1.xml moved successfully.
C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\searchplugins\icqplugin-2.xml moved successfully.
C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\searchplugins\icqplugin-3.xml moved successfully.
C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\searchplugins\icqplugin-4.xml moved successfully.
C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\searchplugins\icqplugin-5.xml moved successfully.
C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\searchplugins\icqplugin-6.xml moved successfully.
C:\Documents and Settings\mata\Application Data\Mozilla\Firefox\Profiles\tfd5786t.default\searchplugins\icqplugin.xml moved successfully.
C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml moved successfully.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-21-1202660629-1677128483-1957994488-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Starting removal of ActiveX control {56762DEC-6B0D-4AB4-A8AD-989993B5D08B}
C:\WINDOWS\Downloaded Program Files\OnlineScanner.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{56762DEC-6B0D-4AB4-A8AD-989993B5D08B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56762DEC-6B0D-4AB4-A8AD-989993B5D08B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{56762DEC-6B0D-4AB4-A8AD-989993B5D08B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56762DEC-6B0D-4AB4-A8AD-989993B5D08B}\ not found.
========== FILES ==========
File\Folder C:\Windows\*.tmp not found.
File\Folder C:\WINDOWS\System32\dllcache\*.tmp not found.
File\Folder C:\Windows\System32\*.tmp not found.
C:\RECYCLER\S-1-5-21-1202660629-1677128483-1957994488-1003 folder moved successfully.
C:\RECYCLER folder moved successfully.
File\Folder C:\$RECYCLE.BIN not found.
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP9\AVZData folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP9 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab folder moved successfully.
C:\Program Files\ESET\ESET Smart Security folder moved successfully.
C:\Program Files\ESET folder moved successfully.
C:\Documents and Settings\LocalService\Local Settings\Application Data\ESET\ESET NOD32 Antivirus\Quarantine folder moved successfully.
C:\Documents and Settings\LocalService\Local Settings\Application Data\ESET\ESET NOD32 Antivirus folder moved successfully.
C:\Documents and Settings\LocalService\Local Settings\Application Data\ESET folder moved successfully.
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus\Stats folder moved successfully.
C:\Documents and Settings\All Users\Application Data\ESET\ESET NOD32 Antivirus folder moved successfully.
C:\Documents and Settings\All Users\Application Data\ESET folder moved successfully.
C:\Program Files\Namkha2007_setup.exe moved successfully.
C:\Program Files\WinDjView-0.4.3.exe moved successfully.
C:\WINDOWS\System32\d3d9caps.dat moved successfully.
File\Folder C:\WINDOWS\tasks\WGASetup.job not found.
C:\WINDOWS\tasks\SA.DAT moved successfully.
========== REGISTRY ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: mata
->Temp folder emptied: 184691535 bytes
->Temporary Internet Files folder emptied: 3393540 bytes
->Java cache emptied: 30600 bytes
->FireFox cache emptied: 41386340 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 770 bytes

User: miso

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 219,00 mb


[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: mata
->Flash cache emptied: 0 bytes

User: miso

User: NetworkService

Total Flash Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.1.36.1 log created on 03122010_082733

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

[Damned]

Avira by ti už neměla nic hlásit, měla by si to mít OK.

Smaž složku C:\_OTL

Stáhni si ToolsCleaner2 (by de A.Rothstein & Dj Quiou) na Plochu a spusť ho.

Klikni na Pt. Restauration (obnova) a poté na OK.
Klikni na Corbeille (koš) a poté na OK.
Klikni na Fichiers temp (temp složky) a poté na OK.
Klikni na Recherche (hledání) a nech Cleaner pracovat. Může se během čištění zastavit , ale nech ho pokračovat.
Když program skončí , klikni na Suppression (odstranění) a odstraň nalezené.
Zavři a smaž program.



Kdyby se něco zase objevilo, tak se zastav.
Označ topic za vyřešený (zelená fajfka) a měj se.

[mataa]

Super, dakujem. Fakt si mi pomohol. Si macher. Maj sa dobre.