nefunkcne "mistni uzivatele a skupiny"

[tre-SKA]

prosim o kontrolu logu

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:45:21, on 26. 3. 2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\winsys2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-602162358-1284227242-839522115-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: VPN Client.lnk = ?
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 7970888812
O17 - HKLM\System\CCS\Services\Tcpip\..\{442A2B75-B3A2-4DAA-91A3-912BA1695D76}: NameServer = 158.195.40.1,158.195.2.2
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4411 bytes

[Reklama]

[jaro3]

To je zase jiný PC než je níže , co řešíme?

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[tre-SKA]

zevraj je to ciste... nenasiel nic

[jaro3]

A co tehle trojan:
C:\WINDOWS\system32\winsys2.exe ????

[tre-SKA]

evidentne ciste...

http://www.virustotal.com/cs/analisis/2 ... a3b7a14ae1


uvidime dal som uplnu kontrolu

[jaro3]

Vypni rez. ochranu u NOD32.
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[tre-SKA]

ComboFix 09-03-25.03 - Admin 2009-03-26 15:46:54.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.2047.1580 [GMT 1:00]
Running from: c:\documents and settings\Admin\Plocha\ComboFix.exe
AV: Eset NOD32 Antivirus 2.70 *On-access scanning enabled* (Updated)
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-02-26 to 2009-03-26 )))))))))))))))))))))))))))))))
.

2009-03-26 15:27 . 2009-03-26 15:27 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-03-26 15:27 . 2009-03-26 15:27 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2009-03-26 15:27 . 2009-03-26 15:27 <DIR> d-------- c:\documents and settings\Admin\Data aplikací\Malwarebytes
2009-03-26 15:27 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-26 15:27 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-03-26 14:44 . 2009-03-26 14:44 <DIR> d-------- c:\program files\Trend Micro
2009-03-26 14:25 . 2009-03-26 14:25 <DIR> d-------- c:\windows\NV25883024.TMP
2009-03-26 14:25 . 2009-02-18 14:44 212,711 --a------ c:\windows\system32\nvapps.nvb
2009-03-25 14:10 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
2009-03-25 14:10 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
2009-03-25 12:29 . 2009-03-25 12:30 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-03-25 12:29 . 2009-03-25 12:30 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2009-03-25 10:10 . 2009-03-26 14:25 <DIR> d-------- c:\windows\LastGood
2009-03-25 10:10 . 2009-03-25 10:10 142 --a------ c:\windows\system32\spupdsvc.inf
2009-03-25 10:07 . 2009-03-25 10:11 <DIR> d-------- c:\windows\system32\KB905474
2009-03-25 10:07 . 2009-03-10 22:18 454,024 --a------ c:\windows\system32\KB905474\wgasetup.exe
2009-03-25 09:47 . 2009-03-25 09:47 <DIR> d---s---- c:\documents and settings\Admin\UserData
2009-03-25 09:28 . 2009-03-25 09:28 512,096 --a------ c:\windows\system32\drivers\amon.sys
2009-03-25 09:28 . 2009-03-25 09:28 298,104 --a------ c:\windows\system32\imon.dll
2009-03-25 09:28 . 2009-03-25 09:28 15,424 --a------ c:\windows\system32\drivers\nod32drv.sys
2009-03-25 09:17 . 2009-03-25 09:17 <DIR> d--h----- c:\windows\system32\GroupPolicy
2009-03-25 09:10 . 2008-04-14 04:22 221,184 --a------ c:\windows\system32\wmpns.dll
2009-03-25 09:09 . 2009-03-26 15:44 <DIR> d-------- c:\documents and settings\Admin\Plocha
2009-03-25 09:09 . 2009-02-12 13:13 <DIR> d--h----- c:\documents and settings\Admin\Okolní tiskárny
2009-03-25 09:09 . 2009-02-12 13:13 <DIR> d--h----- c:\documents and settings\Admin\Okolní síť
2009-03-25 09:09 . 2009-03-25 09:10 <DIR> dr------- c:\documents and settings\Admin\Oblíbené položky
2009-03-25 09:09 . 2009-02-12 12:27 <DIR> d--h----- c:\documents and settings\Admin\Šablony
2009-03-25 09:09 . 2009-02-12 13:13 <DIR> dr------- c:\documents and settings\Admin\Nabídka Start
2009-03-25 09:09 . 2009-03-25 09:10 <DIR> dr------- c:\documents and settings\Admin\Dokumenty
2009-03-25 09:09 . 2009-03-26 15:27 <DIR> dr-h----- c:\documents and settings\Admin\Data aplikací
2009-03-25 09:09 . 2009-03-25 09:47 <DIR> d-------- c:\documents and settings\Admin
2009-03-24 15:44 . 2006-08-11 14:43 1,519,616 --a------ c:\windows\system32\nwiz.exe
2009-03-24 15:44 . 2008-04-14 04:21 141,824 --a------ c:\windows\system32\nwprovau.dll
2009-03-24 15:44 . 2008-04-14 04:21 141,824 --a--c--- c:\windows\system32\dllcache\nwprovau.dll
2009-03-24 15:44 . 2008-04-14 04:21 64,000 --a------ c:\windows\system32\nwapi32.dll
2009-03-24 15:44 . 2008-04-14 04:21 64,000 --a--c--- c:\windows\system32\dllcache\nwapi32.dll
2009-03-24 15:35 . 2009-03-24 15:35 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\nView_Profiles
2009-03-24 15:28 . 2009-03-24 15:34 <DIR> d-------- c:\windows\NV312328.TMP
2009-03-24 15:10 . 2009-03-26 14:26 53 --a------ C:\biosinfo
2009-03-24 14:59 . 2009-03-24 14:59 <DIR> d-------- c:\program files\CCleaner
2009-03-24 14:36 . 2009-03-24 14:36 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\NVIDIA
2009-03-24 14:33 . 2009-03-24 14:40 <DIR> d-------- c:\windows\NV1841076.TMP
2009-03-24 14:08 . 2009-03-24 14:12 <DIR> d-------- c:\windows\NV33803384.TMP
2009-03-24 13:56 . 2006-07-06 10:43 442,368 --a------ c:\windows\system32\CapabilityTable.exe
2009-03-24 13:54 . 2009-03-24 13:54 <DIR> d-------- c:\windows\NV40244028.TMP
2009-03-24 13:54 . 2006-07-12 06:38 1,160,448 -ra------ c:\windows\system32\drivers\nvnrm.sys
2009-03-24 13:54 . 2006-07-12 06:37 261,632 -ra------ c:\windows\system32\drivers\nvsnpu.sys
2009-03-24 13:54 . 2006-07-12 06:36 201,728 -ra------ c:\windows\system32\fdco1.dll
2009-03-24 13:54 . 2006-07-12 06:38 110,592 -ra------ c:\windows\system32\drivers\nvtcp.sys
2009-03-24 13:54 . 2006-07-12 06:38 57,856 -ra------ c:\windows\system32\drivers\NVENETFD.sys
2009-03-24 13:54 . 2006-07-12 06:38 20,480 -ra------ c:\windows\system32\drivers\nvnetbus.sys
2009-03-24 13:54 . 2006-07-12 06:36 11,264 -ra------ c:\windows\system32\bdco1.dll
2009-03-23 14:52 . 2003-07-06 13:17 1,404,928 --a------ c:\windows\system\nvcpl.dll
2009-03-23 14:45 . 2006-08-14 14:51 363,008 --a------ c:\windows\system32\idecoiins.dll
2009-03-23 14:45 . 2006-08-14 14:51 363,008 --a------ c:\windows\system32\idecoi.dll
2009-03-23 14:45 . 2006-08-14 14:51 105,344 --a------ c:\windows\system32\drivers\nvata.sys
2009-03-23 12:24 . 2006-09-28 16:05 2,414,360 --a------ c:\windows\system32\d3dx9_31.dll
2009-03-23 12:23 . 2009-03-23 12:24 <DIR> d--h----- c:\windows\msdownld.tmp
2009-03-23 12:23 . 2009-03-23 12:23 <DIR> d-------- c:\windows\Logs
2009-03-23 12:15 . 2009-03-23 12:15 <DIR> d-------- c:\program files\SystemRequirementsLab
2009-03-23 12:15 . 2009-03-23 12:15 <DIR> d-------- c:\documents and settings\Administrator\SystemRequirementsLab
2009-03-23 12:15 . 2009-03-23 12:15 552 --a------ c:\windows\system32\d3d8caps.dat
2009-03-23 11:59 . 2009-03-23 11:59 472,576 --a------ c:\windows\Nvidia Omega Drivers v2.169.21 Uninstall.exe
2009-03-23 10:49 . 2009-03-23 10:50 <DIR> d-------- c:\windows\NV564560.TMP
2009-03-23 10:43 . 2009-03-23 10:44 <DIR> d-------- c:\windows\NV136248.TMP
2009-03-23 10:43 . 2009-03-24 13:50 664 --a------ c:\windows\system32\d3d9caps.dat
2009-03-23 10:39 . 2009-03-23 10:40 <DIR> d-------- c:\windows\NV220164.TMP
2009-03-23 10:36 . 2009-03-23 14:23 <DIR> d-------- C:\NVIDIA
2009-03-10 22:18 . 2009-03-10 22:18 265,096 --------- c:\windows\system32\SET15.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-26 14:46 --------- d-----w c:\program files\ESET
2009-03-25 09:06 --------- d-----w c:\documents and settings\All Users\Data aplikací\Microsoft Help
2009-03-24 14:15 --------- d-----w c:\program files\Common Files\Adobe
2009-03-23 14:32 --------- d-----w c:\program files\Common Files\InstallShield
2009-03-23 10:03 --------- d-----w c:\program files\OpenOffice.org 3
2009-02-23 13:53 90,112 ----a-w c:\windows\DUMP82fb.tmp
2009-02-23 11:52 90,112 ----a-w c:\windows\DUMP6273.tmp
2009-02-23 11:51 90,112 ----a-w c:\windows\DUMP63bb.tmp
2009-02-23 11:49 90,112 ----a-w c:\windows\DUMPc236.tmp
2009-02-23 09:16 90,112 ----a-w c:\windows\DUMPa587.tmp
2009-02-23 09:10 90,112 ----a-w c:\windows\DUMP5e8b.tmp
2009-02-17 15:01 --------- d-----w c:\program files\MSXML 4.0
2009-02-17 14:44 410,976 ----a-w c:\windows\system32\deploytk.dll
2009-02-17 14:44 --------- d-----w c:\program files\Java
2009-02-17 14:43 --------- d-----w c:\program files\Avago-HP
2009-02-16 22:17 453,152 ----a-w c:\windows\system32\NVUNINST.EXE
2009-02-16 08:38 --------- d-----w c:\program files\Common Files\SAP Shared
2009-02-16 08:36 --------- d-----w c:\program files\SAP
2009-02-16 08:21 --------- d-----w c:\program files\Common Files\Deterministic Networks
2009-02-16 08:07 --------- d-----w c:\program files\Cisco Systems
2009-02-12 12:13 --------- d-----w c:\program files\Total Commander
2009-02-12 12:11 --------- d-----w c:\documents and settings\Uzivatel\Data aplikací\OpenOffice.org
2009-02-12 12:05 --------- d-----w c:\program files\Microsoft Works
2009-02-12 12:04 --------- d-----w c:\program files\MSBuild
2009-02-12 11:44 --------- d-----w c:\program files\Analog Devices
2009-02-12 11:43 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-12 11:30 --------- d-----w c:\program files\microsoft frontpage
2009-02-09 14:07 1,846,784 ----a-w c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-07-20 847872]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-17 136600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640]
"SW20"="c:\windows\system32\sw20.exe" [2006-09-07 208896]
"SW24"="c:\windows\system32\sw24.exe" [2006-09-07 69632]
"WinSys2"="c:\windows\system32\winsys2.exe" [2006-10-03 217088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-03-25 949376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 86016]
"nwiz"="nwiz.exe" [2006-08-11 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
VPN Client.lnk - c:\windows\Installer\{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}\Icon3E5562ED7.ico [2009-02-16 6144]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\SAP\\FrontEnd\\SAPgui\\saplogon.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"500:UDP"= 500:UDP:193.87.58.66/255.255.255.255,193.87.58.93/255.255.255.255:Enabled:FIS1
"4500:UDP"= 4500:UDP:193.87.58.66/255.255.255.255,193.87.58.93/255.255.255.255:Enabled:FIS2
"10000:UDP"= 10000:UDP:193.87.58.66/255.255.255.255,193.87.58.93/255.255.255.255:Enabled:FIS3

R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2009-03-25 15424]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2004-08-18 69120]
S2 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [2009-02-12 26488]
.
.
------- Supplementary Scan -------
.
LSP: c:\windows\system32\imon.dll
TCP: {442A2B75-B3A2-4DAA-91A3-912BA1695D76} = 158.195.40.1,158.195.2.2
FF - ProfilePath - c:\documents and settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\u47b0yhx.default\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-26 15:48:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-03-26 15:48:41
ComboFix-quarantined-files.txt 2009-03-26 14:48:39

Pre-Run: Volných bajtů: 181 846 388 736
Post-Run: Volných bajtů: 182,061,887,488

170

[jaro3]

Takže jsi ho smazal , už tam není...
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
c:\windows\system32\SET15.tmp
c:\windows\DUMP82fb.tmp
c:\windows\DUMP6273.tmp
c:\windows\DUMP63bb.tmp
c:\windows\DUMPc236.tmp
c:\windows\DUMPa587.tmp
c:\windows\DUMP5e8b.tmp


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

[tre-SKA]

ComboFix 09-03-25.03 - Admin 2009-03-26 16:09:28.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.2047.1589 [GMT 1:00]
Running from: c:\documents and settings\Admin\Plocha\ComboFix.exe
Command switches used :: c:\documents and settings\Admin\Plocha\CFScript.txt
AV: Eset NOD32 Antivirus 2.70 *On-access scanning enabled* (Updated)
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\windows\DUMP5e8b.tmp
c:\windows\DUMP6273.tmp
c:\windows\DUMP63bb.tmp
c:\windows\DUMP82fb.tmp
c:\windows\DUMPa587.tmp
c:\windows\DUMPc236.tmp
c:\windows\system32\SET15.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\DUMP5e8b.tmp
c:\windows\DUMP6273.tmp
c:\windows\DUMP63bb.tmp
c:\windows\DUMP82fb.tmp
c:\windows\DUMPa587.tmp
c:\windows\DUMPc236.tmp
c:\windows\system32\SET15.tmp

.
((((((((((((((((((((((((( Files Created from 2009-02-26 to 2009-03-26 )))))))))))))))))))))))))))))))
.

2009-03-26 15:27 . 2009-03-26 15:27 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-03-26 15:27 . 2009-03-26 15:27 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2009-03-26 15:27 . 2009-03-26 15:27 <DIR> d-------- c:\documents and settings\Admin\Data aplikací\Malwarebytes
2009-03-26 15:27 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-26 15:27 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-03-26 14:44 . 2009-03-26 14:44 <DIR> d-------- c:\program files\Trend Micro
2009-03-26 14:25 . 2009-03-26 14:25 <DIR> d-------- c:\windows\NV25883024.TMP
2009-03-26 14:25 . 2009-02-18 14:44 212,711 --a------ c:\windows\system32\nvapps.nvb
2009-03-25 14:10 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
2009-03-25 14:10 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
2009-03-25 12:29 . 2009-03-25 12:30 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-03-25 12:29 . 2009-03-25 12:30 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2009-03-25 10:10 . 2009-03-26 14:25 <DIR> d-------- c:\windows\LastGood
2009-03-25 10:10 . 2009-03-25 10:10 142 --a------ c:\windows\system32\spupdsvc.inf
2009-03-25 10:07 . 2009-03-25 10:11 <DIR> d-------- c:\windows\system32\KB905474
2009-03-25 10:07 . 2009-03-10 22:18 454,024 --a------ c:\windows\system32\KB905474\wgasetup.exe
2009-03-25 09:47 . 2009-03-25 09:47 <DIR> d---s---- c:\documents and settings\Admin\UserData
2009-03-25 09:28 . 2009-03-25 09:28 512,096 --a------ c:\windows\system32\drivers\amon.sys
2009-03-25 09:28 . 2009-03-25 09:28 298,104 --a------ c:\windows\system32\imon.dll
2009-03-25 09:28 . 2009-03-25 09:28 15,424 --a------ c:\windows\system32\drivers\nod32drv.sys
2009-03-25 09:17 . 2009-03-25 09:17 <DIR> d--h----- c:\windows\system32\GroupPolicy
2009-03-25 09:10 . 2008-04-14 04:22 221,184 --a------ c:\windows\system32\wmpns.dll
2009-03-25 09:09 . 2009-03-26 16:09 <DIR> d-------- c:\documents and settings\Admin\Plocha
2009-03-25 09:09 . 2009-02-12 13:13 <DIR> d--h----- c:\documents and settings\Admin\Okolní tiskárny
2009-03-25 09:09 . 2009-02-12 13:13 <DIR> d--h----- c:\documents and settings\Admin\Okolní síť
2009-03-25 09:09 . 2009-03-25 09:10 <DIR> dr------- c:\documents and settings\Admin\Oblíbené položky
2009-03-25 09:09 . 2009-02-12 12:27 <DIR> d--h----- c:\documents and settings\Admin\Šablony
2009-03-25 09:09 . 2009-02-12 13:13 <DIR> dr------- c:\documents and settings\Admin\Nabídka Start
2009-03-25 09:09 . 2009-03-25 09:10 <DIR> dr------- c:\documents and settings\Admin\Dokumenty
2009-03-25 09:09 . 2009-03-26 15:27 <DIR> dr-h----- c:\documents and settings\Admin\Data aplikací
2009-03-25 09:09 . 2009-03-25 09:47 <DIR> d-------- c:\documents and settings\Admin
2009-03-24 15:44 . 2006-08-11 14:43 1,519,616 --a------ c:\windows\system32\nwiz.exe
2009-03-24 15:44 . 2008-04-14 04:21 141,824 --a------ c:\windows\system32\nwprovau.dll
2009-03-24 15:44 . 2008-04-14 04:21 141,824 --a--c--- c:\windows\system32\dllcache\nwprovau.dll
2009-03-24 15:44 . 2008-04-14 04:21 64,000 --a------ c:\windows\system32\nwapi32.dll
2009-03-24 15:44 . 2008-04-14 04:21 64,000 --a--c--- c:\windows\system32\dllcache\nwapi32.dll
2009-03-24 15:35 . 2009-03-24 15:35 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\nView_Profiles
2009-03-24 15:28 . 2009-03-24 15:34 <DIR> d-------- c:\windows\NV312328.TMP
2009-03-24 15:10 . 2009-03-26 14:26 53 --a------ C:\biosinfo
2009-03-24 14:59 . 2009-03-24 14:59 <DIR> d-------- c:\program files\CCleaner
2009-03-24 14:36 . 2009-03-24 14:36 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\NVIDIA
2009-03-24 14:33 . 2009-03-24 14:40 <DIR> d-------- c:\windows\NV1841076.TMP
2009-03-24 14:08 . 2009-03-24 14:12 <DIR> d-------- c:\windows\NV33803384.TMP
2009-03-24 13:56 . 2006-07-06 10:43 442,368 --a------ c:\windows\system32\CapabilityTable.exe
2009-03-24 13:54 . 2009-03-24 13:54 <DIR> d-------- c:\windows\NV40244028.TMP
2009-03-24 13:54 . 2006-07-12 06:38 1,160,448 -ra------ c:\windows\system32\drivers\nvnrm.sys
2009-03-24 13:54 . 2006-07-12 06:37 261,632 -ra------ c:\windows\system32\drivers\nvsnpu.sys
2009-03-24 13:54 . 2006-07-12 06:36 201,728 -ra------ c:\windows\system32\fdco1.dll
2009-03-24 13:54 . 2006-07-12 06:38 110,592 -ra------ c:\windows\system32\drivers\nvtcp.sys
2009-03-24 13:54 . 2006-07-12 06:38 57,856 -ra------ c:\windows\system32\drivers\NVENETFD.sys
2009-03-24 13:54 . 2006-07-12 06:38 20,480 -ra------ c:\windows\system32\drivers\nvnetbus.sys
2009-03-24 13:54 . 2006-07-12 06:36 11,264 -ra------ c:\windows\system32\bdco1.dll
2009-03-23 14:52 . 2003-07-06 13:17 1,404,928 --a------ c:\windows\system\nvcpl.dll
2009-03-23 14:45 . 2006-08-14 14:51 363,008 --a------ c:\windows\system32\idecoiins.dll
2009-03-23 14:45 . 2006-08-14 14:51 363,008 --a------ c:\windows\system32\idecoi.dll
2009-03-23 14:45 . 2006-08-14 14:51 105,344 --a------ c:\windows\system32\drivers\nvata.sys
2009-03-23 12:24 . 2006-09-28 16:05 2,414,360 --a------ c:\windows\system32\d3dx9_31.dll
2009-03-23 12:23 . 2009-03-23 12:24 <DIR> d--h----- c:\windows\msdownld.tmp
2009-03-23 12:23 . 2009-03-23 12:23 <DIR> d-------- c:\windows\Logs
2009-03-23 12:15 . 2009-03-23 12:15 <DIR> d-------- c:\program files\SystemRequirementsLab
2009-03-23 12:15 . 2009-03-23 12:15 <DIR> d-------- c:\documents and settings\Administrator\SystemRequirementsLab
2009-03-23 12:15 . 2009-03-23 12:15 552 --a------ c:\windows\system32\d3d8caps.dat
2009-03-23 11:59 . 2009-03-23 11:59 472,576 --a------ c:\windows\Nvidia Omega Drivers v2.169.21 Uninstall.exe
2009-03-23 10:49 . 2009-03-23 10:50 <DIR> d-------- c:\windows\NV564560.TMP
2009-03-23 10:43 . 2009-03-23 10:44 <DIR> d-------- c:\windows\NV136248.TMP
2009-03-23 10:43 . 2009-03-24 13:50 664 --a------ c:\windows\system32\d3d9caps.dat
2009-03-23 10:39 . 2009-03-23 10:40 <DIR> d-------- c:\windows\NV220164.TMP
2009-03-23 10:36 . 2009-03-23 14:23 <DIR> d-------- C:\NVIDIA

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-26 14:46 --------- d-----w c:\program files\ESET
2009-03-25 09:06 --------- d-----w c:\documents and settings\All Users\Data aplikací\Microsoft Help
2009-03-24 14:15 --------- d-----w c:\program files\Common Files\Adobe
2009-03-23 14:32 --------- d-----w c:\program files\Common Files\InstallShield
2009-03-23 10:03 --------- d-----w c:\program files\OpenOffice.org 3
2009-02-17 15:01 --------- d-----w c:\program files\MSXML 4.0
2009-02-17 14:44 410,976 ----a-w c:\windows\system32\deploytk.dll
2009-02-17 14:44 --------- d-----w c:\program files\Java
2009-02-17 14:43 --------- d-----w c:\program files\Avago-HP
2009-02-16 22:17 453,152 ----a-w c:\windows\system32\NVUNINST.EXE
2009-02-16 08:38 --------- d-----w c:\program files\Common Files\SAP Shared
2009-02-16 08:36 --------- d-----w c:\program files\SAP
2009-02-16 08:21 --------- d-----w c:\program files\Common Files\Deterministic Networks
2009-02-16 08:07 --------- d-----w c:\program files\Cisco Systems
2009-02-12 12:13 --------- d-----w c:\program files\Total Commander
2009-02-12 12:11 --------- d-----w c:\documents and settings\Uzivatel\Data aplikací\OpenOffice.org
2009-02-12 12:05 --------- d-----w c:\program files\Microsoft Works
2009-02-12 12:04 --------- d-----w c:\program files\MSBuild
2009-02-12 11:44 --------- d-----w c:\program files\Analog Devices
2009-02-12 11:43 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-12 11:30 --------- d-----w c:\program files\microsoft frontpage
2009-02-09 14:07 1,846,784 ----a-w c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-07-20 847872]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-17 136600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640]
"SW20"="c:\windows\system32\sw20.exe" [2006-09-07 208896]
"SW24"="c:\windows\system32\sw24.exe" [2006-09-07 69632]
"WinSys2"="c:\windows\system32\winsys2.exe" [2006-10-03 217088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-03-25 949376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 86016]
"nwiz"="nwiz.exe" [2006-08-11 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
VPN Client.lnk - c:\windows\Installer\{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}\Icon3E5562ED7.ico [2009-02-16 6144]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\SAP\\FrontEnd\\SAPgui\\saplogon.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"500:UDP"= 500:UDP:193.87.58.66/255.255.255.255,193.87.58.93/255.255.255.255:Enabled:FIS1
"4500:UDP"= 4500:UDP:193.87.58.66/255.255.255.255,193.87.58.93/255.255.255.255:Enabled:FIS2
"10000:UDP"= 10000:UDP:193.87.58.66/255.255.255.255,193.87.58.93/255.255.255.255:Enabled:FIS3

R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2009-03-25 15424]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2004-08-18 69120]
S2 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [2009-02-12 26488]
.
.
------- Supplementary Scan -------
.
LSP: c:\windows\system32\imon.dll
TCP: {442A2B75-B3A2-4DAA-91A3-912BA1695D76} = 158.195.40.1,158.195.2.2
FF - ProfilePath - c:\documents and settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\u47b0yhx.default\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-26 16:10:22
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-03-26 16:11:00
ComboFix-quarantined-files.txt 2009-03-26 15:10:58
ComboFix2.txt 2009-03-26 14:48:41

Pre-Run: Volných bajtů: 182 004 895 744
Post-Run: Volných bajtů: 181,991,931,904

183

[tre-SKA]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:11:47, on 26. 3. 2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-602162358-1284227242-839522115-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: VPN Client.lnk = ?
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 7970888812
O17 - HKLM\System\CCS\Services\Tcpip\..\{442A2B75-B3A2-4DAA-91A3-912BA1695D76}: NameServer = 158.195.40.1,158.195.2.2
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4491 bytes

[jaro3]

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Napiš jak to vypadá s nefunkčností místní uživatelé...

[tre-SKA]

nepomohlo to