Kontrola logu Vyřešeno

[Voki]

Moc prosím o pomoc. Počítač byl zavirovaný, AVASTu se nepodařilo odstarnit viry ze systému. Sice se počítač chová normálně, ale ty potvory mě silně znervozńují. Pomůžete mi, prosím, někdo s odstraněním těch breber? Přikládám log z HJT.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:33:37, on 27.10.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\TO2SSM\McciTrayApp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\Eset\Eset Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [WinDLL (service.exe)] service.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TO2SSM_McciTrayApp] C:\Program Files\TO2SSM\McciTrayApp.exe
O4 - HKLM\..\RunOnce: [UninstallReportAgent] "C:\Program Files\Common Files\Motive\installhelper.exe" /UninstallVendor=TO2SAM /Dir=C:\Program Files\
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {50E43D86-A74D-11D0-98CE-004005249458} (AnimatedGif Control) - https://www.mojebanka.cz/jars/confwiz/MVSGif.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 8218826451
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Eset Service (ekrn) - Unknown owner - C:\Program Files\Eset\Eset Smart Security\ekrn.exe (file missing)
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe

--
End of file - 5268 bytes

[Reklama]

[pitimir]

Ahoj, kde je ten bordel hlaseny?

Stiahni RSIT. Spust, klik na "Continue". Po dokoneceni by se ti mal otvorit textovy subor. Ten skopiruj sem.
Pokial by sa nieco stalo, najdes ho aj na adrese "C:\rsit\log.txt".

[Voki]

Díky za odpoved. AVAST našel nekolik virů, viz prilozeny report. Pri oprave u nekterych doslo k chybe. Navic se nam ted v odeslane poste objevil Warazov a nejde to AVASTEm smazat, tak nevim, co s tim, zda to je jen v te poste nebo i jinde.

report AVAST
Počet prohledaných složek: 4165
Počet testovaných souborů: 75052
Počet infikovaných souborů: 2

----------------------------------------
14.10.2009 08:38
Testují se všechny lokální disky

Soubor C:\Documents and Settings\Jirka\Data aplikací\lizkavd.exe je infikován virem Win32:Malware-gen, Oprava: Chyba 42060 {Soubor nebyl opraven.}, Přesun do truhly: Chyba 0xC0000034 {Název objektu nebyl nalezen.}, Přesun do truhly: Chyba 0xC0000034 {Název objektu nebyl nalezen.}, Oprava: Chyba 42060 {Soubor nebyl opraven.}
Test přerušen

Počet prohledaných složek: 260
Počet testovaných souborů: 1463
Počet infikovaných souborů: 1

----------------------------------------
14.10.2009 08:47
Testují se všechny lokální disky

Soubor C:\Documents and Settings\Jirka\Local Settings\Temp\21.tmp je infikován virem Win32:Trojan-gen, Přesunut do truhly
Soubor C:\System Volume Information\_restore{DBEAD42F-ABEB-4F8B-A598-EB64EFD9F1B7}\RP343\A0019402.exe je infikován virem Win32:Trojan-gen, Oprava: Chyba 42060 {Soubor nebyl opraven.}, Přesun do truhly: Chyba 0xC0000034 {Název objektu nebyl nalezen.}
Soubor C:\System Volume Information\_restore{DBEAD42F-ABEB-4F8B-A598-EB64EFD9F1B7}\RP343\A0019420.exe je infikován virem Win32:Trojan-gen, Oprava: Chyba 42060 {Soubor nebyl opraven.}, Přesun do truhly: Chyba 0xC0000034 {Název objektu nebyl nalezen.}
Soubor C:\System Volume Information\_restore{DBEAD42F-ABEB-4F8B-A598-EB64EFD9F1B7}\RP344\A0020426.exe je infikován virem Win32:Trojan-gen, Oprava: Chyba 42060 {Soubor nebyl opraven.}, Přesun do truhly: Chyba 0xC0000034 {Název objektu nebyl nalezen.}
Soubor C:\System Volume Information\_restore{DBEAD42F-ABEB-4F8B-A598-EB64EFD9F1B7}\RP344\A0020695.exe je infikován virem Win32:Trojan-gen, Oprava: Chyba 42060 {Soubor nebyl opraven.}, Přesun do truhly: Chyba 0xC0000034 {Název objektu nebyl nalezen.}
Soubor C:\System Volume Information\_restore{DBEAD42F-ABEB-4F8B-A598-EB64EFD9F1B7}\RP344\A0020705.exe je infikován virem Win32:Trojan-gen, Oprava: Chyba 42060 {Soubor nebyl opraven.}, Přesun do truhly: Chyba 0xC0000034 {Název objektu nebyl nalezen.}
Soubor C:\System Volume Information\_restore{DBEAD42F-ABEB-4F8B-A598-EB64EFD9F1B7}\RP346\A0020727.exe je infikován virem Win32:Malware-gen, Oprava: Chyba 42060 {Soubor nebyl opraven.}, Přesun do truhly: Chyba 0xC0000034 {Název objektu nebyl nalezen.}
Soubor C:\System Volume Information\_restore{DBEAD42F-ABEB-4F8B-A598-EB64EFD9F1B7}\RP346\A0020728.exe je infikován virem Win32:Trojan-gen, Oprava: Chyba 42060 {Soubor nebyl opraven.}, Přesun do truhly: Chyba 0xC0000034 {Název objektu nebyl nalezen.}
Soubor C:\System Volume Information\_restore{DBEAD42F-ABEB-4F8B-A598-EB64EFD9F1B7}\RP346\A0020729.exe je infikován virem Win32:Trojan-gen, Oprava: Chyba 42060 {Soubor nebyl opraven.}, Přesun do truhly: Chyba 0xC0000034 {Název objektu nebyl nalezen.}
Soubor C:\System Volume Information\_restore{DBEAD42F-ABEB-4F8B-A598-EB64EFD9F1B7}\RP346\A0020735.exe je infikován virem Win32:Malware-gen, Oprava: Chyba 42060 {Soubor nebyl opraven.}, Přesun do truhly: Chyba 0xC0000034 {Název objektu nebyl nalezen.}
Počet prohledaných složek: 4174
Počet testovaných souborů: 75177
Počet infikovaných souborů: 10

----------------------------------------
28.10.2009 18:39
Testují se všechny lokální disky

Počet prohledaných složek: 4310
Počet testovaných souborů: 62138
Počet infikovaných souborů: 0


RST:
Logfile of random's system information tool 1.06 (written by random/random)
Run by Jirka at 2009-10-28 19:26:24
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 31 GB (61%) free of 50 GB
Total RAM: 446 MB (38% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:26:30, on 28.10.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\TO2SSM\McciTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jirka\Plocha\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Jirka.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\Eset\Eset Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [WinDLL (service.exe)] service.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TO2SSM_McciTrayApp] C:\Program Files\TO2SSM\McciTrayApp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {50E43D86-A74D-11D0-98CE-004005249458} (AnimatedGif Control) - https://www.mojebanka.cz/jars/confwiz/MVSGif.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 8218826451
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Eset Service (ekrn) - Unknown owner - C:\Program Files\Eset\Eset Smart Security\ekrn.exe (file missing)
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe

--
End of file - 5044 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2005-02-08 339968]
"SetRefresh"=C:\Program Files\Compaq\SetRefresh\SetRefresh.exe [2003-11-20 525824]
"zBrowser Launcher"=C:\Program Files\Logitech\iTouch\iTouch.exe [2004-03-18 892928]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2004-12-20 33792]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"egui"=C:\Program Files\Eset\Eset Smart Security\egui.exe /hide /waitservice []
"WinDLL (service.exe)"=service.exe []
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-09-15 81000]
"TO2SSM_McciTrayApp"=C:\Program Files\TO2SSM\McciTrayApp.exe [2008-08-15 1473536]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-18 15360]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-08-17 1667584]
"WEBTRAN"= []
"OEXPRESS"= []

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-02-08 61440]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2e30e3e9-a22a-11db-9f86-0013d3bd81a0}]
shell\AutoRun\command - setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af6a2f52-a8f1-11de-a145-a6e49b37a817}]
shell\AutoRun\command - E:\WDSetup.exe


======List of files/folders created in the last 1 months======

2009-10-28 19:26:24 ----D---- C:\rsit
2009-10-28 17:45:57 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-10-28 17:45:53 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-10-28 17:45:49 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-10-28 17:45:44 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-10-28 17:45:39 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-10-28 17:45:33 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-10-28 17:45:29 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-10-28 17:45:24 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-10-28 17:45:19 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-10-28 17:45:14 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-10-28 17:45:09 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-10-28 17:45:01 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-10-28 17:44:54 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-10-28 17:44:48 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-10-28 17:44:43 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-10-28 17:44:34 ----HDC---- C:\WINDOWS\$NtUninstallKB944338-v2$
2009-10-27 09:52:20 ----D---- C:\Program Files\Trend Micro
2009-10-27 09:21:27 ----D---- C:\Program Files\TO2SSM
2009-10-27 08:53:20 ----D---- C:\Documents and Settings\Jirka\Data aplikací\Motive
2009-10-27 08:53:03 ----D---- C:\Program Files\Common Files\Motive
2009-10-27 08:52:05 ----D---- C:\Documents and Settings\All Users\Data aplikací\Motive
2009-10-07 20:17:29 ----A---- C:\WINDOWS\system32\aswBoot.exe
2009-10-07 20:17:27 ----D---- C:\Program Files\Alwil Software
2009-10-07 20:12:30 ----SHD---- C:\Config.Msi
2009-10-07 20:00:57 ----A---- C:\WINDOWS\system32\LuResult.txt
2009-10-07 10:43:58 ----A---- C:\WINDOWS\azygyqitup.vbs
2009-10-07 10:43:50 ----D---- C:\Program Files\AntivirusPro_2010
2009-10-07 10:41:32 ----A---- C:\Documents and Settings\Jirka\Data aplikací\iniasd.txt

======List of files/folders modified in the last 1 months======

2009-10-28 19:26:28 ----D---- C:\WINDOWS\Prefetch
2009-10-28 19:05:49 ----D---- C:\WINDOWS\system32
2009-10-28 19:05:49 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-10-28 19:01:57 ----D---- C:\WINDOWS\Temp
2009-10-28 19:01:55 ----HD---- C:\WINDOWS\inf
2009-10-28 19:01:53 ----D---- C:\WINDOWS\system32\CatRoot2
2009-10-28 19:01:48 ----D---- C:\WINDOWS
2009-10-28 19:01:16 ----RD---- C:\Program Files
2009-10-28 17:46:12 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-10-28 17:45:59 ----RSHD---- C:\WINDOWS\system32\dllcache
2009-10-28 17:45:59 ----D---- C:\WINDOWS\system32\drivers
2009-10-28 17:45:57 ----HD---- C:\WINDOWS\$hf_mig$
2009-10-28 17:45:55 ----A---- C:\WINDOWS\imsins.BAK
2009-10-28 17:45:50 ----D---- C:\Program Files\Messenger
2009-10-27 17:38:06 ----A---- C:\WINDOWS\WINCMD.INI
2009-10-27 08:53:03 ----D---- C:\Program Files\Common Files
2009-10-08 14:00:59 ----D---- C:\WINDOWS\system32\config
2009-10-08 07:37:27 ----D---- C:\Program Files\Common Files\Symantec Shared
2009-10-07 20:14:05 ----SHD---- C:\WINDOWS\Installer
2009-10-07 20:14:02 ----D---- C:\Program Files\Symantec
2009-10-07 20:13:47 ----D---- C:\Documents and Settings\All Users\Data aplikací\Symantec
2009-10-07 20:12:18 ----SD---- C:\WINDOWS\Tasks
2009-10-07 14:22:09 ----A---- C:\WINDOWS\WDICT32.INI
2009-10-07 10:41:49 ----A---- C:\WINDOWS\ModemLog_Agere Win Modem.txt

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-09-15 27408]
R1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 42496]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-09-15 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-09-15 52368]
R1 easdrv;easdrv; C:\WINDOWS\system32\DRIVERS\easdrv.sys [2007-05-03 11776]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2007-05-03 44032]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-09-15 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-09-15 94160]
R2 eamon;EAMON; C:\WINDOWS\system32\DRIVERS\eamon.sys [2007-05-03 133120]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2007-05-03 41984]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-09-21 2278784]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-09-15 23152]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-02-08 970240]
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2005-03-17 132608]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2007-05-03 24064]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 itchfltr;iTouch Keyboard Filter; C:\WINDOWS\system32\DRIVERS\itchfltr.sys [2004-03-10 12953]
R3 ltmodem5;Agere Modem Driver; C:\WINDOWS\system32\DRIVERS\ltmdmnt.sys [2003-07-01 652497]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-18 57600]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024]
S1 P3;Ovladač procesoru Intel PentiumIII; C:\WINDOWS\system32\DRIVERS\p3.sys [2004-08-18 46336]
S3 ac97intc;Služba instalace zvukového ovladače Intel(r) (WDM); C:\WINDOWS\system32\drivers\ac97intc.sys [2001-08-17 96256]
S3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-10-24 117760]
S3 i81x;i81x; C:\WINDOWS\system32\DRIVERS\i81xnt5.sys [2004-08-03 161020]
S3 iAimFP0;iAimFP0; C:\WINDOWS\system32\DRIVERS\wADV01nt.sys [2004-08-03 12415]
S3 iAimFP1;iAimFP1; C:\WINDOWS\system32\DRIVERS\wADV02NT.sys [2004-08-03 12127]
S3 iAimFP2;iAimFP2; C:\WINDOWS\system32\DRIVERS\wADV05NT.sys [2004-08-03 11775]
S3 iAimFP3;iAimFP3; C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys [2004-08-03 12063]
S3 iAimFP4;iAimFP4; C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys [2004-08-03 19455]
S3 iAimFP5;iAimFP5; C:\WINDOWS\system32\DRIVERS\wADV07nt.sys [2004-08-03 11807]
S3 iAimFP6;iAimFP6; C:\WINDOWS\system32\DRIVERS\wADV08nt.sys [2004-08-03 11295]
S3 iAimFP7;iAimFP7; C:\WINDOWS\system32\DRIVERS\wADV09nt.sys [2004-08-03 11871]
S3 iAimTV0;iAimTV0; C:\WINDOWS\system32\DRIVERS\wATV01nt.sys [2004-08-03 29311]
S3 iAimTV1;iAimTV1; C:\WINDOWS\system32\DRIVERS\wATV02NT.sys [2004-08-03 19551]
S3 iAimTV3;iAimTV3; C:\WINDOWS\system32\DRIVERS\wATV04nt.sys [2004-08-03 33599]
S3 iAimTV4;iAimTV4; C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys [2004-08-03 23615]
S3 iAimTV5;iAimTV5; C:\WINDOWS\system32\DRIVERS\wATV10nt.sys [2004-08-03 25471]
S3 iAimTV6;iAimTV6; C:\WINDOWS\system32\DRIVERS\wATV06nt.sys [2004-08-03 22271]
S3 MREMP50;MREMP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS []
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS []
S3 MREMPR5;MREMPR5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS []
S3 MRENDIS5;MRENDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS []
S3 MRESP50;MRESP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS []
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS []
S3 sermouse;Ovladač sériové myši; C:\WINDOWS\system32\DRIVERS\sermouse.sys [2001-10-24 17664]
S3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20090826.001\symidsco.sys []
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-18 20480]
S4 adpu320;adpu320; C:\WINDOWS\system32\DRIVERS\adpu320.sys [2002-05-08 105472]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\DRIVERS\intelide.sys [2004-08-17 5504]
S4 Symmpi;Symmpi; C:\WINDOWS\system32\DRIVERS\symmpi.sys [2002-04-04 28416]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-09-15 18752]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-02-08 348160]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-09-15 138680]
R2 CCALib8;Canon Camera Access Library 8; C:\Program Files\Canon\CAL\CALMAIN.exe [2006-03-30 96341]
R2 McciCMService;McciCMService; C:\Program Files\Common Files\Motive\McciCMService.exe [2007-10-15 303104]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-09-15 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-09-15 352920]
S2 ekrn;Eset Service; C:\Program Files\Eset\Eset Smart Security\ekrn.exe []
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

-----------------EOF-----------------

[pitimir]

Smejda vidim, ideme likvidovat.

1) Stiahni >>tento<< subor a spust ho. Po ukonceni fixu stlac lubovolnu klavesu - mal by sa zjavit log, jeho obsah sem skopiruj.


2) Stiahni ComboFix, najlepsie na plochu. Vypni vsetky otvorene aplikacie, ako aj rezidenty antiviru, antispywaru a firewall. Spust program cez ucet s administratorskymi pravami a postupuj podla instrukcii. Cely sken bude trvat cca 10 minut. Pocas neho moze byt PC restartovane. Log, ktory ComboFix vytvori, najdes na adrese "C:\ComboFix.txt".
Ten vloz sem.

Pozor: Kym ComboFix nevytvori log, na nic neklikat, nic nestlacat !!

[Voki]

Tady je ten prvni log,ale Commbofix na me rve, ze mam porad jeste pusteny Eset Smart Security 3.0. Zkusila jsem to vypnout i odinstalovat, ale je to pry porad aktivmi. Co s tim?


exeHelper by Raktor
Build 20091021
Run at 22:10:20 on 10/28/09
Now searching...
Checking for numerical processes...
Checking for bad processes...
Checking for bad files...
Deleting file C:\Program Files\AntivirusPro_2010\AntivirusPro_2010.cfg
Deleting file C:\Documents and Settings\Jirka\Data aplikací\Microsoft\Internet Explorer\Quick Launch\AntivirusPro_2010.lnk
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

[pitimir]

Spust ho, ignoruj hlasenie.

[Voki]

Tak tady je ten vysledek z ComboFixu

ComboFix 09-10-27.08 - Jirka 28.10.2009 22:38.1.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.446.182 [GMT 1:00]
Spuštěný z: c:\documents and settings\Jirka\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091028-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Eset Smart Security 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: Eset personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Dokumenty\akywidur.pif
c:\documents and settings\All Users\Dokumenty\motet.inf
c:\documents and settings\All Users\Dokumenty\musunyz._sy
c:\documents and settings\Jirka\Cookies\huluwukyl.sys
c:\documents and settings\Jirka\Cookies\otetidypes.sys
c:\documents and settings\Jirka\Cookies\ybufejiv.lib
c:\documents and settings\Jirka\Local Settings\Data aplikacˇ\axijuz.bat
c:\documents and settings\Jirka\Local Settings\Data aplikacˇ\omyzivone.bat
c:\documents and settings\Jirka\Local Settings\Temporary Internet Files\agidycyqy.db
c:\documents and settings\Jirka\Local Settings\Temporary Internet Files\howubunyx.scr
c:\documents and settings\Jirka\Local Settings\Temporary Internet Files\igecyzy.dat
c:\documents and settings\Jirka\Local Settings\Temporary Internet Files\ivesyqak.reg
c:\documents and settings\Jirka\Local Settings\Temporary Internet Files\ucucucilop.com
c:\documents and settings\Jirka\Local Settings\Temporary Internet Files\ygalanyta.dll
c:\program files\AntivirusPro_2010
c:\recycler\S-1-5-21-1844237615-1897051121-725345543-1003
c:\recycler\S-1-5-21-2961847386-950681618-3684262642-1003
c:\windows\azygyqitup.vbs
c:\windows\esanujip.inf
c:\windows\mysami.reg
c:\windows\system32\ieuinit.inf
c:\windows\ukyz.inf

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-09-28 do 2009-10-28 )))))))))))))))))))))))))))))))
.

2009-10-28 18:26 . 2009-10-28 18:26 -------- d-----w- C:\rsit
2009-10-27 08:52 . 2009-10-27 08:52 -------- d-----w- c:\program files\Trend Micro
2009-10-27 08:21 . 2009-10-27 08:22 -------- d-----w- c:\program files\TO2SSM
2009-10-27 07:53 . 2009-10-27 08:22 -------- d-----w- c:\program files\Common Files\Motive
2009-10-07 19:17 . 2009-09-15 10:54 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-10-07 19:17 . 2009-09-15 10:54 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-10-07 19:17 . 2009-09-15 10:53 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-10-07 19:17 . 2009-09-15 10:53 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-10-07 19:17 . 2009-09-15 10:56 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-10-07 19:17 . 2009-09-15 10:56 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-10-07 19:17 . 2009-09-15 10:55 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-10-07 19:17 . 2009-09-15 10:55 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-10-07 19:17 . 2009-09-15 10:59 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-10-07 19:17 . 2009-10-07 19:17 -------- d-----w- c:\program files\Alwil Software
2009-10-07 09:43 . 2009-10-07 09:43 15626 ----a-w- c:\windows\amerurut.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-28 18:05 . 2004-09-06 07:23 63328 ----a-w- c:\windows\system32\perfc005.dat
2009-10-28 18:05 . 2004-09-06 07:23 382822 ----a-w- c:\windows\system32\perfh005.dat
2009-10-08 06:37 . 2005-12-19 01:53 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-10-07 19:14 . 2005-12-19 01:53 -------- d-----w- c:\program files\Symantec
2006-02-02 13:33 . 2006-02-02 13:33 4429593 ----a-w- c:\program files\it222enu.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-17 1667584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-08 339968]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2004-03-18 892928]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2004-12-20 33792]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"TO2SSM_McciTrayApp"="c:\program files\TO2SSM\McciTrayApp.exe" [2008-08-15 1473536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [7.10.2009 20:17 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7.10.2009 20:17 20560]
R3 itchfltr;iTouch Keyboard Filter;c:\windows\system32\drivers\itchfltr.sys [3.2.2006 15:11 12953]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - MBR
*Deregistered* - mbr
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {50E43D86-A74D-11D0-98CE-004005249458} - hxxps://www.mojebanka.cz/jars/confwiz/MVSGif.cab
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-WEBTRAN - (no file)
HKCU-Run-OEXPRESS - (no file)
HKLM-Run-WinDLL (service.exe) - service.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-28 22:40
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(896)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2009-10-28 22:41
ComboFix-quarantined-files.txt 2009-10-28 21:41

Před spuštěním: Volných bajtů: 31 925 239 808
Po spuštění: Volných bajtů: 31 958 908 928

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Home Edition" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - ABDDE465152B963ECEE91095E740FD65

[pitimir]

Ktory AV pouzivas? Eseta alebo Avast? A zajtra to docistime

[Voki]

Pouzivam AVAST, tak diky ahoj zitra

[pitimir]

Tak predsa este len mam cas dnes :)

1) Stiahni a pouzi >>tento<< odinstalator.


2) Napichaj do PC vsetky USB kluce, flash disky a podobne a pouzi Flash Desinfector.


3) Presun ikonu CF na plochu, vypni vsetky otvorene aplikacie, ako aj rezidenty antiviru, antispywaru a firewall a otvor poznamkovy blok. Donho skopiruj:

Kód: Vybrat vše

KillAll::
SecCenter::
{E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
{E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

File::
c:\windows\amerurut.dat

FileLook::
c:\program files\it222enu.exe

Folder::
c:\program files\Symantec
c:\program files\Common Files\Symantec Shared

DDS::
uStart Page = about:blank
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {50E43D86-A74D-11D0-98CE-004005249458} - hxxps://www.mojebanka.cz/jars/confwiz/MVSGif.cab

Uloz na plochu ako CFScript.txt a mysou pretiahni nad ikonou CF.



Program script spracuje a spravi novy log.


Pozor: Ak po aplikacii skriptu nenabehne Windows, restartuj PC, stlac F8 a zvol Poslednu znamu funkcnu konfiguraciu.

[Voki]

Tak tohle je ten poslední log

ComboFix 09-10-27.08 - Jirka 28.10.2009 23:12.2.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.446.160 [GMT 1:00]
Spuštěný z: c:\documents and settings\Jirka\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Jirka\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1356 [VPS 091028-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\windows\amerurut.dat"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Jirka\Local Settings\Data aplikacˇ\axijuz.bat
c:\documents and settings\Jirka\Local Settings\Data aplikacˇ\omyzivone.bat
c:\program files\Common Files\Symantec Shared
c:\program files\Common Files\Symantec Shared\SymcData\ids-diskless\lulock.dat
c:\program files\Symantec
c:\windows\amerurut.dat

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-09-28 do 2009-10-28 )))))))))))))))))))))))))))))))
.

2009-10-28 21:25 . 2009-10-28 21:25 -------- d-----w- c:\windows\LastGood.Tmp
2009-10-28 18:26 . 2009-10-28 18:26 -------- d-----w- C:\rsit
2009-10-27 08:52 . 2009-10-27 08:52 -------- d-----w- c:\program files\Trend Micro
2009-10-27 08:21 . 2009-10-27 08:22 -------- d-----w- c:\program files\TO2SSM
2009-10-27 07:53 . 2009-10-27 08:22 -------- d-----w- c:\program files\Common Files\Motive
2009-10-07 19:17 . 2009-09-15 10:54 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-10-07 19:17 . 2009-09-15 10:54 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-10-07 19:17 . 2009-09-15 10:53 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-10-07 19:17 . 2009-09-15 10:53 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-10-07 19:17 . 2009-09-15 10:56 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-10-07 19:17 . 2009-09-15 10:56 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-10-07 19:17 . 2009-09-15 10:55 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-10-07 19:17 . 2009-09-15 10:55 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-10-07 19:17 . 2009-09-15 10:59 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-10-07 19:17 . 2009-10-07 19:17 -------- d-----w- c:\program files\Alwil Software

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-28 18:05 . 2004-09-06 07:23 63328 ----a-w- c:\windows\system32\perfc005.dat
2009-10-28 18:05 . 2004-09-06 07:23 382822 ----a-w- c:\windows\system32\perfh005.dat
2006-02-02 13:33 . 2006-02-02 13:33 4429593 ----a-w- c:\program files\it222enu.exe
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

--- c:\program files\it222enu.exe ---
Company: Logitech
File Description:
File Version: Grenache
Product Name: iTouch
Copyright:
Original Filename: stub32i.exe
File size: 4429593
Created time: 2006-02-02 13:33
Modified time: 2006-02-02 13:33
MD5: F12A6BA934A173950F09FD38B3EF7D2F
SHA1: 31C8ED57C3A9112818140EEBEE164E794DB29BBE


((((((((((((((((((((((((((((( SnapShot@2009-10-28_21.40.46 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-28 21:25 . 2007-05-03 13:31 24064 c:\windows\LastGood.Tmp\system32\DRIVERS\epfwndis.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-17 1667584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-08 339968]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2004-03-18 892928]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2004-12-20 33792]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"TO2SSM_McciTrayApp"="c:\program files\TO2SSM\McciTrayApp.exe" [2008-08-15 1473536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [7.10.2009 20:17 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7.10.2009 20:17 20560]
R3 itchfltr;iTouch Keyboard Filter;c:\windows\system32\drivers\itchfltr.sys [3.2.2006 15:11 12953]

--- Ostatní služby/ovladače v paměti ---

*Deregistered* - mbr
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-28 23:16
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...


c:\docume~1\Jirka\LOCALS~1\Temp\PTI3.tmp 0 bytes

sken byl úspešně dokončen
skryté soubory: 1

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(644)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3928)
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
c:\program files\Common Files\Microsoft Shared\Web Components\10\1029\OWCI10.DLL
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
c:\program files\Common Files\Microsoft Shared\Web Components\11\1029\OWCI11.DLL
c:\program files\Common Files\Logitech\Scrolling\LgMsgHk.dll
c:\windows\system32\MSCTF.dll
c:\windows\system32\msls31.dll
c:\program files\Logitech\iTouch\iTchHk.dll
c:\windows\system32\shdoclc.dll
c:\windows\system32\msimtf.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\Ati2evxx.exe
c:\combofix\CF5312.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\imapi.exe
c:\combofix\PEV.cfxxe
.
**************************************************************************
.
Celkový čas: 2009-10-28 23:18 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-10-28 22:18
ComboFix2.txt 2009-10-28 21:41

Před spuštěním: Volných bajtů: 31 972 298 752
Po spuštění: Volných bajtů: 31 941 308 416

- - End Of File - - 82EFFFC148AC735AF295D3BFF10AD571

[pitimir]

Este jeden CFScript.txt, rovnaky postup ako v predoslom pripade:

Kód: Vybrat vše

KillAll::
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"=dword:00000001

ADS::

A mali by sme to mat vsetko, uz to len docistime.