PC-HELP.CZ

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:20:18, on 13.8.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\AVG\AVG9\avgfws9.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\OO Software\Defrag\oodag.exe
C:\Program Files\AVG\AVG9\avgam.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\OO Software\Defrag\oodtray.exe
C:\Program Files\AVG\AVG9\Identity Protection\agent\bin\avgidsmonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OO Software\Defrag\OODCNT.EXE
C:\Program Files\Opera\Opera.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - (no file)
R3 - URLSearchHook: (no name) - {95289393-33EA-4F8D-B952-483415B9C955} - (no file)
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [OODefragTray] C:\Program Files\OO Software\Defrag\oodtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP\qip.exe (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: AVG Firewall (avgfws9) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgfws9.exe
O23 - Service: AVG9IDSAgent (AVGIDSAgent) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: O&O Defrag Agent (OODefragAgent) - O&O Software GmbH - C:\Program Files\OO Software\Defrag\oodag.exe
O23 - Service: SRS Labs License Service - SRS Labs - C:\Program Files\Common Files\SRS Labs Shared\Service\srslabslicenseservice.exe

--
End of file - 8560 bytes

dekuju moc predem za radu a pomoc.

Vítej na fóru PC-HELP.Cz

Odinstaluj:
SweetIM Toolbar
Daemon Tools Toolbar
BearShare MediaBar

v logu fixni:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - (no file)
R3 - URLSearchHook: (no name) - {95289393-33EA-4F8D-B952-483415B9C955} - (no file)
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

snažil sem se postupovat přesně podle navodu tak snad sem nic nepokazil. tady to je :

Malwarebytes' Anti-Malware
www.malwarebytes.org

Verze databáze:

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

13.8.2011 17:00:54
mbam-log-2011-08-13 (17-00-49).txt

Typ: Rychlá kontrola
Kontrolované objekty: 150839
Uplynulý čas: 15 minut, 44 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 2
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 1
Infikované složky: 1
Infikované soubory: 3

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS (Trojan.Renos) -> No action taken.

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> No action taken.

Infikované složky:
c:\documents and settings\Ferda\data aplikací\s-2535-6853-2745 (Worm.Slenping) -> No action taken.

Infikované soubory:
c:\documents and settings\Ferda\dokumenty\downloads\setupcasino_c963f4.exe (PUP.Casino) -> No action taken.
c:\WINDOWS\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> No action taken.
c:\WINDOWS\Tasks\{35dc3473-a719-4d14-b7c1-fd326ca84a0c}.job (Trojan.Downloader) -> No action taken.

Ahoj,
v mbamu vše smaž.

Stáhni na plochu ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- Před použitím vypni všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary
-Zavři všechna aktivní okna a spusť ho pod učtem s právy administrátora
- Po spuštění se zobrazí podmínky použití, potvrď je stiskem tlačítka Ano

- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna

- Po dokončení skenování, se vytvoří log C:\ComboFix.txt, zkopíruj celý jeho obsah sem.

muzu se jenom zeptat? co to je mbam? jinak diky za pomoc.

Malwarebytes' Anti-Malware - dával jsi z něj zde log.

ok to bych mel:), akorat nvm jestli sem uplne blbej nebo nemoznej, ale nepodarilo se mi vypnout AVG.. takze nemuzu pokracovat, kdyby nekdo poradil:(.. diky

AVG9 odinstaluj , stejně je staré , pak si nainstaluješ jiný antivir...

Avira 10
Avast6
nebo AVG 2011...

ok :) tak tady to je :

ComboFix 11-08-18.03 - Ferda 19.08.2011 13:04:21.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.612 [GMT 2:00]
Spuštěný z: c:\documents and settings\Ferda\Plocha\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Ferda\WINDOWS
c:\program files\AskSearch\bin\DefaultSearch.dll
c:\program files\messenger\msmsgsin.exe
c:\windows\ehome\medctrro.exe
c:\windows\system32\system
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SSHNAS
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-19 do 2011-08-19 )))))))))))))))))))))))))))))))
.
.
2011-08-16 12:53 . 2011-08-16 12:53 -------- dc-h--w- c:\documents and settings\All Users\Data aplikací\{4B0F043C-7F75-4273-8BB4-DA0455DFBF5F}
2011-08-16 12:53 . 2011-08-16 12:53 -------- d-----w- c:\program files\Common Files\Topaz Labs
2011-08-16 12:53 . 2011-08-16 12:53 -------- d-----w- c:\program files\Topaz Labs
2011-08-16 12:00 . 2008-04-13 22:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2011-08-16 12:00 . 2008-04-13 22:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2011-08-16 11:59 . 2011-08-16 12:02 -------- d-----w- c:\program files\o.tel.o
2011-08-15 16:44 . 2011-08-15 16:44 -------- d-----w- c:\program files\Driver-Soft
2011-08-15 09:21 . 2011-08-15 09:21 -------- d-----w- c:\documents and settings\Ferda\Data aplikací\DVDVideoSoft
2011-08-15 09:21 . 2011-08-15 09:21 -------- d-----w- c:\program files\Conduit
2011-08-15 09:21 . 2011-08-15 09:21 -------- d-----w- c:\documents and settings\Ferda\Local Settings\Data aplikací\DVDVideoSoftTB
2011-08-15 09:20 . 2011-08-15 09:21 -------- d-----w- c:\documents and settings\Ferda\Local Settings\Data aplikací\Conduit
2011-08-15 09:20 . 2011-08-15 09:20 -------- d-----w- c:\program files\DVDVideoSoftTB
2011-08-15 08:58 . 2011-08-15 08:58 -------- d-----w- c:\windows\system32\NtmsData
2011-08-14 14:45 . 2011-08-14 18:03 -------- d-----w- c:\program files\ICQ7.5
2011-08-13 14:44 . 2011-08-13 14:44 -------- d-----w- c:\documents and settings\Ferda\Data aplikací\Malwarebytes
2011-08-13 14:44 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-13 14:44 . 2011-08-13 14:44 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-08-13 14:43 . 2011-08-13 14:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-13 14:43 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-13 14:18 . 2011-08-13 14:18 388096 ----a-r- c:\documents and settings\Ferda\Data aplikací\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-08-13 14:18 . 2011-08-13 14:18 -------- d-----w- c:\program files\Trend Micro
2011-08-13 12:20 . 2011-08-13 12:20 -------- d-----w- c:\documents and settings\NetworkService\Plocha
2011-08-13 12:19 . 2011-08-13 12:19 -------- d-----w- c:\windows\system32\oodag
2011-08-13 11:59 . 2011-08-13 11:59 -------- d-----w- c:\documents and settings\Ferda\Local Settings\Data aplikací\O&O
2011-08-13 11:55 . 2011-08-13 11:55 -------- d-----w- c:\program files\OO Software
2011-08-13 11:16 . 2011-08-13 11:16 -------- d-----w- c:\documents and settings\Ferda\X86
2011-08-13 11:16 . 2011-08-13 11:16 -------- d-----w- c:\documents and settings\Ferda\X64
2011-08-11 07:46 . 2011-06-24 14:10 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-11 07:43 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-15 13:29 . 2002-08-29 01:59 456320 ------w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-09 20:34 . 2011-07-09 20:34 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-08 14:02 . 2001-10-25 14:00 10496 ------w- c:\windows\system32\drivers\ndistapi.sys
2011-06-29 15:22 . 2011-06-29 15:22 1626440 ----a-w- c:\windows\system32\ooscrsav.scr
2011-06-29 15:21 . 2011-06-29 15:21 275784 ----a-w- c:\windows\system32\oodbs.exe
2011-06-29 15:20 . 2011-06-29 15:20 535880 ----a-w- c:\windows\system32\oodssrs.dll
2011-06-29 15:19 . 2011-06-29 15:19 9544 ----a-w- c:\windows\system32\oodbsrs.dll
2011-06-24 14:10 . 2002-01-01 23:04 139656 ------w- c:\windows\system32\drivers\rdpwd.sys
2011-06-21 18:18 . 2002-09-20 18:05 668160 ----a-w- c:\windows\system32\wininet.dll
2011-06-21 18:18 . 2001-10-25 14:00 61952 ------w- c:\windows\system32\tdc.ocx
2011-06-21 18:18 . 2009-07-17 17:05 81920 ------w- c:\windows\system32\ieencode.dll
2011-06-21 18:16 . 2009-07-17 17:05 370176 ------w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2002-09-20 18:05 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-06 11:35 . 2002-09-20 17:41 1858944 ------w- c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\prxtbDVDV.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 14:54 175912 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2011-01-17 14:54 175912 ----a-w- c:\program files\DVDVideoSoftTB\prxtbDVDV.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\prxtbDVDV.dll" [2011-01-17 175912]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-06-12 399736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OODefragTray"="c:\program files\OO Software\Defrag\oodtray.exe" [2011-06-29 2770248]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstall ... er=9.0.894" [?]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2011-08-01 08:28 124480 ----a-w- c:\program files\ICQ7.5\ICQ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
2011-06-29 15:22 2770248 ----a-w- c:\program files\OO Software\Defrag\oodtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2011-06-12 16:55 399736 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\Ferda\\Plocha\\utorrent.exe"=
"c:\\Program Files\\Counter-Strike 1.6\\hl.exe"=
"c:\\Program Files\\Day of Defeat\\hl.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\sweeney\\bass4\\TBass4\\TBass4.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\EA SPORTS\\NHL07\\nhl2007.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\ICQ7.5\\ICQ.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"18878:TCP"= 18878:TCP:BitComet 18878 TCP
"18878:UDP"= 18878:UDP:BitComet 18878 UDP
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [20.7.2009 19:47 721904]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [17.7.2009 23:13 247608]
R2 OODefragAgent;O&O Defrag Agent;c:\program files\OO Software\Defrag\oodag.exe [29.6.2011 17:22 2468168]
S3 A0380VID;WinFast iCAM100 M;c:\windows\system32\drivers\A0380Vid.sys [20.7.2009 18:08 3935872]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [13.8.2011 16:44 41272]
S3 NANMp50;NANMp50 NDIS Protocol Driver;c:\windows\system32\Drivers\NANMp50.sys --> c:\windows\system32\Drivers\NANMp50.sys [?]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [27.12.2009 1:50 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [27.12.2009 1:50 8320]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys --> c:\windows\system32\drivers\ScreamingBAudio.sys [?]
S4 gupdate1ca142dd3f52e28;Služba Google Update (gupdate1ca142dd3f52e28);c:\program files\Google\Update\GoogleUpdate.exe [3.8.2009 13:30 133104]
S4 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [3.8.2009 13:30 133104]
S4 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [25.5.2011 17:29 1336712]
.
Obsah adresáře 'Naplánované úlohy'
.
2010-11-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
2011-08-13 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-08-03 11:27]
.
2011-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-03 11:30]
.
2011-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-03 11:30]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search.conduit.com?SearchSource= ... =CT2269050
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\documents and settings\Ferda\Data aplikací\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 90.183.115.6
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKLM-Run-Cmaudio - cmicnfg.cpl
HKLM-Run-TaskTray - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-19 13:12
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1606980848-329068152-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:88,e8,2b,2c,c3,6a,7e,8c,f8,79,07,12,0a,96,cd,0d,21,66,96,5a,47,d7,13,
90,ba,07,72,f8,c9,76,e5,b7,ff,49,1e,54,d5,98,66,ff,92,08,0a,a6,6c,0d,f8,8f,\
"??"=hex:b5,5e,67,b3,49,08,72,ad,41,a9,3a,9c,e3,bb,58,83
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|˙˙˙˙Ŕ•€|ů•6~*]
"5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\\Software\\Adobe\\FeatureSubscriptions\\DVAAdobeDocMeta\\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\\Registered"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG14.00.00.01PROFESSIONAL"="09E107CD2F9703BEF80B346438ACF207E4542B3DEEE74349E0046EBB59A18A5B1E697B2E4D2619B77A131FBA2770BB25ED96A7585EFBD90543E2DD5A69204C9D1DACD50AE6009A7ECF5D85D3A409FEF38DA136FD6C82B80B58F93DF4262A311FD1E48B2746E2EE834B920AED92745D2C382FC3062DDA607BDCB2E31FF99F370DDC5082F1CB512F99FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A6A0AC4980AC7933BA7FD869164D67949DB7CE019D40AA5CC12C5FC557D5765CBBE7C1A81E72836319861DCE6BA0BEC09DBFD664173CE9B8E5013D2E401AEBEE7A575524817483519B66EF9A69ECCB0375EA217D521D13E19054F31B802C7D9C9EEAF87F9187F94E9206A45BBC1C073485D2FD83E4A34573732A1276F9065E67C376CB7CA6C73A049CAC07CC520800CA9150044AEF8CEC4B988B20CEA364F83654D46104AC92C9042AA557CE2950799CAE3F42CB285929285A869654074866D31263419E2289603F833DC7E5D7D9E9E8C97E3AA3574D4E316829E35DC1F67AEE910464FC19146D10BFC8823904C87ACE20F15E94D97063EEC60B6BE507F93918BB1BBC71BBDB11AF4E9DA315EB8B0BD1C4801A82A18EA4CF4E4101091D9E5AC6CC14AAF1434EA23EF01739E85FCDAEDA1F17497535B97F25A86CEF0B5E75C9D656DC079BFE9D2A3FBC13C8494285AB37E9A4BD1CAA449923D8AAF65038D3A883BCE41C2B53C0E4999C74CAEC0CE87A96321DBB4632C6CAE42FA04662AED2CCF2B8A3A90536F145194CA1A9B1CA724C8D5D777CE88C1D1CE5D4F7057056CFBCA7D791E12F342EF0ECDE86C6169E630294A0B0AC1D8DE74F89465DCD4CD9EAB58F7AAD6BD46BB8C0A83A1075BEB9BBB28886C7EE9F9F8B579452802C6BF70B2977D3F7E1C4101743C398B17EF2E6C429A8EEBF56D240AFDBAE1E17A56703D8B9906E77D4F1E814B79907631D1E018963990BA16DB880C0B7671FD8AD7E60C0C2732736C6F3D0BD16E9669D0151785915E4E377AFFB84EEFAAF23032F920B744D992E402F84B86508D6EEDECEBFD1C6227552D10FE908ADE95CC8D608A911689C6188277783A1A169E9282D9FC1A528281C0644F172D536792705970A6D9557240D0E8280F2A4CD4C0C700C7DD22099740F02662E2AD084D8AD1E0E7CABCD3C8D436CEA1DF96C85F50F79066A14017B08641B5313CB6D58E3F0310818D784D9B28EA57D136438ADDF244AABD7471C6E1C987FAC6233B5B431562DD58B0597B4A7DC8BDC9EA0DBEAB864BA0EB055DADB190E2B934EDF45E386A8D64B77EF7916AD0249AEED403DA662CAF9C4CF4BBAEC1F8771B00279CE715F1344C1F3F3300C3F325B9B257C58116F36896A8357C79200ADF9B09AC697ACECA763968A9557E58888"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1016)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(540)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\RunDll32.exe
.
**************************************************************************
.
Celkový čas: 2011-08-19 13:16:56 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-19 11:16
.
Před spuštěním: Volných bajtů: 21 159 219 200
Po spuštění: Volných bajtů: 21 249 392 640
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
.
- - End Of File - - BE0A95F2684EF4C679D97492FB718E8F

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

díky moc tady tohle mi vyjelo.:

ComboFix 11-08-18.03 - Ferda 19.08.2011 16:48:50.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1023.615 [GMT 2:00]
Spuštěný z: c:\documents and settings\Ferda\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Ferda\Plocha\CFScript.txt
.
FILE ::
"c:\windows\system32\Drivers\NANMp50.sys"
"c:\windows\system32\drivers\ScreamingBAudio.sys"
"c:\windows\Tasks\Google Software Updater.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Conduit
c:\program files\Conduit\Community Alerts\Alert.dll
c:\program files\Conduit\Community Alerts\Alert0.dll
c:\program files\ConduitEngine
c:\program files\ConduitEngine\appContextMenu.xml
c:\program files\ConduitEngine\ConduitEngine.dll
c:\program files\ConduitEngine\ConduitEngineHelper.exe
c:\program files\ConduitEngine\ConduitEngineUninstall.exe
c:\program files\ConduitEngine\engineContextMenu.xml
c:\program files\ConduitEngine\EngineSettings.json
c:\program files\ConduitEngine\INSTALL.LOG
c:\program files\ConduitEngine\prxConduitEngine.dll
c:\program files\ConduitEngine\toolbar.cfg
c:\program files\DVDVideoSoftTB
c:\program files\DVDVideoSoftTB\DVDVideoSoftTBToolbarHelper.exe
c:\program files\DVDVideoSoftTB\GottenAppsContextMenu.xml
c:\program files\DVDVideoSoftTB\OtherAppsContextMenu.xml
c:\program files\DVDVideoSoftTB\prxtbDVDV.dll
c:\program files\DVDVideoSoftTB\SharedAppsContextMenu.xml
c:\program files\DVDVideoSoftTB\tbDVDV.dll
c:\program files\DVDVideoSoftTB\toolbar.cfg
c:\program files\DVDVideoSoftTB\ToolbarContextMenu.xml
c:\program files\DVDVideoSoftTB\uninstall.exe
c:\program files\ICQ6Toolbar
c:\program files\ICQ6Toolbar\config.xml
c:\program files\ICQ6Toolbar\Icons.bmp
c:\program files\ICQ6Toolbar\ICQ Service.exe
c:\program files\ICQ6Toolbar\icq6Toolbar.ico
c:\program files\ICQ6Toolbar\ICQToolBar.dll
c:\program files\ICQ6Toolbar\ICQUnToolbar.exe
c:\program files\ICQ6Toolbar\logo_small.gif
c:\program files\ICQ6Toolbar\ServiceStarter.exe
c:\program files\ICQ6Toolbar\short.wav
c:\program files\ICQ6Toolbar\Thumbs.db
c:\program files\ICQ6Toolbar\Version.txt
c:\program files\ICQ6Toolbar\voucher.bmp
c:\program files\ICQ6Toolbar\voucher2.bmp
c:\windows\Tasks\Google Software Updater.job
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
Nakažená kopie c:\windows\system32\Drivers\atapi.sys byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\ERDNT\cache\atapi.sys
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ICQ_SERVICE
-------\Legacy_NANMP50
-------\Service_ICQ Service
-------\Service_NANMp50
-------\Service_SCREAMINGBDRIVER
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-19 do 2011-08-19 )))))))))))))))))))))))))))))))
.
.
2011-08-19 11:28 . 2011-08-19 11:29 -------- d-----w- c:\documents and settings\Ferda\Data aplikací\PriceGong
2011-08-16 12:53 . 2011-08-16 12:53 -------- dc-h--w- c:\documents and settings\All Users\Data aplikací\{4B0F043C-7F75-4273-8BB4-DA0455DFBF5F}
2011-08-16 12:53 . 2011-08-16 12:53 -------- d-----w- c:\program files\Common Files\Topaz Labs
2011-08-16 12:53 . 2011-08-16 12:53 -------- d-----w- c:\program files\Topaz Labs
2011-08-16 12:00 . 2008-04-13 22:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2011-08-16 12:00 . 2008-04-13 22:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2011-08-16 11:59 . 2011-08-16 12:02 -------- d-----w- c:\program files\o.tel.o
2011-08-15 16:44 . 2011-08-15 16:44 -------- d-----w- c:\program files\Driver-Soft
2011-08-15 09:21 . 2011-08-15 09:21 -------- d-----w- c:\documents and settings\Ferda\Data aplikací\DVDVideoSoft
2011-08-15 09:21 . 2011-08-19 11:28 -------- d-----w- c:\documents and settings\Ferda\Local Settings\Data aplikací\DVDVideoSoftTB
2011-08-15 09:20 . 2011-08-15 09:21 -------- d-----w- c:\documents and settings\Ferda\Local Settings\Data aplikací\Conduit
2011-08-15 08:58 . 2011-08-15 08:58 -------- d-----w- c:\windows\system32\NtmsData
2011-08-14 14:45 . 2011-08-14 18:03 -------- d-----w- c:\program files\ICQ7.5
2011-08-13 14:44 . 2011-08-13 14:44 -------- d-----w- c:\documents and settings\Ferda\Data aplikací\Malwarebytes
2011-08-13 14:44 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-13 14:44 . 2011-08-13 14:44 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-08-13 14:43 . 2011-08-13 14:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-13 14:43 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-13 14:18 . 2011-08-13 14:18 388096 ----a-r- c:\documents and settings\Ferda\Data aplikací\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-08-13 14:18 . 2011-08-13 14:18 -------- d-----w- c:\program files\Trend Micro
2011-08-13 12:20 . 2011-08-13 12:20 -------- d-----w- c:\documents and settings\NetworkService\Plocha
2011-08-13 12:19 . 2011-08-13 12:19 -------- d-----w- c:\windows\system32\oodag
2011-08-13 11:59 . 2011-08-13 11:59 -------- d-----w- c:\documents and settings\Ferda\Local Settings\Data aplikací\O&O
2011-08-13 11:55 . 2011-08-13 11:55 -------- d-----w- c:\program files\OO Software
2011-08-13 11:16 . 2011-08-13 11:16 -------- d-----w- c:\documents and settings\Ferda\X86
2011-08-13 11:16 . 2011-08-13 11:16 -------- d-----w- c:\documents and settings\Ferda\X64
2011-08-11 07:46 . 2011-06-24 14:10 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-11 07:43 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-15 13:29 . 2002-08-29 01:59 456320 ------w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-09 20:34 . 2011-07-09 20:34 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-08 14:02 . 2001-10-25 14:00 10496 ------w- c:\windows\system32\drivers\ndistapi.sys
2011-06-29 15:22 . 2011-06-29 15:22 1626440 ----a-w- c:\windows\system32\ooscrsav.scr
2011-06-29 15:21 . 2011-06-29 15:21 275784 ----a-w- c:\windows\system32\oodbs.exe
2011-06-29 15:20 . 2011-06-29 15:20 535880 ----a-w- c:\windows\system32\oodssrs.dll
2011-06-29 15:19 . 2011-06-29 15:19 9544 ----a-w- c:\windows\system32\oodbsrs.dll
2011-06-24 14:10 . 2002-01-01 23:04 139656 ------w- c:\windows\system32\drivers\rdpwd.sys
2011-06-21 18:18 . 2002-09-20 18:05 668160 ----a-w- c:\windows\system32\wininet.dll
2011-06-21 18:18 . 2001-10-25 14:00 61952 ------w- c:\windows\system32\tdc.ocx
2011-06-21 18:18 . 2009-07-17 17:05 81920 ------w- c:\windows\system32\ieencode.dll
2011-06-21 18:16 . 2009-07-17 17:05 370176 ------w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2002-09-20 18:05 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-06 11:35 . 2002-09-20 17:41 1858944 ------w- c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\documents and settings\All Users\Data aplikací\{4B0F043C-7F75-4273-8BB4-DA0455DFBF5F} ----
.
2011-08-16 12:53 . 2011-08-16 12:53 95 -c--a-w- c:\documents and settings\All Users\Data aplikací\{4B0F043C-7F75-4273-8BB4-DA0455DFBF5F}\instance.dat
2011-08-16 12:53 . 2011-08-16 12:53 0 -c--a-w- c:\documents and settings\All Users\Data aplikací\{4B0F043C-7F75-4273-8BB4-DA0455DFBF5F}\clean3_setup.lnk
2011-08-16 12:53 . 2011-08-16 12:53 4171 -c--a-w- c:\documents and settings\All Users\Data aplikací\{4B0F043C-7F75-4273-8BB4-DA0455DFBF5F}\clean3_setup.par
2011-08-16 12:53 . 2011-08-16 12:53 241 -c--a-w- c:\documents and settings\All Users\Data aplikací\{4B0F043C-7F75-4273-8BB4-DA0455DFBF5F}\clean3_setup.dat
2011-08-16 12:53 . 2010-09-28 20:33 575060 -c--a-w- c:\documents and settings\All Users\Data aplikací\{4B0F043C-7F75-4273-8BB4-DA0455DFBF5F}\mia.lib
2011-08-16 12:53 . 2010-09-28 20:33 916873 -c--a-w- c:\documents and settings\All Users\Data aplikací\{4B0F043C-7F75-4273-8BB4-DA0455DFBF5F}\clean3_setup.res
2011-08-16 12:53 . 2010-09-28 20:33 317440 -c--a-w- c:\documents and settings\All Users\Data aplikací\{4B0F043C-7F75-4273-8BB4-DA0455DFBF5F}\clean3_setup.msi
2011-08-16 12:53 . 2010-09-28 20:33 2943454 -c--a-w- c:\documents and settings\All Users\Data aplikací\{4B0F043C-7F75-4273-8BB4-DA0455DFBF5F}\clean3_setup.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-06-12 399736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OODefragTray"="c:\program files\OO Software\Defrag\oodtray.exe" [2011-06-29 2770248]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2011-08-01 08:28 124480 ----a-w- c:\program files\ICQ7.5\ICQ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
2011-06-29 15:22 2770248 ----a-w- c:\program files\OO Software\Defrag\oodtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2011-06-12 16:55 399736 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\Ferda\\Plocha\\utorrent.exe"=
"c:\\Program Files\\Counter-Strike 1.6\\hl.exe"=
"c:\\Program Files\\Day of Defeat\\hl.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\sweeney\\bass4\\TBass4\\TBass4.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\EA SPORTS\\NHL07\\nhl2007.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\ICQ7.5\\ICQ.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"18878:TCP"= 18878:TCP:BitComet 18878 TCP
"18878:UDP"= 18878:UDP:BitComet 18878 UDP
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [20.7.2009 19:47 721904]
R2 OODefragAgent;O&O Defrag Agent;c:\program files\OO Software\Defrag\oodag.exe [29.6.2011 17:22 2468168]
S3 A0380VID;WinFast iCAM100 M;c:\windows\system32\drivers\A0380Vid.sys [20.7.2009 18:08 3935872]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [13.8.2011 16:44 41272]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [27.12.2009 1:50 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [27.12.2009 1:50 8320]
S4 gupdate1ca142dd3f52e28;Služba Google Update (gupdate1ca142dd3f52e28);c:\program files\Google\Update\GoogleUpdate.exe [3.8.2009 13:30 133104]
S4 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [3.8.2009 13:30 133104]
S4 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [25.5.2011 17:29 1336712]
.
Obsah adresáře 'Naplánované úlohy'
.
2010-11-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Doplňkový sken -------
.
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\documents and settings\Ferda\Data aplikací\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 90.183.115.6
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-conduitEngine - c:\progra~1\CONDUI~1\ConduitEngineUninstall.exe
AddRemove-DVDVideoSoftTB Toolbar - c:\progra~1\DVDVID~2\UNINST~1.EXE
AddRemove-ICQToolbar - c:\program files\ICQ6Toolbar\ICQUnToolbar.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-19 16:59
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1606980848-329068152-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:88,e8,2b,2c,c3,6a,7e,8c,f8,79,07,12,0a,96,cd,0d,21,66,96,5a,47,d7,13,
90,ba,07,72,f8,c9,76,e5,b7,ff,49,1e,54,d5,98,66,ff,92,08,0a,a6,6c,0d,f8,8f,\
"??"=hex:b5,5e,67,b3,49,08,72,ad,41,a9,3a,9c,e3,bb,58,83
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|˙˙˙˙Ŕ•€|ů•6~*]
"5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\\Software\\Adobe\\FeatureSubscriptions\\DVAAdobeDocMeta\\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\\Registered"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG14.00.00.01PROFESSIONAL"="09E107CD2F9703BEF80B346438ACF207E4542B3DEEE74349E0046EBB59A18A5B1E697B2E4D2619B77A131FBA2770BB25ED96A7585EFBD90543E2DD5A69204C9D1DACD50AE6009A7ECF5D85D3A409FEF38DA136FD6C82B80B58F93DF4262A311FD1E48B2746E2EE834B920AED92745D2C382FC3062DDA607BDCB2E31FF99F370DDC5082F1CB512F99FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A6A0AC4980AC7933BA7FD869164D67949DB7CE019D40AA5CC12C5FC557D5765CBBE7C1A81E72836319861DCE6BA0BEC09DBFD664173CE9B8E5013D2E401AEBEE7A575524817483519B66EF9A69ECCB0375EA217D521D13E19054F31B802C7D9C9EEAF87F9187F94E9206A45BBC1C073485D2FD83E4A34573732A1276F9065E67C376CB7CA6C73A049CAC07CC520800CA9150044AEF8CEC4B988B20CEA364F83654D46104AC92C9042AA557CE2950799CAE3F42CB285929285A869654074866D31263419E2289603F833DC7E5D7D9E9E8C97E3AA3574D4E316829E35DC1F67AEE910464FC19146D10BFC8823904C87ACE20F15E94D97063EEC60B6BE507F93918BB1BBC71BBDB11AF4E9DA315EB8B0BD1C4801A82A18EA4CF4E4101091D9E5AC6CC14AAF1434EA23EF01739E85FCDAEDA1F17497535B97F25A86CEF0B5E75C9D656DC079BFE9D2A3FBC13C8494285AB37E9A4BD1CAA449923D8AAF65038D3A883BCE41C2B53C0E4999C74CAEC0CE87A96321DBB4632C6CAE42FA04662AED2CCF2B8A3A90536F145194CA1A9B1CA724C8D5D777CE88C1D1CE5D4F7057056CFBCA7D791E12F342EF0ECDE86C6169E630294A0B0AC1D8DE74F89465DCD4CD9EAB58F7AAD6BD46BB8C0A83A1075BEB9BBB28886C7EE9F9F8B579452802C6BF70B2977D3F7E1C4101743C398B17EF2E6C429A8EEBF56D240AFDBAE1E17A56703D8B9906E77D4F1E814B79907631D1E018963990BA16DB880C0B7671FD8AD7E60C0C2732736C6F3D0BD16E9669D0151785915E4E377AFFB84EEFAAF23032F920B744D992E402F84B86508D6EEDECEBFD1C6227552D10FE908ADE95CC8D608A911689C6188277783A1A169E9282D9FC1A528281C0644F172D536792705970A6D9557240D0E8280F2A4CD4C0C700C7DD22099740F02662E2AD084D8AD1E0E7CABCD3C8D436CEA1DF96C85F50F79066A14017B08641B5313CB6D58E3F0310818D784D9B28EA57D136438ADDF244AABD7471C6E1C987FAC6233B5B431562DD58B0597B4A7DC8BDC9EA0DBEAB864BA0EB055DADB190E2B934EDF45E386A8D64B77EF7916AD0249AEED403DA662CAF9C4CF4BBAEC1F8771B00279CE715F1344C1F3F3300C3F325B9B257C58116F36896A8357C79200ADF9B09AC697ACECA763968A9557E58888"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1012)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(1164)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Bonjour\mDNSResponder.exe
.
**************************************************************************
.
Celkový čas: 2011-08-19 17:03:46 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-19 15:03
ComboFix2.txt 2011-08-19 11:16
.
Před spuštěním: Volných bajtů: 21 236 969 472
Po spuštění: Volných bajtů: 21 215 002 624
.
Current=2 Default=2 Failed=3 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 6074CF2D43C3B165166BCACB2BD91D6C

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu