Prosím o kontrolu logu Vyřešeno

[kubajs]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:18:46, on 24.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\zFTPServer\zFTPServer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.daemonsearch.com/intl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O1 - Hosts: 212.71.145.115 L2authd.lineage2.com
O1 - Hosts: 212.71.145.115 L2testauthd.lineage2.com
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Microsoft Updates] svdhost.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [zFTPServer] "C:\Program Files\zFTPServer\zFTPServer.exe"
O4 - HKLM\..\RunServices: [Microsoft Updates] svdhost.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [LaunchList] C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1644491937-2052111302-725345543-1004\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Omezený')
O4 - S-1-5-21-1644491937-2052111302-725345543-1004 Startup: ctfmon.exe (User 'Omezený')
O4 - S-1-5-21-1644491937-2052111302-725345543-1004 User Startup: ctfmon.exe (User 'Omezený')
O4 - Startup: ctfmon.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://arcade.icq.com/carlo/zuma/popcaploader_v5.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{84A158C2-549C-439C-A600-8729FBCBFC4F}: NameServer = 192.168.2.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 7820 bytes

[Reklama]

[fredik]

Není v logu vidět žádný antivir, tak si nějaký doinstaluj.

Stáhni si SDFix
- Spusť ho a rozbalí se ti na disk kde je nainstalovaný Windows (typicky to je C:\SDfix)
- Pak restartuj PC do nouzového režimu (zvol možnost: Stav nouze, ne Stav nouze s práci v síti)
- Otevři adresář kde je vybalený SDFix a spusť soubor RunThis.bat tím spustíš program.
* Pak stiskni klávesu Y a pak Enter pro zahájení čistícího procesu.
* Pro dokončení kontroly budeš vyzván ke stisknoutí libovolné klávesy a počítač se restartuje.
* Při nabíhání operačního systému se program spustí znovu a dokončí čistící proces. Až se objeví Finish, budeš muset po vyzvání stisknout libovolnou klávesu, tim se ukončí program a zobrazí se ti ikony na ploše
- Když se skončí načítání ikon na ploše, otevře se ti na obrazovce log z SDFix a zároveň ho uloží do adresáře kde je rozbalený SDFix jako soubor Report.txt
Pak sem zkopíruj jeho obsah + dej sem nový log z HJT

[kubajs]

mám problém s Nouzovým režimem ... když do něj najedu, asi po 3 vteřinách se mi restartuje PC. Nevíš co stím?
PS: jinak mám napadenej ctfmon.exe ňejakým trojanem

[fredik]

Stáhni si ComboFix (by sUBs) a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem klávesy 1
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[kubajs]

ComboFix 07-11-19.3 - Jakub 2007-11-24 19:43:09.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.1625 [GMT 1:00]
Running from: C:\Documents and Settings\Jakub\Plocha\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\wpcap.dll
E:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_NPF
-------\NPF


((((((((((((((((((((((((( Files Created from 2007-10-24 to 2007-11-24 )))))))))))))))))))))))))))))))
.

2007-11-24 17:08 <DIR> d--h----- C:\Documents and Settings\Administrator.ATHLON1\ćablony
2007-11-24 17:08 <DIR> d-------- C:\Documents and Settings\Administrator.ATHLON1\Plocha
2007-11-24 17:08 <DIR> d--h----- C:\Documents and Settings\Administrator.ATHLON1\Okolnˇ tisk rny
2007-11-24 17:08 <DIR> d--h----- C:\Documents and Settings\Administrator.ATHLON1\Okolnˇ sˇś
2007-11-24 17:08 <DIR> d-------- C:\Documents and Settings\Administrator.ATHLON1\Oblˇben‚ polo§ky
2007-11-24 17:08 <DIR> dr------- C:\Documents and Settings\Administrator.ATHLON1\Nabˇdka Start
2007-11-24 17:08 <DIR> d-------- C:\Documents and Settings\Administrator.ATHLON1\Dokumenty
2007-11-24 17:08 <DIR> dr-h----- C:\Documents and Settings\Administrator.ATHLON1\Data aplikacˇ
2007-11-24 13:11 2,338 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2007-11-24 01:18 <DIR> d-------- C:\Program Files\Trend Micro
2007-11-16 17:34 <DIR> d-------- C:\Program Files\zFTPServer Administration
2007-11-16 17:34 <DIR> d-------- C:\Program Files\zFTPServer
2007-11-14 15:41 545 --a------ C:\WINDOWS\UC.PIF
2007-11-14 15:41 545 --a------ C:\WINDOWS\RAR.PIF
2007-11-14 15:41 545 --a------ C:\WINDOWS\PKZIP.PIF
2007-11-14 15:41 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2007-11-14 15:41 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2007-11-13 15:37 <DIR> d-------- C:\Program Files\FTP Commander
2007-11-11 22:18 <DIR> d-------- C:\WINDOWS\Mozilla
2007-11-11 21:45 <DIR> d-------- C:\Program Files\DivX
2007-11-11 20:07 <DIR> d-------- C:\Program Files\SmartSound Software
2007-11-11 20:06 196,096 --a------ C:\WINDOWS\system32\macd32.dll
2007-11-11 20:06 138,752 --a------ C:\WINDOWS\system32\mase32.dll
2007-11-11 20:06 136,192 --a------ C:\WINDOWS\system32\mamc32.dll
2007-11-11 20:06 57,856 --a------ C:\WINDOWS\system32\masd32.dll
2007-11-11 20:06 41,219 --a------ C:\WINDOWS\RSETPATH.exe
2007-11-11 20:06 27,648 --a------ C:\WINDOWS\system32\ma32.dll
2007-11-11 18:20 90,112 --a------ C:\WINDOWS\unvise32.exe
2007-11-11 18:14 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-11-10 17:49 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikac
2007-11-10 17:45 171,520 --a------ C:\WINDOWS\system32\drivers\MarvinBus.sys
2007-11-10 17:45 84,992 --a------ C:\WINDOWS\system32\ATL70.DLL
2007-11-10 17:45 14,165 --a------ C:\WINDOWS\system32\drivers\Pclepci.sys
2007-11-10 17:44 974,848 --a------ C:\WINDOWS\system32\MFC70.DLL
2007-11-10 17:44 964,608 --a------ C:\WINDOWS\system32\MFC70U.DLL
2007-11-10 17:42 <DIR> d-------- C:\Program Files\Pinnacle
2007-11-05 16:09 <DIR> d-------- C:\Program Files\The Witcher
2007-11-05 11:50 <DIR> d-------- C:\Program Files\MediaCoder
2007-11-01 23:06 <DIR> d-------- C:\Program Files\DAEMON Tools Pro
2007-10-24 18:50 <DIR> d-------- C:\Program Files\Beruska
2007-10-24 16:32 <DIR> d-------- C:\Program Files\Prime95

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-24 18:49 42,512 ----a-w C:\WINDOWS\system32\drivers\npf.sys
2007-11-24 16:49 --------- d-----w C:\Program Files\SpeedFan
2007-11-23 23:05 --------- d-----w C:\Program Files\LogMeIn
2007-11-20 19:03 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-11-14 19:37 40,960 ----a-w C:\WINDOWS\Ferrari 599 GTB Fiorano - 01.dll
2007-11-14 19:37 243,552 ----a-w C:\WINDOWS\Ferrari 599 GTB Fiorano - 01.scr
2007-11-14 19:37 1,331,565 ----a-w C:\WINDOWS\Ferrari 599 GTB Fiorano - 01.exe
2007-11-11 19:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-01 18:51 278,984 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys
2007-10-31 18:17 --------- d-----w C:\Program Files\Futuremark
2007-10-31 17:43 --------- d-----w C:\Program Files\Gothic III
2007-10-31 17:17 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2007-10-24 21:45 --------- d-----w C:\Program Files\Lineage II C4
2007-10-24 18:47 --------- d-----w C:\Program Files\QIP
2007-10-24 18:20 7,425,248 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-10-14 18:18 --------- d-----w C:\Program Files\Hamachi
2007-10-13 17:56 --------- d-----w C:\Program Files\Unreal Tournament 3 Demo
2007-10-13 17:55 --------- d-----w C:\Program Files\DIFX
2007-10-13 17:55 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-10-13 17:54 --------- d-----w C:\Program Files\AGEIA Technologies
2007-10-08 17:49 18,048 ----a-w C:\WINDOWS\system32\drivers\lirsgt.sys
2007-10-02 21:10 --------- d-----w C:\Program Files\RivaTuner v2.05
2007-10-02 20:08 --------- d-----w C:\Program Files\NVIDIA Corporation
2007-09-29 09:37 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-09-29 07:49 --------- d-----w C:\Program Files\Absolute Uninstaller
2007-09-29 07:15 --------- d-----w C:\Program Files\PowerISO
2007-09-28 08:34 3,623,736 ----a-w C:\procexp.exe
2007-09-28 08:32 98,304 ----a-w C:\Tcpview.exe
2007-03-19 21:06 457 ----a-w C:\Program Files\INSTALL.LOG
2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
2007-06-13 13:23 937,984 --sh--r C:\WINDOWS\system32\svdhost.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 00:04]
"Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [2006-08-20 23:24]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08]
"LaunchList"="C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSysVol"="C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 09:43]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 06:03]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 06:03]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"Microsoft Updates"="svdhost.exe" [2007-06-13 14:23 C:\WINDOWS\system32\svdhost.exe]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-18 13:00 C:\WINDOWS\system32\rundll32.exe]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57]
"nwiz"="nwiz.exe" [2007-10-24 19:20 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-18 13:00 C:\WINDOWS\system32\rundll32.exe]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-11 01:26]
"zFTPServer"="C:\Program Files\zFTPServer\zFTPServer.exe" [2005-04-02 12:53]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Microsoft Updates"="svdhost.exe" [2007-06-13 14:23 C:\WINDOWS\system32\svdhost.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"RunStartupScriptSync"= 0 (0x0)
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 1 (0x1)
"NoRecentDocsHistory"= 1 (0x1)
"MemCheckBoxInRunDlg"= 0 (0x0)
"NoAutoTrayNotify"= 0 (0x0)
"NoResolveTrack"= 0 (0x0)
"NoResolveSearch"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoSharedDocuments"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2007-05-25 14:22 63040 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jakub^Nabídka Start^Programy^Po spuštění^hamachi.lnk]
path=C:\Documents and Settings\Jakub\Nabídka Start\Programy\Po spuštění\hamachi.lnk
backup=C:\WINDOWS\pss\hamachi.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
C:\Program Files\DAEMON Tools\daemon.exe -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
Logi_MwX.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
2007-04-17 13:03 63048 --a------ C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe clear

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2007-04-09 13:23 200704 --a------ C:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 00:00 90112 --------- C:\WINDOWS\UpdReg.EXE

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys
R2 LMIInfo;LogMeIn Kernel Information Provider;\??\C:\Program Files\LogMeIn\x86\RaInfo.sys
R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
R3 lmimirr;lmimirr;C:\WINDOWS\system32\DRIVERS\lmimirr.sys
R3 P17;Sound Blaster Live! 24-bit;C:\WINDOWS\system32\drivers\P17.sys
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB;C:\WINDOWS\system32\DRIVERS\usbohci.sys
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
S3 ALSysIO;ALSysIO;\??\C:\DOCUME~1\Jakub\LOCALS~1\Temp\ALSysIO.sys
S3 GcKernel;Ovladač filtru Microsoft SideWinder Value Add;C:\WINDOWS\system32\DRIVERS\GcKernel.sys
S3 HIDSwvd;Miniovladač stanadardu HID Microsoft SideWinder Virtual;C:\WINDOWS\system32\DRIVERS\HIDSwvd.sys
S3 NPF;Netgroup Packet Filter;C:\WINDOWS\system32\drivers\npf.sys
S3 RivaTuner32;RivaTuner32;\??\C:\Program Files\RivaTuner v2.05\RivaTuner32.sys
S3 SWUSBFLT;Ovladač filtru Microsoft SideWinder VIA;C:\WINDOWS\system32\DRIVERS\SWUSBFLT.sys
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB;C:\WINDOWS\system32\DRIVERS\usbccgp.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##Acer#VFF0315 (E)]
\Shell\AutoRun\command - Y:\InstMenu.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{03701c60-58b7-11db-a0ee-806d6172696f}]
\Shell\AutoRun\command - D:\CTRun\Start.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7b68ea42-58c0-11db-8099-806d6172696f}]
\Shell\AutoRun\command - D:\Setup.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-09-16 17:36:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-24 19:48:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-24 19:50:31 - machine was rebooted
.
--- E O F ---

[fredik]

1)
U těch položek ctfmon.exe fixni jen ty uvedené, ostatní tam nech!

Spusť znovu HijackThis a zaškrtni v něm okénka před řádky:
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O4 - S-1-5-21-1644491937-2052111302-725345543-1004 Startup: ctfmon.exe (User 'Omezený')
O4 - S-1-5-21-1644491937-2052111302-725345543-1004 User Startup: ctfmon.exe (User 'Omezený')
O4 - Startup: ctfmon.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://arcade.icq.com/carlo/zu.....der_v5.cab
po zaškrtnutí klikni na tlačítko Fix Checked

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
2)
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok)
Zkopíruj do něj následující text označený zeleně:

Kód: Vybrat vše

File::
C:\WINDOWS\system32\svdhost.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Updates"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Microsoft Updates"=-

Zvol možnost Uložit soubor jako, pojmenuj soubor CFScript.txt a zvol Uložit jako typ: Všechny soubory.
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
3)
Stáhni tento program: Flash Disinfector (by sUBs) a spusť ho.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
4)
Vytvoř si tento skriptik, ulož si ho na disk a postupně si ho zkopíruj na všechny disky co máš doma a spusť ho vždycky na jednom disku a vlož sem log, který se ti zobrazí. Takže začneš na disku C, pak na D, E... atd.:

Spusť Poznámkový blok (Notepad): Start -> Spustit.. otevře se ti okno a do něj napiš notepad a dej Ok.
Otevře se ti poznámkový blok a do něj zkopíruj tento tučně označený text:

If Exist ctflog.txt del /q ctflog.txt
Dir /S/A-D "%drive%\ctfmon.exe" >>ctflog.txt
Notepad ctflog.txt
Del /q ctflog.txt

Zvol v menu záložku Soubor -> Uložit jako... a natav/vyplň tyto údaje
Název souboru: ctffind.bat
Uložit jako typ: Všechny soubory
Ulož soubor na disky u a spusť ho. Po chvíli hledání se zobrazí nové okno s výsledky, zkopíruj sem prosím celý jeho obsah .

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
V následujícím příspěvku sem vlož tyto logy/výsledky:
- log z Comobifx po použití skriptu
- logy ze skriptu
- nový log z HJT

[kubajs]

V HJT sem nenašel tento řádek :
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:24:33, on 25.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\zFTPServer\zFTPServer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Documents and Settings\Jakub\Nabídka Start\Programy\Po spuštění\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.daemonsearch.com/intl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdmcks.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [zFTPServer] "C:\Program Files\zFTPServer\zFTPServer.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [LaunchList] C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe
O4 - Startup: ctfmon.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{84A158C2-549C-439C-A600-8729FBCBFC4F}: NameServer = 192.168.2.1
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 7042 bytes


ComboFix 07-11-19.3 - Jakub 2007-11-25 10:10:05.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.1646 [GMT 1:00]
Running from: C:\Documents and Settings\Jakub\Plocha\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jakub\Plocha\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\svdhost.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\svdhost.exe
C:\WINDOWS\system32\wpcap.dll
E:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_NPF


((((((((((((((((((((((((( Files Created from 2007-10-25 to 2007-11-25 )))))))))))))))))))))))))))))))
.

2007-11-24 17:08 <DIR> d--h----- C:\Documents and Settings\Administrator.ATHLON1\ćablony
2007-11-24 17:08 <DIR> d-------- C:\Documents and Settings\Administrator.ATHLON1\Plocha
2007-11-24 17:08 <DIR> d--h----- C:\Documents and Settings\Administrator.ATHLON1\Okolnˇ tisk rny
2007-11-24 17:08 <DIR> d--h----- C:\Documents and Settings\Administrator.ATHLON1\Okolnˇ sˇś
2007-11-24 17:08 <DIR> d-------- C:\Documents and Settings\Administrator.ATHLON1\Oblˇben‚ polo§ky
2007-11-24 17:08 <DIR> dr------- C:\Documents and Settings\Administrator.ATHLON1\Nabˇdka Start
2007-11-24 17:08 <DIR> d-------- C:\Documents and Settings\Administrator.ATHLON1\Dokumenty
2007-11-24 17:08 <DIR> dr-h----- C:\Documents and Settings\Administrator.ATHLON1\Data aplikacˇ
2007-11-24 13:11 2,505 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2007-11-24 01:18 <DIR> d-------- C:\Program Files\Trend Micro
2007-11-16 17:34 <DIR> d-------- C:\Program Files\zFTPServer Administration
2007-11-16 17:34 <DIR> d-------- C:\Program Files\zFTPServer
2007-11-14 15:41 545 --a------ C:\WINDOWS\UC.PIF
2007-11-13 15:37 <DIR> d-------- C:\Program Files\FTP Commander
2007-11-11 22:18 <DIR> d-------- C:\WINDOWS\Mozilla
2007-11-11 21:45 <DIR> d-------- C:\Program Files\DivX
2007-11-11 20:07 <DIR> d-------- C:\Program Files\SmartSound Software
2007-11-11 20:06 196,096 --a------ C:\WINDOWS\system32\macd32.dll
2007-11-11 20:06 138,752 --a------ C:\WINDOWS\system32\mase32.dll
2007-11-11 20:06 136,192 --a------ C:\WINDOWS\system32\mamc32.dll
2007-11-11 20:06 57,856 --a------ C:\WINDOWS\system32\masd32.dll
2007-11-11 20:06 41,219 --a------ C:\WINDOWS\RSETPATH.exe
2007-11-11 20:06 27,648 --a------ C:\WINDOWS\system32\ma32.dll
2007-11-11 18:20 90,112 --a------ C:\WINDOWS\unvise32.exe
2007-11-11 18:14 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-11-10 17:49 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikac
2007-11-10 17:46 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
2007-11-10 17:45 171,520 --a------ C:\WINDOWS\system32\drivers\MarvinBus.sys
2007-11-10 17:45 84,992 --a------ C:\WINDOWS\system32\ATL70.DLL
2007-11-10 17:45 14,165 --a------ C:\WINDOWS\system32\drivers\Pclepci.sys
2007-11-10 17:44 974,848 --a------ C:\WINDOWS\system32\MFC70.DLL
2007-11-10 17:44 964,608 --a------ C:\WINDOWS\system32\MFC70U.DLL
2007-11-10 17:42 <DIR> d-------- C:\Program Files\Pinnacle
2007-11-05 16:09 <DIR> d-------- C:\Program Files\The Witcher
2007-11-05 11:50 <DIR> d-------- C:\Program Files\MediaCoder
2007-11-01 23:06 <DIR> d-------- C:\Program Files\DAEMON Tools Pro
2007-11-01 19:51 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-24 23:05 --------- d-----w C:\Program Files\LogMeIn
2007-11-24 16:49 --------- d-----w C:\Program Files\SpeedFan
2007-11-20 19:03 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-11-14 19:37 40,960 ----a-w C:\WINDOWS\Ferrari 599 GTB Fiorano - 01.dll
2007-11-14 19:37 243,552 ----a-w C:\WINDOWS\Ferrari 599 GTB Fiorano - 01.scr
2007-11-14 19:37 1,331,565 ----a-w C:\WINDOWS\Ferrari 599 GTB Fiorano - 01.exe
2007-11-11 19:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-01 18:51 278,984 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys
2007-10-31 18:17 --------- d-----w C:\Program Files\Futuremark
2007-10-31 17:43 --------- d-----w C:\Program Files\Gothic III
2007-10-31 17:17 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2007-10-24 21:45 --------- d-----w C:\Program Files\Lineage II C4
2007-10-24 18:47 --------- d-----w C:\Program Files\QIP
2007-10-24 18:20 7,425,248 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-10-24 17:50 --------- d-----w C:\Program Files\Beruska
2007-10-24 15:32 --------- d-----w C:\Program Files\Prime95
2007-10-14 18:18 --------- d-----w C:\Program Files\Hamachi
2007-10-13 17:56 --------- d-----w C:\Program Files\Unreal Tournament 3 Demo
2007-10-13 17:55 --------- d-----w C:\Program Files\DIFX
2007-10-13 17:55 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-10-13 17:54 --------- d-----w C:\Program Files\AGEIA Technologies
2007-10-08 17:49 18,048 ----a-w C:\WINDOWS\system32\drivers\lirsgt.sys
2007-10-02 21:10 --------- d-----w C:\Program Files\RivaTuner v2.05
2007-10-02 20:08 --------- d-----w C:\Program Files\NVIDIA Corporation
2007-09-29 09:37 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-09-29 07:49 --------- d-----w C:\Program Files\Absolute Uninstaller
2007-09-29 07:15 --------- d-----w C:\Program Files\PowerISO
2007-09-28 08:34 3,623,736 ----a-w C:\procexp.exe
2007-09-28 08:32 98,304 ----a-w C:\Tcpview.exe
2007-03-19 21:06 457 ----a-w C:\Program Files\INSTALL.LOG
2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 00:04]
"Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [2006-08-20 23:24]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08]
"LaunchList"="C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSysVol"="C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 09:43]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 06:03]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 06:03]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-18 13:00 C:\WINDOWS\system32\rundll32.exe]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57]
"nwiz"="nwiz.exe" [2007-10-24 19:20 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-18 13:00 C:\WINDOWS\system32\rundll32.exe]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-11 01:26]
"zFTPServer"="C:\Program Files\zFTPServer\zFTPServer.exe" [2005-04-02 12:53]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"RunStartupScriptSync"= 0 (0x0)
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 1 (0x1)
"NoRecentDocsHistory"= 1 (0x1)
"MemCheckBoxInRunDlg"= 0 (0x0)
"NoAutoTrayNotify"= 0 (0x0)
"NoResolveTrack"= 0 (0x0)
"NoResolveSearch"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoSharedDocuments"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2007-05-25 14:22 63040 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jakub^Nabídka Start^Programy^Po spuštění^hamachi.lnk]
path=C:\Documents and Settings\Jakub\Nabídka Start\Programy\Po spuštění\hamachi.lnk
backup=C:\WINDOWS\pss\hamachi.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
C:\Program Files\DAEMON Tools\daemon.exe -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
Logi_MwX.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
2007-04-17 13:03 63048 --a------ C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe clear

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2007-04-09 13:23 200704 --a------ C:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 00:00 90112 --------- C:\WINDOWS\UpdReg.EXE

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys
R2 LMIInfo;LogMeIn Kernel Information Provider;\??\C:\Program Files\LogMeIn\x86\RaInfo.sys
R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
R3 lmimirr;lmimirr;C:\WINDOWS\system32\DRIVERS\lmimirr.sys
R3 P17;Sound Blaster Live! 24-bit;C:\WINDOWS\system32\drivers\P17.sys
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB;C:\WINDOWS\system32\DRIVERS\usbohci.sys
S3 GcKernel;Ovladač filtru Microsoft SideWinder Value Add;C:\WINDOWS\system32\DRIVERS\GcKernel.sys
S3 HIDSwvd;Miniovladač stanadardu HID Microsoft SideWinder Virtual;C:\WINDOWS\system32\DRIVERS\HIDSwvd.sys
S3 RivaTuner32;RivaTuner32;\??\C:\Program Files\RivaTuner v2.05\RivaTuner32.sys
S3 SWUSBFLT;Ovladač filtru Microsoft SideWinder VIA;C:\WINDOWS\system32\DRIVERS\SWUSBFLT.sys
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB;C:\WINDOWS\system32\DRIVERS\usbccgp.sys
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##Acer#VFF0315 (E)]
\Shell\AutoRun\command - Y:\InstMenu.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{03701c60-58b7-11db-a0ee-806d6172696f}]
\Shell\AutoRun\command - D:\CTRun\Start.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d57de6f-e6c0-11db-8f34-001109d5746f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(0)\command - Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7b68ea42-58c0-11db-8099-806d6172696f}]
\Shell\AutoRun\command - D:\Setup.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-09-16 17:36:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-25 10:15:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-25 10:17:13 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-24 19:50
.
--- E O F ---




Svazek v jednotce C nemá žádnou jmenovku.
Sériové číslo svazku je 8879-A0A4.

Výpis adresáře C:\Documents and Settings\Jakub\Nabídka Start\Programy\Po spuštění

27.06.2006 10:06 20 480 ctfmon.exe
1 souborů, 20 480 bajtů

Výpis adresáře C:\Documents and Settings\Jakub\Plocha

27.06.2006 10:06 20 480 ctfmon.exe
1 souborů, 20 480 bajtů

Výpis adresáře C:\Documents and Settings\Omezený\Nabídka Start\Programy\Po spuštění

27.06.2006 10:06 20 480 ctfmon.exe
1 souborů, 20 480 bajtů

Výpis adresáře C:\Recycled

27.06.2006 10:06 20 480 ctfmon.exe
1 souborů, 20 480 bajtů

Výpis adresáře C:\Recycled\Recycled

27.06.2006 10:06 20 480 ctfmon.exe
1 souborů, 20 480 bajtů

Výpis adresáře C:\WINDOWS\system32\dllcache

18.08.2004 13:00 15 360 ctfmon.exe
1 souborů, 15 360 bajtů

Počet souborů v seznamu:
6 souborů, 117 760 bajtů
Adresářů: 0, Volných bajtů: 6 751 326 208




Svazek v jednotce E je E40.
Sériové číslo svazku je 6C96-FD85.

Výpis adresáře E:\Apacer flash\Recycled

27.06.2006 10:06 20 480 ctfmon.exe
1 souborů, 20 480 bajtů

Výpis adresáře E:\Recycled

27.06.2006 10:06 20 480 ctfmon.exe
1 souborů, 20 480 bajtů

Počet souborů v seznamu:
2 souborů, 40 960 bajtů
Adresářů: 0, Volných bajtů: 1 182 154 752

[fredik]

Stáhni si Avenger

Vytvoř si nový CFScript.txt, vlož do něho tentokrát toto a použij ho stejným způsobem jako ten předchozí:

Kód: Vybrat vše

Folder::
C:\Recycled
D:\Recycled
E:\Recycled

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d57de6f-e6c0-11db-8f34-001109d5746f}]

Po jeho proběhnutí spusť Avenger pod účtem admin. právy
Zvol možnost - Input script manually a klikni na ikonku lupy vyskočí prázdné okno kam zkopíruj tento tučný text:
Files to delete:
C:\Documents and Settings\Jakub\Nabídka Start\Programy\Po spuštění\ctfmon.exe
C:\Documents and Settings\Jakub\Plocha\ctfmon.exe
C:\Documents and Settings\Omezený\Nabídka Start\Programy\Po spuštění\ctfmon.exe
E:\Apacer flash\Recycled\ctfmon.exe

Poté klikni na Done.
Pak klikni na ikonku semafory.
Vyskočí ti hláška kde odklikni Yes. PC se restartuje po restartu by ti měl "vyskočit" výpis z Avengeru tak ho sem zkopíruj, jinak ho najdeš v souboru C:\avenger.txt

Po najetí zpět do Win. spusť znovu Flash Disinfector.

V následujícím příspěvku sem vlož tyto logy/výsledky:
- nový log z Combofix, po použití skriptu
- log z Avengeru
- znovu sem vlož výsledky ze skriptu ctffind.bat

Ten disk E to je fleška?

[kubajs]

Ne disk E: je pevný disk, akorát jsem tam kdysi dělal zálohu důležitých věcí ,co jsem měl na flešce.
ten ctfmon.exe se dokáže pohybovat mezi fleškou a PC HDD ? oběma směry? Na notebooku mi Norton našel na flšce, co jsem ztrkal i do mého zavirovaného PC, ve složce Recycled ctfmon.exe taky ... ale nevím o tom ,že by tam nějaká taková složka byla ...

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\vhcudwtk

*******************

Script file located at: \??\C:\WINDOWS\jaquwpep.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\Documents and Settings\Jakub\Nabídka Start\Programy\Po spuštění\ctfmon.exe deleted successfully.
File C:\Documents and Settings\Jakub\Plocha\ctfmon.exe deleted successfully.
File C:\Documents and Settings\Omezený\Nabídka Start\Programy\Po spuštění\ctfmon.exe deleted successfully.


Could not open file E:\Apacer flash\Recycled\ctfmon.exe for deletion
Deletion of file E:\Apacer flash\Recycled\ctfmon.exe failed!

Could not process line:
E:\Apacer flash\Recycled\ctfmon.exe
Status: 0xc000003a


Completed script processing.

*******************

Finished! Terminate.



ComboFix 07-11-19.3 - Jakub 2007-11-25 13:15:48.3 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.1672 [GMT 1:00]
Running from: C:\Documents and Settings\Jakub\Plocha\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jakub\Plocha\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\Recycled
C:\Recycled\ctfmon.exe
C:\Recycled\desktop.ini
C:\Recycled\INFO2
C:\Recycled\Recycled\ctfmon.exe
E:\Autorun.inf
E:\Recycled
E:\Recycled\ctfmon.exe
E:\Recycled\desktop.ini
E:\Recycled\INFO2

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_NPF


((((((((((((((((((((((((( Files Created from 2007-10-25 to 2007-11-25 )))))))))))))))))))))))))))))))
.

2007-11-25 13:19 <DIR> dr-hs---- C:\Recycled
2007-11-25 10:21 128 --a------ C:\ctffind.bat
2007-11-24 17:08 <DIR> d--h----- C:\Documents and Settings\Administrator.ATHLON1\ćablony
2007-11-24 17:08 <DIR> d-------- C:\Documents and Settings\Administrator.ATHLON1\Plocha
2007-11-24 17:08 <DIR> d--h----- C:\Documents and Settings\Administrator.ATHLON1\Okolnˇ tisk rny
2007-11-24 17:08 <DIR> d--h----- C:\Documents and Settings\Administrator.ATHLON1\Okolnˇ sˇś
2007-11-24 17:08 <DIR> d-------- C:\Documents and Settings\Administrator.ATHLON1\Oblˇben‚ polo§ky
2007-11-24 17:08 <DIR> dr------- C:\Documents and Settings\Administrator.ATHLON1\Nabˇdka Start
2007-11-24 17:08 <DIR> d-------- C:\Documents and Settings\Administrator.ATHLON1\Dokumenty
2007-11-24 17:08 <DIR> dr-h----- C:\Documents and Settings\Administrator.ATHLON1\Data aplikacˇ
2007-11-24 13:11 2,505 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2007-11-24 01:18 <DIR> d-------- C:\Program Files\Trend Micro
2007-11-16 17:34 <DIR> d-------- C:\Program Files\zFTPServer Administration
2007-11-16 17:34 <DIR> d-------- C:\Program Files\zFTPServer
2007-11-14 15:41 545 --a------ C:\WINDOWS\UC.PIF
2007-11-13 15:37 <DIR> d-------- C:\Program Files\FTP Commander
2007-11-11 22:18 <DIR> d-------- C:\WINDOWS\Mozilla
2007-11-11 21:45 <DIR> d-------- C:\Program Files\DivX
2007-11-11 20:07 <DIR> d-------- C:\Program Files\SmartSound Software
2007-11-11 20:06 196,096 --a------ C:\WINDOWS\system32\macd32.dll
2007-11-11 20:06 138,752 --a------ C:\WINDOWS\system32\mase32.dll
2007-11-11 20:06 136,192 --a------ C:\WINDOWS\system32\mamc32.dll
2007-11-11 20:06 57,856 --a------ C:\WINDOWS\system32\masd32.dll
2007-11-11 20:06 41,219 --a------ C:\WINDOWS\RSETPATH.exe
2007-11-11 20:06 27,648 --a------ C:\WINDOWS\system32\ma32.dll
2007-11-11 18:20 90,112 --a------ C:\WINDOWS\unvise32.exe
2007-11-11 18:14 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-11-10 17:49 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikac
2007-11-10 17:46 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
2007-11-10 17:45 171,520 --a------ C:\WINDOWS\system32\drivers\MarvinBus.sys
2007-11-10 17:45 84,992 --a------ C:\WINDOWS\system32\ATL70.DLL
2007-11-10 17:45 14,165 --a------ C:\WINDOWS\system32\drivers\Pclepci.sys
2007-11-10 17:44 974,848 --a------ C:\WINDOWS\system32\MFC70.DLL
2007-11-10 17:44 964,608 --a------ C:\WINDOWS\system32\MFC70U.DLL
2007-11-10 17:42 <DIR> d-------- C:\Program Files\Pinnacle
2007-11-05 16:09 <DIR> d-------- C:\Program Files\The Witcher
2007-11-05 11:50 <DIR> d-------- C:\Program Files\MediaCoder
2007-11-01 23:06 <DIR> d-------- C:\Program Files\DAEMON Tools Pro
2007-11-01 19:51 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-24 23:05 --------- d-----w C:\Program Files\LogMeIn
2007-11-24 16:49 --------- d-----w C:\Program Files\SpeedFan
2007-11-20 19:03 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-11-20 19:03 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-11-14 19:37 40,960 ----a-w C:\WINDOWS\Ferrari 599 GTB Fiorano - 01.dll
2007-11-14 19:37 243,552 ----a-w C:\WINDOWS\Ferrari 599 GTB Fiorano - 01.scr
2007-11-14 19:37 1,331,565 ----a-w C:\WINDOWS\Ferrari 599 GTB Fiorano - 01.exe
2007-11-11 19:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-01 18:51 278,984 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys
2007-10-31 18:17 --------- d-----w C:\Program Files\Futuremark
2007-10-31 17:43 --------- d-----w C:\Program Files\Gothic III
2007-10-31 17:39 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2007-10-31 17:17 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2007-10-24 21:45 --------- d-----w C:\Program Files\Lineage II C4
2007-10-24 18:47 --------- d-----w C:\Program Files\QIP
2007-10-24 18:20 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-10-24 18:20 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-10-24 18:20 8,527,872 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-10-24 18:20 757,760 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-10-24 18:20 7,425,248 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-10-24 18:20 6,901,760 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-10-24 18:20 6,541,312 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-10-24 18:20 5,767,936 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-10-24 18:20 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-10-24 18:20 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-10-24 18:20 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-10-24 18:20 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-10-24 18:20 380,928 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-10-24 18:20 35,328 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-10-24 18:20 35,328 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-10-24 18:20 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-10-24 18:20 3,698,688 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-10-24 18:20 3,407,872 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-10-24 18:20 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-10-24 18:20 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll
2007-10-24 18:20 2,486,272 ----a-w C:\WINDOWS\system32\nvwss.dll
2007-10-24 18:20 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll
2007-10-24 18:20 155,716 ----a-w C:\WINDOWS\system32\nvsvc32.exe
2007-10-24 18:20 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe
2007-10-24 18:20 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-10-24 18:20 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
2007-10-24 18:20 1,478,656 ----a-w C:\WINDOWS\system32\nview.dll
2007-10-24 18:20 1,339,392 ----a-w C:\WINDOWS\system32\nvdspsch.exe
2007-10-24 18:20 1,212,416 ----a-w C:\WINDOWS\system32\nvmobls.dll
2007-10-24 18:20 1,019,904 ----a-w C:\WINDOWS\system32\nvwimg.dll
2007-10-24 17:50 --------- d-----w C:\Program Files\Beruska
2007-10-24 16:08 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2007-10-24 16:08 262,144 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2007-10-24 15:32 --------- d-----w C:\Program Files\Prime95
2007-10-14 18:18 --------- d-----w C:\Program Files\Hamachi
2007-10-13 17:56 --------- d-----w C:\Program Files\Unreal Tournament 3 Demo
2007-10-13 17:55 --------- d-----w C:\Program Files\DIFX
2007-10-13 17:55 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-10-13 17:54 --------- d-----w C:\Program Files\AGEIA Technologies
2007-10-08 17:49 18,048 ----a-w C:\WINDOWS\system32\drivers\lirsgt.sys
2007-10-02 21:10 --------- d-----w C:\Program Files\RivaTuner v2.05
2007-10-02 20:08 --------- d-----w C:\Program Files\NVIDIA Corporation
2007-09-29 09:37 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-09-29 07:49 --------- d-----w C:\Program Files\Absolute Uninstaller
2007-09-29 07:15 --------- d-----w C:\Program Files\PowerISO
2007-09-28 08:34 3,623,736 ----a-w C:\procexp.exe
2007-09-28 08:32 98,304 ----a-w C:\Tcpview.exe
2007-09-17 00:10 356,352 ----a-w C:\WINDOWS\system32\nvusmb.exe
2007-09-17 00:10 356,352 ----a-w C:\WINDOWS\system32\nvunrm.exe
2007-09-17 00:10 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-09-17 00:10 356,352 ----a-w C:\WINDOWS\system32\nvuide.exe
2007-09-17 00:10 356,352 ----a-w C:\WINDOWS\system32\nvudisp.exe
2007-09-16 23:07 5,509,120 ----a-w C:\WINDOWS\system32\nvdispsr.dll
2007-09-16 23:07 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll
2007-09-16 23:07 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll
2007-09-16 23:07 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll
2007-09-16 23:07 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll
2007-09-16 23:07 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll
2007-09-16 23:07 327,680 ----a-w C:\WINDOWS\system32\nvrshe.dll
2007-09-16 23:07 327,680 ----a-w C:\WINDOWS\system32\nvrsar.dll
2007-09-16 23:07 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll
2007-09-16 23:07 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll
2007-09-16 23:07 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll
2007-09-16 23:07 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll
2007-09-16 23:07 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll
2007-09-16 23:07 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll
2007-09-16 23:07 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll
2007-09-16 23:07 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll
2007-09-16 23:07 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll
2007-09-16 23:07 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll
2007-09-16 23:07 3,629,056 ----a-w C:\WINDOWS\system32\nvvitvsr.dll
2007-09-16 23:07 3,166,208 ----a-w C:\WINDOWS\system32\nvgamesr.dll
2007-09-16 23:07 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll
2007-09-16 23:07 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll
2007-09-16 23:07 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll
2007-09-16 23:07 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll
2007-09-16 23:07 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll
2007-09-16 23:07 290,816 ----a-w C:\WINDOWS\system32\nvwrsth.dll
2007-09-16 23:07 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll
2007-09-16 23:07 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll
2007-09-16 23:07 282,624 ----a-w C:\WINDOWS\system32\nvwrsar.dll
2007-09-16 23:07 282,624 ----a-w C:\WINDOWS\system32\nvrsfr.dll
2007-09-16 23:07 282,624 ----a-w C:\WINDOWS\system32\nvrses.dll
2007-09-16 23:07 282,624 ----a-w C:\WINDOWS\system32\nvrsel.dll
2007-09-16 23:07 278,528 ----a-w C:\WINDOWS\system32\nvwrshe.dll
2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
.

((((((((((((((((((((((((((((( snapshot@2007-11-25_10.16.22.79 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-25 08:54:47 74,696 ----a-w C:\WINDOWS\system32\perfc005.dat
+ 2007-11-25 12:25:23 74,696 ----a-w C:\WINDOWS\system32\perfc005.dat
- 2007-11-25 08:54:47 63,266 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-11-25 12:25:23 63,266 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-25 08:54:47 401,504 ----a-w C:\WINDOWS\system32\perfh005.dat
+ 2007-11-25 12:25:23 401,504 ----a-w C:\WINDOWS\system32\perfh005.dat
- 2007-11-25 08:54:47 403,664 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-25 12:25:23 403,664 ----a-w C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 00:04]
"Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [2006-08-20 23:24]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08]
"LaunchList"="C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSysVol"="C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 09:43]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 06:03]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 06:03]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-18 13:00 C:\WINDOWS\system32\rundll32.exe]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57]
"nwiz"="nwiz.exe" [2007-10-24 19:20 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-18 13:00 C:\WINDOWS\system32\rundll32.exe]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-11 01:26]
"zFTPServer"="C:\Program Files\zFTPServer\zFTPServer.exe" [2005-04-02 12:53]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"RunStartupScriptSync"= 0 (0x0)
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 1 (0x1)
"NoRecentDocsHistory"= 1 (0x1)
"MemCheckBoxInRunDlg"= 0 (0x0)
"NoAutoTrayNotify"= 0 (0x0)
"NoResolveTrack"= 0 (0x0)
"NoResolveSearch"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoSharedDocuments"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2007-05-25 14:22 63040 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jakub^Nabídka Start^Programy^Po spuštění^hamachi.lnk]
path=C:\Documents and Settings\Jakub\Nabídka Start\Programy\Po spuštění\hamachi.lnk
backup=C:\WINDOWS\pss\hamachi.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
C:\Program Files\DAEMON Tools\daemon.exe -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
Logi_MwX.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
2007-04-17 13:03 63048 --a------ C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe clear

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2007-04-09 13:23 200704 --a------ C:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 00:00 90112 --------- C:\WINDOWS\UpdReg.EXE

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys
R2 LMIInfo;LogMeIn Kernel Information Provider;\??\C:\Program Files\LogMeIn\x86\RaInfo.sys
R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
R3 lmimirr;lmimirr;C:\WINDOWS\system32\DRIVERS\lmimirr.sys
R3 P17;Sound Blaster Live! 24-bit;C:\WINDOWS\system32\drivers\P17.sys
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB;C:\WINDOWS\system32\DRIVERS\usbohci.sys
S3 GcKernel;Ovladač filtru Microsoft SideWinder Value Add;C:\WINDOWS\system32\DRIVERS\GcKernel.sys
S3 HIDSwvd;Miniovladač stanadardu HID Microsoft SideWinder Virtual;C:\WINDOWS\system32\DRIVERS\HIDSwvd.sys
S3 RivaTuner32;RivaTuner32;\??\C:\Program Files\RivaTuner v2.05\RivaTuner32.sys
S3 SWUSBFLT;Ovladač filtru Microsoft SideWinder VIA;C:\WINDOWS\system32\DRIVERS\SWUSBFLT.sys
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB;C:\WINDOWS\system32\DRIVERS\usbccgp.sys
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##Acer#VFF0315 (E)]
\Shell\AutoRun\command - Y:\InstMenu.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{03701c60-58b7-11db-a0ee-806d6172696f}]
\Shell\AutoRun\command - D:\CTRun\Start.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d57de6f-e6c0-11db-8f34-001109d5746f}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(0)\command - G:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7b68ea42-58c0-11db-8099-806d6172696f}]
\Shell\AutoRun\command - D:\Setup.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-09-16 17:36:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-25 13:25:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-25 13:27:08 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-25 10:17
C:\ComboFix3.txt ... 2007-11-24 19:50
.
--- E O F ---



Svazek v jednotce C nemá žádnou jmenovku.
Sériové číslo svazku je 8879-A0A4.

Výpis adresáře C:\Recycled\Recycled

27.06.2006 10:06 20 480 ctfmon.exe
1 souborů, 20 480 bajtů

Výpis adresáře C:\WINDOWS\system32\dllcache

18.08.2004 13:00 15 360 ctfmon.exe
1 souborů, 15 360 bajtů

Počet souborů v seznamu:
2 souborů, 35 840 bajtů
Adresářů: 0, Volných bajtů: 6 383 038 464


Svazek v jednotce E je E40.
Sériové číslo svazku je 6C96-FD85.

Výpis adresáře E:\Apacer flash\Recycled

27.06.2006 10:06 20 480 ctfmon.exe
1 souborů, 20 480 bajtů

Výpis adresáře E:\Recycled

27.06.2006 10:06 20 480 ctfmon.exe
1 souborů, 20 480 bajtů

Počet souborů v seznamu:
2 souborů, 40 960 bajtů
Adresářů: 0, Volných bajtů: 1 182 109 696

[fredik]

Nejschůdnější řešení bylo kdyby jsi na dané Pc ze kterého posíláš logy nainstaloval nějaký antivir a nechal s ním zkontrolovat celý disk.

Připoj k Pc všechny výměnné zařízení (flešku/y), které na něm používáš.

Vytvoř si nový CFScript.txt, vlož do něho tentokrát toto a použij ho stejným způsobem jako ten předchozí, s tím rozdílem že si položku Folder:: rozšiř o písmena všech disků/flesh disků, které se ti mapují. Např. pokud se ti fleška mapuje pod písmenem G tak za E:\Recycled přidáš G:\Recycled tak aby byl každý záznam na novém řádku.

Kód: Vybrat vše

Folder::
E:\Apacer flash\Recycled
C:\Recycled\Recycled
C:\Recycled
D:\Recycled
E:\Recycled

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d57de6f-e6c0-11db-8f34-001109d5746f}]

Hned po proběhnutí Combofix-u použij znovu Flash Disinfector

Dej sem pak log z Combofixu a použij znovu skript ctffind.bat na všech discích včetně flešky a vlož sem výsledky.

Adresář/složka Recycled je skrytá.

[kubajs]

Projel jsem to NODem a smazal co se dalo. Ctffind.bat mi našel ctfmon.exe už jen na C:
(Na ostatních discích/fleškách E,G,M nenašel nic)


Svazek v jednotce C nemá žádnou jmenovku.
Sériové číslo svazku je 8879-A0A4.

Výpis adresáře C:\WINDOWS\system32\dllcache

18.08.2004 13:00 15 360 ctfmon.exe
1 souborů, 15 360 bajtů

Počet souborů v seznamu:
1 souborů, 15 360 bajtů
Adresářů: 0, Volných bajtů: 6 089 502 720


ComboFix 07-11-19.3 - Jakub 2007-11-25 17:58:43.4 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.1583 [GMT 1:00]
Running from: C:\Documents and Settings\Jakub\Plocha\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jakub\Plocha\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\Recycled
C:\Recycled\desktop.ini
C:\Recycled\INFO2
E:\Apacer flash\Recycled
E:\Apacer flash\Recycled\desktop.ini
E:\Apacer flash\Recycled\INFO2
E:\Autorun.inf
E:\Recycled
E:\Recycled\desktop.ini
E:\Recycled\INFO2
G:\Recycled
G:\Recycled\desktop.ini
G:\Recycled\INFO2
M:\Recycled
M:\Recycled\desktop.ini
M:\Recycled\INFO2

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_NPF


((((((((((((((((((((((((( Files Created from 2007-10-25 to 2007-11-25 )))))))))))))))))))))))))))))))
.

2007-11-25 10:21 128 --a------ C:\ctffind.bat
2007-11-24 17:08 <DIR> d--h----- C:\Documents and Settings\Administrator.ATHLON1\ćablony
2007-11-24 17:08 <DIR> d-------- C:\Documents and Settings\Administrator.ATHLON1\Plocha
2007-11-24 17:08 <DIR> d--h----- C:\Documents and Settings\Administrator.ATHLON1\Okolnˇ tisk rny
2007-11-24 17:08 <DIR> d--h----- C:\Documents and Settings\Administrator.ATHLON1\Okolnˇ sˇś
2007-11-24 17:08 <DIR> d-------- C:\Documents and Settings\Administrator.ATHLON1\Oblˇben‚ polo§ky
2007-11-24 17:08 <DIR> dr------- C:\Documents and Settings\Administrator.ATHLON1\Nabˇdka Start
2007-11-24 17:08 <DIR> d-------- C:\Documents and Settings\Administrator.ATHLON1\Dokumenty
2007-11-24 17:08 <DIR> dr-h----- C:\Documents and Settings\Administrator.ATHLON1\Data aplikacˇ
2007-11-24 01:18 <DIR> d-------- C:\Program Files\Trend Micro
2007-11-16 17:34 <DIR> d-------- C:\Program Files\zFTPServer Administration
2007-11-16 17:34 <DIR> d-------- C:\Program Files\zFTPServer
2007-11-14 15:41 545 --a------ C:\WINDOWS\UC.PIF
2007-11-13 15:37 <DIR> d-------- C:\Program Files\FTP Commander
2007-11-11 22:18 <DIR> d-------- C:\WINDOWS\Mozilla
2007-11-11 21:45 <DIR> d-------- C:\Program Files\DivX
2007-11-11 20:35 30,208 --------- C:\WINDOWS\system32\lfbmp13n.dll
2007-11-11 20:07 <DIR> d-------- C:\Program Files\SmartSound Software
2007-11-11 20:06 196,096 --a------ C:\WINDOWS\system32\macd32.dll
2007-11-11 20:06 138,752 --a------ C:\WINDOWS\system32\mase32.dll
2007-11-11 20:06 136,192 --a------ C:\WINDOWS\system32\mamc32.dll
2007-11-11 20:06 57,856 --a------ C:\WINDOWS\system32\masd32.dll
2007-11-11 20:06 41,219 --a------ C:\WINDOWS\RSETPATH.exe
2007-11-11 20:06 27,648 --a------ C:\WINDOWS\system32\ma32.dll
2007-11-11 18:20 90,112 --a------ C:\WINDOWS\unvise32.exe
2007-11-11 18:14 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-11-10 17:49 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikac
2007-11-10 17:46 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
2007-11-10 17:44 974,848 --a------ C:\WINDOWS\system32\MFC70.DLL
2007-11-10 17:44 964,608 --a------ C:\WINDOWS\system32\MFC70U.DLL
2007-11-10 17:42 <DIR> d-------- C:\Program Files\Pinnacle
2007-11-05 16:09 <DIR> d-------- C:\Program Files\The Witcher
2007-11-05 11:50 <DIR> d-------- C:\Program Files\MediaCoder
2007-11-01 23:06 <DIR> d-------- C:\Program Files\DAEMON Tools Pro
2007-11-01 19:51 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-25 16:47 2,839 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
2007-11-25 16:19 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2007-11-25 16:19 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2007-11-24 23:05 --------- d-----w C:\Program Files\LogMeIn
2007-11-24 16:49 --------- d-----w C:\Program Files\SpeedFan
2007-11-20 19:03 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-11-14 19:37 40,960 ----a-w C:\WINDOWS\Ferrari 599 GTB Fiorano - 01.dll
2007-11-14 19:37 243,552 ----a-w C:\WINDOWS\Ferrari 599 GTB Fiorano - 01.scr
2007-11-14 19:37 1,331,565 ----a-w C:\WINDOWS\Ferrari 599 GTB Fiorano - 01.exe
2007-11-11 19:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-01 18:51 278,984 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys
2007-10-31 18:17 --------- d-----w C:\Program Files\Futuremark
2007-10-31 17:43 --------- d-----w C:\Program Files\Gothic III
2007-10-31 17:17 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2007-10-24 21:45 --------- d-----w C:\Program Files\Lineage II C4
2007-10-24 18:47 --------- d-----w C:\Program Files\QIP
2007-10-24 18:20 7,425,248 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-10-24 17:50 --------- d-----w C:\Program Files\Beruska
2007-10-24 15:32 --------- d-----w C:\Program Files\Prime95
2007-10-14 18:18 --------- d-----w C:\Program Files\Hamachi
2007-10-13 17:56 --------- d-----w C:\Program Files\Unreal Tournament 3 Demo
2007-10-13 17:55 --------- d-----w C:\Program Files\DIFX
2007-10-13 17:55 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-10-13 17:54 --------- d-----w C:\Program Files\AGEIA Technologies
2007-10-08 17:49 18,048 ----a-w C:\WINDOWS\system32\drivers\lirsgt.sys
2007-10-02 21:10 --------- d-----w C:\Program Files\RivaTuner v2.05
2007-10-02 20:08 --------- d-----w C:\Program Files\NVIDIA Corporation
2007-09-29 09:37 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-09-29 07:49 --------- d-----w C:\Program Files\Absolute Uninstaller
2007-09-29 07:15 --------- d-----w C:\Program Files\PowerISO
2007-09-28 08:34 3,623,736 ----a-w C:\procexp.exe
2007-09-28 08:32 98,304 ----a-w C:\Tcpview.exe
2007-03-19 21:06 457 ----a-w C:\Program Files\INSTALL.LOG
2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
.

((((((((((((((((((((((((((((( snapshot@2007-11-25_10.16.22.79 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-25 16:19:02 298,104 ----a-w C:\WINDOWS\system32\imon.dll
- 2007-11-25 08:54:47 74,696 ----a-w C:\WINDOWS\system32\perfc005.dat
+ 2007-11-25 16:52:13 74,696 ----a-w C:\WINDOWS\system32\perfc005.dat
- 2007-11-25 08:54:47 63,266 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-11-25 16:52:13 63,266 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-25 08:54:47 401,504 ----a-w C:\WINDOWS\system32\perfh005.dat
+ 2007-11-25 16:52:13 401,504 ----a-w C:\WINDOWS\system32\perfh005.dat
- 2007-11-25 08:54:47 403,664 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-25 16:52:13 403,664 ----a-w C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 00:04]
"Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [2006-08-20 23:24]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08]
"LaunchList"="C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSysVol"="C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 09:43]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 06:03]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 06:03]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-18 13:00 C:\WINDOWS\system32\rundll32.exe]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57]
"nwiz"="nwiz.exe" [2007-10-24 19:20 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-18 13:00 C:\WINDOWS\system32\rundll32.exe]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-11 01:26]
"zFTPServer"="C:\Program Files\zFTPServer\zFTPServer.exe" [2005-04-02 12:53]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-11-25 17:19]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"RunStartupScriptSync"= 0 (0x0)
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 1 (0x1)
"NoRecentDocsHistory"= 1 (0x1)
"MemCheckBoxInRunDlg"= 0 (0x0)
"NoAutoTrayNotify"= 0 (0x0)
"NoResolveTrack"= 0 (0x0)
"NoResolveSearch"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoSharedDocuments"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2007-05-25 14:22 63040 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jakub^Nabídka Start^Programy^Po spuštění^hamachi.lnk]
path=C:\Documents and Settings\Jakub\Nabídka Start\Programy\Po spuštění\hamachi.lnk
backup=C:\WINDOWS\pss\hamachi.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
C:\Program Files\DAEMON Tools\daemon.exe -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
Logi_MwX.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
2007-04-17 13:03 63048 --a------ C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe clear

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2007-04-09 13:23 200704 --a------ C:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 00:00 90112 --------- C:\WINDOWS\UpdReg.EXE

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys
R2 LMIInfo;LogMeIn Kernel Information Provider;\??\C:\Program Files\LogMeIn\x86\RaInfo.sys
R2 LMIRfsDriver;LogMeIn Remote File System Driver;\??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
R3 lmimirr;lmimirr;C:\WINDOWS\system32\DRIVERS\lmimirr.sys
R3 P17;Sound Blaster Live! 24-bit;C:\WINDOWS\system32\drivers\P17.sys
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB;C:\WINDOWS\system32\DRIVERS\usbohci.sys
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
S3 GcKernel;Ovladač filtru Microsoft SideWinder Value Add;C:\WINDOWS\system32\DRIVERS\GcKernel.sys
S3 HIDSwvd;Miniovladač stanadardu HID Microsoft SideWinder Virtual;C:\WINDOWS\system32\DRIVERS\HIDSwvd.sys
S3 RivaTuner32;RivaTuner32;\??\C:\Program Files\RivaTuner v2.05\RivaTuner32.sys
S3 SWUSBFLT;Ovladač filtru Microsoft SideWinder VIA;C:\WINDOWS\system32\DRIVERS\SWUSBFLT.sys
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB;C:\WINDOWS\system32\DRIVERS\usbccgp.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##Acer#VFF0315 (E)]
\Shell\AutoRun\command - Y:\InstMenu.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{03701c60-58b7-11db-a0ee-806d6172696f}]
\Shell\AutoRun\command - D:\CTRun\Start.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7b68ea42-58c0-11db-8099-806d6172696f}]
\Shell\AutoRun\command - D:\Setup.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-09-16 17:36:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-25 18:04:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-25 18:06:12 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-25 13:27
C:\ComboFix3.txt ... 2007-11-25 10:17
.
--- E O F ---

[fredik]

Jdi přes Start -> Spustit... a napiš do okna tento příkaz označený modře ComboFix /u (mezi comobofix a /u musí být mezera) a dej Ok.

Dej sem nový log z HJT a řekni jestli problémy přetrvávají?