ComboFix - prosím o kontrolu logu

[Lance]

Mám poslední dobou hodně problémy s trojany a podobnou havětí, snažil jsem se to eliminovat snad vším co šlo, ale nic nepomáhá, tak tady je log z CF pro profesionály :)
Poraďte prosím co dál (HJT mám)

EDIT: v "Other Deletions" jsem měl ještě několik stovek .tmp souborů, který by se sem ale nevešly

ComboFix 08-01-23.2 - Lancˇźek 2008-01-24 14:38:53.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.1481 [GMT 1:00]
Running from: C:\Documents and Settings\Lancˇźek\Plocha\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.


C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService
-------\NPF


((((((((((((((((((((((((( Files Created from 2007-12-24 to 2008-01-24 )))))))))))))))))))))))))))))))
.

2008-01-24 14:38 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-24 14:35 . 2008-01-24 14:35 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-24 13:47 . 2008-01-24 13:48 <DIR> d-------- C:\Program Files\ICQ6
2008-01-17 21:47 . 2008-01-17 21:51 <DIR> d-------- C:\Program Files\Uniblue
2008-01-13 17:27 . 2008-01-19 15:47 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-01-13 16:40 . 2008-01-13 17:04 1,060,442 ---hs---- C:\WINDOWS\system32\mhdvoqdy.ini
2008-01-12 04:42 . 2008-01-12 04:42 1,060,562 ---hs---- C:\WINDOWS\system32\odvnypeh.ini
2008-01-10 01:47 . 2008-01-12 01:48 1,060,502 ---hs---- C:\WINDOWS\system32\gbwnshfc.ini
2008-01-09 01:46 . 2008-01-09 01:46 1,055,022 ---hs---- C:\WINDOWS\system32\wcwsgfgj.tmp
2008-01-06 13:16 . 2004-08-17 15:49 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-01-06 13:16 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-01-06 13:16 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-01-06 13:16 . 2001-10-24 12:25 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-01-06 07:48 . 2008-01-21 00:42 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-06 07:48 . 2008-01-06 07:48 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-06 01:14 . 2008-01-06 01:14 1,043,800 ---hs---- C:\WINDOWS\system32\ncbffwci.ini
2008-01-03 00:53 . 2008-01-05 00:57 1,031,458 ---hs---- C:\WINDOWS\system32\dgnyufrt.ini
2008-01-02 23:37 . 2008-01-02 23:37 294 ---hs---- C:\WINDOWS\system32\bvyxrcre.ini
2008-01-01 23:36 . 2008-01-02 14:13 354 ---hs---- C:\WINDOWS\system32\rjlaghem.ini
2008-01-01 22:59 . 2008-01-01 22:59 <DIR> d-------- C:\Program Files\Electronic Arts
2008-01-01 19:43 . 2008-01-01 19:44 <DIR> d-------- C:\Program Files\Reg Cleaner
2008-01-01 14:31 . 2008-01-01 14:40 114 --a------ C:\WINDOWS\level.ini
2007-12-29 23:31 . 2008-01-01 20:03 654 ---hs---- C:\WINDOWS\system32\pnwmakct.ini
2007-12-28 15:40 . 2007-12-29 17:03 4,096 --a------ C:\WINDOWS\system32\crash

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-24 13:24 --------- d-----w C:\Program Files\QuickTime
2008-01-24 13:24 --------- d-----w C:\Program Files\DAEMON Tools
2008-01-24 12:48 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-24 10:53 --------- d-----w C:\Program Files\DC++
2008-01-19 14:48 --------- d-----w C:\Program Files\Spyware Terminator
2008-01-17 20:51 --------- d-----w C:\Program Files\TQDefiler
2008-01-13 16:27 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-12 13:57 --------- d-----w C:\Program Files\Lavasoft
2008-01-06 20:06 --------- d-----w C:\Program Files\Azureus
2008-01-01 18:49 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2007-12-29 22:20 --------- d-----w C:\Program Files\Microsoft Games
2007-12-29 01:44 --------- d-----w C:\Program Files\ATI Technologies
2007-12-28 13:17 --------- d-----w C:\Program Files\iTunes
2007-12-28 13:17 --------- d-----w C:\Program Files\iPod
2007-12-22 10:56 --------- d-----w C:\Program Files\AGEIA Technologies
2007-12-21 20:12 --------- d-----w C:\Program Files\Huawei technologies
2007-12-05 05:26 2,782,208 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-12-05 02:16 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-12-02 13:22 --------- d-----w C:\Program Files\NCSoft
2007-11-25 16:31 --------- d-----w C:\Program Files\Creative Labs
.

Kód: Vybrat vše

<pre>
----a-w            90,112 2008-01-01 19:57:14  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart .exe
----a-w           171,464 2008-01-18 19:10:17  C:\Program Files\DAEMON Tools\daemon .exe
----a-w         1,410,304 2008-01-13 15:54:25  C:\Program Files\ESET\ESET NOD32 Antivirus\egui .exe
----a-w         1,877,272 2008-01-19 13:22:52  C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster  .exe
----a-w           159,232 2008-01-19 15:06:17  C:\WINDOWS\pchealth\helpctr\binaries\MSConfig  .exe
----a-w            15,360 2008-01-11 15:30:06  C:\WINDOWS\system32\ctfmon .exe
----a-w           155,648 2008-01-01 19:57:14  C:\WINDOWS\system32\NeroCheck .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{836700F1-FF89-44BC-B5F3-781403D1A1D4}]
C:\WINDOWS\system32\mlljh.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-24 13:44 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 13:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-24 13:44 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"HideShutdownScripts"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MaxRecentDocs"= 99 (0x63)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqnlli]
urqnlli.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winhoq32]
winhoq32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, wowfx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Synchronizer.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^Lancíček^Nabídka Start^Programy^Po spuštění^findfast.exe]

[HKLM\~\startupfolder\^brpinfo.dll]
path=\brpinfo.dll
backup=C:\WINDOWS\pss\brpinfo.dllCommon Startup

[HKLM\~\startupfolder\^dxva_sig.txt]
path=\dxva_sig.txt

[HKLM\~\startupfolder\^HCAppRes.dll]
path=\HCAppRes.dll
backup=C:\WINDOWS\pss\HCAppRes.dllCommon Startup

[HKLM\~\startupfolder\^HelpCtr.exe]
path=\HelpCtr.exe
backup=C:\WINDOWS\pss\HelpCtr.exeCommon Startup

[HKLM\~\startupfolder\^HelpHost.exe]
path=\HelpHost.exe
backup=C:\WINDOWS\pss\HelpHost.exeCommon Startup

[HKLM\~\startupfolder\^HelpSvc.exe]
path=\HelpSvc.exe
backup=C:\WINDOWS\pss\HelpSvc.exeCommon Startup

[HKLM\~\startupfolder\^hscsp_w3.cab]
path=\hscsp_w3.cab
backup=C:\WINDOWS\pss\hscsp_w3.cabCommon Startup

[HKLM\~\startupfolder\^HscUpd.exe]
path=\HscUpd.exe
backup=C:\WINDOWS\pss\HscUpd.exeCommon Startup

[HKLM\~\startupfolder\^MSConfig .exe]
path=\MSConfig .exe
backup=C:\WINDOWS\pss\MSConfig .exeCommon Startup

[HKLM\~\startupfolder\^msinfo.dll]
path=\msinfo.dll
backup=C:\WINDOWS\pss\msinfo.dllCommon Startup

[HKLM\~\startupfolder\^notiflag.exe]
path=\notiflag.exe
backup=C:\WINDOWS\pss\notiflag.exeCommon Startup

[HKLM\~\startupfolder\^NTUSER.DAT]
path=\NTUSER.DAT
backup=C:\WINDOWS\pss\NTUSER.DATCommon Startup

[HKLM\~\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG
backup=C:\WINDOWS\pss\ntuser.dat.LOGCommon Startup

[HKLM\~\startupfolder\^ntuser.ini]
path=\ntuser.ini
backup=C:\WINDOWS\pss\ntuser.iniCommon Startup

[HKLM\~\startupfolder\^pchdt_w3.cab]
path=\pchdt_w3.cab
backup=C:\WINDOWS\pss\pchdt_w3.cabCommon Startup

[HKLM\~\startupfolder\^pchshell.dll]
path=\pchshell.dll
backup=C:\WINDOWS\pss\pchshell.dllCommon Startup

[HKLM\~\startupfolder\^pchsvc.dll]
path=\pchsvc.dll
backup=C:\WINDOWS\pss\pchsvc.dllCommon Startup

[HKLM\~\startupfolder\^Plocha(2)]
path=\Plocha(2)

[HKLM\~\startupfolder\^SI.bin]
path=\SI.bin

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\50f2dce7]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2006-12-12 20:33 69632 C:\WINDOWS\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctaratev]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2006-03-02 13:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
C:\Program Files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui]
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\system32\mlljh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2005-12-13 08:49 217088 C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 2006-12-12 20:33 16270848 C:\WINDOWS\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
--a------ 2006-12-12 20:33 2879488 C:\WINDOWS\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spoolsv]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-03-14 02:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
--a------ 2008-01-19 14:22 1877272 C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)
"IDriverT"=3 (0x3)
"DomainService"=2 (0x2)

R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2007-08-26 13:30]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2006-03-02 13:00]
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys [2006-08-16 07:25]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16dfedde-b0ef-11dc-b9ff-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20fb28ec-b16c-11dc-ba07-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20fb28ee-b16c-11dc-ba07-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20fb28ef-b16c-11dc-ba07-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20fb28f0-b16c-11dc-ba07-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95e97ffa-b194-11dc-ba08-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c7452f04-b542-11dc-ba11-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c7452f05-b542-11dc-ba11-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce375769-affc-11dc-b9fe-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce37576b-affc-11dc-b9fe-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-01-24 02:30:00 C:\WINDOWS\Tasks\RegClean Scheduled Scan.job"
- C:\Program Files\RegClean\RegClean.ex
- C:\Program Files\RegClean
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-24 14:43:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

[Reklama]

[fredik]

Než začneš něco dělat tak mi prosím tě zabal log z ComboFix a buď ho vlož jako přílohu ke svému dalšímu příspěvku, nebo mi ho postni přes SZ.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok)
Zkopíruj do něj následující text označený zeleně:

Kód: Vybrat vše

File::
C:\WINDOWS\system32\mhdvoqdy.ini
C:\WINDOWS\system32\odvnypeh.ini
C:\WINDOWS\system32\gbwnshfc.ini
C:\WINDOWS\system32\wcwsgfgj.tmp
C:\WINDOWS\system32\ncbffwci.ini
C:\WINDOWS\system32\dgnyufrt.ini
C:\WINDOWS\system32\bvyxrcre.ini
C:\WINDOWS\system32\rjlaghem.ini
C:\WINDOWS\system32\pnwmakct.ini

RenV::
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart .exe
C:\Program Files\DAEMON Tools\daemon .exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui .exe
C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster  .exe
C:\WINDOWS\pchealth\helpctr\binaries\MSConfig  .exe
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\NeroCheck .exe

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{836700F1-FF89-44BC-B5F3-781403D1A1D4}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqnlli]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winhoq32]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[-HKLM\~\startupfolder\C:^Documents and Settings^Lancíček^Nabídka Start^Programy^Po spuštění^findfast.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\50f2dce7]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctaratev]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spoolsv]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"DomainService"=-

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť

- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

Dej sem taký log z HJT.

[Lance]

Tady to je, předchozí log je v příloze

Log z CF:

ComboFix 08-01-23.2 - Lancíček 2008-01-24 18:08:53.4 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.1579 [GMT 1:00]
Running from: C:\Documents and Settings\Lancíček\Plocha\ComboFix.exe
Command switches used :: C:\Documents and Settings\Lancíček\Plocha\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\system32\bvyxrcre.ini
C:\WINDOWS\system32\dgnyufrt.ini
C:\WINDOWS\system32\gbwnshfc.ini
C:\WINDOWS\system32\mhdvoqdy.ini
C:\WINDOWS\system32\ncbffwci.ini
C:\WINDOWS\system32\odvnypeh.ini
C:\WINDOWS\system32\pnwmakct.ini
C:\WINDOWS\system32\rjlaghem.ini
C:\WINDOWS\system32\wcwsgfgj.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\bvyxrcre.ini
C:\WINDOWS\system32\pnwmakct.ini
C:\WINDOWS\system32\rjlaghem.ini
C:\WINDOWS\system32\wcwsgfgj.tmp
.
---- Previous Run -------
.

C:\WINDOWS\system32\dgnyufrt.ini
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\gbwnshfc.ini
C:\WINDOWS\system32\mhdvoqdy.ini
C:\WINDOWS\system32\ncbffwci.ini
C:\WINDOWS\system32\odvnypeh.ini
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService
-------\NPF








((((((((((((((((((((((((( Files Created from 2007-12-24 to 2008-01-24 )))))))))))))))))))))))))))))))
.

2008-01-24 17:30 . 2008-01-24 17:30 <DIR> d-------- C:\WINDOWS\LastGood
2008-01-24 16:43 . 2008-01-24 17:08 121 --a------ C:\WINDOWS\bdagent.INI
2008-01-24 16:40 . 2008-01-24 17:30 <DIR> d-------- C:\Program Files\Common Files\BitDefender
2008-01-24 14:38 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-24 14:35 . 2008-01-24 14:35 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-24 13:47 . 2008-01-24 13:48 <DIR> d-------- C:\Program Files\ICQ6
2008-01-19 16:06 . 2008-01-19 16:06 159,232 --a--c--- C:\WINDOWS\system32\dllcache\msconfig.exe
2008-01-17 21:47 . 2008-01-17 21:51 <DIR> d-------- C:\Program Files\Uniblue
2008-01-13 17:27 . 2008-01-19 15:47 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-01-06 13:16 . 2004-08-17 15:49 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-01-06 13:16 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-01-06 13:16 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-01-06 13:16 . 2001-10-24 12:25 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-01-06 07:48 . 2008-01-21 00:42 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-06 07:48 . 2008-01-06 07:48 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-01 22:59 . 2008-01-01 22:59 <DIR> d-------- C:\Program Files\Electronic Arts
2008-01-01 19:43 . 2008-01-01 19:44 <DIR> d-------- C:\Program Files\Reg Cleaner
2008-01-01 14:31 . 2008-01-01 14:40 114 --a------ C:\WINDOWS\level.ini
2007-12-28 15:40 . 2007-12-29 17:03 4,096 --a------ C:\WINDOWS\system32\crash

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-24 17:08 --------- d-----w C:\Program Files\DAEMON Tools
2008-01-24 13:24 --------- d-----w C:\Program Files\QuickTime
2008-01-24 12:48 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-24 10:53 --------- d-----w C:\Program Files\DC++
2008-01-19 15:06 159,232 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\MSConfig.exe
2008-01-19 14:48 --------- d-----w C:\Program Files\Spyware Terminator
2008-01-17 20:51 --------- d-----w C:\Program Files\TQDefiler
2008-01-13 16:27 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-12 13:57 --------- d-----w C:\Program Files\Lavasoft
2008-01-11 15:30 15,360 ----a-w C:\WINDOWS\system32\ctfmon.exe
2008-01-06 20:06 --------- d-----w C:\Program Files\Azureus
2008-01-01 19:57 155,648 ----a-w C:\WINDOWS\system32\NeroCheck.exe
2008-01-01 18:49 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2007-12-29 22:20 --------- d-----w C:\Program Files\Microsoft Games
2007-12-29 01:44 --------- d-----w C:\Program Files\ATI Technologies
2007-12-28 13:17 --------- d-----w C:\Program Files\iTunes
2007-12-28 13:17 --------- d-----w C:\Program Files\iPod
2007-12-22 10:56 --------- d-----w C:\Program Files\AGEIA Technologies
2007-12-21 20:12 --------- d-----w C:\Program Files\Huawei technologies
2007-12-05 05:26 2,782,208 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-12-05 03:05 368,640 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-12-05 03:04 269,312 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-12-05 02:56 147,456 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-12-05 02:55 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-12-05 02:55 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-12-05 02:54 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2007-12-05 02:53 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-12-05 02:53 495,616 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2007-12-05 02:48 9,535,488 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-12-05 02:44 3,175,584 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-12-05 02:33 1,640,192 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-12-05 02:19 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2007-12-05 02:19 385,024 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-12-05 02:17 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-12-05 02:16 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-12-05 02:14 180,224 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-12-05 02:11 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-12-02 13:22 --------- d-----w C:\Program Files\NCSoft
2007-11-25 16:31 --------- d-----w C:\Program Files\Creative Labs
2007-11-07 09:29 720,896 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:44 1,290,240 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-25 09:00 230,912 ----a-w C:\WINDOWS\system32\wmasf.dll
.

((((((((((((((((((((((((((((( snapshot_2008-01-24_17.08.19.29 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-24 13:38:46 1,384,448 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-24 17:08:50 1,384,448 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-24 13:38:46 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-24 17:08:50 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-24 13:38:46 1,384,448 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-24 17:08:50 1,384,448 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-24 13:38:46 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-24 17:08:50 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-24 13:38:47 5,808,128 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-24 17:08:50 5,808,128 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-24 13:38:47 462,848 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-24 17:08:51 462,848 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2007-11-12 15:27:46 87,952 ----a-w C:\WINDOWS\LastGood\system32\DRIVERS\bdfndisf.sys
+ 2007-08-02 15:03:44 188,432 ----a-w C:\WINDOWS\LastGood\system32\DRIVERS\bdfsfltr.sys
- 2006-03-02 12:00:00 15,360 -c--a-w C:\WINDOWS\system32\dllcache\ctfmon.exe
+ 2008-01-11 15:30:06 15,360 -c--a-w C:\WINDOWS\system32\dllcache\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-01-11 16:30 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"HideShutdownScripts"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MaxRecentDocs"= 99 (0x63)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Synchronizer.lnk]

[HKLM\~\startupfolder\^brpinfo.dll]
path=\brpinfo.dll
backup=C:\WINDOWS\pss\brpinfo.dllCommon Startup

[HKLM\~\startupfolder\^dxva_sig.txt]
path=\dxva_sig.txt

[HKLM\~\startupfolder\^HCAppRes.dll]
path=\HCAppRes.dll
backup=C:\WINDOWS\pss\HCAppRes.dllCommon Startup

[HKLM\~\startupfolder\^HelpCtr.exe]
path=\HelpCtr.exe
backup=C:\WINDOWS\pss\HelpCtr.exeCommon Startup

[HKLM\~\startupfolder\^HelpHost.exe]
path=\HelpHost.exe
backup=C:\WINDOWS\pss\HelpHost.exeCommon Startup

[HKLM\~\startupfolder\^HelpSvc.exe]
path=\HelpSvc.exe
backup=C:\WINDOWS\pss\HelpSvc.exeCommon Startup

[HKLM\~\startupfolder\^hscsp_w3.cab]
path=\hscsp_w3.cab
backup=C:\WINDOWS\pss\hscsp_w3.cabCommon Startup

[HKLM\~\startupfolder\^HscUpd.exe]
path=\HscUpd.exe
backup=C:\WINDOWS\pss\HscUpd.exeCommon Startup

[HKLM\~\startupfolder\^MSConfig .exe]
path=\MSConfig .exe
backup=C:\WINDOWS\pss\MSConfig .exeCommon Startup

[HKLM\~\startupfolder\^msinfo.dll]
path=\msinfo.dll
backup=C:\WINDOWS\pss\msinfo.dllCommon Startup

[HKLM\~\startupfolder\^notiflag.exe]
path=\notiflag.exe
backup=C:\WINDOWS\pss\notiflag.exeCommon Startup

[HKLM\~\startupfolder\^NTUSER.DAT]
path=\NTUSER.DAT
backup=C:\WINDOWS\pss\NTUSER.DATCommon Startup

[HKLM\~\startupfolder\^ntuser.dat.LOG]
path=\ntuser.dat.LOG
backup=C:\WINDOWS\pss\ntuser.dat.LOGCommon Startup

[HKLM\~\startupfolder\^ntuser.ini]
path=\ntuser.ini
backup=C:\WINDOWS\pss\ntuser.iniCommon Startup

[HKLM\~\startupfolder\^pchdt_w3.cab]
path=\pchdt_w3.cab
backup=C:\WINDOWS\pss\pchdt_w3.cabCommon Startup

[HKLM\~\startupfolder\^pchshell.dll]
path=\pchshell.dll
backup=C:\WINDOWS\pss\pchshell.dllCommon Startup

[HKLM\~\startupfolder\^pchsvc.dll]
path=\pchsvc.dll
backup=C:\WINDOWS\pss\pchsvc.dllCommon Startup

[HKLM\~\startupfolder\^Plocha(2)]
path=\Plocha(2)

[HKLM\~\startupfolder\^SI.bin]
path=\SI.bin

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2006-12-12 20:33 69632 C:\WINDOWS\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2008-01-11 16:30 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
--a------ 2008-01-18 20:10 171464 C:\Program Files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui]
--a------ 2008-01-13 16:54 1410304 C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2005-12-13 08:49 217088 C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
--a------ 2006-12-12 20:33 16270848 C:\WINDOWS\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
--a------ 2006-12-12 20:33 2879488 C:\WINDOWS\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-03-14 02:43 83608 C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)
"IDriverT"=3 (0x3)

R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2007-08-26 13:30]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2006-03-02 13:00]
R4 bdftdif;bdftdif;C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys []
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys [2006-08-16 07:25]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{16dfedde-b0ef-11dc-b9ff-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20fb28ec-b16c-11dc-ba07-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20fb28ee-b16c-11dc-ba07-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20fb28ef-b16c-11dc-ba07-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20fb28f0-b16c-11dc-ba07-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95e97ffa-b194-11dc-ba08-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c7452f04-b542-11dc-ba11-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c7452f05-b542-11dc-ba11-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce375769-affc-11dc-b9fe-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce37576b-affc-11dc-b9fe-0016e6dd6c22}]
\Shell\AutoRun\command - F:\AutoRun.exe

*Newly Created Service* - BDFTDIF
.
Contents of the 'Scheduled Tasks' folder
"2008-01-24 02:30:00 C:\WINDOWS\Tasks\RegClean Scheduled Scan.job"
- C:\Program Files\RegClean\RegClean.ex
- C:\Program Files\RegClean
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-24 18:09:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.

Log z HJT:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:12, on 2008-01-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{90889C56-1AB5-494A-9A69-1059C26CECD6}: NameServer = 10.0.0.138
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - ATI Technologies Inc. - (no file)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 3045 bytes

[fredik]

Já jsem myslel ten úplně první log z ComboFix, jak jsi tam vymazal ty soubor aby se to sem vešlo. Jinak příště klidně když se to sem nevejde rozděl log na víc příspěvků.

Spusť znovu HijackThis a zaškrtni v něm okénka před řádky:
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
po zaškrtnutí klikni na tlačítko Fix Checked

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Máš tam starou verzi Javy tak proveď její update:
- Stáhni si poslení verzi Java Runtime Environment (JRE) 6 Update 4
- Posuň se dolů kde je napsáno Java Runtime Environment (JRE) 6 Update 4 a klikni na tlačítko Download
- Načte se ti nová stránka
- Pod nadpisem Select Platform and Language for your download:
* u položky Platform: vyber Windows
* zatrhni možnost kde je napsáno: I agree to the Java SE Runtime Environment 6 License Agreement
* klikni na tlačítko Continue >>
- Načte se ti nová stránka
- Klikni na odkaz pro stažení pod položkou: Windows Offline Installation a ulož si ho na disk

- Ukonči běžící programy které máš spuštěné, hlavě webový prohlížeč
- Jdi přes Start -> Ovládací panely -> Přidat nebo odebrat programy a odinstaluj všechny staré verze Javy
- Podívej se po položkách s názvem Java Runtime Environment (JRE or J2SE)
* příklady starých verzí v Přidat nebo odebrat programy:

J2SE Runtime Environment 5.0
J2SE Runtime Environment 5.0 Update 8
Java 2 Runtime Environment, SE v1.4.2

- Odinstaluj je přes tlačítko Změnit nebo odebrat nebo Odebrat
- Odinstaluj postupně po sobě případné všechny staré verze Javy
- Po skončení odinstalovaní restartuj Pc.
- Pak už jen spusť instalaci poslední verze ze souboru jre-6u4-windows-i586-p.exe, který sis stáhl na začátku.

Ten Nod jsi odinstaloval? Koukám že jsi nainstaloval Bitdefender, tak pak v něm spusť Full System Scan a vlož sem jeho výsledek + dej sem nový log z HTJ po proběhnutí kontroly antivirem.

[Lance]

Jdu na to, hodím to sem pravděpodobně až před půlnocí.
EDIT: NOD jsem odinstalovával

[Lance]

BD dopadl pozitivně (nemohl akorát zkontrolovat zaheslovaný soubory)

BitDefender Log File !!!!!
Product : BitDefender Total Security 2008
Version : BitDefender UIScanner v.11
Log date : 20:01:32 24/01/2008
Log path : C:\Documents and Settings\All Users\Data aplikací\BitDefender\Desktop\Profiles\Logs\full_scan\1201201292_1_02.xml

Scan Paths:Path0000: C:\


Scan Options:Scan for viruses : Yes
Scan for adware : Yes
Scan for spyware : Yes
Scan for applications : Yes
Scan for dialers : Yes
Scan for rootkits : Yes


Target selection options:Scan registry keys : Yes
Scan cookies : Yes
Scan boot sectors : Yes
Scan memory processes : Yes
Scan archives : No
Scan runtime packers : Yes
Scan emails : Yes
Scan all files : Yes
Heuristic Scan : Yes
Scanned extensions :
Excluded extensions :


Target ProcessingDefault action for infected objects : Disinfect
Default action for suspicious objects : None
Default action for hidden objects : None


Scan engines summaryNumber of virus signatures : 976911
Archive plugins : 41
Email plugins : 6
Scan plugins : 12
Archive plugins : 41
System plugins : 4
Unpack plugins : 7


Overall scan summaryScanned items : 220011
Infected items : 0
Suspicious items : 0
Resolved items : 0
Individual viruses found : 0
Scanned directories : 8700
Scanned boot sectors : 2
Scanned archives : 21
Input-output errors : 27
Scan time : 00:01:11:45
Files per second : 51


Scanned processes summaryScanned : 27
Infected : 0


Scanned registry keys summaryScanned : 298
Infected : 0


Scanned cookies summaryScanned : 0
Infected : 0


A tady nový log z HJT


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:03, on 2008-01-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\ICQ6\ICQ.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{90889C56-1AB5-494A-9A69-1059C26CECD6}: NameServer = 10.0.0.138
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - ATI Technologies Inc. - (no file)
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

--
End of file - 3969 bytes

[Lance]

Já jsem myslel ten úplně první log z ComboFix, jak jsi tam vymazal ty soubor aby se to sem vešlo. Jinak příště klidně když se to sem nevejde rozděl log na víc příspěvků.

On se mi ten ComboFix.txt přepsává, nedělá mi nový a nový

[fredik]

Pokud máš ještě nainstalovaný RegClean (nesplést s Reg Cleaner) tak ho odinstaluj.

Vytvoř si nový CFScript a tentokrát vlož do něho toto:

Kód: Vybrat vše

File::
C:\WINDOWS\Tasks\RegClean Scheduled Scan.job

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean]

Máš ještě nějaké problémy?

[Lance]

Děkuju

Mno nic co by se nějak projevovalo, ale AVG i hlásil pár důležitých souborů jako infikovaných nějakým Dropperem a Vundo mi zas hlásil Msconfig jako vadný -> umístil ho do karantény. Teď ho musím spouštět přímo procházením složek. Ale nejlepší bude, když to sem napíšu až uvidim, že se zase děje něco nekalýho

[fredik]

Jdi přes Start -> Spustit... a napiš do okna tento příkaz označený modře ComboFix /u (mezi comobofix a /u musí být mezera) a dej Ok.

Pár souborů co bylo modifikováno bylo upraveno do původní podoby, takže by s tím neměl být problém.

MSConfig by jsi měl normálně spustit i takto:
Start -> Spustit... a napiš do okna msconfig a dej Ok a otevře se ti jeho okno

Jsou tam ještě nějaké drobné modifikace v registrech u toho msconfig.

Když spustíš MSConfig a přepneš se na záložku Obecné tak máš nastaveno asi Výběrové spuštění? nebo Normální spuštění.

Pokud máš problémy se spouštěním některých programů, které máš nainstalované tak bude potřeba je přeinstalovat.

[Lance]

Msconfig mi touto cestou nejde spustit, protože mi ho myslím Vundofix umístil do karantény. Musím si ho vždy najít ručně...

[fredik]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok)
Zkopíruj do něj následující text označený zeleně:

Kód: Vybrat vše

@echo off
set mvyp=C:\msc.txt
if exist %mvyp% del %mvyp%

cd\
echo ------------- VypAdr ------------- >> %mvyp%
dir /s /a /-p /o:gen "C:\WINDOWS\PCHEALTH\HELPCTR\Binaries" >> %mvyp%
echo ------------- VypSou ------------- >> %mvyp%
dir c:\msconfig???.exe /a h /s >> %mvyp%
start notepad %mvyp%

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: vyp.bat
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu a spusť ho.
Zobrazí se ti log tak ho sem vlož.

*****************************************************************************************************************************************

Jdi přes Start -> Spustit... a napiš do okna tento příkaz označený modře:
regedit /e "%userprofile%\Plocha\regkey.txt" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"
a dej Ok Na ploše se ti objeví soubor regkey.txt tak sem vlož jeho obsah.