install_temp_318

[fredik]

Použij znovu ADS Spy:
- spusť ho a proveď znovu Scan
- po proběhnutí kontroly zatrhni/zaškrtni políčko (čtverec) před touto položkou:
C:\WINDOWS\system32\svchost.exe : ext.exe (28160 bytes)
- pak klikneš na tlačítko: Remove selected
Po té spusť znovu Scan a po proběhnutí sem vlož nový log.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Spusť znovu OTMoveIt2 a tentokrát tam vlož toto:
- Do prvního horního levého sloupce (Paste Standard List of Files/Folders to Move) zkopíruj tyto cesty:

Kód: Vybrat vše

C:\WINDOWS\system32\winccf32.dll
C:\WINDOWS\system32\winjks32.dl
C:\WINDOWS\system32\winuns32.dll
C:\WINDOWS\Temp\win1E.exe

- Po zkopírování klikni na tlačítko MoveIt! a vlož sem následně celý obsah z pravého sloupce, jinak uložený ve složce C:\_OTMoveIt\MovedFiles\, který bude informovat o výsledcích
- Je možné, že pokud nebudou moci být soubory odstraněny, budeš dotázán na restart počítače, v tom případě restart potvrď

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Stáhni si a spusť T-cleaner, odstraní zálohy a pozůstatky použitých programů.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Vlož sem pak nový log z:
- ADS Spy
- OTMoveIt2

Ten nový test pomocí Kasperského udělej až po provedení všech kroků a log z OTMoveIt sem vlož ještě před použitím T-cleaner.

[Reklama]

[honza1007]

Vsechno jsem udelal dle navodu, a posilam slibene logy.

C:\WINDOWS\Cursors\arrow_n.cur : NEDTA.DAT (6144 bytes)



DllUnregisterServer procedure not found in C:\WINDOWS\system32\winccf32.dll
C:\WINDOWS\system32\winccf32.dll NOT unregistered.
C:\WINDOWS\system32\winccf32.dll moved successfully.
File/Folder C:\WINDOWS\system32\winjks32.dl not found.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\winuns32.dll
C:\WINDOWS\system32\winuns32.dll NOT unregistered.
C:\WINDOWS\system32\winuns32.dll moved successfully.
C:\WINDOWS\Temp\win1E.exe moved successfully.

OTMoveIt2 v1.0.20 log created on 03022008_090520



Ted spustim T-cleaner a potom Kasperskeho.

[honza1007]

T-cleaner vymazal soubory ktere vytvorily nektere spustene pgm.
a Kaspersky se konecne dodelal, tak posilam jeho log:



-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, March 02, 2008 3:46:51 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 2/03/2008
Kaspersky Anti-Virus database records: 546324
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\

Scan Statistics:
Total number of scanned objects: 114967
Number of viruses found: 5
Number of infected objects: 8
Number of suspicious objects: 0
Duration of the scan process: 02:33:10

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Data aplikací\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\LiveUpdate\2008-03-02_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SPBBC\BBConfig.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SPBBC\BBDebug.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SPBBC\BBDetect.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SPBBC\BBNotify.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SPBBC\BBRefr.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SPBBC\BBSetCfg.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SPBBC\BBSetCfg2.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SPBBC\BBSetDev.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SPBBC\BBSetLoc.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SPBBC\BBSetUsr.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SPBBC\BBStHash.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SPBBC\BBValid.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SPBBC\SPPolicy.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SPBBC\SPStart.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SPBBC\SPStop.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SRTSP\SrtErEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SRTSP\SrtETmp\32980ED9.TMP Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SRTSP\SrtMoEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SRTSP\SrtNvEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SRTSP\SrtScEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SRTSP\SrtTxFEvt.log Object is locked skipped
C:\Documents and Settings\All Users\Data aplikací\Symantec\SRTSP\SrtViEvt.log Object is locked skipped
C:\Documents and Settings\Bingo\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Bingo\Local Settings\Data aplikací\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Bingo\Local Settings\Data aplikací\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Bingo\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Bingo\Local Settings\History\History.IE5\MSHist012008030220080303\index.dat Object is locked skipped
C:\Documents and Settings\Bingo\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Bingo\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Bingo\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Data aplikací\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Data aplikací\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Data aplikací\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Data aplikací\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\5JY6WUZ7\802002[1].exe Infected: Backdoor.Win32.Agent.esy skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\5JY6WUZ7\802002[2].exe Infected: Backdoor.Win32.Agent.esy skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\WLI709MJ\8020zh[1].exe Infected: Backdoor.Win32.Agent.esy skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\NFWEVT.LOG Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\system32\winjks32.dll Infected: Trojan.Win32.Dialer.yz skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\_restore{F3E7B893-D6EF-4D8D-B3AF-3607D87E456A}\RP5\A0001393.exe Infected: Trojan-Downloader.Win32.Small.gl skipped
F:\System Volume Information\_restore{F3E7B893-D6EF-4D8D-B3AF-3607D87E456A}\RP5\A0001960.exe Infected: Trojan-Downloader.Win32.Small.iq skipped
G:\Programy\Nové\Nejnovejsi!!\Nová složka\Norton antivirus 2007\NortonAntivirus2007.iso/NAV071400.exe Infected: Trojan-Downloader.Win32.Agent.ayi skipped
G:\Programy\Nové\Nejnovejsi!!\Nová složka\Norton antivirus 2007\NortonAntivirus2007.iso ISOimage: infected - 1 skipped
G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.

[fredik]

Použij znovu OTMoveIt a tentokrát tam vlož toto:
- Do prvního horního levého sloupce (Paste Standard List of Files/Folders to Move) zkopíruj tyto cesty:

Kód: Vybrat vše

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\5JY6WUZ7\802002[1].exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\5JY6WUZ7\802002[2].exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\WLI709MJ\8020zh[1].exe
C:\WINDOWS\system32\winjks32.dll

- Po zkopírování klikni na tlačítko MoveIt! a vlož sem následně celý obsah z pravého sloupce, jinak uložený ve složce C:\_OTMoveIt\MovedFiles\, který bude informovat o výsledcích
- Je možné, že pokud nebudou moci být soubory odstraněny, budeš dotázán na restart počítače, v tom případě restart potvrď

G:\Programy\Nové\Nejnovejsi!!\Nová složka\Norton antivirus 2007\NortonAntivirus2007.iso
Toto Iso nortona bych byt tebou smazal. Pokud máš nainstalovaný i NAV z něho tak bych ti doporučil ho odinstalovat a pokud nechceš investovat nějaké finance do antiviru, tak sáhnout po některém z produktů, které jsou nabízeny zdarma.

Pokud máš ještě ComboFix, tak ho smaž a stáhni si ho znovu a ulož si ho na plochu:
Spusť ho znovu. Pokud by neproběhl až do konce, spusť ho v nouzovém režimu.
Restartuj do nouzového režimu a spusť ho tam. Vlož sem pak z něho log.

[honza1007]

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\5JY6WUZ7\802002[1].exe moved successfully.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\5JY6WUZ7\802002[2].exe moved successfully.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\WLI709MJ\8020zh[1].exe moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\winjks32.dll
C:\WINDOWS\system32\winjks32.dll NOT unregistered.
C:\WINDOWS\system32\winjks32.dll moved successfully.

OTMoveIt2 v1.0.20 log created on 03042008_071735






ComboFix 08-03-04.2 - Bingo 2008-03-04 7:20:26.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.518 [GMT 1:00]
Running from: C:\Documents and Settings\Bingo\Plocha\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\hrpdcf.bin
C:\WINDOWS\system32\kl80.bin

.
((((((((((((((((((((((((( Files Created from 2008-02-04 to 2008-03-04 )))))))))))))))))))))))))))))))
.

2008-03-04 07:17 . 2008-03-04 07:17 <DIR> d-------- C:\_OTMoveIt
2008-03-04 07:16 . 2008-03-04 07:16 290,816 --a------ C:\OTMoveIt2.exe
2008-03-02 09:10 . 2008-03-02 09:10 241 --a------ C:\Documents and Settings\Bingo\SR.vbs
2008-02-29 20:08 . 2008-02-29 20:08 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-28 17:34 . 2008-01-12 18:32 23,904 --a------ C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-02-28 17:34 . 2008-01-15 09:54 10,537 --a------ C:\WINDOWS\system32\drivers\COH_Mon.cat
2008-02-28 17:34 . 2008-01-15 05:28 706 --a------ C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-02-27 11:22 . 2008-02-28 10:34 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-02-27 11:22 . 2008-02-27 11:22 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-25 22:09 . 2008-02-25 22:09 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-25 19:17 . 2008-02-25 19:17 <DIR> d-------- C:\Documents and Settings\Bingo\kbpki
2008-02-23 16:11 . 2008-02-23 16:18 <DIR> d-------- C:\Program Files\RegCleaner
2008-02-23 15:33 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-23 15:33 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-02-23 15:33 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-23 15:33 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-02-23 15:24 . 2008-02-23 15:24 <DIR> d-------- C:\Program Files\ScanSoft
2008-02-23 15:24 . 2008-02-23 15:24 <DIR> d-------- C:\Program Files\Common Files\ScanSoft Shared
2008-02-23 15:24 . 2008-02-23 15:24 412 --a------ C:\WINDOWS\MAXLINK.INI
2008-02-23 15:23 . 2008-02-23 15:24 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-02-23 15:22 . 2008-02-23 15:22 <DIR> d-------- C:\Program Files\Common Files\CANON
2008-02-23 15:19 . 2008-02-23 15:19 <DIR> d--h----- C:\WINDOWS\system32\CanonIJ Uninstaller Information
2008-02-23 15:19 . 2008-02-23 15:19 <DIR> d--h----- C:\Program Files\CanonBJ
2008-02-23 15:19 . 2007-03-23 08:30 1,400,832 --a------ C:\WINDOWS\system32\CNC210C.DLL
2008-02-23 15:19 . 2007-03-18 21:00 215,040 --a------ C:\WINDOWS\system32\CNMLM8S.DLL
2008-02-23 15:19 . 2007-03-19 02:16 200,704 --a------ C:\WINDOWS\system32\CNC210L.DLL
2008-02-23 15:19 . 2007-03-15 06:12 188,416 --a------ C:\WINDOWS\system32\CNC210O.DLL
2008-02-23 15:19 . 2007-03-23 08:29 98,304 --a------ C:\WINDOWS\system32\CNC210I.DLL
2008-02-23 15:18 . 2008-02-23 15:34 <DIR> d-------- C:\Program Files\Canon
2008-02-23 10:15 . 2008-02-23 10:15 <DIR> d-------- C:\Program Files\Lavasoft
2008-02-22 16:50 . 2008-02-22 16:50 <DIR> d---s---- C:\Documents and Settings\Bingo\UserData
2008-02-21 18:41 . 2008-02-27 11:58 7 --a------ C:\WINDOWS\system32\ngxt.bin
2008-02-21 18:33 . 2008-02-21 18:38 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-21 17:46 . 2008-02-21 17:46 <DIR> d-------- C:\WINDOWS\Sun
2008-02-20 19:00 . 2008-02-20 19:00 <DIR> d-------- C:\stare certifikaty
2008-02-20 19:00 . 2008-02-20 19:00 <DIR> d-------- C:\KBcertifikat
2008-02-20 18:56 . 2008-02-20 18:56 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-02-20 18:54 . 2008-02-20 18:54 <DIR> d-------- C:\WINDOWS\Cache
2008-02-20 18:41 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-02-20 18:40 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-20 18:40 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-02-18 19:04 . 1999-11-10 11:05 86,016 --a------ C:\WINDOWS\unvise32qt.exe
2008-02-17 19:58 . 2008-02-17 19:58 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-02-17 19:58 . 2008-02-17 19:58 <DIR> d-------- C:\Program Files\Ahead
2008-02-17 19:58 . 2004-07-26 16:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
2008-02-17 19:58 . 2004-07-26 16:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
2008-02-17 19:58 . 2004-07-26 16:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
2008-02-17 19:58 . 2004-07-26 16:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll
2008-02-17 19:58 . 2001-07-09 10:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-02-17 19:58 . 2004-03-02 16:37 125,184 --------- C:\WINDOWS\system32\drivers\imagesrv.sys
2008-02-17 19:58 . 2000-06-26 10:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2008-02-17 19:58 . 2004-03-02 16:37 5,504 --------- C:\WINDOWS\system32\drivers\imagedrv.sys
2008-02-17 19:45 . 1998-10-09 17:04 327,168 --a------ C:\WINDOWS\IsUn0405.exe
2008-02-14 06:49 . 2008-02-14 06:49 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-02-14 06:49 . 2008-02-14 06:49 <DIR> d-------- C:\Program Files\Common Files\ACD Systems
2008-02-14 06:49 . 2008-02-14 06:49 <DIR> d-------- C:\Program Files\ACD Systems
2008-02-13 19:26 . 2008-02-13 19:29 10,740 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-02-13 19:26 . 2008-02-13 19:29 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-02-13 19:24 . 2008-02-13 19:24 <DIR> d-------- C:\Program Files\Codec Pack - All In 1
2008-02-13 19:24 . 2008-02-13 19:23 737,280 --a------ C:\WINDOWS\iun6002.exe
2008-02-13 19:21 . 2008-02-13 19:21 <DIR> d-------- C:\Program Files\CyberLink
2008-02-13 18:48 . 2004-08-17 14:49 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-02-13 18:48 . 2008-03-03 17:15 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-02-13 18:35 . 2008-02-28 17:35 <DIR> d-------- C:\Program Files\Norton AntiVirus
2008-02-13 18:34 . 2008-02-13 19:29 <DIR> d-------- C:\Program Files\Symantec
2008-02-13 18:34 . 2008-02-28 22:43 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-02-13 18:34 . 2008-02-13 19:29 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-02-13 18:34 . 2008-02-13 19:29 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-04 06:21 --------- d-----w C:\Program Files\DC++nove
2008-02-21 16:59 --------- d-----w C:\Program Files\DAEMON Tools
2008-02-21 16:47 14,336 ----a-w C:\WINDOWS\system32\svchost.exe
2008-02-17 18:51 --------- d-----w C:\Program Files\Common Files\Nero
2008-02-13 12:37 --------- d-----w C:\Program Files\DC++
2008-02-13 12:12 --------- d-----w C:\Program Files\Java
2008-02-13 12:12 --------- d-----w C:\Program Files\Common Files\Java
2008-02-13 12:08 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-13 12:06 --------- d-----w C:\Program Files\C-Media 3D Audio
2008-02-13 11:55 --------- d-----w C:\Program Files\microsoft frontpage
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-17 14:49 15360]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-29 16:09 171464]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 01:04 1415824]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06 1318912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 03:23 75520]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-09-03 03:04 84640]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2006-09-05 21:22 26248]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-01-08 22:26 68640]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 22:17 52256]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"CanonSolutionMenu"="C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 17:01 644696]
"CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 17:50 1603152]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-17 14:49 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mplink]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winjks32]
winjks32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

R2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 07:49]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-03 22:04]
S3 SetupNTGLM7X;SetupNTGLM7X;J:\NTGLM7X.sys []

.
Contents of the 'Scheduled Tasks' folder
"2008-02-29 19:18:51 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Bingo.job"
- C:\PROGRA~1\NORTON~1\Navw32.exee/TASK:
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-04 07:23:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\RunDll32.exe
.
**************************************************************************
.
Completion time: 2008-03-04 7:24:33 - machine was rebooted [Bingo]
ComboFix-quarantined-files.txt 2008-03-04 06:24:27




Vsechno probehlo uspesne a bez preruseni. Odstranil jsem i toho Nortona.

[fredik]

Použij znovu OTMoveIt a tentokrát tam vlož toto:
- Do prvního horního levého sloupce (Paste Standard List of Files/Folders to Move) zkopíruj tuto cestu:

Kód: Vybrat vše

C:\WINDOWS\system32\ngxt.bin

A použij ho již známým způsobem a vlož sem z něho log.

*********************************************************************************************************

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok)
Zkopíruj do něj následující text označený zeleně:

Kód: Vybrat vše

REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mplink]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winjks32]

Pak dej Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: fix.reg
Uložit jako typ: tak tam vyber Všechny soubory
Ulož si daný soubor na plochu
Na ploše by se měl objevit soubor fix.reg spusť ho vyskočí hláška kde odklikni Ano poté je další hláška kde odklikni OK

**********************************************************************************************************

Vlož sem pak zároveň s logem z OTMoveIt2 i nový log z HJT.
Řekni pak jestli máš ještě nějaké problémy?

[honza1007]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:19:51, on 5.3.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Documents and Settings\Bingo\Plocha\HiJack This\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.seznam.cz/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/ka ... nicode.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.5.0_11) -
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 6597 bytes






C:\WINDOWS\system32\ngxt.bin moved successfully.

OTMoveIt2 v1.0.20 log created on 03052008_221727




Pocitac se tvari bezvadne, uz mi to nic neposila a ani se mi neobjevuje ve slozkach ta proklata slozka

install temp. Moc ti dekuju mas zlaty rucicky! Honza

[fredik]

Jdi přes Start -> Spustit... a napiš do okna tento příkaz označený modře ComboFix /u (mezi comobofix a /u musí být mezera) a dej Ok.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Spusť znovu HijackThis a zaškrtni v něm okénka před řádky:
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.5.0_11) -
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -
po zaškrtnutí klikni na tlačítko Fix Checked

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Pro lepší zabezpečení by bylo dobré si doinstalovat firewall, můžeš si vybrat některý zde uvedený nebo některý jiný z odkazu: Přehled osobních firewallů
Firewally zdarma:
Comodo - kvalitní, pokročilý, s mnoha funkcemi, originálně v angličtině
Kerio - přehledný, větší možnosti nastavení, náročnější na systémové prostředky, v češtině
ZoneAlarm - jednoduchý, kompatibilní, nenáročný na systémové prostředky, málo možností nastavení, v angličtině

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Doporučil bych ti také aktualizovat Javu:
- Stáhni si poslení verzi Java Runtime Environment (JRE) 6 Update 5
- Posuň se dolů kde je napsáno Java Runtime Environment (JRE) 6 Update 5 a klikni na tlačítko Download
- Zatrhni možnost kde je napsáno: Accept License Agreement
- Stránka se ti znovu načte.
- Klikni na odkaz pro stažení: Windows Offline Installation, Multi-language a ulož si ho na disk
- Ukonči běžící programy které máš spuštěné, hlavě webový prohlížeč
- Jdi přes Start -> Ovládací panely -> Přidat nebo odebrat programy a odinstaluj všechny staré verze Javy
- Podívej se po položkách s názvem Java Runtime Environment (JRE or J2SE)
* příklady starých verzí v Přidat nebo odebrat programy:

J2SE Runtime Environment 5.0
J2SE Runtime Environment 5.0 Update 8
Java 2 Runtime Environment, SE v1.4.2

- Odinstaluj je přes tlačítko Změnit nebo odebrat nebo Odebrat
- Odinstaluj postupně po sobě případné všechny staré verze Javy
- Po skončení odinstalovaní restartuj Pc.
- Pak už jen spusť instalaci poslední verze ze souboru jre-6u5-windows-i586-p.exe, který sis stáhl na začátku.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Vypni obnovu systému:
Jdi přes Start -> Spustit... a napiš do okna tento příkaz označený modře: control sysdm.cpl,,4
- Otevře se ti okno na záložce Obnovení systému a tam zaškrtni možnost Vypnout nástroj Obnova systému na všech jednotkách a klikni na tlačítko Ok.

Spusť znovu OTMoveIt2 a klikni na tlačítko CleanUp!. Zeptá se tě na začátek čištění tak zvol Yes. Pak se tě ještě jednou zeptá na povolení restartu tak zvol znovu Yes.

Po najetí zpět do Win. si můžeš zapnout Obnovu systému zpět.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Pokud už nemáš žádné další problémy tak by to bylo vše. Nemáš za co