odstranit antivirus 2009

[solky]

Ako ho mam odstanit sakra

[Reklama]

[solky]

tu je log
ComboFix 08-11-01.06 - solkyuser 2008-11-02 16:36:50.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.1400 [GMT 1:00]
Spuštěný z: C:\Documents and Settings\solkyuser\Plocha\ComboFix.exe
* Vytvořen nový Bod Obnovení
* Resident AV is active

.
Tyto soubory byly během aplikování deaktivovány:
C:\Program Files\Spyware Doctor\tools\swpg.dat
C:\Program Files\Spyware Doctor\Tools\eg.dat
C:\Program Files\Spyware Doctor\Tools\klg.dat


((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Antivirus 2009
C:\Program Files\Antivirus 2009\av2009.exe
C:\WINDOWS\system32\ieupdates.exe.tmp
D:\Autorun.inf

.
((((((((((((((((((((((((( Soubory vytvořené od 2008-10-02 do 2008-11-02 )))))))))))))))))))))))))))))))
.

2008-11-02 16:14 . 2008-11-02 16:14 <DIR> d-------- C:\Program Files\Trend Micro
2008-10-26 18:17 . 2008-10-26 18:17 <DIR> d-------- C:\WINDOWS\system32\msmq
2008-10-26 18:17 . 2008-10-26 18:17 <DIR> d-------- C:\WINDOWS\system32\Logfiles
2008-10-26 18:17 . 2008-10-26 18:17 <DIR> d-------- C:\Inetpub
2008-10-26 18:12 . 2008-10-26 18:12 <DIR> d---s---- C:\Documents and Settings\solkyuser\UserData
2008-10-26 17:36 . 2008-10-26 17:36 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-10-26 17:20 . 2008-10-26 17:20 <DIR> d-------- C:\WINDOWS\system32\cs-cz
2008-10-26 16:59 . 2008-10-26 17:12 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-10-26 16:58 . 2008-08-14 14:46 2,182,528 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-26 16:58 . 2008-08-14 14:46 2,138,112 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-26 16:58 . 2008-08-14 14:46 2,059,904 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-26 16:58 . 2008-08-14 14:46 2,017,792 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-23 15:28 . 2008-10-23 15:28 <DIR> d-------- C:\ProgramData
2008-10-23 15:27 . 2008-10-23 15:27 <DIR> d-------- C:\Documents and Settings\solkyuser\Data aplikací\Leadertech
2008-10-23 15:11 . 2008-10-23 15:11 <DIR> d-------- C:\Program Files\EA Sports
2008-10-19 19:56 . 2008-10-19 19:56 <DIR> d-------- C:\Program Files\VideoLAN
2008-10-19 19:56 . 2008-10-19 19:56 <DIR> d-------- C:\Documents and Settings\solkyuser\Data aplikací\vlc
2008-10-17 15:51 . 2008-10-26 20:41 8,192 --ahs---- C:\WINDOWS\Thumbs.db
2008-10-17 09:20 . 2008-10-17 09:20 <DIR> d-------- C:\Documents and Settings\solkyuser\Data aplikací\Media Player Classic
2008-10-15 19:15 . 2008-10-15 19:15 <DIR> d-------- C:\67f8d7419c948740b384f32fd52c7c61
2008-10-14 09:24 . 2004-08-17 14:45 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-10-14 09:24 . 2004-08-17 14:45 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-10-14 09:22 . 2004-08-17 14:49 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-10-14 09:22 . 2004-08-17 14:49 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-10-14 09:21 . 2004-08-03 22:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-10-14 09:21 . 2004-08-03 22:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-10-07 10:48 . 2008-10-07 10:48 <DIR> d-------- C:\Program Files\DAEMON Tools
2008-10-07 10:44 . 2008-10-07 10:44 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-10-06 09:12 . 2008-10-06 09:12 <DIR> d-------- C:\Program Files\ESET
2008-10-04 11:08 . 2008-10-04 11:08 <DIR> d-------- C:\Documents and Settings\LocalService\Data aplikací\Ahead

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-02 14:04 --------- d---a-w C:\Documents and Settings\All Users\Data aplikací\TEMP
2008-10-26 20:05 --------- d-----w C:\Documents and Settings\solkyuser\Data aplikací\ICQ
2008-10-23 14:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-23 14:28 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-10-20 18:15 --------- d-----w C:\Documents and Settings\solkyuser\Data aplikací\Ahead
2008-10-20 14:12 --------- d-----w C:\Program Files\Google
2008-10-19 18:58 --------- d-----w C:\Program Files\The KMPlayer
2008-09-24 06:08 --------- d-----w C:\Program Files\ICQ6
2008-09-23 15:18 --------- d-----w C:\Program Files\Webteh
2008-09-23 09:25 --------- d-----w C:\Program Files\devnz
2008-09-18 17:38 --------- d-----w C:\Program Files\DivX
2008-09-16 13:45 --------- d-----w C:\Documents and Settings\solkyuser\Data aplikací\DivX
2008-09-15 16:00 --------- d-----w C:\Program Files\Spyware Doctor
2008-09-15 15:40 1,846,016 ----a-w C:\WINDOWS\system32\win32k.sys
2008-09-07 13:04 --------- d-----w C:\Documents and Settings\solkyuser\Data aplikací\Sports Interactive
2008-09-07 12:48 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-09-07 12:48 --------- d--h--r C:\Documents and Settings\solkyuser\Data aplikací\SecuROM
2008-09-07 12:47 --------- d--h--w C:\Program Files\Zero G Registry
2008-09-06 13:44 --------- d-----w C:\Program Files\MyPhoneExplorer
2008-09-06 13:44 --------- d-----w C:\Documents and Settings\solkyuser\Data aplikací\AD ON Multimedia
2008-09-06 13:33 --------- d-----w C:\Program Files\CONEXANT
2008-09-05 20:39 --------- d-----w C:\Documents and Settings\solkyuser\Data aplikací\CyberLink
2008-09-05 20:39 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\CyberLink
2008-09-05 20:38 505,128 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-09-05 20:38 353,576 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-09-05 20:35 --------- d-----w C:\Program Files\AVSMedia
2008-09-05 20:33 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-09-05 20:08 --------- d-----w C:\Program Files\Codec Pack - All In 1
2008-09-05 20:07 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-09-05 17:52 --------- d-----w C:\Program Files\ICQ6Toolbar
2008-09-05 17:52 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\ICQ
2008-09-05 16:45 --------- d-----w C:\Documents and Settings\solkyuser\Data aplikací\PC Tools
2008-09-05 16:43 --------- d-----w C:\Program Files\Winamp
2008-09-05 16:42 64,048 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-09-05 16:42 6,120 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-09-05 16:42 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-09-05 16:36 --------- d-----w C:\Program Files\SRSLabs
2008-09-05 16:36 --------- d-----w C:\Program Files\Common Files\SRS
2008-09-05 16:32 --------- d-----w C:\Program Files\Common Files\Ahead
2008-09-05 16:31 --------- d-----w C:\Program Files\Nero
2008-09-05 16:25 --------- d-----w C:\Program Files\Common Files\Adobe
2008-09-05 16:24 --------- d-----w C:\Documents and Settings\solkyuser\Data aplikací\ACD Systems
2008-09-05 16:23 10,368 ----a-w C:\WINDOWS\system32\drivers\pfc.sys
2008-09-05 16:23 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-09-05 16:23 --------- d-----w C:\Program Files\ACD Systems
2008-09-05 16:23 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\ACD Systems
2008-09-05 16:19 --------- d-----w C:\Program Files\Microsoft.NET
2008-09-05 16:19 --------- d-----w C:\Program Files\Microsoft Works
2008-09-05 00:11 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\ESET
2008-09-05 00:08 --------- d-----w C:\Program Files\Intel
2008-09-05 00:07 --------- d-----w C:\Documents and Settings\solkyuser\Data aplikací\InstallShield
2008-09-04 23:59 --------- d-----w C:\Program Files\Synaptics
2008-09-04 23:36 --------- d-----w C:\Program Files\Hewlett-Packard
2008-09-04 23:17 --------- d-----w C:\Program Files\microsoft frontpage
2008-09-04 22:22 1,548,288 ----a-w C:\WINDOWS\system32\sfcfiles.dll
2008-09-04 22:19 1,245,184 ----a-w C:\WINDOWS\system32\syssetup.dll
2008-08-20 05:38 660,480 ----a-w C:\WINDOWS\system32\wininet.dll
2008-08-14 13:46 2,138,112 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 13:46 2,017,792 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
.

------- Sigcheck -------

2004-08-17 14:49 974848 4d32d7ffc2f583fe21ef0a4f99eabb12 C:\WINDOWS\explorer.exe
2008-04-14 04:22 1034240 27afd587c462e280ee046b8cca3c2cd1 C:\WINDOWS\SoftwareDistribution\Download\1dab8d41b73a912c39f7d3fd77a4df39\explorer.exe
2004-08-17 14:49 974848 4d32d7ffc2f583fe21ef0a4f99eabb12 C:\WINDOWS\system32\dllcache\explorer.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 139264]
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" [2008-09-15 2115728]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-30 68856]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 167368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-09-18 141848]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-09-18 166424]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-09-18 137752]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-14 102400]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-06-10 1447168]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" [2008-09-15 2115728]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2004-08-17 C:\WINDOWS\system32\advpack.dll]

C:\Documents and Settings\solkyuser\Nabˇdka Start\Programy\Po spuçtŘnˇ\
RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 630784]
TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 65536]
UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 180224]
Y'z Shadow.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 155648]

C:\Documents and Settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\ICQ6\\ICQ.exe"=
"C:\\Documents and Settings\\solkyuser\\Dokumenty\\ICQ\\395758161\\ReceivedFiles\\363973918 pines\\StrongDC.exe"=
"C:\\Documents and Settings\\solkyuser\\Dokumenty\\hry\\Warcraft III\\Warcraft III\\Warcraft III.exe"=

R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-06-10 34312]
R2 ICQ Service;ICQ Service;C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2008-06-10 222456]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-03 69120]

*Newly Created Service* - PROCEXP90
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKLM-Run-Media Codec Update Service - C:\Program Files\Essentials Codec Pack\update.exe


.
------- Doplňkový sken -------
.
FireFox -: Profile - C:\Documents and Settings\solkyuser\Data aplikací\Mozilla\Firefox\Profiles\j2s22bxv.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://uk.search.yahoo.com/search?ei=UT ... f-divxd&p=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://uk.yahoo.com/
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-02 16:38:09
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\C:\WINDOWS\TEMP\mc21.tmp"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

PROCES: C:\WINDOWS\system32\winlogon.exe
-> C:\Program Files\Spyware Doctor\tools\swpg.dat
-> C:\Program Files\Spyware Doctor\Tools\eg.dat
-> C:\Program Files\Spyware Doctor\Tools\klg.dat

PROCES: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Spyware Doctor\tools\swpg.dat
-> C:\Program Files\Spyware Doctor\Tools\eg.dat
-> C:\Program Files\Spyware Doctor\Tools\klg.dat

PROCES: C:\WINDOWS\system32\csrss.exe
-> C:\Program Files\Spyware Doctor\tools\swpg.dat
-> C:\Program Files\Spyware Doctor\Tools\eg.dat
-> C:\Program Files\Spyware Doctor\Tools\klg.dat
.
Celkový čas: 2008-11-02 16:39:10
ComboFix-quarantined-files.txt 2008-11-02 15:39:07

Před spuštěním: Volných bajtů: 38 967 431 168
Po spuštění: Volných bajtů: 39,608,754,176

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS
[operating systems]
D:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

212 --- E O F --- 2008-10-26 16:21:07

[jaro3]

Vítej na fóru PC-HELP!
Především se uklidni.
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
C:\WINNT\TEMP\mc21.tmp

Driver::
mchInjDrv

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

[solky]

Díky za pomoc vsetko funguje

[Tejky]

Ahoj mam stejny problem, lze pouzit vyse uvedeny postup i v pripade OS M Vista Enterprise? Diky za odpoved...

/založ si prosím nové téma. memphisto