samovolne vypinani pc a RAM 700MB

[junfan]

Ahoj,
vcera jsem navstivil warez stranky a stahl soubor ktery chtel prepsat winlogon.exe.. Samozrejme jsem dal zakazat a vse uzavrel.. Od te doby se mi pc vypina (ted zatim v poho) a vytizeni RAM je 700MB - drive jsem mel cca 250MB po startu.. take jsem si vsimnul noveho procesu reader_s.exe - neznam to.
Prosim o kazdou radu co s tim.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:41:28, on 6.3.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\junfan\reader_s.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: My-Tool Toolbar - {0e6d7a5d-b560-4d1c-9713-18dd1ade6011} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll
O3 - Toolbar: My-Tool Toolbar - {0e6d7a5d-b560-4d1c-9713-18dd1ade6011} - (no file)
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [reader_s] C:\WINDOWS\System32\reader_s.exe
O4 - HKCU\..\Run: [365dni] C:\Program Files\365dníNET\365dniNET.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [reader_s] C:\Documents and Settings\morff\reader_s.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [dbxnxsej.exe] C:\WINDOWS\dbxnxsej.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [dbxxnxpg.exe] C:\WINDOWS\dbxxnxpg.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 0903852000
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 0916758453
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe

--
End of file - 7473 bytes

[Reklama]

[jaro3]

Odinstaluj: ICQToolBar

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[junfan]

Malwarebytes' Anti-Malware 1.34
Verze databáze: 1825
Windows 5.1.2600 Service Pack 3

6.3.2009 20:22:33
mbam-log-2009-03-06 (20-22-29).txt

Typ skenu: Rychlý sken
Objektu skenováno: 77058
Uplynulý cas: 3 minute(s), 28 second(s)

Infikované procesy pameti: 1
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 3
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 11

Infikované procesy pameti:
C:\Documents and Settings\morff\reader_s.exe (Trojan.Agent) -> No action taken.

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reader_s (Trojan.FakeAlert.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reader_s (Trojan.FakeAlert.H) -> No action taken.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reader_s (Trojan.Agent) -> No action taken.

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
C:\Documents and Settings\morff\reader_s.exe (Trojan.FakeAlert.H) -> No action taken.
C:\WINDOWS\system32\reader_s.exe (Trojan.FakeAlert.H) -> No action taken.
C:\WINDOWS\system32\6.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\7.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\8.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\9.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\A.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\B.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\C.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\D.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\E.tmp (Trojan.Agent) -> No action taken.

[jaro3]

. Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Můžeš sem pak vložit log z MbAM.

Vypni rez. ochrany u ESS.
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[junfan]

Po kazdem restartu mi ESS najde a presune do karanteny: http:// (upraven odkaz na vir. memphisto) - varianta infiltrace Win32/kryptik.GT trojsky kun.

Malwarebytes' Anti-Malware 1.34
Verze databáze: 1825
Windows 5.1.2600 Service Pack 3

6.3.2009 20:32:47
mbam-log-2009-03-06 (20-32-47).txt

Typ skenu: Rychlý sken
Objektu skenováno: 77241
Uplynulý cas: 2 minute(s), 49 second(s)

Infikované procesy pameti: 1
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 3
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 11

Infikované procesy pameti:
C:\Documents and Settings\morff\reader_s.exe (Trojan.Agent) -> Unloaded process successfully.

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reader_s (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reader_s (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reader_s (Trojan.Agent) -> Quarantined and deleted successfully.

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
C:\Documents and Settings\morff\reader_s.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\reader_s.exe (Trojan.FakeAlert.H) -> Delete on reboot.
C:\WINDOWS\system32\6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\B.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.






ComboFix 09-03-04.01 - morff 2009-03-06 20:42:49.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1029.18.1023.514 [GMT 1:00]
Spuštěný z: c:\documents and settings\morff\Plocha\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated)
FW: ESET personal firewall *enabled*
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\morff\reader_s.exe
c:\windows\system32\9.tmp
c:\windows\system32\drivers\ntndis.sys
c:\windows\system32\reader_s.exe
F:\Autorun.inf

. . . je infikován!!

. . . je infikován!!

. . . je infikován!!

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-02-06 do 2009-03-06 )))))))))))))))))))))))))))))))
.

2009-03-06 20:51 . 2009-03-06 20:51 24,465 --a------ c:\windows\system32\A.tmp
2009-03-06 20:51 . 2009-03-06 20:51 80 --a------ c:\windows\system32\8.tmp
2009-03-06 20:35 . 2009-03-06 20:35 80 --a------ c:\windows\system32\7.tmp
2009-03-06 20:16 . 2009-03-06 20:16 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-03-06 20:16 . 2009-03-06 20:16 <DIR> d-------- c:\documents and settings\morff\Data aplikací\Malwarebytes
2009-03-06 20:16 . 2009-03-06 20:16 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2009-03-06 20:16 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-06 20:16 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-03-06 20:14 . 2009-03-06 20:14 24,465 --a------ c:\windows\system32\11.tmp
2009-03-06 16:58 . 2009-03-06 16:58 <DIR> d-------- c:\documents and settings\NetworkService\Plocha
2009-03-05 22:42 . 2009-03-05 22:42 29,184 --a------ c:\windows\fprxftzx.exe
2009-03-05 22:42 . 2009-03-05 22:42 0 --a------ c:\windows\system32\1E.tmp
2009-03-05 22:42 . 2009-03-05 22:42 0 --a------ c:\windows\system32\1D.tmp
2009-03-05 22:36 . 2009-03-05 22:36 33,280 --a------ c:\windows\system32\10.tmp
2009-03-05 22:36 . 2009-03-05 22:36 29,184 --a------ c:\windows\dbxxnxpg.exe
2009-03-05 22:36 . 2009-03-05 22:36 0 --a------ c:\windows\system32\13.tmp
2009-03-05 22:33 . 2009-03-05 22:33 29,184 --a------ c:\windows\dbxnxsej.exe
2009-03-05 22:33 . 2009-03-05 22:33 2,685 --a------ c:\windows\system32\11A.tmp
2009-03-05 22:33 . 2009-03-05 22:33 0 --a------ c:\windows\system32\11C.tmp
2009-03-05 21:16 . 2009-03-05 22:42 136,096 --a------ c:\windows\system32\drivers\ethaqmhs.sys
2009-03-05 21:16 . 2009-03-05 21:16 29,184 --a------ c:\windows\dbxkdvja.exe
2009-03-05 21:11 . 2009-03-05 21:11 0 --a------ c:\windows\system32\73.tmp
2009-03-05 20:47 . 2009-03-05 20:47 182,656 --a--c--- c:\windows\system32\dllcache\ndis.sys
2009-03-05 20:44 . 2009-03-05 20:44 23,013 --a------ c:\windows\system32\4EF.tmp
2009-03-05 20:42 . 2009-03-05 20:44 162,816 --a------ c:\windows\system32\4E9.tmp
2009-03-05 20:42 . 2009-03-05 20:42 124 --a------ c:\windows\system32\4E7.tmp
2009-03-01 15:53 . 2009-03-01 15:53 <DIR> d-------- c:\program files\Moyea
2009-03-01 15:53 . 2009-03-01 15:53 <DIR> d-------- c:\documents and settings\morff\Data aplikací\Moyea
2009-02-24 20:25 . 2009-02-24 20:26 <DIR> d-------- c:\program files\sdc222
2009-02-16 17:58 . 2009-02-16 18:43 <DIR> d-------- c:\program files\Belltech Business Card Designer Pro
2009-02-08 12:53 . 2009-01-02 14:43 <DIR> d-------- c:\documents and settings\Administrator\Plocha
2009-02-08 12:53 . 2009-01-02 14:43 <DIR> d--h----- c:\documents and settings\Administrator\Okolní tiskárny
2009-02-08 12:53 . 2009-01-02 14:43 <DIR> d--h----- c:\documents and settings\Administrator\Okolní síť
2009-02-08 12:53 . 2009-01-02 14:43 <DIR> d-------- c:\documents and settings\Administrator\Oblíbené položky
2009-02-08 12:53 . 2009-01-02 13:57 <DIR> d--h----- c:\documents and settings\Administrator\Šablony
2009-02-08 12:53 . 2009-01-02 14:43 <DIR> dr------- c:\documents and settings\Administrator\Nabídka Start
2009-02-08 12:53 . 2009-01-02 14:43 <DIR> d-------- c:\documents and settings\Administrator\Dokumenty
2009-02-08 12:53 . 2009-01-02 14:43 <DIR> dr-h----- c:\documents and settings\Administrator\Data aplikací
2009-02-08 12:53 . 2009-03-06 16:53 <DIR> d-------- c:\documents and settings\Administrator
2009-02-08 12:49 . 2009-02-08 12:49 <DIR> d-------- c:\documents and settings\Guest\Data aplikací\ESET
2009-02-08 12:48 . 2009-01-02 14:43 <DIR> d-------- c:\documents and settings\Guest\Plocha
2009-02-08 12:48 . 2009-01-02 14:43 <DIR> d--h----- c:\documents and settings\Guest\Okolní tiskárny
2009-02-08 12:48 . 2009-01-02 14:43 <DIR> d--h----- c:\documents and settings\Guest\Okolní síť
2009-02-08 12:48 . 2009-02-08 12:49 <DIR> dr------- c:\documents and settings\Guest\Oblíbené položky
2009-02-08 12:48 . 2009-01-02 13:57 <DIR> d--h----- c:\documents and settings\Guest\Šablony
2009-02-08 12:48 . 2009-01-02 14:43 <DIR> dr------- c:\documents and settings\Guest\Nabídka Start
2009-02-08 12:48 . 2009-02-08 12:49 <DIR> dr------- c:\documents and settings\Guest\Dokumenty
2009-02-08 12:48 . 2009-02-08 12:49 <DIR> dr-h----- c:\documents and settings\Guest\Data aplikací
2009-02-08 12:48 . 2009-03-05 21:12 <DIR> d-------- c:\documents and settings\Guest
2009-02-07 20:21 . 2009-02-07 20:21 <DIR> d-------- c:\documents and settings\morff\Data aplikací\Samsung
2009-02-07 20:00 . 2006-05-03 22:53 174,592 --a------ c:\windows\system32\framedyn.dll
2009-02-07 19:57 . 2009-02-07 19:57 <DIR> d-------- c:\windows\system32\Samsung_USB_Drivers
2009-02-07 19:57 . 2005-08-30 01:49 94,000 --a------ c:\windows\system32\drivers\ssm_mdm.sys
2009-02-07 19:57 . 2005-08-30 01:47 58,320 --a------ c:\windows\system32\drivers\ssm_bus.sys
2009-02-07 19:57 . 2005-08-30 01:49 8,336 --a------ c:\windows\system32\drivers\ssm_mdfl.sys
2009-02-07 19:57 . 2005-08-30 01:49 6,176 --a------ c:\windows\system32\drivers\ssm_cmnt.sys
2009-02-07 19:57 . 2005-08-30 01:49 6,176 --a------ c:\windows\system32\drivers\ssm_cm.sys
2009-02-07 19:57 . 2005-08-30 01:47 5,840 --a------ c:\windows\system32\drivers\ssm_whnt.sys
2009-02-07 19:57 . 2005-08-30 01:47 5,840 --a------ c:\windows\system32\drivers\ssm_wh.sys
2009-02-07 19:57 . 2009-02-07 20:20 5,632 --a------ c:\windows\system32\drivers\StarOpen.sys
2009-02-07 19:57 . 2005-08-28 20:51 766 --a------ c:\windows\system32\Uninstall.ico
2009-02-07 19:56 . 2009-02-07 19:56 <DIR> d-------- c:\program files\Samsung

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-05 21:15 --------- d-----w c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2009-03-05 19:47 182,656 ----a-w c:\windows\system32\drivers\ndis.sys
2009-03-05 16:57 --------- d-----w c:\documents and settings\morff\Data aplikací\365dni
2009-03-02 20:31 138,184 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-03-01 15:54 --------- d-----w c:\documents and settings\All Users\Data aplikací\FLEXnet
2009-03-01 11:56 --------- d-----w c:\program files\ICQ6.5
2009-03-01 11:56 --------- d-----w c:\documents and settings\morff\Data aplikací\ICQ
2009-02-15 19:45 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-02-11 19:44 --------- d-----w c:\documents and settings\All Users\Data aplikací\Microsoft Help
2009-02-07 18:56 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-07 18:53 --------- d-----w c:\program files\Common Files\Adobe
2009-01-30 19:46 --------- d-----w c:\documents and settings\morff\Data aplikací\BSplayer
2009-01-24 16:57 64,160 ----a-w c:\windows\system32\drivers\Lbd.sys
2009-01-24 16:55 --------- dc-h--w c:\documents and settings\All Users\Data aplikací\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-24 16:48 --------- d-----w c:\documents and settings\All Users\Data aplikací\Lavasoft
2009-01-22 18:01 --------- d-----w c:\program files\MultiMail
2009-01-18 16:22 --------- d--h--r c:\documents and settings\morff\Data aplikací\SecuROM
2009-01-18 16:19 --------- d-----w c:\documents and settings\morff\Data aplikací\Leadertech
2009-01-18 16:10 --------- d-----w c:\program files\EA Games
2009-01-18 15:55 --------- d-----w c:\program files\GameHouse
2009-01-18 15:55 --------- d-----w c:\documents and settings\morff\Data aplikací\GameHouse
2009-01-15 21:35 --------- d-----w c:\program files\Electronic Arts
2009-01-15 21:35 --------- d-----w c:\program files\Common Files\InstallShield
2009-01-12 18:37 --------- d-----w c:\program files\WM Converter
2009-01-09 13:16 --------- d-----w c:\documents and settings\morff\Data aplikací\Nero
2009-01-08 19:25 --------- d-----w c:\program files\Common Files\Nero
2009-01-08 19:10 --------- d-----w c:\program files\Nero
2009-01-08 19:03 --------- d-----w c:\documents and settings\All Users\Data aplikací\Nero
2009-01-08 08:03 22,328 ----a-w c:\documents and settings\morff\Data aplikací\PnkBstrK.sys
2009-01-08 07:54 --------- d-----w c:\program files\Activision
2009-01-06 17:01 --------- d-----w c:\program files\Trend Micro
2009-01-06 16:25 --------- d-----w c:\documents and settings\morff\Data aplikací\Software Informer
2009-01-06 16:24 --------- d-----w c:\documents and settings\morff\Data aplikací\IObit
2009-01-06 15:58 --------- d-----w c:\documents and settings\All Users\Data aplikací\Sandlot Games
2009-01-06 15:57 --------- d-----w c:\documents and settings\All Users\Data aplikací\n7-89-o9-3r-4t-r9
2009-01-02 13:21 159,841 ----a-w c:\windows\Marsu-Fix Uninstaller.exe
.

------- Sigcheck -------

2004-08-18 13:00 182912 1df7f42665c94b825322fae71721130d c:\windows\$NtServicePackUninstall$\ndis.sys
2008-04-13 20:20 182656 1df7f42665c94b825322fae71721130d c:\windows\ServicePackFiles\i386\ndis.sys
2008-04-13 20:20 182656 1df7f42665c94b825322fae71721130d c:\windows\SoftwareDistribution\Download\50ce127b6bb5262be7f814de23be86b4\ndis.sys
2009-03-05 20:47 213120 1df7f42665c94b825322fae71721130d c:\windows\system32\dllcache\ndis.sys
2009-03-05 20:47 213120 1df7f42665c94b825322fae71721130d c:\windows\system32\drivers\ndis.sys

2008-04-14 04:22 1051648 6b779dcafc80621bac9f9874565d5535 c:\windows\explorer.exe
2004-08-18 13:00 1050112 3f19cedbe63d47356a51cae8f6d29aed c:\windows\$NtServicePackUninstall$\explorer.exe
2008-04-14 04:22 1051648 0776dd339c556f960479c2da396d2f71 c:\windows\ServicePackFiles\i386\explorer.exe
2008-04-14 04:22 1051648 abfdad25a547ae1f2726b3ccb76934bc c:\windows\SoftwareDistribution\Download\50ce127b6bb5262be7f814de23be86b4\explorer.exe

2004-08-18 13:00 32768 c0e518c5efbae4a5c85b8441172cd2d0 c:\windows\$NtServicePackUninstall$\ctfmon.exe
2008-04-14 04:22 32768 4f5235b1ff2263def5e4d4c30cf8bf33 c:\windows\ServicePackFiles\i386\ctfmon.exe
2008-04-14 04:22 32768 314c2d5b1ce44bbbca2ea0b66ec5dc83 c:\windows\SoftwareDistribution\Download\50ce127b6bb5262be7f814de23be86b4\ctfmon.exe
2008-04-14 04:22 32768 365544d518ba869bf4366e2136a82793 c:\windows\system32\ctfmon.exe

2004-08-18 13:00 75264 6b44f97ac5974d6d67acf9c8f85cc23a c:\windows\$NtServicePackUninstall$\spoolsv.exe
2008-04-14 04:22 75264 ff90a709f9a7c3bafb537eb206eb240d c:\windows\ServicePackFiles\i386\spoolsv.exe
2008-04-14 04:22 75264 e387bd0828634c9e264f01cf199e27be c:\windows\SoftwareDistribution\Download\50ce127b6bb5262be7f814de23be86b4\spoolsv.exe
2008-04-14 04:22 75264 2105cb77a16b161ec9e3ceb154497eae c:\windows\system32\spoolsv.exe

2004-08-18 13:00 41984 5a26f8467b3ea2d2f504d508350815e7 c:\windows\$NtServicePackUninstall$\userinit.exe
2008-04-14 04:22 43520 51d339b7368d9f6d787efee246abb7bb c:\windows\ServicePackFiles\i386\userinit.exe
2008-04-14 04:22 43520 864dc79f0c3e143de3f8645c9eb57966 c:\windows\SoftwareDistribution\Download\50ce127b6bb5262be7f814de23be86b4\userinit.exe
2008-04-14 04:22 43520 8d44dc140ea75044d6856be524b85b0b c:\windows\system32\userinit.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"365dni"="c:\program files\365dníNET\365dniNET.exe" [2007-01-06 774144]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 32768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-03-13 1443072]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"nwiz"="nwiz.exe" [2007-12-05 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-30 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 32768]
"dbxkdvja.exe"="c:\windows\dbxkdvja.exe" [2009-03-05 29184]
"dbxnxsej.exe"="c:\windows\dbxnxsej.exe" [2009-03-05 29184]
"dbxxnxpg.exe"="c:\windows\dbxxnxpg.exe" [2009-03-05 29184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\explorer.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.iac2"= c:\progra~1\ACEMEG~1\SystemS\Intel\iac25_32.ax
"msacm.sl_anet"= c:\progra~1\ACEMEG~1\SystemS\sl_anet.acm
"vidc.yv12"= c:\progra~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL
"vidc.divx"= c:\progra~1\ACEMEG~1\SystemS\DivX\DivX520.dll
"vidc.iyuv"= c:\progra~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll
"vidc.yvu9"= c:\progra~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll
"vidc.uyvy"= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yuy2"= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yvyu"= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"msacm.msaudio1"= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-01-24 64160]
R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2008-03-13 472320]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2004-08-18 69120]
S1 ethaqmhs;ethaqmhs;c:\windows\system32\drivers\ethaqmhs.sys [2009-03-05 136096]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096]
.
Obsah adresáře 'Naplánované úlohy'

2009-03-02 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-31 17:57]

2009-03-05 c:\windows\Tasks\HP Usg Daily.job
- c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\pexpress\hphped05.exe [2004-06-07 06:35]
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

URLSearchHooks-{0e6d7a5d-b560-4d1c-9713-18dd1ade6011} - (no file)
Toolbar-{0e6d7a5d-b560-4d1c-9713-18dd1ade6011} - (no file)
WebBrowser-{0E6D7A5D-B560-4D1C-9713-18DD1ADE6011} - (no file)
HKLM-Run-reader_s - c:\windows\System32\reader_s.exe
HKU-Default-Run-reader_s - c:\documents and settings\morff\reader_s.exe


.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: microsoft.com\update
Trusted Zone: microsoft.com\windowsupdate
FF - ProfilePath - c:\documents and settings\morff\Data aplikací\Mozilla\Firefox\Profiles\kf4z2ags.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - About:Blank
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - component: c:\program files\BS.Player ControlBar\FirefoxDTT\components\BSToolbarFF.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-06 20:52:46
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwOpenFile

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\windows\system32\rundll32.exe
c:\qoobox\Quarantine\C\WINDOWS\system32\reader_s.exe.vir
c:\program files\Internet Explorer\iexplore.exe
c:\program files\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Celkový čas: 2009-03-06 20:54:46 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-03-06 19:54:43

Před spuštěním: Volných bajtů: 45 038 489 600
Po spuštění: Volných bajtů: 45,044,715,520

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

265 --- E O F --- 2009-02-25 14:50:56

[flashparkprd]

Sakra já na to kliknul To jsem ale blb on tam na mě vyskočil ten trojan

/upraven odkaz na vir. memphisto

[junfan]

hihi nemuzes chtit mit vsechno

[jaro3]

Toto vypadá, nechoďte na nebezpečné stránky!!§
udělej toto:
ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

Pokud Ti tam zbyde C:\qoobox tak ho smaž.
Dodám sem script.
memphisto smaž prosím ten odkaz.

/už se stalo.stáhl jsem si to a zkouším pod Linuxem memphisto

[junfan]

V procesech jsem ho mel stale (reader_s.exe) tak jsem ukoncil jeho proces bo jinak bych nevymazal Qoobox

[jaro3]

Odinstaluj ten cracklý ESS!!

Stahni si Avanger
do něj podle navodu:
zadej prikaz z kodu:

Kód: Vybrat vše

Files to delete:
c:\windows\system32\A.tmp
c:\windows\system32\8.tmp
c:\windows\system32\7.tmp
c:\windows\system32\11.tmp
c:\windows\fprxftzx.exe
c:\windows\system32\1E.tmp
c:\windows\system32\1D.tmp
c:\windows\system32\10.tmp
c:\windows\dbxxnxpg.exe
c:\windows\system32\13.tmp
c:\windows\dbxnxsej.exe
c:\windows\system32\11A.tmp
c:\windows\system32\11C.tmp
c:\windows\dbxkdvja.exe
c:\windows\system32\73.tmp
c:\windows\system32\4EF.tmp
c:\windows\system32\4E9.tmp
c:\windows\system32\4E7.tmp
C:\Program\Marsu-Fix
C:\WINDOWS\Marsu-Fix Uninstaller.exe


po restartu log z avengeru..
**************************************************************************************************************************************
Opakuj stažení Combofixu..a jeho aplikaci.

[jaro3]

Až sem dáš logy z Avengeru a CF proveď toto:
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

@Echo off
sc stop "ethaqmhs"
sc delete "ethaqmhs"
exit

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: fixthis.bat
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Poklepej na soubor fixthis.bat a okno se otevře a zavře, to je normální.
Restartuj PC.
****************************************************************************************************************************************
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
c:\windows\system32\drivers\ethaqmhs.sys

Driver::
ethaqmhs

DirLook::
c:\documents and settings\All Users\Data aplikací\{83C91755-2546-441D-AC40-9A6B4B860800}
c:\documents and settings\All Users\Data aplikací\n7-89-o9-3r-4t-r9

Registry::
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"dbxkdvja.exe"=-
"dbxnxsej.exe"=-
"dbxxnxpg.exe"=-


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT
Zítra se podívám..

[junfan]

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "c:\windows\system32\A.tmp" deleted successfully.
File "c:\windows\system32\8.tmp" deleted successfully.
File "c:\windows\system32\7.tmp" deleted successfully.
File "c:\windows\system32\11.tmp" deleted successfully.
File "c:\windows\fprxftzx.exe" deleted successfully.
File "c:\windows\system32\1E.tmp" deleted successfully.
File "c:\windows\system32\1D.tmp" deleted successfully.
File "c:\windows\system32\10.tmp" deleted successfully.
File "c:\windows\dbxxnxpg.exe" deleted successfully.
File "c:\windows\system32\13.tmp" deleted successfully.
File "c:\windows\dbxnxsej.exe" deleted successfully.
File "c:\windows\system32\11A.tmp" deleted successfully.
File "c:\windows\system32\11C.tmp" deleted successfully.
File "c:\windows\dbxkdvja.exe" deleted successfully.
File "c:\windows\system32\73.tmp" deleted successfully.
File "c:\windows\system32\4EF.tmp" deleted successfully.
File "c:\windows\system32\4E9.tmp" deleted successfully.
File "c:\windows\system32\4E7.tmp" deleted successfully.

Error: could not open file "C:\Program\Marsu-Fix"
Deletion of file "C:\Program\Marsu-Fix" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist

File "C:\WINDOWS\Marsu-Fix Uninstaller.exe" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.






ComboFix 09-03-04.01 - morff 2009-03-06 21:56:45.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.624 [GMT 1:00]
Spuštěný z: c:\documents and settings\morff\Plocha\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\morff\reader_s.exe
c:\windows\services.exe
c:\windows\system32\4.tmp
c:\windows\system32\6.tmp
c:\windows\system32\8.tmp
c:\windows\system32\drivers\ntndis.sys
c:\windows\system32\reader_s.exe

. . . je infikován!!

. . . je infikován!!

. . . je infikován!!

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-02-06 do 2009-03-06 )))))))))))))))))))))))))))))))
.

2009-03-06 21:54 . 2009-03-06 21:54 80 --a------ c:\windows\system32\7.tmp
2009-03-06 21:47 . 2009-03-06 21:47 80 --a------ c:\windows\system32\5.tmp
2009-03-06 21:42 . 2009-03-06 21:42 80 --a------ c:\windows\system32\3.tmp
2009-03-06 21:38 . 2009-03-06 21:38 130 --a------ c:\windows\adobe.bat
2009-03-06 21:38 . 2009-03-06 21:38 80 --a------ c:\windows\system32\46B.tmp
2009-03-06 21:38 . 2009-03-06 21:38 0 --a------ c:\windows\_id.dat
2009-03-06 20:16 . 2009-03-06 20:16 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-03-06 20:16 . 2009-03-06 20:16 <DIR> d-------- c:\documents and settings\morff\Data aplikací\Malwarebytes
2009-03-06 20:16 . 2009-03-06 20:16 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2009-03-06 20:16 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-06 20:16 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-03-06 16:58 . 2009-03-06 16:58 <DIR> d-------- c:\documents and settings\NetworkService\Plocha
2009-03-05 21:16 . 2009-03-05 22:42 136,096 --a------ c:\windows\system32\drivers\ethaqmhs.sys
2009-03-05 20:47 . 2009-03-05 20:47 182,656 --a--c--- c:\windows\system32\dllcache\ndis.sys
2009-03-01 15:53 . 2009-03-01 15:53 <DIR> d-------- c:\program files\Moyea
2009-03-01 15:53 . 2009-03-01 15:53 <DIR> d-------- c:\documents and settings\morff\Data aplikací\Moyea
2009-02-24 20:25 . 2009-02-24 20:26 <DIR> d-------- c:\program files\sdc222
2009-02-16 17:58 . 2009-02-16 18:43 <DIR> d-------- c:\program files\Belltech Business Card Designer Pro
2009-02-08 12:53 . 2009-01-02 14:43 <DIR> d-------- c:\documents and settings\Administrator\Plocha
2009-02-08 12:53 . 2009-01-02 14:43 <DIR> d--h----- c:\documents and settings\Administrator\Okolní tiskárny
2009-02-08 12:53 . 2009-01-02 14:43 <DIR> d--h----- c:\documents and settings\Administrator\Okolní síť
2009-02-08 12:53 . 2009-01-02 14:43 <DIR> d-------- c:\documents and settings\Administrator\Oblíbené položky
2009-02-08 12:53 . 2009-01-02 13:57 <DIR> d--h----- c:\documents and settings\Administrator\Šablony
2009-02-08 12:53 . 2009-01-02 14:43 <DIR> dr------- c:\documents and settings\Administrator\Nabídka Start
2009-02-08 12:53 . 2009-01-02 14:43 <DIR> d-------- c:\documents and settings\Administrator\Dokumenty
2009-02-08 12:53 . 2009-01-02 14:43 <DIR> dr-h----- c:\documents and settings\Administrator\Data aplikací
2009-02-08 12:53 . 2009-03-06 16:53 <DIR> d-------- c:\documents and settings\Administrator
2009-02-08 12:49 . 2009-02-08 12:49 <DIR> d-------- c:\documents and settings\Guest\Data aplikací\ESET
2009-02-08 12:48 . 2009-01-02 14:43 <DIR> d-------- c:\documents and settings\Guest\Plocha
2009-02-08 12:48 . 2009-01-02 14:43 <DIR> d--h----- c:\documents and settings\Guest\Okolní tiskárny
2009-02-08 12:48 . 2009-01-02 14:43 <DIR> d--h----- c:\documents and settings\Guest\Okolní síť
2009-02-08 12:48 . 2009-02-08 12:49 <DIR> dr------- c:\documents and settings\Guest\Oblíbené položky
2009-02-08 12:48 . 2009-01-02 13:57 <DIR> d--h----- c:\documents and settings\Guest\Šablony
2009-02-08 12:48 . 2009-01-02 14:43 <DIR> dr------- c:\documents and settings\Guest\Nabídka Start
2009-02-08 12:48 . 2009-02-08 12:49 <DIR> dr------- c:\documents and settings\Guest\Dokumenty
2009-02-08 12:48 . 2009-02-08 12:49 <DIR> dr-h----- c:\documents and settings\Guest\Data aplikací
2009-02-08 12:48 . 2009-03-05 21:12 <DIR> d-------- c:\documents and settings\Guest
2009-02-07 20:21 . 2009-02-07 20:21 <DIR> d-------- c:\documents and settings\morff\Data aplikací\Samsung
2009-02-07 20:00 . 2006-05-03 22:53 174,592 --a------ c:\windows\system32\framedyn.dll
2009-02-07 19:57 . 2009-02-07 19:57 <DIR> d-------- c:\windows\system32\Samsung_USB_Drivers
2009-02-07 19:57 . 2005-08-30 01:49 94,000 --a------ c:\windows\system32\drivers\ssm_mdm.sys
2009-02-07 19:57 . 2005-08-30 01:47 58,320 --a------ c:\windows\system32\drivers\ssm_bus.sys
2009-02-07 19:57 . 2005-08-30 01:49 8,336 --a------ c:\windows\system32\drivers\ssm_mdfl.sys
2009-02-07 19:57 . 2005-08-30 01:49 6,176 --a------ c:\windows\system32\drivers\ssm_cmnt.sys
2009-02-07 19:57 . 2005-08-30 01:49 6,176 --a------ c:\windows\system32\drivers\ssm_cm.sys
2009-02-07 19:57 . 2005-08-30 01:47 5,840 --a------ c:\windows\system32\drivers\ssm_whnt.sys
2009-02-07 19:57 . 2005-08-30 01:47 5,840 --a------ c:\windows\system32\drivers\ssm_wh.sys
2009-02-07 19:57 . 2009-02-07 20:20 5,632 --a------ c:\windows\system32\drivers\StarOpen.sys
2009-02-07 19:57 . 2005-08-28 20:51 766 --a------ c:\windows\system32\Uninstall.ico
2009-02-07 19:56 . 2009-02-07 19:56 <DIR> d-------- c:\program files\Samsung

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-05 21:15 --------- d-----w c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2009-03-05 19:47 182,656 ----a-w c:\windows\system32\drivers\ndis.sys
2009-03-05 16:57 --------- d-----w c:\documents and settings\morff\Data aplikací\365dni
2009-03-02 20:31 138,184 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-03-01 15:54 --------- d-----w c:\documents and settings\All Users\Data aplikací\FLEXnet
2009-03-01 11:56 --------- d-----w c:\program files\ICQ6.5
2009-03-01 11:56 --------- d-----w c:\documents and settings\morff\Data aplikací\ICQ
2009-02-15 19:45 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-02-11 19:44 --------- d-----w c:\documents and settings\All Users\Data aplikací\Microsoft Help
2009-02-07 18:56 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-07 18:53 --------- d-----w c:\program files\Common Files\Adobe
2009-01-30 19:46 --------- d-----w c:\documents and settings\morff\Data aplikací\BSplayer
2009-01-24 16:57 64,160 ----a-w c:\windows\system32\drivers\Lbd.sys
2009-01-24 16:55 --------- dc-h--w c:\documents and settings\All Users\Data aplikací\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-24 16:48 --------- d-----w c:\documents and settings\All Users\Data aplikací\Lavasoft
2009-01-22 18:01 --------- d-----w c:\program files\MultiMail
2009-01-18 16:22 --------- d--h--r c:\documents and settings\morff\Data aplikací\SecuROM
2009-01-18 16:19 --------- d-----w c:\documents and settings\morff\Data aplikací\Leadertech
2009-01-18 16:10 --------- d-----w c:\program files\EA Games
2009-01-18 15:55 --------- d-----w c:\program files\GameHouse
2009-01-18 15:55 --------- d-----w c:\documents and settings\morff\Data aplikací\GameHouse
2009-01-15 21:35 --------- d-----w c:\program files\Electronic Arts
2009-01-15 21:35 --------- d-----w c:\program files\Common Files\InstallShield
2009-01-12 18:37 --------- d-----w c:\program files\WM Converter
2009-01-09 13:16 --------- d-----w c:\documents and settings\morff\Data aplikací\Nero
2009-01-08 19:25 --------- d-----w c:\program files\Common Files\Nero
2009-01-08 19:10 --------- d-----w c:\program files\Nero
2009-01-08 19:03 --------- d-----w c:\documents and settings\All Users\Data aplikací\Nero
2009-01-08 08:03 22,328 ----a-w c:\documents and settings\morff\Data aplikací\PnkBstrK.sys
2009-01-08 07:54 --------- d-----w c:\program files\Activision
2009-01-06 17:01 --------- d-----w c:\program files\Trend Micro
2009-01-06 16:25 --------- d-----w c:\documents and settings\morff\Data aplikací\Software Informer
2009-01-06 16:24 --------- d-----w c:\documents and settings\morff\Data aplikací\IObit
2009-01-06 15:58 --------- d-----w c:\documents and settings\All Users\Data aplikací\Sandlot Games
2009-01-06 15:57 --------- d-----w c:\documents and settings\All Users\Data aplikací\n7-89-o9-3r-4t-r9
.

------- Sigcheck -------

2004-08-18 13:00 182912 1df7f42665c94b825322fae71721130d c:\windows\$NtServicePackUninstall$\ndis.sys
2008-04-13 20:20 182656 1df7f42665c94b825322fae71721130d c:\windows\ServicePackFiles\i386\ndis.sys
2008-04-13 20:20 182656 1df7f42665c94b825322fae71721130d c:\windows\SoftwareDistribution\Download\50ce127b6bb5262be7f814de23be86b4\ndis.sys
2009-03-05 20:47 213120 1df7f42665c94b825322fae71721130d c:\windows\system32\dllcache\ndis.sys
2009-03-05 20:47 213120 1df7f42665c94b825322fae71721130d c:\windows\system32\drivers\ndis.sys

2008-04-14 04:22 1051648 6b779dcafc80621bac9f9874565d5535 c:\windows\explorer.exe
2004-08-18 13:00 1050112 3f19cedbe63d47356a51cae8f6d29aed c:\windows\$NtServicePackUninstall$\explorer.exe
2008-04-14 04:22 1051648 0776dd339c556f960479c2da396d2f71 c:\windows\ServicePackFiles\i386\explorer.exe
2008-04-14 04:22 1051648 abfdad25a547ae1f2726b3ccb76934bc c:\windows\SoftwareDistribution\Download\50ce127b6bb5262be7f814de23be86b4\explorer.exe

2004-08-18 13:00 32768 c0e518c5efbae4a5c85b8441172cd2d0 c:\windows\$NtServicePackUninstall$\ctfmon.exe
2008-04-14 04:22 32768 4f5235b1ff2263def5e4d4c30cf8bf33 c:\windows\ServicePackFiles\i386\ctfmon.exe
2008-04-14 04:22 32768 314c2d5b1ce44bbbca2ea0b66ec5dc83 c:\windows\SoftwareDistribution\Download\50ce127b6bb5262be7f814de23be86b4\ctfmon.exe
2008-04-14 04:22 32768 365544d518ba869bf4366e2136a82793 c:\windows\system32\ctfmon.exe

2004-08-18 13:00 75264 6b44f97ac5974d6d67acf9c8f85cc23a c:\windows\$NtServicePackUninstall$\spoolsv.exe
2008-04-14 04:22 75264 ff90a709f9a7c3bafb537eb206eb240d c:\windows\ServicePackFiles\i386\spoolsv.exe
2008-04-14 04:22 75264 e387bd0828634c9e264f01cf199e27be c:\windows\SoftwareDistribution\Download\50ce127b6bb5262be7f814de23be86b4\spoolsv.exe
2008-04-14 04:22 75264 2105cb77a16b161ec9e3ceb154497eae c:\windows\system32\spoolsv.exe

2004-08-18 13:00 41984 5a26f8467b3ea2d2f504d508350815e7 c:\windows\$NtServicePackUninstall$\userinit.exe
2008-04-14 04:22 43520 51d339b7368d9f6d787efee246abb7bb c:\windows\ServicePackFiles\i386\userinit.exe
2008-04-14 04:22 43520 864dc79f0c3e143de3f8645c9eb57966 c:\windows\SoftwareDistribution\Download\50ce127b6bb5262be7f814de23be86b4\userinit.exe
2008-04-14 04:22 43520 8d44dc140ea75044d6856be524b85b0b c:\windows\system32\userinit.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"365dni"="c:\program files\365dníNET\365dniNET.exe" [2007-01-06 774144]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 32768]
"reader_s"="c:\documents and settings\morff\reader_s.exe" [2009-03-06 33280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"reader_s"="c:\windows\System32\reader_s.exe" [2009-03-06 33280]
"nwiz"="nwiz.exe" [2007-12-05 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-30 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 32768]
"reader_s"="c:\documents and settings\morff\reader_s.exe" [2009-03-06 33280]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\explorer.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.iac2"= c:\progra~1\ACEMEG~1\SystemS\Intel\iac25_32.ax
"msacm.sl_anet"= c:\progra~1\ACEMEG~1\SystemS\sl_anet.acm
"vidc.yv12"= c:\progra~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL
"vidc.divx"= c:\progra~1\ACEMEG~1\SystemS\DivX\DivX520.dll
"vidc.iyuv"= c:\progra~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll
"vidc.yvu9"= c:\progra~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll
"vidc.uyvy"= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yuy2"= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yvyu"= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"msacm.msaudio1"= c:\progra~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-01-24 64160]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2004-08-18 69120]
S1 ethaqmhs;ethaqmhs;c:\windows\system32\drivers\ethaqmhs.sys [2009-03-05 136096]
.
Obsah adresáře 'Naplánované úlohy'

2009-03-02 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-31 17:57]

2009-03-06 c:\windows\Tasks\HP Usg Daily.job
- c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\pexpress\hphped05.exe [2004-06-07 06:35]
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKU-Default-Run-dbxkdvja.exe - c:\windows\dbxkdvja.exe
HKU-Default-Run-dbxnxsej.exe - c:\windows\dbxnxsej.exe
HKU-Default-Run-dbxxnxpg.exe - c:\windows\dbxxnxpg.exe
HKU-Default-Run-services - c:\windows\services.exe
HKLM-Explorer_Run-services - c:\windows\services.exe
HKU-Default-Explorer_Run-services - c:\windows\services.exe


.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: microsoft.com\update
Trusted Zone: microsoft.com\windowsupdate
FF - ProfilePath - c:\documents and settings\morff\Data aplikací\Mozilla\Firefox\Profiles\kf4z2ags.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - About:Blank
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - component: c:\program files\BS.Player ControlBar\FirefoxDTT\components\BSToolbarFF.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-06 22:05:22
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwOpenFile

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...


c:\windows\system32\6.tmp 80 bytes
c:\windows\system32\8.tmp 38913 bytes executable

sken byl úspešně dokončen
skryté soubory: 2

**************************************************************************
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
c:\windows\system32\rundll32.exe
c:\program files\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Celkový čas: 2009-03-06 22:09:08 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-03-06 21:09:04

Před spuštěním: Volných bajtů: 51 975 135 232
Po spuštění: Volných bajtů: 51,966,058,496

247 --- E O F --- 2009-02-25 14:50:56