HiJackThis log - preventivní kontrola Vyřešeno

[onewinger]

Prosil bych o kontrolu logu. Díky


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:05:16, on 28.6.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\RocketDock\RocketDock.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Trust\Trust R-series Mouse And Keyboard\MouseDrv.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gameworld.best4you.sk/news.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [WireLessMouse] C:\Program Files\Trust\Trust R-series Mouse And Keyboard\StartAutorun.exe MouseDrv.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [QIP2005] C:\Program Files\QIP\qip.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint - Náhled - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Přidat na seznam k tisku - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint - Tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Vysokorychlostní tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/v ... .2.4.8.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - Unknown owner - c:\program files\mcafee.com\agent\mcdetect.exe (file missing)
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)
O23 - Service: Automatické aktualizace (wuauserv) - Unknown owner - C:\WINDOWS\

--
End of file - 8644 bytes

[Reklama]

[Damned]

Spusť HJT, vypni prohlížeče, odpoj se od internetu a fixni (zatrhnout políčko před hodnotou zmáčknout
"Fix checked"):

O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - (no file)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/v ... .2.4.8.cab

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[onewinger]

Malwarebytes' Anti-Malware 1.38
Verze databáze: 2297
Windows 5.1.2600 Service Pack 3

28.6.2009 11:17:29
mbam-log-2009-06-28 (11-17-25).txt

Typ skenu: Rychlý sken
Objektu skenováno: 99567
Uplynulý cas: 10 minute(s), 40 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 2
Infikované složky: 0
Infikované soubory: 0

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)

[Damned]

Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Vypni rezidentní štít antiviru (pokud máš tak i antispyware).
Stáhni si ComboFix (by sUBs)
nebo ComboFix (subs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[onewinger]

Malwarebytes' Anti-Malware 1.38
Verze databáze: 2297
Windows 5.1.2600 Service Pack 3

28.6.2009 11:53:21
mbam-log-2009-06-28 (11-53-21).txt

Typ skenu: Rychlý sken
Objektu skenováno: 99626
Uplynulý cas: 6 minute(s), 10 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 2
Infikované složky: 0
Infikované soubory: 0

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)

[onewinger]

ComboFix 09-06-26.02 - Petr 28.06.2009 12:08.3 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.511.287 [GMT 2:00]
Spuštěný z: c:\documents and settings\Petr\Plocha\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
* Vytvořen nový Bod Obnovení
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\ddindfefsners.dll
c:\windows\system32\winitn.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-05-28 do 2009-06-28 )))))))))))))))))))))))))))))))
.

2009-06-28 09:05 . 2009-06-17 09:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-28 09:05 . 2009-06-17 09:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-28 09:05 . 2009-06-28 09:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-21 11:11 . 2009-06-21 12:25 -------- d-----w- c:\program files\Game_Maker7
2009-06-21 10:49 . 2009-06-21 11:10 -------- d-----w- c:\program files\Game_Maker6
2009-06-12 18:34 . 2009-06-12 18:34 -------- d-----w- c:\windows\system32\XPSViewer
2009-06-12 18:33 . 2009-06-12 18:33 -------- d-----w- c:\program files\Reference Assemblies
2009-06-12 18:32 . 2006-06-29 11:07 14048 ------w- c:\windows\system32\spmsg2.dll
2009-06-12 17:59 . 2009-06-12 17:59 -------- d-----w- c:\program files\Sony Setup
2009-06-12 17:58 . 2009-06-12 17:59 -------- d-----w- c:\program files\VideoMach-3.4.1
2009-06-11 17:17 . 2008-11-05 03:59 40496 ----a-w- c:\windows\system32\drivers\hotcore3.sys
2009-06-11 17:15 . 2009-06-11 17:15 -------- d-----w- c:\program files\Paragon Software
2009-06-05 13:15 . 2009-06-05 13:19 -------- d-----w- c:\windows\nview
2009-06-05 13:15 . 2006-10-22 10:22 208896 ----a-w- c:\windows\system32\nvudisp.exe
2009-06-05 13:04 . 2006-10-22 13:06 208896 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-06-03 17:50 . 2009-06-03 17:50 -------- d-----w- c:\program files\Common Files\Steinberg
2009-06-03 17:08 . 2009-06-03 17:13 -------- d-----w- c:\program files\Cakewalk
2009-06-02 18:38 . 2009-06-02 18:38 233472 ----a-w- c:\windows\system32\REX Shared Library.dll
2009-06-02 18:24 . 2009-06-02 18:45 -------- d-----w- c:\program files\Native Instruments
2009-06-02 18:22 . 2009-06-12 19:06 -------- d-----w- c:\program files\VSTplugins
2009-06-01 14:53 . 2009-06-01 16:13 -------- d-----w- c:\program files\VirtualDJ
2009-06-01 14:49 . 2005-11-30 19:20 2314332 ----a-w- c:\windows\system32\LIBMMD.DLL

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-27 08:02 . 2009-05-27 17:37 -------- d-----w- c:\program files\Steam
2009-06-12 18:42 . 2001-10-25 12:00 77706 ----a-w- c:\windows\system32\perfc005.dat
2009-06-12 18:42 . 2001-10-25 12:00 427336 ----a-w- c:\windows\system32\perfh005.dat
2009-06-12 18:41 . 2009-03-18 16:43 -------- d-----w- c:\program files\MSBuild
2009-06-05 13:20 . 2009-04-25 12:22 8 ----a-w- c:\windows\system32\nvModes.dat
2009-06-02 18:23 . 2003-08-14 14:34 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-01 15:55 . 2003-08-14 14:35 -------- d-----w- c:\program files\CCleaner
2009-06-01 15:27 . 2009-06-01 14:54 -------- d-----w- c:\program files\Akram Audio Editor
2009-06-01 14:54 . 2009-06-01 14:54 450560 ----a-w- c:\windows\system32\maai.dll
2009-06-01 14:54 . 2009-06-01 14:54 196608 ----a-w- c:\windows\system32\maag.dll
2009-06-01 14:54 . 2009-06-01 14:54 1040384 ----a-w- c:\windows\system32\maah.dll
2009-06-01 14:54 . 2009-06-01 14:54 311296 ----a-w- c:\windows\system32\maaf.dll
2009-06-01 14:54 . 2009-06-01 14:54 835584 ----a-w- c:\windows\system32\maae.dll
2009-06-01 14:54 . 2009-06-01 14:54 729088 ----a-w- c:\windows\system32\maad.dll
2009-06-01 14:54 . 2009-06-01 14:54 335872 ----a-w- c:\windows\system32\maac.dll
2009-06-01 14:54 . 2009-06-01 14:54 315392 ----a-w- c:\windows\system32\maab.dll
2009-06-01 14:54 . 2009-06-01 14:54 1843200 ----a-w- c:\windows\system32\maaa.dll
2009-06-01 14:54 . 2009-06-01 14:54 237568 ----a-w- c:\windows\system32\lame_enc.dll
2009-06-01 04:52 . 2009-05-17 16:42 -------- d-----w- c:\program files\QIP
2009-05-31 19:22 . 2009-05-17 17:16 -------- d-----w- c:\program files\Zoner
2009-05-28 16:26 . 2009-05-16 08:00 -------- d-----w- c:\program files\IDoser v4
2009-05-28 16:24 . 2009-04-27 13:07 -------- d-----w- c:\program files\Winamp
2009-05-28 16:23 . 2009-03-23 14:02 -------- d-----w- c:\program files\Common Files\InstallShield
2009-05-25 14:06 . 2009-05-25 14:05 -------- d-----w- c:\program files\Teamspeak2_RC2
2009-05-22 04:51 . 2009-05-21 17:10 -------- d-----w- c:\program files\McAfee
2009-05-21 17:26 . 2009-05-21 17:19 -------- d-----w- c:\program files\SiteAdvisor
2009-05-21 17:12 . 2009-05-21 17:11 -------- d-----w- c:\program files\Common Files\McAfee
2009-05-21 17:11 . 2009-05-21 17:11 -------- d-----w- c:\program files\McAfee.com
2009-05-17 16:40 . 2009-04-07 16:58 -------- d-----w- c:\program files\QIP Infium
2009-05-16 20:17 . 2009-05-16 20:17 -------- d-----w- c:\program files\Common Files\LightScribe
2009-05-16 09:46 . 2009-04-07 14:40 -------- d-----w- c:\program files\Free Sound Recorder
2009-05-14 13:30 . 2009-05-14 13:30 -------- d-----w- c:\program files\Vypínač na dobrou noc
2009-05-10 10:27 . 2009-03-23 14:03 -------- d-----w- c:\program files\Sony Ericsson
2009-05-02 17:17 . 2009-05-02 17:18 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-02 17:16 . 2009-05-02 17:16 -------- d-----w- c:\program files\Java
2009-04-24 15:13 . 2009-04-24 15:13 62976 ----a-w- c:\windows\DTDraw.dll
2009-04-22 17:28 . 2009-04-22 17:28 421888 ----a-w- c:\windows\NEXON_EU_DownloaderUpdater.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"QIP2005"="c:\program files\QIP\qip.exe" [2009-02-12 3276288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WireLessMouse"="c:\program files\Trust\Trust R-series Mouse And Keyboard\StartAutorun.exe" [2007-03-06 212992]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2006-10-17 398944]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-03-25 645328]
"McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-01-09 1176808]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-22 1622016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\NexonEU\\NGM\\NGM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"e:\\CS 1.6 Internet\\hl.exe"=
"e:\\CS 1.6 Bot\\hl.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 hotcore3;hc3ServiceName;c:\windows\system32\drivers\hotcore3.sys [11.6.2009 19:17 40496]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [21.5.2009 19:17 206112]
S2 LF30FS;LF30FS;\??\c:\program files\Everstrike Software\Lock Folder XP 3.5\LF30XP.sys --> c:\program files\Everstrike Software\Lock Folder XP 3.5\LF30XP.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Obsah adresáře 'Naplánované úlohy'

2009-05-21 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-05-21 08:53]

2009-05-21 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-05-21 08:53]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.gameworld.best4you.sk/news.php
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Easy-WebPrint - Náhled - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint - Přidat na seznam k tisku - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint - Tisk - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint - Vysokorychlostní tisk - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
FF - ProfilePath - c:\documents and settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\dzrfm8ma.default\
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-28 12:17
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
Celkový čas: 2009-06-28 12:20
ComboFix-quarantined-files.txt 2009-06-28 10:20

Před spuštěním: Volných bajtů: 14 735 306 752
Po spuštění: Volných bajtů: 14 735 323 136

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(2)partition(1)\WINDOWS
[operating systems]
e:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(2)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,2,3,4,5
171

[Damned]

Červený soubor zkontroluj na Virustotalu

c:\windows\NEXON_EU_DownloaderUpdater.exe

a vlož sem odkaz na výsledek

[onewinger]

Doufám že jsem to udělal dobře.
http://www.virustotal.com/cs/analisis/1 ... 1244484668

[Damned]

Vždy, když ti napíše že už ho zkontroloval, musíš si nechat zkontrolovat soubor svůj ("Znovu zkontrolovat"). Soubory se stejným názvem se můžou lišit ve velikosti, umístění, hashe atd.

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
c:\program files\Everstrike Software\Lock Folder XP 3.5\LF30XP.sys

Driver::
LF30FS;LF30FS
LF30FS

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=-




Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

[onewinger]

ComboFix 09-06-26.02 - Petr 28.06.2009 13:46.4 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.511.230 [GMT 2:00]
Spuštěný z: c:\documents and settings\Petr\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Petr\Plocha\CFScript.txt
AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
* Rezidentní štít AV je zapnutý


FILE ::
"c:\program files\Everstrike Software\Lock Folder XP 3.5\LF30XP.sys"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_LF30FS
-------\Service_LF30FS


((((((((((((((((((((((((( Soubory vytvořené od 2009-05-28 do 2009-06-28 )))))))))))))))))))))))))))))))
.

2009-06-28 10:18 . 2009-06-28 10:18 -------- dc----w- c:\windows\system32\dllcache\cache
2009-06-28 09:05 . 2009-06-17 09:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-28 09:05 . 2009-06-17 09:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-28 09:05 . 2009-06-28 09:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-21 11:11 . 2009-06-21 12:25 -------- d-----w- c:\program files\Game_Maker7
2009-06-21 10:49 . 2009-06-21 11:10 -------- d-----w- c:\program files\Game_Maker6
2009-06-12 18:34 . 2009-06-12 18:34 -------- d-----w- c:\windows\system32\XPSViewer
2009-06-12 18:33 . 2009-06-12 18:33 -------- d-----w- c:\program files\Reference Assemblies
2009-06-12 18:32 . 2006-06-29 11:07 14048 ------w- c:\windows\system32\spmsg2.dll
2009-06-12 17:59 . 2009-06-12 17:59 -------- d-----w- c:\program files\Sony Setup
2009-06-12 17:58 . 2009-06-12 17:59 -------- d-----w- c:\program files\VideoMach-3.4.1
2009-06-11 17:17 . 2008-11-05 03:59 40496 ----a-w- c:\windows\system32\drivers\hotcore3.sys
2009-06-11 17:15 . 2009-06-11 17:15 -------- d-----w- c:\program files\Paragon Software
2009-06-05 13:15 . 2009-06-05 13:19 -------- d-----w- c:\windows\nview
2009-06-05 13:15 . 2006-10-22 10:22 208896 ----a-w- c:\windows\system32\nvudisp.exe
2009-06-05 13:04 . 2006-10-22 13:06 208896 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-06-03 17:50 . 2009-06-03 17:50 -------- d-----w- c:\program files\Common Files\Steinberg
2009-06-03 17:08 . 2009-06-03 17:13 -------- d-----w- c:\program files\Cakewalk
2009-06-02 18:38 . 2009-06-02 18:38 233472 ----a-w- c:\windows\system32\REX Shared Library.dll
2009-06-02 18:24 . 2009-06-02 18:45 -------- d-----w- c:\program files\Native Instruments
2009-06-02 18:22 . 2009-06-12 19:06 -------- d-----w- c:\program files\VSTplugins
2009-06-01 14:53 . 2009-06-01 16:13 -------- d-----w- c:\program files\VirtualDJ
2009-06-01 14:49 . 2005-11-30 19:20 2314332 ----a-w- c:\windows\system32\LIBMMD.DLL

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-27 08:02 . 2009-05-27 17:37 -------- d-----w- c:\program files\Steam
2009-06-12 18:42 . 2001-10-25 12:00 77706 ----a-w- c:\windows\system32\perfc005.dat
2009-06-12 18:42 . 2001-10-25 12:00 427336 ----a-w- c:\windows\system32\perfh005.dat
2009-06-12 18:41 . 2009-03-18 16:43 -------- d-----w- c:\program files\MSBuild
2009-06-05 13:20 . 2009-04-25 12:22 8 ----a-w- c:\windows\system32\nvModes.dat
2009-06-02 18:23 . 2003-08-14 14:34 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-01 15:55 . 2003-08-14 14:35 -------- d-----w- c:\program files\CCleaner
2009-06-01 15:27 . 2009-06-01 14:54 -------- d-----w- c:\program files\Akram Audio Editor
2009-06-01 14:54 . 2009-06-01 14:54 450560 ----a-w- c:\windows\system32\maai.dll
2009-06-01 14:54 . 2009-06-01 14:54 196608 ----a-w- c:\windows\system32\maag.dll
2009-06-01 14:54 . 2009-06-01 14:54 1040384 ----a-w- c:\windows\system32\maah.dll
2009-06-01 14:54 . 2009-06-01 14:54 311296 ----a-w- c:\windows\system32\maaf.dll
2009-06-01 14:54 . 2009-06-01 14:54 835584 ----a-w- c:\windows\system32\maae.dll
2009-06-01 14:54 . 2009-06-01 14:54 729088 ----a-w- c:\windows\system32\maad.dll
2009-06-01 14:54 . 2009-06-01 14:54 335872 ----a-w- c:\windows\system32\maac.dll
2009-06-01 14:54 . 2009-06-01 14:54 315392 ----a-w- c:\windows\system32\maab.dll
2009-06-01 14:54 . 2009-06-01 14:54 1843200 ----a-w- c:\windows\system32\maaa.dll
2009-06-01 14:54 . 2009-06-01 14:54 237568 ----a-w- c:\windows\system32\lame_enc.dll
2009-06-01 04:52 . 2009-05-17 16:42 -------- d-----w- c:\program files\QIP
2009-05-31 19:22 . 2009-05-17 17:16 -------- d-----w- c:\program files\Zoner
2009-05-28 16:26 . 2009-05-16 08:00 -------- d-----w- c:\program files\IDoser v4
2009-05-28 16:24 . 2009-04-27 13:07 -------- d-----w- c:\program files\Winamp
2009-05-28 16:23 . 2009-03-23 14:02 -------- d-----w- c:\program files\Common Files\InstallShield
2009-05-25 14:06 . 2009-05-25 14:05 -------- d-----w- c:\program files\Teamspeak2_RC2
2009-05-22 04:51 . 2009-05-21 17:10 -------- d-----w- c:\program files\McAfee
2009-05-21 17:26 . 2009-05-21 17:19 -------- d-----w- c:\program files\SiteAdvisor
2009-05-21 17:12 . 2009-05-21 17:11 -------- d-----w- c:\program files\Common Files\McAfee
2009-05-21 17:11 . 2009-05-21 17:11 -------- d-----w- c:\program files\McAfee.com
2009-05-17 16:40 . 2009-04-07 16:58 -------- d-----w- c:\program files\QIP Infium
2009-05-16 20:17 . 2009-05-16 20:17 -------- d-----w- c:\program files\Common Files\LightScribe
2009-05-16 09:46 . 2009-04-07 14:40 -------- d-----w- c:\program files\Free Sound Recorder
2009-05-14 13:30 . 2009-05-14 13:30 -------- d-----w- c:\program files\Vypínač na dobrou noc
2009-05-10 10:27 . 2009-03-23 14:03 -------- d-----w- c:\program files\Sony Ericsson
2009-05-02 17:17 . 2009-05-02 17:18 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-02 17:16 . 2009-05-02 17:16 -------- d-----w- c:\program files\Java
2009-04-24 15:13 . 2009-04-24 15:13 62976 ----a-w- c:\windows\DTDraw.dll
2009-04-22 17:28 . 2009-04-22 17:28 421888 ----a-w- c:\windows\NEXON_EU_DownloaderUpdater.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-06-28_10.17.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-28 11:55 . 2009-06-28 11:55 16384 c:\windows\temp\Perflib_Perfdata_1c4.dat
+ 2008-10-16 12:09 . 2008-10-16 12:09 43544 c:\windows\system32\wups2.dll
+ 2009-03-18 15:44 . 2008-10-16 12:08 34328 c:\windows\system32\wups.dll
+ 2009-03-18 15:44 . 2008-10-16 12:09 51224 c:\windows\system32\wuauclt.exe
+ 2009-06-28 10:26 . 2008-10-16 12:08 34328 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.788\wups.dll
+ 2009-03-18 15:44 . 2008-10-16 12:08 34328 c:\windows\system32\dllcache\wups.dll
+ 2009-03-18 15:44 . 2008-10-16 12:09 51224 c:\windows\system32\dllcache\wuauclt.exe
+ 2004-08-17 13:49 . 2008-10-16 12:09 92696 c:\windows\system32\dllcache\cdm.dll
+ 2009-06-28 10:18 . 2008-04-14 06:52 82432 c:\windows\system32\dllcache\cache\ws2_32.dll
+ 2009-06-28 10:18 . 2008-04-14 06:52 26112 c:\windows\system32\dllcache\cache\userinit.exe
+ 2009-06-28 10:18 . 2008-04-14 06:52 14336 c:\windows\system32\dllcache\cache\svchost.exe
+ 2009-06-28 10:18 . 2008-04-14 06:52 57856 c:\windows\system32\dllcache\cache\spoolsv.exe
+ 2009-06-28 10:18 . 2008-04-14 06:51 17408 c:\windows\system32\dllcache\cache\powrprof.dll
+ 2009-06-28 10:18 . 2008-04-14 06:52 13312 c:\windows\system32\dllcache\cache\lsass.exe
+ 2009-06-28 10:18 . 2008-04-14 05:59 24576 c:\windows\system32\dllcache\cache\kbdclass.sys
+ 2009-06-28 10:18 . 2008-04-13 22:23 36608 c:\windows\system32\dllcache\cache\ip6fw.sys
+ 2009-06-28 10:18 . 2008-04-14 06:52 15360 c:\windows\system32\dllcache\cache\ctfmon.exe
+ 2004-08-17 13:49 . 2008-10-16 12:09 92696 c:\windows\system32\cdm.dll
+ 2009-03-18 15:44 . 2008-10-16 12:13 202776 c:\windows\system32\wuweb.dll
+ 2009-03-18 15:44 . 2008-10-16 12:12 323608 c:\windows\system32\wucltui.dll
+ 2009-03-18 15:44 . 2008-10-16 12:12 561688 c:\windows\system32\wuapi.dll
+ 2009-03-18 15:44 . 2008-10-16 12:13 202776 c:\windows\system32\dllcache\wuweb.dll
+ 2009-03-18 15:44 . 2008-10-16 12:12 323608 c:\windows\system32\dllcache\wucltui.dll
+ 2009-03-18 15:44 . 2008-10-16 12:12 561688 c:\windows\system32\dllcache\wuapi.dll
+ 2009-06-28 10:18 . 2008-04-14 06:52 111104 c:\windows\system32\dllcache\cache\wuauclt.exe
+ 2009-06-28 10:18 . 2008-04-14 06:52 507904 c:\windows\system32\dllcache\cache\winlogon.exe
+ 2009-06-28 10:18 . 2009-03-08 02:34 914944 c:\windows\system32\dllcache\cache\wininet.dll
+ 2009-06-28 10:18 . 2008-04-14 06:52 578560 c:\windows\system32\dllcache\cache\user32.dll
+ 2009-06-28 10:18 . 2008-04-14 06:52 295936 c:\windows\system32\dllcache\cache\termsrv.dll
+ 2009-06-28 10:18 . 2008-04-13 22:50 361344 c:\windows\system32\dllcache\cache\tcpip.sys
+ 2009-06-28 10:18 . 2008-04-14 06:52 108544 c:\windows\system32\dllcache\cache\services.exe
+ 2009-06-28 10:18 . 2008-04-13 22:50 182656 c:\windows\system32\dllcache\cache\ndis.sys
+ 2009-06-28 10:18 . 2008-04-14 06:51 988160 c:\windows\system32\dllcache\cache\kernel32.dll
+ 2009-06-28 10:18 . 2008-04-14 06:51 110080 c:\windows\system32\dllcache\cache\imm32.dll
+ 2009-06-28 10:18 . 2008-04-14 06:51 171008 c:\windows\system32\dllcache\cache\appmgmts.dll
+ 2009-03-18 15:44 . 2008-10-16 12:13 1809944 c:\windows\system32\wuaueng.dll
+ 2009-03-18 15:44 . 2008-10-16 12:13 1809944 c:\windows\system32\dllcache\wuaueng.dll
+ 2009-06-28 10:18 . 2008-04-14 06:51 1571840 c:\windows\system32\dllcache\cache\sfcfiles.dll
+ 2009-06-28 10:18 . 2008-04-14 06:07 2191104 c:\windows\system32\dllcache\cache\ntoskrnl.exe
+ 2009-06-28 10:18 . 2008-04-14 06:06 2067968 c:\windows\system32\dllcache\cache\ntkrnlpa.exe
+ 2009-06-28 10:18 . 2008-04-14 06:52 1034240 c:\windows\system32\dllcache\cache\explorer.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"QIP2005"="c:\program files\QIP\qip.exe" [2009-02-12 3276288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WireLessMouse"="c:\program files\Trust\Trust R-series Mouse And Keyboard\StartAutorun.exe" [2007-03-06 212992]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2006-10-17 398944]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-03-25 645328]
"McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-01-09 1176808]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-22 1622016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\NexonEU\\NGM\\NGM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"e:\\CS 1.6 Internet\\hl.exe"=
"e:\\CS 1.6 Bot\\hl.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 hotcore3;hc3ServiceName;c:\windows\system32\drivers\hotcore3.sys [11.6.2009 19:17 40496]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [21.5.2009 19:17 206112]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Obsah adresáře 'Naplánované úlohy'

2009-05-21 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-05-21 08:53]

2009-05-21 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-05-21 08:53]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.gameworld.best4you.sk/news.php
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Easy-WebPrint - Náhled - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint - Přidat na seznam k tisku - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint - Tisk - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint - Vysokorychlostní tisk - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
FF - ProfilePath - c:\documents and settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\dzrfm8ma.default\
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-28 13:58
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(700)
c:\program files\RocketDock\RocketDock.dll
c:\program files\McAfee\SiteAdvisor\saHook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\rundll32.exe
c:\program files\Trust\Trust R-series Mouse And Keyboard\MouseDrv.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe
c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
c:\progra~1\McAfee.com\Agent\mcagent.exe
c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\program files\McAfee\MPF\MpfSrv.exe
.
**************************************************************************
.
Celkový čas: 2009-06-28 14:07 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-06-28 12:07
ComboFix2.txt 2009-06-28 10:20

Před spuštěním: Volných bajtů: 14 689 939 456
Po spuštění: Volných bajtů: 14 615 310 336

Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,2,3,4,5
238

[onewinger]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:13:59, on 28.6.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trust\Trust R-series Mouse And Keyboard\MouseDrv.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gameworld.best4you.sk/news.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [WireLessMouse] C:\Program Files\Trust\Trust R-series Mouse And Keyboard\StartAutorun.exe MouseDrv.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [QIP2005] C:\Program Files\QIP\qip.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint - Náhled - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Přidat na seznam k tisku - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint - Tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Vysokorychlostní tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - Unknown owner - c:\program files\mcafee.com\agent\mcdetect.exe (file missing)
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)

--
End of file - 8307 bytes

[Damned]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000000


Ulož si ho jako na Plochu jako fix.reg a jako typ všechny soubory , najdi tento soubor na Ploše a poklepáním ho spusť. Budeš dotázán na přidání hodnoty do registru. Schval.
*****************************************************************************************************************************************
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.)
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

sc config StyleXPService start= disabled
sc stop StyleXPService
sc delete StyleXPService

ulož si ho na plochu jako-název remove.bat a ulož ho jako typ všechny soubory , najdi na ploše tento soubor , spusť ho poklepáním.
Otevře se Dosovské okno a zavře. Restartuj comp a vlož sem log z HJT.