Antivir (nebo snad vir?) Vyřešeno

[MaxDamageCZ]

Dial-a-fix jsem zkousel, po kliknuti na make writeable stale svitilo cervene make writeable. Nic se nezmenilo. Logy budou za chvili moment

[Reklama]

[MaxDamageCZ]

Svazek v jednotce C nemá žádnou jmenovku.
Sériové číslo svazku je 38C9-F8E2.

Výpis adresáře C:\WINDOWS\$NtServicePackUninstall$

18.08.2004 14:00 1 548 288 sfcfiles.dll
1 souborů, 1 548 288 bajtů

Výpis adresáře C:\WINDOWS\ServicePackFiles\i386

14.04.2008 05:21 1 571 840 sfcfiles.dll
1 souborů, 1 571 840 bajtů

Výpis adresáře C:\WINDOWS\system32\dllcache

14.04.2008 05:21 1 571 840 sfcfiles.dll
1 souborů, 1 571 840 bajtů

Výpis adresáře C:\WINDOWS\system32\dllcache\cache

14.04.2008 05:21 1 571 840 sfcfiles.dll
1 souborů, 1 571 840 bajtů

Počet souborů v seznamu:
4 souborů, 6 263 808 bajtů
Adresářů: 0, Volných bajtů: 145 231 847 424

[jaro3]

Jen vsuvka , vím že je tady moc programů , ale pleteš si programy Dial-a-fix s HostsXpert..

Je to tady na té stránce:
viewtopic.php?f=47&t=42998&start=72
Dial-a-fix

[MaxDamageCZ]

ComboFix 09-08-01.06 - Marek 02.08.2009 17:53.8.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.615 [GMT 2:00]
Spuštěný z: c:\documents and settings\Marek\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Marek\Plocha\CFScript.txt
AV: F-Secure Profi Antivirus 8.01 *On-access scanning disabled* (Updated) {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
FW: F-Secure Profi Antivirus 8.01 *disabled* {D4747503-0346-49EB-9262-997542F79BF4}

FILE ::
"c:\windows\system32\drivers\etc\hosts"
"c:\windows\system32\drivers\etc\hosts.new"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\etc\hosts
c:\windows\system32\drivers\etc\hosts.new

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-07-02 do 2009-08-02 )))))))))))))))))))))))))))))))
.

2009-08-02 15:37 . 2009-08-02 15:44 -------- dc----w- C:\pch
2009-08-01 15:05 . 2009-08-01 16:54 -------- d-----w- c:\program files\Crawler
2009-08-01 13:14 . 2009-08-01 13:26 -------- d-----w- c:\program files\PhotoFiltre
2009-07-31 17:32 . 2009-07-31 17:32 -------- d-----w- c:\windows\system32\CatRoot2
2009-07-31 15:05 . 2009-07-31 15:16 33920 ----a-w- c:\windows\system32\drivers\fsbts.sys
2009-07-31 15:05 . 2008-12-04 13:57 79872 ----a-w- c:\windows\system32\drivers\fsdfw.sys
2009-07-31 15:04 . 2009-08-01 15:59 -------- d-----w- c:\program files\F-Secure
2009-07-31 14:17 . 2009-07-31 14:46 -------- dc----w- C:\HostsXpert 4.3 - Hosts File Manager
2009-07-30 11:56 . 2009-08-01 15:00 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-07-29 21:09 . 2009-07-29 21:10 -------- dc----w- C:\HostsXpert 4.2 - Hosts File Manager
2009-07-28 19:19 . 2009-07-28 19:19 -------- dcs---w- C:\VerTerm
2009-07-28 17:50 . 2009-07-28 17:50 -------- d-----w- c:\program files\PetrLite
2009-07-28 16:14 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-28 16:14 . 2009-07-30 08:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-28 16:14 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-28 15:52 . 2009-07-28 15:52 28672 ----a-w- c:\windows\system32\eEmpty.exe
2009-07-28 15:36 . 2009-07-28 15:36 -------- d-----w- c:\program files\CCleaner
2009-07-28 15:30 . 2009-07-28 15:30 118842 ------r- c:\windows\bwUnin-6.3.2.116-7681197L.exe
2009-07-28 15:16 . 2009-07-28 15:25 -------- d-----w- c:\program files\RegCleaner
2009-07-28 14:03 . 2009-07-28 14:03 -------- d-----w- c:\program files\McAfee UnInstaller 6.5 Demo English
2009-07-28 13:58 . 2007-08-15 11:09 159744 ----a-w- c:\windows\system32\wt_menu.dll
2009-07-28 13:58 . 2007-08-15 11:09 40960 ----a-w- c:\windows\system32\ssubtmr6.dll
2009-07-28 13:58 . 1999-02-09 19:40 188928 ----a-w- c:\windows\system32\vbuzip10.DLL
2009-07-28 13:58 . 2009-07-28 13:59 -------- d-----w- c:\program files\Smarty Uninstaller Pro
2009-07-28 13:57 . 2009-07-28 13:57 -------- d-----w- c:\program files\VS Revo Group
2009-07-28 08:44 . 2009-07-31 13:25 -------- d-----w- c:\program files\Trend Micro
2009-07-27 15:13 . 2009-07-27 15:14 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-07-27 14:14 . 2009-07-27 14:14 -------- d-----w- c:\program files\XnView
2009-07-27 14:00 . 2009-07-27 14:00 -------- d-----w- c:\program files\RealWorld Cursor Editor
2009-07-27 13:56 . 2009-07-27 13:56 -------- d-----w- c:\program files\ImageForge3
2009-07-27 13:50 . 2009-07-27 13:50 -------- d-----w- c:\program files\HTML editor Yugie-shareware
2009-07-27 10:24 . 2009-07-27 10:24 -------- d-----w- c:\program files\BlueVoda Website Builder
2009-07-21 09:24 . 2009-07-21 09:24 -------- d-----w- c:\program files\Audacity
2009-07-21 09:21 . 2009-07-21 09:22 -------- d-----w- c:\program files\Audacity 1.3 Beta (Unicode)
2009-07-16 17:15 . 2009-07-16 17:18 -------- d-----w- c:\program files\Castle Strike

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-01 16:38 . 2008-08-02 17:50 -------- d-----w- c:\program files\Windows Desktop Search
2009-08-01 15:00 . 2008-06-02 12:40 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-01 14:59 . 2004-08-18 12:00 93318 ----a-w- c:\windows\system32\perfc005.dat
2009-08-01 14:59 . 2004-08-18 12:00 461558 ----a-w- c:\windows\system32\perfh005.dat
2009-07-27 15:41 . 2006-07-04 06:24 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-27 15:10 . 2006-07-05 17:26 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-07-26 15:54 . 2006-09-18 08:29 -------- d-----w- c:\program files\Illusion Softworks
2009-07-20 12:45 . 2006-07-05 17:36 -------- d-----w- c:\program files\GameSpy Arcade
2009-07-03 16:59 . 2004-08-18 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-30 11:44 . 2009-06-30 11:44 -------- d-----w- c:\program files\MumboJumbo
2009-06-29 10:33 . 2009-05-06 17:54 -------- d-----w- c:\program files\Stykz
2009-06-29 06:30 . 2009-06-13 15:47 -------- d-----w- c:\program files\World of Warcraft
2009-06-28 18:06 . 2007-05-18 18:18 -------- d-----w- c:\program files\Take2
2009-06-20 11:45 . 2006-09-09 18:52 -------- d-----w- c:\program files\Google
2009-06-16 14:40 . 2004-08-18 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2004-08-18 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-14 11:50 . 2009-06-14 11:50 -------- d-----w- c:\program files\Zeallsoft
2009-06-14 11:29 . 2009-06-14 11:06 -------- d-----w- c:\program files\Active GIF Creator 2.23
2009-06-12 16:16 . 2007-12-25 16:46 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2009-06-03 19:11 . 2004-08-18 12:00 1293824 ----a-w- c:\windows\system32\quartz.dll
2009-05-12 13:12 . 2006-07-04 06:30 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-05-07 15:33 . 2004-08-18 12:00 346624 ----a-w- c:\windows\system32\localspl.dll
2004-08-23 21:38 . 2004-08-23 21:38 3371 ----a-w- c:\program files\!!!readme.txt
2004-08-23 19:08 . 2004-08-23 19:08 83968 -c--a-w- c:\program files\NB_NB_2_12_37.xls
2009-06-21 17:55 . 2009-06-21 17:55 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

(((((((((((((((((((((((((((((((((((((((((( SR_Search ))))))))))))))))))))))))))))))))))))))))))))))))))))))))

[-] 56A6034E7764E23D9114223EB3523925 1571840 c:\windows\system32\dllcache\sfcfiles.dll
[-] 56A6034E7764E23D9114223EB3523925 1571840 \RP8\A0001334.dll
[-] 56A6034E7764E23D9114223EB3523925 1571840 \RP8\A0001338.dll

c:\windows\system32\sfcfiles.dll [x]
[-] 56A6034E7764E23D9114223EB3523925 1571840 \RP8\A0001333.dll
[-] 56A6034E7764E23D9114223EB3523925 1571840 \RP8\A0003428.dll
.
------- Sigcheck -------

Chyba šifrovací služby !!
.
((((((((((((((((((((((((((((( SnapShot@2009-07-30_13.43.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-02 16:03 . 2009-08-02 16:03 16384 c:\windows\temp\Perflib_Perfdata_204.dat
+ 2006-07-03 14:57 . 2008-04-14 03:22 32256 c:\windows\system32\wups.dll
+ 2004-08-18 12:00 . 2009-08-01 14:59 82006 c:\windows\system32\perfc009.dat
+ 2008-10-16 12:08 . 2008-10-16 12:08 34328 c:\windows\SoftwareDistribution\SelfUpdate\wups.dll
+ 2008-10-16 12:09 . 2008-10-16 12:09 51224 c:\windows\SoftwareDistribution\SelfUpdate\wuauclt.exe
+ 2006-07-03 14:57 . 2008-04-14 03:22 120320 c:\windows\system32\wuweb.dll
+ 2006-07-03 14:57 . 2008-04-14 03:22 112640 c:\windows\system32\wucltui.dll
+ 2006-07-03 14:57 . 2008-04-14 03:22 183296 c:\windows\system32\wuaueng1.dll
+ 2006-07-03 14:57 . 2008-04-14 03:22 166912 c:\windows\system32\wuauclt1.exe
+ 2006-07-03 14:57 . 2008-04-14 03:22 111104 c:\windows\system32\wuauclt.exe
+ 2006-07-03 14:57 . 2008-04-14 03:22 431104 c:\windows\system32\wuapi.dll
+ 2004-08-18 12:00 . 2009-08-01 14:59 465124 c:\windows\system32\perfh009.dat
+ 2006-07-04 06:35 . 2006-07-04 06:35 262144 c:\windows\system32\config\systemprofile\ntuser.dat
+ 2008-10-16 12:13 . 2008-10-16 12:13 202776 c:\windows\SoftwareDistribution\SelfUpdate\wuweb.dll
+ 2008-10-16 12:12 . 2008-10-16 12:12 323608 c:\windows\SoftwareDistribution\SelfUpdate\wucltui.dll
+ 2008-10-16 12:12 . 2008-10-16 12:12 561688 c:\windows\SoftwareDistribution\SelfUpdate\wuapi.dll
+ 2006-07-03 14:57 . 2008-04-14 03:22 1135616 c:\windows\system32\wuaueng.dll
+ 2008-10-16 12:13 . 2008-10-16 12:13 1809944 c:\windows\SoftwareDistribution\SelfUpdate\wuaueng.dll
- 2006-12-25 14:24 . 2009-07-28 17:35 2248192 c:\windows\Installer\483f4.msi
+ 2006-12-25 14:24 . 2009-08-02 10:48 2248192 c:\windows\Installer\483f4.msi
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 81920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-10 68856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Google Update"="c:\documents and settings\Marek\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2009-06-20 133104]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"F-Secure Manager"="c:\program files\F-Secure\Common\FSM32.EXE" [2008-12-04 182936]
"F-Secure TNB"="c:\program files\F-Secure\FSGUI\TNBUtil.exe" [2008-12-04 957024]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PnkBstrB"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
"c:\\Program Files\\Electronic Arts\\Need For Speed III\\nfs3.exe"=
"c:\\Program Files\\Sierra\\SWAT 4\\Content\\System\\Swat4.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Illusion Softworks\\Hidden & Dangerous 2\\hd2.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Sierra\\CoolPool\\coolpool.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Codemasters\\Worms 4 Totalni narez\\Worms 4 Mayhem.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\Electronic Arts\\Medal of Honor Airborne\\UnrealEngine3\\Binaries\\MOHA.exe"=
"c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Documents and Settings\\Marek\\Local Settings\\Data aplikací\\Dyyno Receiver\\DPPM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\keyclone\\keyclone.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.0.1-to-3.0.2-enGB-Win-Update-downloader.exe"=
"c:\\Documents and Settings\\Marek\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Marek\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\MumboJumbo\\Luxor\\luxor.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2869:TCP"= 2869:TCP:@xpsp2res.dll,-22008
"11001:TCP"= 11001:TCP:H&D2 port 11001
"11001:UDP"= 11001:UDP:H&D2 port 11001
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"12001:UDP"= 12001:UDP:SMART WebServer Handshake Multicast Port
"6112:TCP"= 6112:TCP:Blizzard Downloader

R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [31.7.2009 17:05 33920]
R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [31.7.2009 17:05 79872]
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [5.7.2006 14:46 63352]
R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\F-Secure\HIPS\drivers\fshs.sys [31.7.2009 17:04 67808]
R2 SMART Web Server;SMART Web Server;c:\program files\SMART Technologies Inc\SMART Board Software\WebServer.exe [19.4.2007 7:42 759312]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\F-Secure\Anti-Virus\minifilter\fsgk.sys [31.7.2009 17:04 99960]
R3 FSORSPClient;F-Secure ORSP Client;c:\program files\F-Secure\ORSP Client\fsorsp.exe [31.7.2009 17:05 55904]
S3 axskbus;axskbus;c:\windows\system32\DRIVERS\axskbus.sys --> c:\windows\system32\DRIVERS\axskbus.sys [?]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [20.2.2008 20:49 13352]
S3 M1000Srv;M5603C USB2.0 Camera Driver;c:\windows\system32\drivers\M1000KNT.sys [25.12.2006 22:11 276930]
S4 BackWeb Plug-in - 7681197;F-Secure Automatic Update;c:\progra~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE --> c:\progra~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [?]
S4 F-Secure Filter;F-Secure File System Filter;c:\program files\F-Secure\Anti-Virus\win2k\fsfilter.sys [31.7.2009 17:04 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\F-Secure\Anti-Virus\win2k\fsrec.sys [31.7.2009 17:04 25184]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Obsah adresáře 'Naplánované úlohy'

2009-06-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 11:42]

2009-08-02 c:\windows\Tasks\User_Feed_Synchronization-{CB8F93AA-F0A1-41BE-9268-229B640A54CD}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Doplňkový sken -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files\F-Secure\FSPS\program\FSLSP.DLL
FF - ProfilePath - c:\documents and settings\Marek\Data aplikací\Mozilla\Firefox\Profiles\j2ggv3xx.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - hxxp://www.atlas.cz/?from=icqhp
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - component: c:\documents and settings\Marek\Data aplikací\Mozilla\Firefox\Profiles\j2ggv3xx.default\extensions\DTToolbar@toolbarnet.com\components\DTToolbarFF.dll
FF - plugin: c:\program files\Dyyno\Dyyno Player\npvlc.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-02 18:04
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(780)
c:\program files\F-Secure\FWES\Program\fsdc32.dll

- - - - - - - > 'lsass.exe'(836)
c:\program files\F-Secure\FSPS\program\FSLSP.DLL
c:\program files\F-Secure\FWES\Program\fsdc32.dll

- - - - - - - > 'explorer.exe'(3080)
c:\program files\Common Files\Ahead\Lib\NeroDigitalExt.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll

- - - - - - - > 'csrss.exe'(756)
c:\program files\F-Secure\FWES\Program\fsdc32.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\F-Secure\Anti-Virus\fsgk32st.exe
c:\program files\F-Secure\Common\FSMA32.EXE
c:\program files\F-Secure\Anti-Virus\fsgk32.exe
c:\windows\system32\drivers\KodakCCS.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\F-Secure\Common\FSMB32.EXE
c:\program files\NVIDIA Corporation\nTune\nTuneService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\program files\F-Secure\Common\FCH32.EXE
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\ScsiAccess.EXE
c:\program files\SMART Technologies Inc\SMART Board Software\SMARTBoardService.exe
c:\program files\F-Secure\Common\FAMEH32.EXE
c:\program files\F-Secure\Anti-Virus\fsqh.exe
c:\program files\F-Secure\FSAUA\program\fsaua.exe
c:\program files\F-Secure\FWES\program\fsdfwd.exe
c:\program files\F-Secure\Anti-Virus\fssm32.exe
c:\program files\F-Secure\FSAUA\program\fsus.exe
c:\program files\F-Secure\Anti-Virus\fsav32.exe
c:\program files\F-Secure\FSGUI\fsguidll.exe
.
**************************************************************************
.
Celkový čas: 2009-08-02 18:09 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-08-02 16:09
ComboFix2.txt 2009-08-02 10:01
ComboFix3.txt 2009-07-31 09:39
ComboFix4.txt 2009-07-30 14:57
ComboFix5.txt 2009-08-02 15:46

Před spuštěním: Volných bajtů: 145 204 539 392
Po spuštění: Volných bajtů: 145 197 223 936

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
290 --- E O F --- 2009-07-29 12:00

[MaxDamageCZ]

Jo máš pravdu, omlouvám se, už z toho blbnu D

[MaxDamageCZ]

Dial-a-fix- dam ten SFC scan, Go, cosi problikne, žádný error, vše v poho, ale nic se vlastně nezměnilo

[MaxDamageCZ]

Tu je ta poslední zpráva, co jsi chtěl


Svazek v jednotce C nemá žádnou jmenovku.
Sériové číslo svazku je 38C9-F8E2.

Výpis adresáře C:\WINDOWS\system32\drivers\etc

02.08.2009 18:04 <DIR> .
02.08.2009 18:04 <DIR> ..
18.08.2004 14:00 3 615 lmhosts.sam
18.08.2004 14:00 412 networks
18.08.2004 14:00 831 protocol
18.08.2004 14:00 7 137 services
4 souborů, 11 995 bajtů
Adresářů: 2, Volných bajtů: 145 196 449 792

[fredik]

Vytvoř si nový CFScript, použij ho a vlož sem pak log.

Kód: Vybrat vše

FCopy::
C:\WINDOWS\ServicePackFiles\i386\sfcfiles.dll | C:\windows\system32\sfcfiles.dll

SRPeek::
c:\windows\system32\sfcfiles.dll

SkipFix::

Nevím jestli si provedl ten příkaz s tím zkopírováním host souboru, pokud ne, nebo se nezdařilo, tak ho zkus tam zkopírovat sám ručně (C:\windows\system32\drivers\etc) nebo zkus teď znovu použít HostsXpert a přes něj si vytvořit ten hosts soubor.

Znovu použij příkaz popsaný zde bod 1) a vlož sem z něho log.

[MaxDamageCZ]

Svazek v jednotce C nemá žádnou jmenovku.
Sériové číslo svazku je 38C9-F8E2.

Výpis adresáře C:\WINDOWS\$NtServicePackUninstall$

18.08.2004 14:00 1 548 288 sfcfiles.dll
1 souborů, 1 548 288 bajtů

Výpis adresáře C:\WINDOWS\ServicePackFiles\i386

14.04.2008 05:21 1 571 840 sfcfiles.dll
1 souborů, 1 571 840 bajtů

Výpis adresáře C:\WINDOWS\system32\dllcache

14.04.2008 05:21 1 571 840 sfcfiles.dll
1 souborů, 1 571 840 bajtů

Výpis adresáře C:\WINDOWS\system32\dllcache\cache

14.04.2008 05:21 1 571 840 sfcfiles.dll
1 souborů, 1 571 840 bajtů

Počet souborů v seznamu:
4 souborů, 6 263 808 bajtů
Adresářů: 0, Volných bajtů: 145 147 023 360






Combo fix bude za moment

[MaxDamageCZ]

ComboFix 09-08-01.06 - Marek 03.08.2009 16:55.9.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.626 [GMT 2:00]
Spuštěný z: c:\documents and settings\Marek\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Marek\Plocha\CFScript.txt
AV: F-Secure Profi Antivirus 8.01 *On-access scanning disabled* (Updated) {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
FW: F-Secure Profi Antivirus 8.01 *disabled* {D4747503-0346-49EB-9262-997542F79BF4}
.
- REŽIM S OMEZENOU FUNKČNOSTÍ -
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
--------------- FCopy ---------------

c:\windows\ServicePackFiles\i386\sfcfiles.dll --> c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((( Soubory vytvořené od 2009-07-03 do 2009-08-03 )))))))))))))))))))))))))))))))
.

2009-08-03 14:55 . 2008-04-14 03:21 1571840 ----a-w- c:\windows\system32\sfcfiles.dll
2009-08-03 14:00 . 2009-08-03 14:00 -------- d-----w- c:\windows\LastGood
2009-08-02 15:37 . 2009-08-03 14:52 -------- dc----w- C:\pch
2009-08-01 15:05 . 2009-08-01 16:54 -------- d-----w- c:\program files\Crawler
2009-08-01 13:14 . 2009-08-01 13:26 -------- d-----w- c:\program files\PhotoFiltre
2009-07-31 17:32 . 2009-07-31 17:32 -------- d-----w- c:\windows\system32\CatRoot2
2009-07-31 15:05 . 2009-07-31 15:16 33920 ----a-w- c:\windows\system32\drivers\fsbts.sys
2009-07-31 15:05 . 2008-12-04 13:57 79872 ----a-w- c:\windows\system32\drivers\fsdfw.sys
2009-07-31 15:04 . 2009-08-03 14:02 -------- d-----w- c:\program files\F-Secure
2009-07-31 14:17 . 2009-07-31 14:46 -------- dc----w- C:\HostsXpert 4.3 - Hosts File Manager
2009-07-30 11:56 . 2009-08-01 15:00 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-07-29 21:09 . 2009-07-29 21:10 -------- dc----w- C:\HostsXpert 4.2 - Hosts File Manager
2009-07-28 19:19 . 2009-07-28 19:19 -------- dcs---w- C:\VerTerm
2009-07-28 17:50 . 2009-07-28 17:50 -------- d-----w- c:\program files\PetrLite
2009-07-28 16:14 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-28 16:14 . 2009-07-30 08:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-28 16:14 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-28 15:52 . 2009-07-28 15:52 28672 ----a-w- c:\windows\system32\eEmpty.exe
2009-07-28 15:36 . 2009-07-28 15:36 -------- d-----w- c:\program files\CCleaner
2009-07-28 15:30 . 2009-07-28 15:30 118842 ------r- c:\windows\bwUnin-6.3.2.116-7681197L.exe
2009-07-28 15:16 . 2009-07-28 15:25 -------- d-----w- c:\program files\RegCleaner
2009-07-28 14:03 . 2009-07-28 14:03 -------- d-----w- c:\program files\McAfee UnInstaller 6.5 Demo English
2009-07-28 13:58 . 2007-08-15 11:09 159744 ----a-w- c:\windows\system32\wt_menu.dll
2009-07-28 13:58 . 2007-08-15 11:09 40960 ----a-w- c:\windows\system32\ssubtmr6.dll
2009-07-28 13:58 . 1999-02-09 19:40 188928 ----a-w- c:\windows\system32\vbuzip10.DLL
2009-07-28 13:58 . 2009-07-28 13:59 -------- d-----w- c:\program files\Smarty Uninstaller Pro
2009-07-28 13:57 . 2009-07-28 13:57 -------- d-----w- c:\program files\VS Revo Group
2009-07-28 08:44 . 2009-07-31 13:25 -------- d-----w- c:\program files\Trend Micro
2009-07-27 15:13 . 2009-07-27 15:14 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-07-27 14:14 . 2009-07-27 14:14 -------- d-----w- c:\program files\XnView
2009-07-27 14:00 . 2009-07-27 14:00 -------- d-----w- c:\program files\RealWorld Cursor Editor
2009-07-27 13:56 . 2009-07-27 13:56 -------- d-----w- c:\program files\ImageForge3
2009-07-27 13:50 . 2009-07-27 13:50 -------- d-----w- c:\program files\HTML editor Yugie-shareware
2009-07-27 10:24 . 2009-07-27 10:24 -------- d-----w- c:\program files\BlueVoda Website Builder
2009-07-21 09:24 . 2009-07-21 09:24 -------- d-----w- c:\program files\Audacity
2009-07-21 09:21 . 2009-07-21 09:22 -------- d-----w- c:\program files\Audacity 1.3 Beta (Unicode)
2009-07-16 17:15 . 2009-07-16 17:18 -------- d-----w- c:\program files\Castle Strike

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-01 16:38 . 2008-08-02 17:50 -------- d-----w- c:\program files\Windows Desktop Search
2009-08-01 15:00 . 2008-06-02 12:40 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-01 14:59 . 2004-08-18 12:00 93318 ----a-w- c:\windows\system32\perfc005.dat
2009-08-01 14:59 . 2004-08-18 12:00 461558 ----a-w- c:\windows\system32\perfh005.dat
2009-07-27 15:41 . 2006-07-04 06:24 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-27 15:10 . 2006-07-05 17:26 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-07-26 15:54 . 2006-09-18 08:29 -------- d-----w- c:\program files\Illusion Softworks
2009-07-20 12:45 . 2006-07-05 17:36 -------- d-----w- c:\program files\GameSpy Arcade
2009-07-03 16:59 . 2004-08-18 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-30 11:44 . 2009-06-30 11:44 -------- d-----w- c:\program files\MumboJumbo
2009-06-29 10:33 . 2009-05-06 17:54 -------- d-----w- c:\program files\Stykz
2009-06-29 06:30 . 2009-06-13 15:47 -------- d-----w- c:\program files\World of Warcraft
2009-06-28 18:06 . 2007-05-18 18:18 -------- d-----w- c:\program files\Take2
2009-06-20 11:45 . 2006-09-09 18:52 -------- d-----w- c:\program files\Google
2009-06-16 14:40 . 2004-08-18 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2004-08-18 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-14 11:50 . 2009-06-14 11:50 -------- d-----w- c:\program files\Zeallsoft
2009-06-14 11:29 . 2009-06-14 11:06 -------- d-----w- c:\program files\Active GIF Creator 2.23
2009-06-12 16:16 . 2007-12-25 16:46 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2009-06-03 19:11 . 2004-08-18 12:00 1293824 ----a-w- c:\windows\system32\quartz.dll
2009-05-12 13:12 . 2006-07-04 06:30 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2009-05-07 15:33 . 2004-08-18 12:00 346624 ----a-w- c:\windows\system32\localspl.dll
2004-08-23 21:38 . 2004-08-23 21:38 3371 ----a-w- c:\program files\!!!readme.txt
2004-08-23 19:08 . 2004-08-23 19:08 83968 -c--a-w- c:\program files\NB_NB_2_12_37.xls
2009-06-21 17:55 . 2009-06-21 17:55 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

(((((((((((((((((((((((((((((((((((((((((( SR_Search ))))))))))))))))))))))))))))))))))))))))))))))))))))))))

[-] 56A6034E7764E23D9114223EB3523925 1571840 c:\windows\system32\dllcache\sfcfiles.dll
[-] 56A6034E7764E23D9114223EB3523925 1571840 \RP8\A0001334.dll
[-] 56A6034E7764E23D9114223EB3523925 1571840 \RP8\A0001338.dll

c:\windows\system32\sfcfiles.dll [x]
[-] 56A6034E7764E23D9114223EB3523925 1571840 \RP8\A0001333.dll
[-] 56A6034E7764E23D9114223EB3523925 1571840 \RP8\A0003428.dll
.
------- Sigcheck -------

Chyba šifrovací služby !!
.
((((((((((((((((((((((((((((( SnapShot@2009-07-30_13.43.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-03 13:58 . 2009-08-03 13:58 16384 c:\windows\temp\Perflib_Perfdata_1dc.dat
+ 2006-07-03 14:57 . 2008-04-14 03:22 32256 c:\windows\system32\wups.dll
+ 2004-08-18 12:00 . 2009-08-01 14:59 82006 c:\windows\system32\perfc009.dat
+ 2008-10-16 12:08 . 2008-10-16 12:08 34328 c:\windows\SoftwareDistribution\SelfUpdate\wups.dll
+ 2008-10-16 12:09 . 2008-10-16 12:09 51224 c:\windows\SoftwareDistribution\SelfUpdate\wuauclt.exe
+ 2006-07-03 14:57 . 2008-04-14 03:22 120320 c:\windows\system32\wuweb.dll
+ 2006-07-03 14:57 . 2008-04-14 03:22 112640 c:\windows\system32\wucltui.dll
+ 2006-07-03 14:57 . 2008-04-14 03:22 183296 c:\windows\system32\wuaueng1.dll
+ 2006-07-03 14:57 . 2008-04-14 03:22 166912 c:\windows\system32\wuauclt1.exe
+ 2006-07-03 14:57 . 2008-04-14 03:22 111104 c:\windows\system32\wuauclt.exe
+ 2006-07-03 14:57 . 2008-04-14 03:22 431104 c:\windows\system32\wuapi.dll
+ 2004-08-18 12:00 . 2009-08-01 14:59 465124 c:\windows\system32\perfh009.dat
+ 2006-07-04 06:35 . 2006-07-04 06:35 262144 c:\windows\system32\config\systemprofile\ntuser.dat
+ 2008-10-16 12:13 . 2008-10-16 12:13 202776 c:\windows\SoftwareDistribution\SelfUpdate\wuweb.dll
+ 2008-10-16 12:12 . 2008-10-16 12:12 323608 c:\windows\SoftwareDistribution\SelfUpdate\wucltui.dll
+ 2008-10-16 12:12 . 2008-10-16 12:12 561688 c:\windows\SoftwareDistribution\SelfUpdate\wuapi.dll
+ 2006-07-03 14:57 . 2008-04-14 03:22 1135616 c:\windows\system32\wuaueng.dll
+ 2008-10-16 12:13 . 2008-10-16 12:13 1809944 c:\windows\SoftwareDistribution\SelfUpdate\wuaueng.dll
- 2006-12-25 14:24 . 2009-07-28 17:35 2248192 c:\windows\Installer\483f4.msi
+ 2006-12-25 14:24 . 2009-08-02 10:48 2248192 c:\windows\Installer\483f4.msi
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 81920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-10 68856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Google Update"="c:\documents and settings\Marek\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2009-06-20 133104]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"F-Secure Manager"="c:\program files\F-Secure\Common\FSM32.EXE" [2008-12-04 182936]
"F-Secure TNB"="c:\program files\F-Secure\FSGUI\TNBUtil.exe" [2008-12-04 957024]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PnkBstrB"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
"c:\\Program Files\\Electronic Arts\\Need For Speed III\\nfs3.exe"=
"c:\\Program Files\\Sierra\\SWAT 4\\Content\\System\\Swat4.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Illusion Softworks\\Hidden & Dangerous 2\\hd2.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Sierra\\CoolPool\\coolpool.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Codemasters\\Worms 4 Totalni narez\\Worms 4 Mayhem.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\Program Files\\Electronic Arts\\Medal of Honor Airborne\\UnrealEngine3\\Binaries\\MOHA.exe"=
"c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Documents and Settings\\Marek\\Local Settings\\Data aplikací\\Dyyno Receiver\\DPPM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\keyclone\\keyclone.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.0.1-to-3.0.2-enGB-Win-Update-downloader.exe"=
"c:\\Documents and Settings\\Marek\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Marek\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\MumboJumbo\\Luxor\\luxor.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2869:TCP"= 2869:TCP:@xpsp2res.dll,-22008
"11001:TCP"= 11001:TCP:H&D2 port 11001
"11001:UDP"= 11001:UDP:H&D2 port 11001
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"12001:UDP"= 12001:UDP:SMART WebServer Handshake Multicast Port
"6112:TCP"= 6112:TCP:Blizzard Downloader

R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [31.7.2009 17:05 33920]
R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [31.7.2009 17:05 79872]
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [5.7.2006 14:46 63352]
R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\F-Secure\HIPS\drivers\fshs.sys [31.7.2009 17:04 67808]
R2 SMART Web Server;SMART Web Server;c:\program files\SMART Technologies Inc\SMART Board Software\WebServer.exe [19.4.2007 7:42 759312]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\F-Secure\Anti-Virus\minifilter\fsgk.sys [31.7.2009 17:04 99960]
R3 FSORSPClient;F-Secure ORSP Client;c:\program files\F-Secure\ORSP Client\fsorsp.exe [31.7.2009 17:05 55904]
S3 axskbus;axskbus;c:\windows\system32\DRIVERS\axskbus.sys --> c:\windows\system32\DRIVERS\axskbus.sys [?]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [20.2.2008 20:49 13352]
S3 M1000Srv;M5603C USB2.0 Camera Driver;c:\windows\system32\drivers\M1000KNT.sys [25.12.2006 22:11 276930]
S4 BackWeb Plug-in - 7681197;F-Secure Automatic Update;c:\progra~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE --> c:\progra~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [?]
S4 F-Secure Filter;F-Secure File System Filter;c:\program files\F-Secure\Anti-Virus\win2k\fsfilter.sys [31.7.2009 17:04 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\F-Secure\Anti-Virus\win2k\fsrec.sys [31.7.2009 17:04 25184]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Obsah adresáře 'Naplánované úlohy'

2009-06-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 11:42]

2009-08-03 c:\windows\Tasks\User_Feed_Synchronization-{CB8F93AA-F0A1-41BE-9268-229B640A54CD}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Doplňkový sken -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files\F-Secure\FSPS\program\FSLSP.DLL
FF - ProfilePath - c:\documents and settings\Marek\Data aplikací\Mozilla\Firefox\Profiles\j2ggv3xx.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - hxxp://www.atlas.cz/?from=icqhp
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... id=afex&q=
FF - component: c:\documents and settings\Marek\Data aplikací\Mozilla\Firefox\Profiles\j2ggv3xx.default\extensions\DTToolbar@toolbarnet.com\components\DTToolbarFF.dll
FF - plugin: c:\program files\Dyyno\Dyyno Player\npvlc.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-03 16:56
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(800)
c:\program files\F-Secure\FWES\Program\fsdc32.dll

- - - - - - - > 'lsass.exe'(856)
c:\program files\F-Secure\FSPS\program\FSLSP.DLL
c:\program files\F-Secure\FWES\Program\fsdc32.dll

- - - - - - - > 'explorer.exe'(636)
c:\program files\Common Files\Ahead\Lib\NeroDigitalExt.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll

- - - - - - - > 'csrss.exe'(772)
c:\program files\F-Secure\FWES\Program\fsdc32.dll
.
Celkový čas: 2009-08-03 16:58
ComboFix-quarantined-files.txt 2009-08-03 14:57
ComboFix2.txt 2009-08-02 16:09
ComboFix3.txt 2009-08-02 10:01
ComboFix4.txt 2009-07-31 09:39
ComboFix5.txt 2009-08-03 14:54

Před spuštěním: Volných bajtů: 145 133 965 312
Po spuštění: Volných bajtů: 145 139 089 408

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
266 --- E O F --- 2009-07-29 12:00

[jaro3]

Restartuj PC. Poté:
Toto otestuj na Virustotal
c:\windows\system32\sfcfiles.dll
c:\windows\system32\dllcache\sfcfiles.dll
c:\windows\Installer\483f4.msi
c:\windows\Installer\483f4.msi
Vlož sem pak odkazy výsledků.

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"=-


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

[MaxDamageCZ]

Soubor sfcfiles.dll.vir přijatý 2009.07.26 20:41:27 (UTC)
Současný stav: Dokončeno
Výsledek: 0/41 (0.00%)
Formátované Formátované
Vytisknout výsledky Vytisknout výsledky
Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.5.0.24 2009.07.26 -
AhnLab-V3 5.0.0.2 2009.07.26 -
AntiVir 7.9.0.228 2009.07.24 -
Antiy-AVL 2.0.3.7 2009.07.24 -
Authentium 5.1.2.4 2009.07.26 -
Avast 4.8.1335.0 2009.07.26 -
AVG 8.5.0.387 2009.07.26 -
BitDefender 7.2 2009.07.26 -
CAT-QuickHeal 10.00 2009.07.25 -
ClamAV 0.94.1 2009.07.26 -
Comodo 1775 2009.07.26 -
DrWeb 5.0.0.12182 2009.07.26 -
eSafe 7.0.17.0 2009.07.26 -
eTrust-Vet 31.6.6640 2009.07.25 -
F-Prot 4.4.4.56 2009.07.26 -
F-Secure 8.0.14470.0 2009.07.26 -
Fortinet 3.120.0.0 2009.07.26 -
GData 19 2009.07.26 -
Ikarus T3.1.1.64.0 2009.07.26 -
Jiangmin 11.0.800 2009.07.26 -
K7AntiVirus 7.10.802 2009.07.25 -
Kaspersky 7.0.0.125 2009.07.26 -
McAfee 5689 2009.07.26 -
McAfee+Artemis 5689 2009.07.26 -
McAfee-GW-Edition 6.8.5 2009.07.26 -
Microsoft 1.4903 2009.07.26 -
NOD32 4280 2009.07.26 -
Norman 6.01.09 2009.07.24 -
nProtect 2009.1.8.0 2009.07.26 -
Panda 10.0.0.14 2009.07.26 -
PCTools 4.4.2.0 2009.07.26 -
Prevx 3.0 2009.07.26 -
Rising 21.39.62.00 2009.07.26 -
Sophos 4.44.0 2009.07.26 -
Sunbelt 3.2.1858.2 2009.07.26 -
Symantec 1.4.4.12 2009.07.26 -
TheHacker 6.3.4.3.374 2009.07.26 -
TrendMicro 8.950.0.1094 2009.07.25 -
VBA32 3.12.10.9 2009.07.26 -
ViRobot 2009.7.25.1853 2009.07.25 -
VirusBuster 4.6.5.0 2009.07.26 -
Rozšiřující informace
File size: 1571840 bytes
MD5 : 56a6034e7764e23d9114223eb3523925
SHA1 : 886ea9e4eb843363decb534c67e024cf98236019
SHA256: 0f4522834efb9f391397de6533c37873a55e670a3d8f001d485f395ed2f0f504
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x120D
timedatestamp.....: 0x48025231 (Sun Apr 13 20:34:25 2008)
machinetype.......: 0x14C (Intel I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xCBF 0xE00 5.89 ccd83c1e26e262720c731cb56f817e7b
.data 0x2000 0x1744A8 0x174600 3.26 e58aed19433b12fea9d8093264bc807d
.rsrc 0x177000 0x408 0x600 2.50 51475f865b45066a3692f34ab9b77cd4
.reloc 0x178000 0x9CFC 0x9E00 5.77 7a58ceb675c48048ea9a69c7643e68d2

( 1 imports )

> ntdll.dll: LdrDisableThreadCalloutsForDll, NtClose, NtQueryValueKey, NtOpenKey, RtlInitUnicodeString, RtlGetVersion, NtTerminateProcess, RtlUnhandledExceptionFilter, RtlUnwind, NtQueryVirtualMemory

( 1 exports )

> SfcGetFiles
TrID : File type identification
Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ssdeep: 3072:d0+RebH/3ETKnPPrSMpxo7KlKR2IgYohuFII7KL3y7v+15F+bAVIv3eNmnW:dsosppx2KORFn0yD+v3E7W
PEiD : -
RDS : NSRL Reference Data Set
-

VAROVÁNÍ VAROVÁNÍ: VirusTotal je služba poskytovaná zdarma společnosti Hispasec Sistemas. Kvalita výsledků není nijak zaručena. Výsledky jsou závislé na tvůrci daného produktu. Vysledky testů nemusí být 100% správné. Tyto výsledky nemusí znamenat, že daný soubor je infikován, nebo čistý!