Prosim o kontrolu logu-PC zamrzne Vyřešeno

[bruno]

Prosim o kontrolu logu,comp když postoji tak zamrza,a po restartu ESET Smar hlasi trojana 6.12.2009 12:40:01 Rezidentná ochrana súbor C:\WINDOWS\system32\drivers\atapi.sys Win32/Wigon.MM trójsky kôň nemožno liečiť NT AUTHORITY\SYSTEM Táto skutočnosť bola zistená na súbore, ktorý bol modifikovaný aplikáciou: C:\WINDOWS\System32\svchost.exe.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:53:25, on 6.12.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\ZSSnp211.exe
C:\Program Files\MP3 Flash Drive Driver v2.08r022\shwicon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\av_md.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.zoznam.sk/?
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: Podpora odkazu pre aplikáciu Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\WINDOWS\WebIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe
O4 - HKLM\..\Run: [ShowIcon_The Company_MP3 Flash Drive Driver v2.08r022] "C:\Program Files\MP3 Flash Drive Driver v2.08r022\shwicon.exe" -t"The Company\MP3 Flash Drive Driver v2.08r022"
O4 - HKLM\..\Run: [av_md] C:\WINDOWS\system32\av_md.exe
O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [av_md] C:\Documents and Settings\Bruno.JA-3A4C675D4C38\av_md.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: siszyd32.exe
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftup ... 6290450203
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 7548263984
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/L ... nstall.cab
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

--
End of file - 7867 bytes

[Reklama]

[Damned]

Neřešil si to náhodou s pitimirem nebo před nedávnem se mnou?

Spusť HJT (HijackThis), vypni prohlížeče, odpoj se od internetu a fixni (spustit HJT, "Do a system scan only",
zatrhnout políčko před hodnotou, zmáčknout "Fix checked" a poté "Ano"):

O4 - HKLM\..\Run: [av_md] C:\WINDOWS\system32\av_md.exe
O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKCU\..\Run: [av_md] C:\Documents and Settings\Bruno.JA-3A4C675D4C38\av_md.exe
O4 - Startup: siszyd32.exe
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
*****************************************************************************************************************************************
Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

[bruno]

Ano delali jsme to spolu vypadalo to dobre pokud jsem pracoval na compu,jakmile postal zamrzlo.ted když jsem skenoval Mbm tak znova anntivirus reakoval na infiltraci tak mi vždy prosimte napiš jestli muže byt pripojeny a take na sit.
Log
Malwarebytes' Anti-Malware 1.42
Verzia databázy: 3303
Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

6.12.2009 16:38:27
mbam-log-2009-12-06 (16-38-15).txt

Typ kontroly: Rýchla
Objektov kontrolovaných: 182454
Uplynutý cas: 6 minute(s), 1 second(s)

Infikovaných procesov pamäte: 0
Infikovaných modulov pamäte: 0
Infikovaných registracných klúcov: 0
Infikovaných registracných hodnôt: 1
Infikovaných registracných údajov položiek: 0
Infikovaných priecinkov: 0
Infikovaných súborov: 5

Infikovaných procesov pamäte:
(Žiadne škodlivé položky)

Infikovaných modulov pamäte:
(Žiadne škodlivé položky)

Infikovaných registracných klúcov:
(Žiadne škodlivé položky)

Infikovaných registracných hodnôt:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regedit32 (Trojan.Agent) -> No action taken.

Infikovaných registracných údajov položiek:
(Žiadne škodlivé položky)

Infikovaných priecinkov:
(Žiadne škodlivé položky)

Infikovaných súborov:
C:\WINDOWS\system32\av_md.exe (Backdoor.Bot) -> No action taken.
C:\WINDOWS\system32\config\SystemProfile\av_md.exe (Backdoor.Bot) -> No action taken.
C:\WINDOWS\temp\~TME.tmp (Backdoor.Bot) -> No action taken.
C:\WINDOWS\temp\~TMF.tmp (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\Bruno.JA-3A4C675D4C38\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> No action taken.

[Damned]

Takže spusť znovu MbAM a dej Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Konec

Vypni rezidentní štít antiviru (pokud máš tak i antispyware).
Stáhni si ComboFix (by sUBs)
nebo ComboFix (subs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[bruno]

Malwarebytes' Anti-Malware 1.42
Verzia databázy: 3303
Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

6.12.2009 17:44:56
mbam-log-2009-12-06 (17-44-56).txt

Typ kontroly: Rýchla
Objektov kontrolovaných: 182486
Uplynutý cas: 6 minute(s), 25 second(s)

Infikovaných procesov pamäte: 0
Infikovaných modulov pamäte: 0
Infikovaných registracných klúcov: 0
Infikovaných registracných hodnôt: 1
Infikovaných registracných údajov položiek: 0
Infikovaných priecinkov: 0
Infikovaných súborov: 5

Infikovaných procesov pamäte:
(Žiadne škodlivé položky)

Infikovaných modulov pamäte:
(Žiadne škodlivé položky)

Infikovaných registracných klúcov:
(Žiadne škodlivé položky)

Infikovaných registracných hodnôt:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regedit32 (Trojan.Agent) -> Quarantined and deleted successfully.

Infikovaných registracných údajov položiek:
(Žiadne škodlivé položky)

Infikovaných priecinkov:
(Žiadne škodlivé položky)

Infikovaných súborov:
C:\WINDOWS\system32\av_md.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\config\SystemProfile\av_md.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\~TME.tmp (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\~TMF.tmp (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Bruno.JA-3A4C675D4C38\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> Quarantined and deleted successfully.
ComboFix 09-12-06.01 - Bruno 06.12.2009 17:56.12.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1033.18.2047.1636 [GMT 1:00]
Running from: c:\documents and settings\Bruno.JA-3A4C675D4C38\Desktop\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
Error: Cfiles.dat

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Bruno.JA-3A4C675D4C38\Start Menu\Programs\Startup\siszyd32.exe

Infected copy of c:\windows\system32\Drivers\atapi.sys was found and disinfected
Restored copy from - c:\windows\erdnt\cache\atapi.sys

.
((((((((((((((((((((((((( Files Created from 2009-11-06 to 2009-12-06 )))))))))))))))))))))))))))))))
.

2009-12-06 15:30 . 2009-12-03 15:14 38224 -c--a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-06 15:30 . 2009-12-03 15:13 19160 -c--a-w- c:\windows\system32\drivers\mbam.sys
2009-12-06 15:30 . 2009-12-06 15:30 -------- dc----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-06 07:59 . 2009-12-06 07:59 -------- dc----w- c:\windows\system32\wbem\Repository
2009-12-06 07:07 . 2009-10-30 14:08 29512 -c--a-w- c:\windows\system32\TURegOpt.exe
2009-12-06 07:07 . 2009-10-30 14:01 30024 -c--a-w- c:\windows\system32\uxtuneup.dll
2009-12-06 07:07 . 2009-12-06 08:06 -------- dc----w- c:\program files\TuneUp Utilities 2010
2009-12-05 21:38 . 2009-12-06 09:19 116 -c--a-w- c:\windows\system32\fjhdyfhsn.bat
2009-12-05 19:24 . 2009-12-06 17:11 664 -c--a-w- c:\windows\system32\d3d9caps.dat
2009-12-05 05:05 . 2009-12-05 05:05 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\Malwarebytes
2009-12-05 05:04 . 2009-12-05 05:04 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-12-04 00:50 . 2009-12-04 00:50 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\FileCure
2009-12-04 00:42 . 2009-12-04 00:42 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\licenses
2009-12-04 00:42 . 2009-12-04 00:42 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\PCMM2009
2009-12-03 02:30 . 2009-12-03 02:30 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\Winferno
2009-12-03 02:26 . 2009-12-03 02:26 -------- dc----w- c:\program files\Freeze.com
2009-12-03 02:26 . 2009-12-03 02:26 -------- dc----w- c:\program files\Free Offers from Freeze.com
2009-12-03 02:25 . 2009-12-03 02:33 -------- dc----w- c:\program files\Winferno
2009-12-03 00:23 . 2009-12-03 00:23 -------- dc----w- c:\program files\EarthView
2009-12-03 00:23 . 2009-12-03 00:23 102400 -c--a-w- c:\windows\EarthView.scr
2009-12-03 00:23 . 2009-12-03 00:23 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\DeskSoft
2009-12-03 00:19 . 2009-12-03 00:19 -------- dc----w- c:\program files\Common Files\Windows Live
2009-11-29 18:08 . 2009-11-29 18:08 -------- dc----w- c:\program files\NewFreeScreensavers
2009-11-29 17:35 . 2009-11-30 19:57 -------- dc----w- c:\program files\Unlocker
2009-11-28 09:45 . 2009-11-28 18:07 -------- dc----w- c:\program files\OGSConverter
2009-11-27 13:06 . 2009-11-27 13:06 -------- dc----w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-11-23 05:57 . 2009-12-06 11:53 -------- dc----w- c:\program files\Trend Micro
2009-11-21 10:40 . 2009-11-21 10:40 -------- dc----w- c:\program files\Recuva
2009-11-21 10:37 . 2009-11-21 10:37 -------- dc----w- c:\program files\Speccy
2009-11-21 10:22 . 2009-11-21 10:22 -------- dc----w- c:\program files\CCleaner
2009-11-21 08:48 . 2009-11-21 08:48 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\Blitware
2009-11-21 07:53 . 2009-11-21 08:25 -------- dc----w- c:\program files\MP3 Flash Drive Driver v2.08r022
2009-11-21 00:19 . 2009-11-21 00:19 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Local Settings\Application Data\Centrum.cz Toolbar
2009-11-18 14:00 . 2009-11-18 14:00 -------- dc----w- c:\documents and settings\LocalService.NT AUTHORITY.003\Application Data\TuneUp Software
2009-11-18 13:54 . 2009-11-18 13:54 -------- dcsh--w- c:\documents and settings\All Users.WINDOWS\Application Data\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2009-11-16 13:02 . 2009-11-16 13:02 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Local Settings\Application Data\Microsoft Corporation
2009-11-12 14:00 . 2009-11-12 14:00 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\nView_Profiles
2009-11-09 12:07 . 2009-11-09 12:07 902592 -c--a-w- c:\windows\system32\drivers\tdrpm228.sys
2009-11-09 12:07 . 2009-11-09 12:07 540000 -c--a-w- c:\windows\system32\drivers\timntr.sys
2009-11-09 12:07 . 2009-11-09 12:07 44704 -c--a-w- c:\windows\system32\drivers\tifsfilt.sys
2009-11-09 12:07 . 2009-11-11 22:31 -------- dc----w- c:\program files\Common Files\Acronis

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-06 16:03 . 2008-11-28 05:19 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\Skype
2009-12-06 15:04 . 2008-07-31 12:24 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\skypePM
2009-12-06 09:47 . 2008-10-20 16:52 1 -c--a-w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-12-06 09:19 . 2009-12-06 09:19 16 -c--a-w- c:\documents and settings\LocalService.NT AUTHORITY.003\Application Data\fvgqad.dat
2009-12-06 08:02 . 2009-12-06 08:02 16 -c--a-w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\fvgqad.dat
2009-12-05 21:38 . 2009-12-05 21:38 16 -c--a-w- c:\documents and settings\NetworkService.NT AUTHORITY.003\Application Data\fvgqad.dat
2009-12-05 21:38 . 2009-12-05 21:38 4 -c--a-w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\avdrn.dat
2009-12-04 01:05 . 2009-09-20 16:56 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\ParetoLogic
2009-12-03 16:22 . 2008-09-22 05:39 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\MSN6
2009-11-21 10:59 . 2008-07-12 07:42 -------- dc----w- c:\program files\Vimicro
2009-11-20 15:15 . 2009-07-26 23:36 -------- dc----w- c:\program files\SpeedSim
2009-11-19 07:29 . 2008-07-27 12:55 2282496 -c--a-w- c:\windows\system32\TUKernel.exe
2009-11-18 14:45 . 2008-07-27 12:53 6964736 -c--a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe
2009-11-18 14:01 . 2009-07-12 17:29 -------- dc----w- c:\program files\TweakNow RegCleaner
2009-11-18 14:01 . 2009-07-12 17:29 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\TweakNow RegCleaner
2009-11-18 13:54 . 2008-07-17 16:43 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\TuneUp Software
2009-11-14 11:20 . 2009-01-18 15:45 411368 -c--a-w- c:\windows\system32\deploytk.dll
2009-11-01 00:01 . 2009-08-09 00:25 139584 -c--a-w- c:\documents and settings\LocalService.NT AUTHORITY.003\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-10-29 23:35 . 2009-10-29 10:40 -------- dc----w- c:\program files\Cake Mania Main Street
2009-10-29 11:15 . 2009-10-29 11:15 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\Sandlot Games
2009-10-14 09:39 . 2009-10-14 09:39 -------- dc----w- c:\program files\ReflexiveArcade
2009-09-20 17:25 . 2008-07-31 10:32 18920 -c--a-w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"nwiz"="nwiz.exe" [2008-10-07 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-10-24 1451264]
"ZSSnp211"="c:\windows\ZSSnp211.exe" [2006-08-19 49152]
"ShowIcon_The Company_MP3 Flash Drive Driver v2.08r022"="c:\program files\MP3 Flash Drive Driver v2.08r022\shwicon.exe" [2003-12-11 73728]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users.WINDOWS\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe
"av_md"=c:\documents and settings\Bruno.JA-3A4C675D4C38\av_md.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
"Domino"=c:\windows\Domino.exe
"Regedit32"=c:\windows\system32\regedit.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\IEPro\\MiniDM.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\WINDOWS\\system32\\electricsheep.scr"=
"c:\\Program Files\\Vimicro\\ZS211\\Driver AutoInstall\\Driver Files\\amcap.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [24.10.2008 20:51 468224]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [30.10.2009 15:05 1021256]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [14.10.2009 7:24 10064]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [23.7.2008 3:30 717296]
S3 PAC207;VideoCAM GE111;c:\windows\system32\drivers\pfc027.sys [8.4.2005 9:46 162176]
S3 TVICHW32;TVICHW32;c:\windows\system32\drivers\TVICHW32.SYS [7.1.2009 13:36 23600]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
uStart Page = hxxp://www.zoznam.sk/?
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\windows\WebIE.dll
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/L ... nstall.cab
FF - ProfilePath - c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\Mozilla\Firefox\Profiles\8ovtu077.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.zoznam.sk/
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\documents and settings\All Users.WINDOWS\Application Data\RealArcade\npraclient.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-06 18:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3732)
c:\windows\system32\WININET.dll
c:\windows\system32\nview.dll
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\wpdshext.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\Audiodev.dll
c:\windows\system32\WMVCore.DLL
c:\windows\system32\WMASF.DLL
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_slk.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\windows\System32\PAStiSvc.exe
c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2009-12-06 18:16 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-06 17:16

Pre-Run: 10 100 117 504 bytes free
Post-Run: 10 082 844 672 bytes free

Current=4 Default=4 Failed=1 LastKnownGood=5 Sets=1,2,3,4,5
- - End Of File - - D2030DE54FBCCFF949A59BF95480C400

[Damned]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
c:\windows\system32\fjhdyfhsn.bat
c:\windows\system32\d3d9caps.dat
c:\documents and settings\LocalService.NT AUTHORITY.003\Application Data\fvgqad.dat
c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\fvgqad.dat
c:\documents and settings\NetworkService.NT AUTHORITY.003\Application Data\fvgqad.dat
c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\avdrn.dat
c:\documents and settings\Bruno.JA-3A4C675D4C38\av_md.exe
c:\documents and settings\LocalService.NT AUTHORITY.003\Application Data\zxcvbd.dat

Registry::
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"av_md"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Regedit32"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\electricsheep.scr"=-




Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix, oprava může trvat i déle než 10 minut. ! Nech ComboFix dokončit svou práci !
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT a popiš chování počítače

[bruno]

ComboFix 09-12-06.01 - Bruno 06.12.2009 19:47.13.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1033.18.2047.1506 [GMT 1:00]
Running from: c:\documents and settings\Bruno.JA-3A4C675D4C38\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Bruno.JA-3A4C675D4C38\Desktop\CFScript.txt
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

FILE ::
"c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\avdrn.dat"
"c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\fvgqad.dat"
"c:\documents and settings\Bruno.JA-3A4C675D4C38\av_md.exe"
"c:\documents and settings\LocalService.NT AUTHORITY.003\Application Data\fvgqad.dat"
"c:\documents and settings\LocalService.NT AUTHORITY.003\Application Data\zxcvbd.dat"
"c:\documents and settings\NetworkService.NT AUTHORITY.003\Application Data\fvgqad.dat"
"c:\windows\system32\d3d9caps.dat"
"c:\windows\system32\fjhdyfhsn.bat"
.
Error: Cfiles.dat

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\avdrn.dat
c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\fvgqad.dat
c:\documents and settings\LocalService.NT AUTHORITY.003\Application Data\fvgqad.dat
c:\documents and settings\NetworkService.NT AUTHORITY.003\Application Data\fvgqad.dat
c:\windows\system32\d3d9caps.dat
c:\windows\system32\fjhdyfhsn.bat

.
((((((((((((((((((((((((( Files Created from 2009-11-06 to 2009-12-06 )))))))))))))))))))))))))))))))
.

2009-12-06 15:30 . 2009-12-03 15:14 38224 -c--a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-06 15:30 . 2009-12-03 15:13 19160 -c--a-w- c:\windows\system32\drivers\mbam.sys
2009-12-06 15:30 . 2009-12-06 15:30 -------- dc----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-06 07:59 . 2009-12-06 07:59 -------- dc----w- c:\windows\system32\wbem\Repository
2009-12-05 05:05 . 2009-12-05 05:05 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\Malwarebytes
2009-12-05 05:04 . 2009-12-05 05:04 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-12-04 00:50 . 2009-12-04 00:50 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\FileCure
2009-12-04 00:42 . 2009-12-04 00:42 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\licenses
2009-12-04 00:42 . 2009-12-04 00:42 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\PCMM2009
2009-12-03 02:30 . 2009-12-03 02:30 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\Winferno
2009-12-03 02:26 . 2009-12-03 02:26 -------- dc----w- c:\program files\Freeze.com
2009-12-03 02:26 . 2009-12-03 02:26 -------- dc----w- c:\program files\Free Offers from Freeze.com
2009-12-03 02:25 . 2009-12-03 02:33 -------- dc----w- c:\program files\Winferno
2009-12-03 00:23 . 2009-12-03 00:23 -------- dc----w- c:\program files\EarthView
2009-12-03 00:23 . 2009-12-03 00:23 102400 -c--a-w- c:\windows\EarthView.scr
2009-12-03 00:23 . 2009-12-03 00:23 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\DeskSoft
2009-12-03 00:19 . 2009-12-03 00:19 -------- dc----w- c:\program files\Common Files\Windows Live
2009-11-29 18:08 . 2009-11-29 18:08 -------- dc----w- c:\program files\NewFreeScreensavers
2009-11-29 17:35 . 2009-11-30 19:57 -------- dc----w- c:\program files\Unlocker
2009-11-28 09:45 . 2009-11-28 18:07 -------- dc----w- c:\program files\OGSConverter
2009-11-27 13:06 . 2009-11-27 13:06 -------- dc----w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-11-23 05:57 . 2009-12-06 11:53 -------- dc----w- c:\program files\Trend Micro
2009-11-21 10:40 . 2009-11-21 10:40 -------- dc----w- c:\program files\Recuva
2009-11-21 10:37 . 2009-11-21 10:37 -------- dc----w- c:\program files\Speccy
2009-11-21 10:22 . 2009-11-21 10:22 -------- dc----w- c:\program files\CCleaner
2009-11-21 08:48 . 2009-11-21 08:48 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\Blitware
2009-11-21 07:53 . 2009-11-21 08:25 -------- dc----w- c:\program files\MP3 Flash Drive Driver v2.08r022
2009-11-21 00:19 . 2009-11-21 00:19 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Local Settings\Application Data\Centrum.cz Toolbar
2009-11-18 14:00 . 2009-11-18 14:00 -------- dc----w- c:\documents and settings\LocalService.NT AUTHORITY.003\Application Data\TuneUp Software
2009-11-18 13:54 . 2009-11-18 13:54 -------- dcsh--w- c:\documents and settings\All Users.WINDOWS\Application Data\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2009-11-16 13:02 . 2009-11-16 13:02 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Local Settings\Application Data\Microsoft Corporation
2009-11-12 14:00 . 2009-11-12 14:00 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\nView_Profiles
2009-11-09 12:07 . 2009-11-09 12:07 902592 -c--a-w- c:\windows\system32\drivers\tdrpm228.sys
2009-11-09 12:07 . 2009-11-09 12:07 540000 -c--a-w- c:\windows\system32\drivers\timntr.sys
2009-11-09 12:07 . 2009-11-09 12:07 44704 -c--a-w- c:\windows\system32\drivers\tifsfilt.sys
2009-11-09 12:07 . 2009-11-11 22:31 -------- dc----w- c:\program files\Common Files\Acronis

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-06 16:03 . 2008-11-28 05:19 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\Skype
2009-12-06 15:04 . 2008-07-31 12:24 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\skypePM
2009-12-06 09:47 . 2008-10-20 16:52 1 -c--a-w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-12-04 01:05 . 2009-09-20 16:56 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\ParetoLogic
2009-12-03 16:22 . 2008-09-22 05:39 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\MSN6
2009-11-21 10:59 . 2008-07-12 07:42 -------- dc----w- c:\program files\Vimicro
2009-11-20 15:15 . 2009-07-26 23:36 -------- dc----w- c:\program files\SpeedSim
2009-11-19 07:29 . 2008-07-27 12:55 2282496 -c--a-w- c:\windows\system32\TUKernel.exe
2009-11-18 14:45 . 2008-07-27 12:53 6964736 -c--a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe
2009-11-18 14:01 . 2009-07-12 17:29 -------- dc----w- c:\program files\TweakNow RegCleaner
2009-11-18 14:01 . 2009-07-12 17:29 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\TweakNow RegCleaner
2009-11-18 13:54 . 2008-07-17 16:43 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\TuneUp Software
2009-11-14 11:20 . 2009-01-18 15:45 411368 -c--a-w- c:\windows\system32\deploytk.dll
2009-11-01 00:01 . 2009-08-09 00:25 139584 -c--a-w- c:\documents and settings\LocalService.NT AUTHORITY.003\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-10-29 23:35 . 2009-10-29 10:40 -------- dc----w- c:\program files\Cake Mania Main Street
2009-10-29 11:15 . 2009-10-29 11:15 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\Sandlot Games
2009-10-14 09:39 . 2009-10-14 09:39 -------- dc----w- c:\program files\ReflexiveArcade
2009-09-20 17:25 . 2008-07-31 10:32 18920 -c--a-w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"nwiz"="nwiz.exe" [2008-10-07 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-10-24 1451264]
"ZSSnp211"="c:\windows\ZSSnp211.exe" [2006-08-19 49152]
"ShowIcon_The Company_MP3 Flash Drive Driver v2.08r022"="c:\program files\MP3 Flash Drive Driver v2.08r022\shwicon.exe" [2003-12-11 73728]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users.WINDOWS\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
"Domino"=c:\windows\Domino.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\IEPro\\MiniDM.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Vimicro\\ZS211\\Driver AutoInstall\\Driver Files\\amcap.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [24.10.2008 20:51 468224]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [23.7.2008 3:30 717296]
S3 PAC207;VideoCAM GE111;c:\windows\system32\drivers\pfc027.sys [8.4.2005 9:46 162176]
S3 TVICHW32;TVICHW32;c:\windows\system32\drivers\TVICHW32.SYS [7.1.2009 13:36 23600]

--- Other Services/Drivers In Memory ---

*Deregistered* - TuneUpUtilitiesDrv
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
uStart Page = hxxp://www.zoznam.sk/?
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\windows\WebIE.dll
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/L ... nstall.cab
FF - ProfilePath - c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\Mozilla\Firefox\Profiles\8ovtu077.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.zoznam.sk/
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\documents and settings\All Users.WINDOWS\Application Data\RealArcade\npraclient.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
Completion time: 2009-12-06 19:54
ComboFix-quarantined-files.txt 2009-12-06 18:53
ComboFix2.txt 2009-12-06 17:16

Pre-Run: 10 454 499 328 bytes free
Post-Run: 10 417 340 416 bytes free

Current=4 Default=4 Failed=1 LastKnownGood=5 Sets=1,2,3,4,5
- - End Of File - - 655935ABD9B014B0BC2FB9FC7D7392F4
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:59:41, on 6.12.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ZSSnp211.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.zoznam.sk/?
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: Podpora odkazu pre aplikáciu Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\WINDOWS\WebIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe
O4 - HKLM\..\Run: [ShowIcon_The Company_MP3 Flash Drive Driver v2.08r022] "C:\Program Files\MP3 Flash Drive Driver v2.08r022\shwicon.exe" -t"The Company\MP3 Flash Drive Driver v2.08r022"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftup ... 6290450203
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 7548263984
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/L ... nstall.cab
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 6559 bytes

[Damned]

Odinstaluj ComboFix ( nutné ) .
ComboFix se odinstaluje takto:
Start-Spustit a zadej Combofix[mezera]/uninstall

Stáhni si T-Cleaner ( nutné - smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš->spustíš)

(pozn.Pokud máš AVG, avast! nebo Aviru, před stažením T-Cleaneru a po dobu čištění deaktivuj AVG, avast! i Aviru (i rezidenty), následně T-Cleaner smaž a zapni si AVG,avast!, Aviru.)


Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.

Stáhni si ToolsCleaner2 (by de A.Rothstein & Dj Quiou) na Plochu a spusť ho.

Klikni na Pt. Restauration (obnova) a poté na OK.
Klikni na Corbeille (koš) a poté na OK.
Klikni na Fichiers temp (temp složky) a poté na OK.
Klikni na Recherche (hledání) a nech Cleaner pracovat. Může se během čištění zastavit , ale nech ho pokračovat.
Když program skončí , klikni na Suppression (odstranění) a odstraň nalezené.
Zavři a smaž program.

Kdyby se něco zase objevilo, tak se zastav.
Označ topic za vyřešený (zelená fajfka) a měj se.

[bruno]

musim se zeptat jestli to je ok unistal Combofix

ComboFix 09-12-06.01 - Bruno 06.12.2009 20:49.14.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1033.18.2047.1430 [GMT 1:00]
Running from: c:\documents and settings\Bruno.JA-3A4C675D4C38\Desktop\ComboFix.exe
Command switches used :: /unistal
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
Error: Cfiles.dat

((((((((((((((((((((((((( Files Created from 2009-11-06 to 2009-12-06 )))))))))))))))))))))))))))))))
.

2009-12-06 15:30 . 2009-12-03 15:14 38224 -c--a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-06 15:30 . 2009-12-03 15:13 19160 -c--a-w- c:\windows\system32\drivers\mbam.sys
2009-12-06 15:30 . 2009-12-06 15:30 -------- dc----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-06 07:59 . 2009-12-06 07:59 -------- dc----w- c:\windows\system32\wbem\Repository
2009-12-05 05:05 . 2009-12-05 05:05 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\Malwarebytes
2009-12-05 05:04 . 2009-12-05 05:04 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-12-04 00:50 . 2009-12-04 00:50 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\FileCure
2009-12-04 00:42 . 2009-12-04 00:42 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\licenses
2009-12-04 00:42 . 2009-12-04 00:42 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\PCMM2009
2009-12-03 02:30 . 2009-12-03 02:30 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\Winferno
2009-12-03 02:26 . 2009-12-03 02:26 -------- dc----w- c:\program files\Freeze.com
2009-12-03 02:26 . 2009-12-03 02:26 -------- dc----w- c:\program files\Free Offers from Freeze.com
2009-12-03 02:25 . 2009-12-03 02:33 -------- dc----w- c:\program files\Winferno
2009-12-03 00:23 . 2009-12-03 00:23 -------- dc----w- c:\program files\EarthView
2009-12-03 00:23 . 2009-12-03 00:23 102400 -c--a-w- c:\windows\EarthView.scr
2009-12-03 00:23 . 2009-12-03 00:23 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\DeskSoft
2009-12-03 00:19 . 2009-12-03 00:19 -------- dc----w- c:\program files\Common Files\Windows Live
2009-11-29 18:08 . 2009-11-29 18:08 -------- dc----w- c:\program files\NewFreeScreensavers
2009-11-29 17:35 . 2009-11-30 19:57 -------- dc----w- c:\program files\Unlocker
2009-11-28 09:45 . 2009-11-28 18:07 -------- dc----w- c:\program files\OGSConverter
2009-11-27 13:06 . 2009-11-27 13:06 -------- dc----w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2009-11-23 05:57 . 2009-12-06 11:53 -------- dc----w- c:\program files\Trend Micro
2009-11-21 10:40 . 2009-11-21 10:40 -------- dc----w- c:\program files\Recuva
2009-11-21 10:37 . 2009-11-21 10:37 -------- dc----w- c:\program files\Speccy
2009-11-21 10:22 . 2009-11-21 10:22 -------- dc----w- c:\program files\CCleaner
2009-11-21 08:48 . 2009-11-21 08:48 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\Blitware
2009-11-21 07:53 . 2009-11-21 08:25 -------- dc----w- c:\program files\MP3 Flash Drive Driver v2.08r022
2009-11-21 00:19 . 2009-11-21 00:19 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Local Settings\Application Data\Centrum.cz Toolbar
2009-11-18 14:00 . 2009-11-18 14:00 -------- dc----w- c:\documents and settings\LocalService.NT AUTHORITY.003\Application Data\TuneUp Software
2009-11-18 13:54 . 2009-11-18 13:54 -------- dcsh--w- c:\documents and settings\All Users.WINDOWS\Application Data\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2009-11-16 13:02 . 2009-11-16 13:02 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Local Settings\Application Data\Microsoft Corporation
2009-11-12 14:00 . 2009-11-12 14:00 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\nView_Profiles
2009-11-09 12:07 . 2009-11-09 12:07 902592 -c--a-w- c:\windows\system32\drivers\tdrpm228.sys
2009-11-09 12:07 . 2009-11-09 12:07 540000 -c--a-w- c:\windows\system32\drivers\timntr.sys
2009-11-09 12:07 . 2009-11-09 12:07 44704 -c--a-w- c:\windows\system32\drivers\tifsfilt.sys
2009-11-09 12:07 . 2009-11-11 22:31 -------- dc----w- c:\program files\Common Files\Acronis

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-06 19:46 . 2008-11-28 05:19 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\Skype
2009-12-06 19:04 . 2008-07-31 12:24 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\skypePM
2009-12-06 09:47 . 2008-10-20 16:52 1 -c--a-w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-12-04 01:05 . 2009-09-20 16:56 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\ParetoLogic
2009-12-03 16:22 . 2008-09-22 05:39 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\MSN6
2009-11-21 10:59 . 2008-07-12 07:42 -------- dc----w- c:\program files\Vimicro
2009-11-20 15:15 . 2009-07-26 23:36 -------- dc----w- c:\program files\SpeedSim
2009-11-19 07:29 . 2008-07-27 12:55 2282496 -c--a-w- c:\windows\system32\TUKernel.exe
2009-11-18 14:45 . 2008-07-27 12:53 6964736 -c--a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe
2009-11-18 14:01 . 2009-07-12 17:29 -------- dc----w- c:\program files\TweakNow RegCleaner
2009-11-18 14:01 . 2009-07-12 17:29 -------- dc----w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\TweakNow RegCleaner
2009-11-18 13:54 . 2008-07-17 16:43 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\TuneUp Software
2009-11-14 11:20 . 2009-01-18 15:45 411368 -c--a-w- c:\windows\system32\deploytk.dll
2009-11-01 00:01 . 2009-08-09 00:25 139584 -c--a-w- c:\documents and settings\LocalService.NT AUTHORITY.003\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-10-29 23:35 . 2009-10-29 10:40 -------- dc----w- c:\program files\Cake Mania Main Street
2009-10-29 11:15 . 2009-10-29 11:15 -------- dc----w- c:\documents and settings\All Users.WINDOWS\Application Data\Sandlot Games
2009-10-14 09:39 . 2009-10-14 09:39 -------- dc----w- c:\program files\ReflexiveArcade
2009-09-20 17:25 . 2008-07-31 10:32 18920 -c--a-w- c:\documents and settings\Bruno.JA-3A4C675D4C38\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( SnapShot@2009-12-06_17.11.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-12-06 19:04 . 2009-12-06 19:04 371272 c:\windows\Installer\{D103C4BA-F905-437A-8049-DB24763BBE36}\SkypeIcon.exe
- 2009-12-06 09:00 . 2009-12-06 09:00 371272 c:\windows\Installer\{D103C4BA-F905-437A-8049-DB24763BBE36}\SkypeIcon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"nwiz"="nwiz.exe" [2008-10-07 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-10-24 1451264]
"ZSSnp211"="c:\windows\ZSSnp211.exe" [2006-08-19 49152]
"ShowIcon_The Company_MP3 Flash Drive Driver v2.08r022"="c:\program files\MP3 Flash Drive Driver v2.08r022\shwicon.exe" [2003-12-11 73728]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users.WINDOWS\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
"Domino"=c:\windows\Domino.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\IEPro\\MiniDM.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Vimicro\\ZS211\\Driver AutoInstall\\Driver Files\\amcap.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [24.10.2008 20:51 468224]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [23.7.2008 3:30 717296]
S3 PAC207;VideoCAM GE111;c:\windows\system32\drivers\pfc027.sys [8.4.2005 9:46 162176]
S3 TVICHW32;TVICHW32;c:\windows\system32\drivers\TVICHW32.SYS [7.1.2009 13:36 23600]

--- Other Services/Drivers In Memory ---

*Deregistered* - TuneUpUtilitiesDrv
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
uStart Page = hxxp://www.zoznam.sk/?
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\windows\WebIE.dll
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/L ... nstall.cab
FF - ProfilePath - c:\documents and settings\Bruno.JA-3A4C675D4C38\Application Data\Mozilla\Firefox\Profiles\8ovtu077.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.zoznam.sk/
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\documents and settings\All Users.WINDOWS\Application Data\RealArcade\npraclient.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-06 20:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2120)
c:\windows\system32\WININET.dll
c:\program files\Windows Media Player\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\wpdshext.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\Audiodev.dll
c:\windows\system32\WMVCore.DLL
c:\windows\system32\WMASF.DLL
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
.
Completion time: 2009-12-06 20:55
ComboFix-quarantined-files.txt 2009-12-06 19:55
ComboFix2.txt 2009-12-06 18:54
ComboFix3.txt 2009-12-06 17:16

Pre-Run: 10 323 935 232 bytes free
Post-Run: 10 318 802 944 bytes free

Current=4 Default=4 Failed=1 LastKnownGood=5 Sets=1,2,3,4,5
- - End Of File - - 032F5530BF91B8EC51067E2BA0AAE2DD

[Damned]

Ne, není.
Zadal jsi správně:

Kód: Vybrat vše

Combofix[mezera]/uninstall

Ráno mi to šlo. Nevadí tak postupuj takto:

Start-->Spustit a do řádku zkopíruj:

Kód: Vybrat vše

"%userprofile%\Plocha\combofix" /uninstall

(Podle CF community bylo změněno /u na uninstall, pokud je na Ploše, tak daný řetězec)

Pokud ti nepůjde ani to tak najdi a smaž:
C:\327882R2FWJFW
C:\ComboFix
C:\Qoobox
C:\Combofix.txt
a Combofix.exe
Pak si stáhni OTCleanIt.
- Připoj se k internetu a dvojklikem spusť program
- Klikni na tlačítko CleanUp
- Po dokončení povol restart PC
- Po restartu tento nástroj smaž - není určen pro běžné používání


Pak použij ten T-Cleaner a pro jistotu i ten ToolsCleaner.

ComboFix se musí odinstalovat, může, při některých zvláštních kombinacích působit kontraproduktivně.

[bruno]

Ahoj zdravim,sasilam ješte log z HJT nebo nejsem si jisty jestli to mam vyčistene,ten T-Cleaner mi nereagoval jinak to jde

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:04:08, on 7.12.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\ZSSnp211.exe
C:\Program Files\MP3 Flash Drive Driver v2.08r022\shwicon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.zoznam.sk/?
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: Podpora odkazu pre aplikáciu Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\WINDOWS\WebIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe
O4 - HKLM\..\Run: [ShowIcon_The Company_MP3 Flash Drive Driver v2.08r022] "C:\Program Files\MP3 Flash Drive Driver v2.08r022\shwicon.exe" -t"The Company\MP3 Flash Drive Driver v2.08r022"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftup ... 6290450203
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 7548263984
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/L ... nstall.cab
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 6562 bytes

[Damned]

Tento log je v pořádku. Pokud zbytky CF neodstranil T-Cleaner, tak určitě ToolsCleaner a OTC.