Vír v PC,nejde funkce obnovení systému,a zmizeli ikony Vyřešeno

[misut]

Jen nyní při opětovném zapnutí Mozilly se objevilo,ale mozilla jde

[Reklama]

[jaro3]

Script chvíli potrvá , je tam toho ještě dost...

[jaro3]

Příště řešit pouze na jednom fóru..


Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
Collect::
c:\windows\system32\scshofst.exe
c:\windows\system32\drivers\etalvk.sys
c:\windows\system32\cT-F3K-t.dll

File::
c:\windows\system32\wmsrvc.exe
c:\windows\system32\regedit.exe.vir
c:\windows\system32\ÇÖ°É Č¬¸éş¸ČŁ±â V1.0.scr
c:\windows\SEC35.tmp
c:\windows\im32st.dat
c:\windows\UN32.EXE
c:\windows\system32\eEmpty.exe

Folder::
c:\windows\system32\CatRoot_bak

Driver::
Ebfwzod
lokewqfy
etalvk

DirLook::
C:\Nová složka

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{777d1175-39e9-6d8e-c902-40412f918d84}]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000
[-HKEY_LOCAL_MACHINE\System\ControlSet004\Services\etalvk]

DDS::
uStart Page = hxxp://www3.iamwired.net/

Firefox::
FF - ProfilePath - c:\documents and settings\PC\Data aplikací\Mozilla\Firefox\Profiles\de4ohtlf.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www3.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: keyword.URL - hxxp://www3.iamwired.net/websearch.php?src=tops&search=

RegNull::
[HKEY_USERS\S-1-5-21-1202660629-1715567821-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{EC737334-5186-95A4-BDA2-8F750AB02F93}*]


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Na disku C se ti vytvoří adresář/složka pojmenovaná Qoobox a v ní bude další adresář Quarantine a v ní najdeš archiv v podobném tvaru [4]-Submit a_2010-02-11@14.14.zip kde čísla za @ znamenají aktuální čas vytvoření souboru. Pošli mi ho jako přílohu přes SZ.Jsou to tři soubory. Dík.

V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko u nezobrazovat systémové soubory.

Toto otestuj na Virustotal
c:\windows\system32\HZIG24MGwf_l.exe
c:\windows\system32\sstunst2.exe
Vlož sem pak odkazy na stránky s výsledky.

do scrpitu přidán ještě jeden driver!!etalvk

[misut]

ComboFix 10-02-11.04 - PC 2010-02-11 22:47:43.23.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.2030.1641 [GMT 1:00]
Spuštěný z: c:\documents and settings\PC\Plocha\VerTerm.exe
Použité ovládací přepínače :: c:\documents and settings\PC\Plocha\CFScript.txt .txt

FILE ::
"c:\windows\im32st.dat"
"c:\windows\SEC35.tmp"
"c:\windows\system32\ÇÖ°É Č¬¸éş¸ČŁ±â V1.0.scr"
"c:\windows\system32\regedit.exe.vir"
"c:\windows\system32\wmsrvc.exe"
"c:\windows\UN32.EXE"

file zipped: c:\windows\system32\cT-F3K-t.dll
file zipped: c:\windows\system32\drivers\etalvk.sys
file zipped: c:\windows\system32\scshofst.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\im32st.dat
c:\windows\SEC35.tmp
c:\windows\system32\cT-F3K-t.dll
c:\windows\system32\drivers\etalvk.sys
c:\windows\system32\regedit.exe.vir
c:\windows\system32\scshofst.exe
c:\windows\system32\wmsrvc.exe
c:\windows\UN32.EXE

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_etalvk
-------\Service_etalvk


((((((((((((((((((((((((( Soubory vytvořené od 2010-01-11 do 2010-02-11 )))))))))))))))))))))))))))))))
.

2010-02-10 17:45 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-10 17:45 . 2010-02-11 18:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-10 17:45 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-10 15:25 . 2008-04-14 07:49 102912 -c----w- c:\windows\system32\dllcache\dpcdll.dll
2010-02-10 11:09 . 2010-02-10 11:09 -------- d-----w- c:\windows\system32\CatRoot_bak
2010-02-10 09:48 . 2008-04-14 07:51 9728 ------w- c:\windows\system32\rwnh.dll
2010-02-10 09:48 . 2008-04-14 07:51 10752 ------w- c:\windows\system32\smtpapi.dll
2010-02-09 23:02 . 2010-02-10 00:07 118284 ----a-w- c:\windows\system32\HZIG24MGwf_l.exe
2010-02-09 20:36 . 2010-02-09 20:36 -------- d-----w- c:\windows\system32\wbem\Repository
2010-02-03 16:01 . 2010-02-03 16:01 -------- dc----w- C:\Output Files
2010-02-01 09:51 . 2010-02-10 07:12 -------- d-----w- c:\program files\CCleaner
2010-01-29 08:51 . 2010-01-29 08:51 373249 ----a-w- c:\windows\system32\ÇÖ°É Č­¸éş¸ČŁ±â V1.0.scr
2010-01-24 10:11 . 2010-01-24 10:11 -------- d-----w- c:\program files\Common Files\iSpring Solutions
2010-01-24 10:11 . 2010-01-24 10:11 -------- d-----w- c:\program files\iSpring
2010-01-24 10:04 . 2010-01-24 10:09 -------- d-----w- c:\program files\IrfanView
2010-01-24 09:57 . 2010-02-10 07:42 -------- d-----w- c:\program files\Image Grabber II
2010-01-19 20:04 . 2010-01-19 20:04 -------- dc----w- C:\Nová složka
2010-01-16 15:47 . 2010-01-16 15:47 -------- d-----w- c:\program files\TeamViewer
2010-01-16 15:13 . 2010-01-16 15:13 -------- d-----w- c:\program files\VideoLAN
2010-01-15 17:29 . 2010-02-10 07:06 -------- dc----w- C:\multiAVCHD

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-10 12:46 . 2008-04-11 14:02 -------- d-----w- c:\program files\AVG
2010-02-10 10:40 . 2007-03-01 11:21 86327 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2010-02-10 10:40 . 2007-03-01 11:21 2724 ----a-w- c:\windows\PCHealth\HelpCtr\PackageStore\SkuStore.bin
2010-02-10 08:14 . 2009-05-24 11:54 -------- d-----w- c:\program files\Wisdom-soft ScreenHunter Free
2010-02-10 08:13 . 2007-03-31 17:20 -------- d-----w- c:\program files\Windows Media Connect 2
2010-02-10 08:13 . 2007-04-01 07:59 -------- d-----w- c:\program files\WinAVIVideoConverter
2010-02-10 08:05 . 2007-11-05 08:49 -------- d-----w- c:\program files\Total Video Converter
2010-02-10 08:03 . 2008-12-08 16:14 -------- d-----w- c:\program files\The KMPlayer
2010-02-10 08:00 . 2008-01-19 21:02 -------- d-----w- c:\program files\Shared files
2010-02-10 08:00 . 2007-05-06 11:51 -------- d-----w- c:\program files\Seznam DVD
2010-02-10 07:56 . 2007-03-01 12:02 -------- d-----w- c:\program files\Realtek AC97
2010-02-10 07:56 . 2008-05-24 10:32 -------- d-----w- c:\program files\QuickMediaConverter
2010-02-10 07:55 . 2008-06-11 18:44 -------- d-----w- c:\program files\QIP
2010-02-10 07:55 . 2008-03-01 00:05 -------- d-----w- c:\program files\PSPad editor
2010-02-10 07:47 . 2009-02-11 17:29 -------- d-----w- c:\program files\Magic Video Converter
2010-02-10 07:43 . 2009-12-30 11:11 -------- d-----w- c:\program files\iWisoft Free Video Converter
2010-02-10 07:41 . 2007-07-15 15:56 -------- d-----w- c:\program files\Image Converter .EXE
2010-02-10 07:25 . 2008-09-03 11:58 -------- d-----w- c:\program files\Get IP
2010-02-10 07:25 . 2008-01-29 09:20 -------- d-----w- c:\program files\Fausto
2010-02-10 07:23 . 2009-06-22 10:26 -------- d-----w- c:\program files\E.M. PowerPoint Video Converter
2010-02-10 07:23 . 2007-03-21 18:27 -------- d-----w- c:\program files\DVDFab Decrypter
2010-02-10 07:23 . 2007-03-02 19:33 -------- d-----w- c:\program files\DVD Shrink
2010-02-10 07:17 . 2007-07-15 15:56 -------- d-----w- c:\program files\Common Files\SoftTech InterCorp
2010-02-10 07:17 . 2007-03-02 15:58 -------- d-----w- c:\program files\Common Files\snpstd2
2010-02-10 07:13 . 2007-12-21 11:42 -------- d-----w- c:\program files\Cell Phone Manager
2010-02-10 07:11 . 2008-08-14 16:34 -------- d-----w- c:\program files\btw
2010-02-10 07:10 . 2008-02-11 20:05 -------- d-----w- c:\program files\Avi To MPEG Scout
2010-02-10 07:10 . 2009-12-11 17:30 -------- d-----w- c:\program files\AVD Video Processor 8.0.1 TRIAL
2010-01-29 08:51 . 2007-03-02 20:29 29184 ----a-w- c:\windows\system32\sstunst2.exe
2010-01-03 15:52 . 2010-01-03 15:52 -------- d-----w- c:\program files\Rising Research
2009-12-31 16:50 . 2004-08-03 21:14 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-28 18:51 . 2009-12-28 18:51 -------- d-----w- c:\program files\FreeTime
2009-12-24 20:23 . 2009-12-24 20:23 -------- d-----w- c:\program files\Topsevenreviews
2009-12-21 19:08 . 2004-08-17 13:49 916480 ------w- c:\windows\system32\wininet.dll
2009-12-17 07:42 . 2007-03-01 11:18 343552 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:10 . 2004-08-17 13:49 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-12 18:54 . 2009-12-12 18:54 26624 ----a-w- c:\windows\OETRN.EXE
2009-12-12 18:54 . 2009-12-12 18:54 200704 ----a-w- c:\windows\TRNOET.DLL
2009-12-12 18:54 . 2009-12-12 18:17 45056 ----a-w- c:\windows\TRNOEH.DLL
2009-12-09 10:11 . 2004-08-17 15:45 2068224 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-09 10:11 . 2004-08-17 13:45 2191360 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-09 08:07 . 2001-10-25 12:00 732556 ----a-w- c:\windows\system32\perfh005.dat
2009-12-09 08:07 . 2001-10-25 12:00 196524 ----a-w- c:\windows\system32\perfc005.dat
2009-12-04 18:22 . 2004-08-03 21:15 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:14 . 2004-08-17 13:49 1294336 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 17:14 . 2004-08-17 15:49 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:09 . 2001-10-25 14:00 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:09 . 2001-10-24 12:25 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:09 . 2004-08-17 15:49 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:09 . 2004-08-17 13:49 11264 ----a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:09 . 2004-08-17 13:49 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-11-25 09:40 . 2009-11-25 09:40 34048 -c--a-w- c:\windows\system32\eEmpty.exe
2009-11-21 16:03 . 2004-08-17 13:49 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-06-28 18:02 . 2009-06-28 18:02 23510720 -c--a-w- c:\program files\dotnetfx.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-17 44544]

c:\documents and settings\PC\Nabˇdka Start\Programy\Po spuçtŘnˇ\
updater.exe [2010-2-10 2746785]
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101952]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 30208]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-13 561213]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\VoipDiscount.com\\VoipDiscount\\VoipDiscount.exe"=
"c:\\Documents and Settings\\PC\\Dokumenty\\eMule\\emule.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\PC\\Plocha\\Az\\DCC.version2.80\\DCC.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Documents and Settings\\PC\\Plocha\\Az\\misut\\test loga\\TuneAZbox\\TuneAZbox.exe"=
"c:\\Program Files\\telesat\\CAM Wizard\\AZBox CAM Wizard.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Skupiny sítě Peer-to-Peer
"3540:UDP"= 3540:UDP:Protokol PNRP (Peer Name Resolution Protocol)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [2006-02-23 11264]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2007-03-01 13696]
R1 VRVD302;VRVD302;c:\windows\system32\drivers\VRVD302.sys [2008-07-16 11296]
S0 ebfwzod;ebfwzod; [x]
S0 lokewqfy;lokewqfy;c:\windows\system32\drivers\pzjkfbea.sys --> c:\windows\system32\drivers\pzjkfbea.sys [?]
S3 USBBOX;Settop Box USB driver;c:\windows\system32\drivers\USBBOX.sys [2007-03-12 16640]
S4 602SQL 8 FastCGI Client;602SQL 8 FastCGI Client;c:\program files\webgencz\602FSVC8.EXE --> c:\program files\webgencz\602FSVC8.EXE [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www3.iamwired.net/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
TCP: {F05B655F-DD1B-414B-B6AA-D0447548F817} = 62.129.50.20,85.135.32.100
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\PC\Data aplikací\Mozilla\Firefox\Profiles\de4ohtlf.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www3.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - prefs.js: keyword.URL - hxxp://www3.iamwired.net/websearch.php?src=tops&search=
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

BHO-{777d1175-39e9-6d8e-c902-40412f918d84} - c:\windows\system32\cT-F3K-t.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-11 22:56
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1202660629-1715567821-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{EC737334-5186-95A4-BDA2-8F750AB02F93}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"napighjfgppokoeihdpdcmihnpfm"=hex:6a,61,64,6f,62,6f,65,67,6d,63,64,67,6a,6d,
6a,6e,66,64,68,64,00,e8
"mafkaefjdmccbffcjjoffknfnl"=hex:6a,61,64,6f,62,6f,65,67,6d,63,64,67,6a,6d,6a,
6e,66,64,68,64,00,02
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(4024)
c:\windows\system32\btmmhook.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\System32\snmp.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
.
**************************************************************************
.
Celkový čas: 2010-02-11 23:04:22 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-02-11 22:04
ComboFix2.txt 2010-02-11 20:32

Před spuštěním: Volných bajtů: 42,406,449,152
Po spuštění: Volných bajtů: 42,393,636,864

- - End Of File - - A5EB5221A59986D6BED9504AEFBBE48E

[misut]

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 23:15, on 2010-02-11
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www3.iamwired.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Startup: updater.exe
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O17 - HKLM\System\CCS\Services\Tcpip\..\{F05B655F-DD1B-414B-B6AA-D0447548F817}: NameServer = 62.129.50.20,85.135.32.100
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 8253 bytes

[jaro3]

Nevím , zda přesně víš jak poslat ty soubory přes SZ,, tedy:
Zkopíruješ je v v quarrantine, vložíš je do složky , kterou pojmenuj třeba infected a vlož je do zprávy (SZ) jako přílohu.

Psal černohous , z virů, že to máš dodělat tady..

Takže ten script si nezkopíroval celý ( je tam posuvník!).

takže ještě jeden script , postup stejný, log z HJT5 už dávat nemusíš.

Kód: Vybrat vše

KillAll::
Folder::
c:\windows\system32\CatRoot_bak

Driver::
Ebfwzod
lokewqfy

DirLook::
C:\Nová složka

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{777d1175-39e9-6d8e-c902-40412f918d84}]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000
[-HKEY_LOCAL_MACHINE\System\ControlSet004\Services\etalvk]

DDS::
uStart Page = hxxp://www3.iamwired.net/

Firefox::
FF - ProfilePath - c:\documents and settings\PC\Data aplikací\Mozilla\Firefox\Profiles\de4ohtlf.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www3.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: keyword.URL - hxxp://www3.iamwired.net/websearch.php?src=tops&search=

RegNull::
[HKEY_USERS\S-1-5-21-1202660629-1715567821-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{EC737334-5186-95A4-BDA2-8F750AB02F93}*]


Ještě ty soubory na virustotal.

[misut]

z virustotalu
http://www.virustotal.com/cs/analisis/5 ... 1265927918

http://www.virustotal.com/cs/analisis/5 ... 1265928146

[jaro3]

Až budeš mít hotov ten script:

Stáhni si program OTM (by OldTimer)
http://www.edisk.cz/stahni/07995/OTMove ... .39KB.html
a ulož si ho na disk C a spusť ho.
- Do levého sloupce (Paste Instructions for Items to be Moved) zkopíruj tyto cesty:
Poznámka: Nepoužij k označení funkci VYBRAT VŠE

Kód: Vybrat vše

:Processes
explorer.exe

:Services

:Reg

:Files
c:\windows\system32\HZIG24MGwf_l.exe

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

- Po zkopírování klikni na tlačítko MoveIt! a vlož sem následně celý obsah z pravého sloupce, jinak uložený ve složce C:\_OTMoveIt\MovedFiles\, který bude informovat o výsledcích
- Je možné, že pokud nebudou moci být soubory odstraněny, budeš dotázán na restart počítače, v tom případě restart potvrď.


ComboFix se odinstaluje takto:

Start-Spustit a zadej ComboFix /Uninstall

vyčisti systém CCleanerem

a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš

Nainstaluj si free antivir, třeba Aviru , Avast, AVG.

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www3.iamwired.net/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O4 - Startup: updater.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)


Budeme pokračovat zítra.

[misut]

ComboFix 10-02-11.04 - PC 2010-02-11 23:54:07.24.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.2030.1601 [GMT 1:00]
Spuštěný z: c:\documents and settings\PC\Plocha\VerTerm.exe
Použité ovládací přepínače :: c:\documents and settings\PC\Plocha\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\CatRoot_bak

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_LOKEWQFY
-------\Service_ebfwzod
-------\Service_lokewqfy


((((((((((((((((((((((((( Soubory vytvořené od 2010-01-11 do 2010-02-11 )))))))))))))))))))))))))))))))
.

2010-02-11 22:14 . 2010-02-11 22:14 -------- d-----w- c:\program files\TrendMicro
2010-02-10 17:45 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-10 17:45 . 2010-02-11 18:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-10 17:45 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-10 15:25 . 2008-04-14 07:49 102912 -c----w- c:\windows\system32\dllcache\dpcdll.dll
2010-02-10 09:48 . 2008-04-14 07:51 9728 ------w- c:\windows\system32\rwnh.dll
2010-02-10 09:48 . 2008-04-14 07:51 10752 ------w- c:\windows\system32\smtpapi.dll
2010-02-09 23:02 . 2010-02-10 00:07 118284 ----a-w- c:\windows\system32\HZIG24MGwf_l.exe
2010-02-09 20:36 . 2010-02-09 20:36 -------- d-----w- c:\windows\system32\wbem\Repository
2010-02-03 16:01 . 2010-02-03 16:01 -------- dc----w- C:\Output Files
2010-02-01 09:51 . 2010-02-10 07:12 -------- d-----w- c:\program files\CCleaner
2010-01-29 08:51 . 2010-01-29 08:51 373249 ----a-w- c:\windows\system32\ÇÖ°É Č­¸éş¸ČŁ±â V1.0.scr
2010-01-24 10:11 . 2010-01-24 10:11 -------- d-----w- c:\program files\Common Files\iSpring Solutions
2010-01-24 10:11 . 2010-01-24 10:11 -------- d-----w- c:\program files\iSpring
2010-01-24 10:04 . 2010-01-24 10:09 -------- d-----w- c:\program files\IrfanView
2010-01-24 09:57 . 2010-02-10 07:42 -------- d-----w- c:\program files\Image Grabber II
2010-01-19 20:04 . 2010-01-19 20:04 -------- dc----w- C:\Nová složka
2010-01-16 15:47 . 2010-01-16 15:47 -------- d-----w- c:\program files\TeamViewer
2010-01-16 15:13 . 2010-01-16 15:13 -------- d-----w- c:\program files\VideoLAN
2010-01-15 17:29 . 2010-02-10 07:06 -------- dc----w- C:\multiAVCHD

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-10 12:46 . 2008-04-11 14:02 -------- d-----w- c:\program files\AVG
2010-02-10 10:40 . 2007-03-01 11:21 86327 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2010-02-10 10:40 . 2007-03-01 11:21 2724 ----a-w- c:\windows\PCHealth\HelpCtr\PackageStore\SkuStore.bin
2010-02-10 08:14 . 2009-05-24 11:54 -------- d-----w- c:\program files\Wisdom-soft ScreenHunter Free
2010-02-10 08:13 . 2007-03-31 17:20 -------- d-----w- c:\program files\Windows Media Connect 2
2010-02-10 08:13 . 2007-04-01 07:59 -------- d-----w- c:\program files\WinAVIVideoConverter
2010-02-10 08:05 . 2007-11-05 08:49 -------- d-----w- c:\program files\Total Video Converter
2010-02-10 08:03 . 2008-12-08 16:14 -------- d-----w- c:\program files\The KMPlayer
2010-02-10 08:00 . 2008-01-19 21:02 -------- d-----w- c:\program files\Shared files
2010-02-10 08:00 . 2007-05-06 11:51 -------- d-----w- c:\program files\Seznam DVD
2010-02-10 07:56 . 2007-03-01 12:02 -------- d-----w- c:\program files\Realtek AC97
2010-02-10 07:56 . 2008-05-24 10:32 -------- d-----w- c:\program files\QuickMediaConverter
2010-02-10 07:55 . 2008-06-11 18:44 -------- d-----w- c:\program files\QIP
2010-02-10 07:55 . 2008-03-01 00:05 -------- d-----w- c:\program files\PSPad editor
2010-02-10 07:47 . 2009-02-11 17:29 -------- d-----w- c:\program files\Magic Video Converter
2010-02-10 07:43 . 2009-12-30 11:11 -------- d-----w- c:\program files\iWisoft Free Video Converter
2010-02-10 07:41 . 2007-07-15 15:56 -------- d-----w- c:\program files\Image Converter .EXE
2010-02-10 07:25 . 2008-09-03 11:58 -------- d-----w- c:\program files\Get IP
2010-02-10 07:25 . 2008-01-29 09:20 -------- d-----w- c:\program files\Fausto
2010-02-10 07:23 . 2009-06-22 10:26 -------- d-----w- c:\program files\E.M. PowerPoint Video Converter
2010-02-10 07:23 . 2007-03-21 18:27 -------- d-----w- c:\program files\DVDFab Decrypter
2010-02-10 07:23 . 2007-03-02 19:33 -------- d-----w- c:\program files\DVD Shrink
2010-02-10 07:17 . 2007-07-15 15:56 -------- d-----w- c:\program files\Common Files\SoftTech InterCorp
2010-02-10 07:17 . 2007-03-02 15:58 -------- d-----w- c:\program files\Common Files\snpstd2
2010-02-10 07:13 . 2007-12-21 11:42 -------- d-----w- c:\program files\Cell Phone Manager
2010-02-10 07:11 . 2008-08-14 16:34 -------- d-----w- c:\program files\btw
2010-02-10 07:10 . 2008-02-11 20:05 -------- d-----w- c:\program files\Avi To MPEG Scout
2010-02-10 07:10 . 2009-12-11 17:30 -------- d-----w- c:\program files\AVD Video Processor 8.0.1 TRIAL
2010-01-29 08:51 . 2007-03-02 20:29 29184 ----a-w- c:\windows\system32\sstunst2.exe
2010-01-03 15:52 . 2010-01-03 15:52 -------- d-----w- c:\program files\Rising Research
2009-12-31 16:50 . 2004-08-03 21:14 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-28 18:51 . 2009-12-28 18:51 -------- d-----w- c:\program files\FreeTime
2009-12-24 20:23 . 2009-12-24 20:23 -------- d-----w- c:\program files\Topsevenreviews
2009-12-21 19:08 . 2004-08-17 13:49 916480 ------w- c:\windows\system32\wininet.dll
2009-12-17 07:42 . 2007-03-01 11:18 343552 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:10 . 2004-08-17 13:49 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-12 18:54 . 2009-12-12 18:54 26624 ----a-w- c:\windows\OETRN.EXE
2009-12-12 18:54 . 2009-12-12 18:54 200704 ----a-w- c:\windows\TRNOET.DLL
2009-12-12 18:54 . 2009-12-12 18:17 45056 ----a-w- c:\windows\TRNOEH.DLL
2009-12-09 10:11 . 2004-08-17 15:45 2068224 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-09 10:11 . 2004-08-17 13:45 2191360 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-09 08:07 . 2001-10-25 12:00 732556 ----a-w- c:\windows\system32\perfh005.dat
2009-12-09 08:07 . 2001-10-25 12:00 196524 ----a-w- c:\windows\system32\perfc005.dat
2009-12-04 18:22 . 2004-08-03 21:15 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:14 . 2004-08-17 13:49 1294336 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 17:14 . 2004-08-17 15:49 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:09 . 2001-10-25 14:00 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:09 . 2001-10-24 12:25 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:09 . 2004-08-17 15:49 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-27 16:09 . 2004-08-17 13:49 11264 ----a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:09 . 2004-08-17 13:49 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-11-25 09:40 . 2009-11-25 09:40 34048 -c--a-w- c:\windows\system32\eEmpty.exe
2009-11-21 16:03 . 2004-08-17 13:49 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-06-28 18:02 . 2009-06-28 18:02 23510720 -c--a-w- c:\program files\dotnetfx.exe
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of C:\Nová složka ----



(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-17 44544]

c:\documents and settings\PC\Nabˇdka Start\Programy\Po spuçtŘnˇ\
updater.exe [2010-2-10 2746785]
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101952]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 30208]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-13 561213]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\VoipDiscount.com\\VoipDiscount\\VoipDiscount.exe"=
"c:\\Documents and Settings\\PC\\Dokumenty\\eMule\\emule.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\PC\\Plocha\\Az\\DCC.version2.80\\DCC.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Documents and Settings\\PC\\Plocha\\Az\\misut\\test loga\\TuneAZbox\\TuneAZbox.exe"=
"c:\\Program Files\\telesat\\CAM Wizard\\AZBox CAM Wizard.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Skupiny sítě Peer-to-Peer
"3540:UDP"= 3540:UDP:Protokol PNRP (Peer Name Resolution Protocol)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [2006-02-23 11264]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2007-03-01 13696]
R1 VRVD302;VRVD302;c:\windows\system32\drivers\VRVD302.sys [2008-07-16 11296]
S3 USBBOX;Settop Box USB driver;c:\windows\system32\drivers\USBBOX.sys [2007-03-12 16640]
S4 602SQL 8 FastCGI Client;602SQL 8 FastCGI Client;c:\program files\webgencz\602FSVC8.EXE --> c:\program files\webgencz\602FSVC8.EXE [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
.
------- Doplňkový sken -------
.
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
TCP: {F05B655F-DD1B-414B-B6AA-D0447548F817} = 62.129.50.20,85.135.32.100
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\PC\Data aplikací\Mozilla\Firefox\Profiles\de4ohtlf.default\
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-12 00:01
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3220)
c:\windows\system32\btmmhook.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\System32\snmp.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2010-02-12 00:07:19 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-02-11 23:07
ComboFix2.txt 2010-02-11 22:04
ComboFix3.txt 2010-02-11 20:32

Před spuštěním: Volných bajtů: 42,333,503,488
Po spuštění: Volných bajtů: 42,312,536,064

- - End Of File - - F77CE88ADE803645DD616E90FC0BD444

[misut]

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File/Folder c:\windows\system32\HZIG24MGwf_l.exe not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\PC\LOCALS~1\Temp\hpodvd09.log scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\PC\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_210.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_344.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\PC\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\de4ohtlf.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\PC\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\de4ohtlf.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\PC\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\de4ohtlf.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\PC\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\de4ohtlf.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\PC\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\de4ohtlf.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\PC\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\de4ohtlf.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Opera cache emptied.
Temp folders emptied.
Explorer started successfully

OTM by OldTimer - Version 2.1.0.1 log created on 02122010_001800

Files moved on Reboot...
C:\DOCUME~1\PC\LOCALS~1\Temp\hpodvd09.log moved successfully.
File C:\WINDOWS\temp\Perflib_Perfdata_210.dat not found!
C:\WINDOWS\temp\Perflib_Perfdata_344.dat moved successfully.
C:\Documents and Settings\PC\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\de4ohtlf.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\PC\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\de4ohtlf.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\PC\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\de4ohtlf.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\PC\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\de4ohtlf.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\PC\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\de4ohtlf.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\PC\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\de4ohtlf.default\XUL.mfl moved successfully.

Registry entries deleted on Reboot...

[jaro3]

Fajn, můžeš smazat složky:
C:\Nová složka+
c:\program files\AVG

Stáhni si GooredFix

a ulož si ho na plochu.Poklepej na něj .
Objeví se hláška ,dej YES
Otevře se log , zkopíruj sem celý jeho obsah ( jinak ho najdeš na své ploše pod názvem Goored.txt).

///////////////////////

Opakuj toto:
Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

///////////
Pokud se bude dál objevovat hláška v FF:

Bude třeba si zazálohovat záložky Mozzila FF, odinstalovat FF a smazat tyto složky.:
C:\Program Files\Mozilla Firefox
C:\Documents and Settings\Jméno\Data aplikací\Mozilla
C:\Documents and Settings\Jméno\Local Settings\Data aplikací\Mozilla

Znovu si nainstaluj FF a hláška by se již neměla opakovat.

[misut]

GooredFix by jpshortstuff (08.01.10.1)
Log created at 09:15 on 12/02/2010 (PC)
Firefox version 3.5.3 (cs)

========== GooredScan ==========


========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\
{383db9ec-2f0e-ccdb-5eab-d8e645f5e981} [00:07 10/02/2010]
{972ce4c6-7e08-4474-a285-3208198ce6fd} [18:58 27/11/2009]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{20a82645-c095-46ed-80e3-08825760534b}"="C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [20:46 14/08/2009]
"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff" [13:35 19/12/2008]

-=E.O.F=-