Prosím o kontrolu logu z HJT Vyřešeno

[mara362]

Systém je velmi pomalý; spuštění programů probíhá velmi pomalu, ve správci úloh, záložka procesy, není vidět uživatelské jméno u žádného procesu kromě "nečinné procesy systému win". Začalo to asi před týdnem, odinstaloval jsem NOD32 a nainstaloval COMODO firewall + antivirus, projel skeny MalwareBytes - Antimalware. Beze změny. Dnes jsem COMODO dal pryč a instnul zpátky NODa. Stáří systému je cca měsíc. Sestava: cpu 1.8GHz AMD Athlon XP, 1GB RAM DDR, deska QDI K7S746FX, gr. karta ATi X1650 pro 512MB, HDD WD 320GB PATA.


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:45:43, on 22.6.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\PixArt\PAC7302\Monitor.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
C:\Program Files\Opera\opera.exe
C:\Documents and Settings\Marek\Plocha\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [PAC7302_Monitor] C:\WINDOWS\PixArt\PAC7302\Monitor.exe
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [EPSON Stylus DX4000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\WINDOWS\TEMP\E_S29BE.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP\qip.exe (HKCU)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs:
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: WD SmartWare Drive Manager (WDDMService) - WDC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
O23 - Service: WD SmartWare Background Service (WDSmartWareBackgroundService) - Memeo - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe

--
End of file - 7509 bytes

[Reklama]

[bledulka]

Ahoj,
odinstaluj Daemon tools toolbar



Stáhni na plochu ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- Před použitím vypni všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary
-Zavři všechna aktivní okna a spusť ho pod učtem s právy administrátora
- Po spuštění se zobrazí podmínky použití, potvrď je stiskem tlačítka Ano

- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna

- Po dokončení skenování, se vytvoří log C:\ComboFix.txt, zkopíruj celý jeho obsah sem.

[mara362]

ComboFix 10-06-22.02 - Marek 22.06.2010 22:34:36.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1023.730 [GMT 2:00]
Spuštěný z: c:\documents and settings\Marek\Plocha\ComboFix.exe
AV: Eset NOD32 Antivirus 2.70 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((( Soubory vytvořené od 2010-05-22 do 2010-06-22 )))))))))))))))))))))))))))))))
.

2010-06-22 12:42 . 2010-06-22 12:41 512096 ----a-w- c:\windows\system32\drivers\amon.sys
2010-06-22 12:42 . 2010-06-22 12:41 298104 ----a-w- c:\windows\system32\imon.dll
2010-06-22 12:42 . 2010-06-22 12:41 15424 ----a-w- c:\windows\system32\drivers\nod32drv.sys
2010-06-22 12:37 . 2010-06-22 12:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-06-21 20:09 . 2010-06-21 20:10 -------- d-----w- c:\program files\RegCleaner
2010-06-20 12:24 . 2010-06-20 12:24 -------- d-----w- c:\program files\Opera
2010-06-20 12:06 . 2010-06-20 12:06 -------- d-----w- c:\windows\system32\Adobe
2010-06-14 16:27 . 2010-06-14 16:27 -------- d-----w- C:\VritualRoot
2010-06-14 16:27 . 2010-06-22 12:33 528321 ----a-w- c:\windows\system32\drivers\sfi.dat
2010-06-14 16:25 . 2010-06-14 16:26 -------- d--h--w- c:\windows\$hf_mig$
2010-06-14 16:23 . 2010-06-22 12:33 -------- d-----w- c:\program files\Comodo
2010-06-10 15:43 . 2010-06-10 15:43 -------- d-----w- c:\windows\system32\Lang
2010-06-07 23:44 . 2010-06-07 23:44 -------- d-----w- c:\program files\Google
2010-06-07 22:07 . 2010-06-07 22:07 -------- d-----w- c:\program files\AviSynth 2.5
2010-06-07 22:06 . 2010-06-07 22:06 -------- d-sh--w- c:\windows\system32\ShellDHCP
2010-06-06 20:38 . 2010-06-06 20:38 -------- d-----w- c:\program files\7-Zip
2010-06-04 13:03 . 2010-06-20 17:54 -------- d-----w- c:\documents and settings\Marek\old screens
2010-06-03 22:54 . 2010-06-06 20:10 -------- d-----w- C:\QIP Infium JadrisPack
2010-06-03 22:29 . 2010-06-03 22:29 -------- d-----w- c:\program files\ICQ6Toolbar
2010-06-03 21:33 . 2010-06-03 21:34 -------- d-----w- c:\program files\ABBYY FineReader 6.0 Sprint
2010-06-03 21:29 . 2004-09-10 20:12 49152 ----a-w- c:\windows\system32\E_DCINST.DLL
2010-06-03 21:28 . 2005-12-09 01:03 71168 ----a-w- c:\windows\system32\E_FLBBEE.DLL
2010-06-03 21:28 . 2005-04-11 01:01 62976 ----a-w- c:\windows\system32\E_FD4BBEE.DLL
2010-06-03 21:28 . 2004-08-03 20:58 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2010-06-03 21:28 . 2004-08-03 20:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-06-03 21:27 . 2010-06-03 21:35 -------- d-----w- c:\program files\epson
2010-06-03 21:27 . 2005-02-24 22:00 46080 ----a-w- c:\windows\system32\escimgd.dll
2010-06-03 21:27 . 2005-02-24 22:00 29696 ----a-w- c:\windows\system32\escwiad.dll
2010-06-03 21:27 . 2005-02-24 22:00 22016 ----a-w- c:\windows\system32\esccmd.dll
2010-06-03 21:18 . 2004-08-03 21:01 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2010-06-03 21:18 . 2004-08-03 21:01 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2010-06-02 18:58 . 2010-03-29 13:24 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-02 18:58 . 2010-03-29 13:24 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-06-02 18:57 . 2010-06-02 18:58 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-31 14:50 . 2010-05-31 14:54 -------- d-----w- c:\windows\SxsCaPendDel
2010-05-31 13:18 . 2010-05-31 13:18 -------- d-----w- c:\documents and settings\LocalService\Plocha
2010-05-31 13:12 . 2010-05-31 13:11 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-05-29 10:23 . 2010-05-29 10:23 -------- d-----w- c:\program files\Common Files\Java
2010-05-29 10:23 . 2010-04-12 15:29 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-05-28 08:48 . 2010-05-28 08:48 -------- d-----w- c:\windows\Sun
2010-05-28 08:45 . 2010-05-29 10:23 -------- d-----w- c:\program files\Java
2010-05-28 07:25 . 2010-05-28 07:25 21840 ----a-w- c:\windows\system32\SIntfNT.dll
2010-05-28 07:25 . 2010-05-28 07:25 17212 ----a-w- c:\windows\system32\SIntf32.dll
2010-05-28 07:25 . 2010-05-28 07:25 12067 ----a-w- c:\windows\system32\SIntf16.dll
2010-05-28 07:17 . 2010-05-28 07:17 -------- d-----w- c:\program files\A4Tech
2010-05-27 18:16 . 2010-05-27 18:24 -------- d-----w- c:\program files\TalonSoft
2010-05-27 17:44 . 2010-05-27 17:44 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-05-27 15:33 . 2010-06-15 21:20 -------- d-----w- c:\program files\LucasArts
2010-05-27 14:29 . 2010-05-27 14:29 -------- d-sh--w- c:\documents and settings\Marek\IECompatCache
2010-05-27 14:24 . 2010-05-27 14:24 -------- d-sh--w- c:\documents and settings\Marek\PrivacIE
2010-05-27 10:30 . 2010-05-27 10:30 -------- d-----w- c:\program files\Tetris
2010-05-27 10:14 . 2010-05-27 10:14 -------- d-sh--w- c:\documents and settings\Marek\IETldCache
2010-05-27 10:11 . 2010-05-27 10:12 -------- d-----w- c:\windows\system32\cs-CZ
2010-05-27 10:11 . 2010-05-27 10:12 -------- dc-h--w- c:\windows\ie8
2010-05-26 19:25 . 2004-08-17 13:49 54272 -c--a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2010-05-26 19:25 . 2004-08-17 13:49 54272 ----a-w- c:\windows\system32\vfwwdm32.dll
2010-05-26 11:33 . 2007-10-04 15:42 48128 ----a-w- c:\windows\system32\Remove.exe
2010-05-26 11:33 . 2007-11-08 08:29 458752 ----a-w- c:\windows\system32\drivers\PAC7302.SYS
2010-05-26 11:33 . 2007-11-02 09:07 6656 ----a-w- c:\windows\system32\CoInst_071029.dll
2010-05-26 11:33 . 2010-05-26 11:33 -------- d-----w- c:\program files\ANC
2010-05-26 11:33 . 2006-10-12 09:57 14336 ----a-w- c:\windows\system32\P7302USD.dll
2010-05-26 11:33 . 2010-05-26 11:33 -------- d-----w- c:\program files\Common Files\PAC7302
2010-05-26 11:33 . 2010-05-26 11:33 -------- d-----w- c:\windows\PixArt
2010-05-26 11:22 . 2010-05-26 11:24 -------- d-----w- c:\program files\Common Files\Adobe
2010-05-25 13:42 . 2010-05-25 13:42 -------- d-----w- c:\program files\Rockstar Games
2010-05-24 23:37 . 2003-03-15 21:15 90112 ----a-w- c:\windows\unvise32.exe
2010-05-24 23:32 . 2010-05-24 23:32 -------- d-----w- c:\program files\DreamCatcher
2010-05-24 22:59 . 2010-05-24 22:59 -------- d-----w- c:\program files\Psi
2010-05-24 22:29 . 2010-05-24 22:29 -------- d-----w- c:\program files\EA GAMES
2010-05-24 22:20 . 2006-10-26 17:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2010-05-24 22:20 . 2006-10-26 17:56 32592 ----a-w- c:\windows\system32\msonpmon.dll
2010-05-24 22:19 . 2010-05-24 22:19 -------- d-----w- c:\program files\Microsoft Works
2010-05-24 15:03 . 2006-10-26 17:58 30512 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2010-05-24 15:03 . 2006-10-26 17:58 30512 ----a-w- c:\windows\system32\mdimon.dll
2010-05-24 13:23 . 2010-05-24 13:23 -------- d-----w- c:\program files\ACDSee32
2010-05-24 12:45 . 2010-05-24 12:45 -------- d-----w- c:\program files\eRightSoft
2010-05-24 12:44 . 2010-05-24 12:44 -------- d-----w- c:\program files\VirtualDub
2010-05-24 12:43 . 2010-05-25 12:44 -------- d-----w- c:\program files\Scorpions WinCheater
2010-05-24 12:43 . 2010-05-24 12:43 -------- d-----w- c:\program files\CyberLink
2010-05-24 12:42 . 2010-05-24 12:42 47104 ------w- c:\windows\AKDeInstall.exe
2010-05-24 12:42 . 2010-05-24 12:42 -------- d-----w- c:\program files\mpegable
2010-05-24 12:40 . 2010-05-24 12:41 -------- d-----w- c:\program files\HyperSnap 6
2010-05-24 12:10 . 2010-05-24 14:53 -------- d-----w- c:\program files\World of Warcraft
2010-05-24 11:58 . 2010-06-04 22:04 -------- d-----w- c:\documents and settings\Marek\PsiData
2010-05-24 11:57 . 2010-05-24 11:57 -------- d-----w- c:\program files\PSPad editor
2010-05-24 11:33 . 2010-05-24 11:33 -------- d-----w- c:\program files\themes
2010-05-23 23:34 . 2010-05-23 23:34 -------- d-----w- c:\program files\Common Files\LightScribe
2010-05-23 23:28 . 2010-05-23 23:32 -------- d-----w- c:\program files\Common Files\Nero
2010-05-23 23:28 . 2010-05-23 23:28 -------- d-----w- c:\program files\Nero
2010-05-23 23:20 . 2010-06-22 20:34 -------- d-----w- c:\program files\ESET
2010-05-23 23:18 . 2010-06-14 19:58 -------- d-----w- c:\program files\uTorrent

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-22 12:30 . 2010-05-23 16:12 -------- d-----r- c:\program files\Skype
2010-06-15 21:20 . 2010-05-23 15:57 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-15 10:16 . 2001-10-25 14:00 68736 ----a-w- c:\windows\system32\perfc005.dat
2010-06-15 10:16 . 2001-10-25 14:00 389664 ----a-w- c:\windows\system32\perfh005.dat
2010-06-03 21:38 . 2010-05-23 15:56 -------- d-----w- c:\program files\Common Files\InstallShield
2010-05-24 23:10 . 2010-05-23 16:08 -------- d-----w- c:\program files\CCleaner
2010-05-24 22:18 . 2010-05-24 22:18 -------- d-----w- c:\program files\Microsoft.NET
2010-05-24 17:24 . 2010-05-24 17:24 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ggsemc_01007.Wdf
2010-05-24 17:24 . 2010-05-24 17:24 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ggflt_01007.Wdf
2010-05-24 17:24 . 2010-05-24 17:24 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2010-05-24 17:16 . 2010-05-24 17:16 27632 ----a-w- c:\windows\system32\drivers\seehcri.sys
2010-05-24 17:16 . 2010-05-24 17:16 25512 ----a-w- c:\windows\system32\drivers\ggsemc.sys
2010-05-24 17:16 . 2010-05-24 17:16 1112288 ----a-w- c:\windows\system32\WdfCoInstaller01007.dll
2010-05-24 17:16 . 2010-05-24 17:16 13224 ----a-w- c:\windows\system32\drivers\ggflt.sys
2010-05-24 17:15 . 2010-05-24 17:15 -------- d-----w- c:\program files\Sony Ericsson
2010-05-24 13:12 . 2010-05-24 12:47 -------- d-----w- c:\program files\MyPhoneExplorer
2010-05-23 16:21 . 2010-05-23 16:21 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-05-23 16:19 . 2010-05-23 16:19 0 ----a-w- c:\windows\ativpsrm.bin
2010-05-23 16:18 . 2010-05-23 16:17 -------- d-----w- c:\program files\Realtek AC97
2010-05-23 16:15 . 2010-05-23 16:14 -------- d-----w- c:\program files\Winamp
2010-05-23 16:14 . 2010-05-23 16:14 -------- d-----w- c:\program files\Winamp Detect
2010-05-23 16:12 . 2010-05-23 16:12 -------- d-----w- c:\program files\Common Files\Skype
2010-05-23 16:11 . 2010-05-23 16:10 -------- d-----w- c:\program files\QIP
2010-05-23 16:09 . 2010-05-23 16:09 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-05-23 16:09 . 2010-05-23 16:09 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-05-23 16:07 . 2010-05-23 16:07 -------- d-----w- c:\program files\Webteh
2010-05-23 16:06 . 2010-05-23 16:06 -------- d-----w- c:\program files\1stbenison
2010-05-23 16:03 . 2010-05-23 16:03 -------- d-----w- c:\program files\SiSLan
2010-05-23 16:01 . 2010-05-23 15:58 -------- d-----w- c:\program files\Common Files\ATI Technologies
2010-05-23 16:01 . 2010-05-23 15:57 -------- d-----w- c:\program files\ATI Technologies
2010-05-23 15:49 . 2010-05-23 15:49 -------- d-----w- c:\program files\Western Digital
2010-05-23 15:30 . 2010-05-23 15:07 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-05-23 15:30 . 2010-05-23 15:07 2426 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-05-23 15:30 . 2010-05-23 15:07 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-05-23 15:08 . 2010-05-23 15:08 -------- d-----w- c:\program files\microsoft frontpage
2010-05-23 15:04 . 2010-05-23 15:04 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-04-29 09:47 . 2010-04-29 09:47 499712 ----a-w- c:\windows\system32\msvcp71.dll
2005-05-13 15:12 . 2005-05-13 15:12 217073 --sha-r- c:\windows\meta4.exe
2005-10-24 09:13 . 2005-10-24 09:13 66560 --sha-r- c:\windows\MOTA113.exe
2005-10-13 19:27 . 2005-10-13 19:27 422400 --sha-r- c:\windows\x2.64.exe
2005-10-07 17:14 . 2005-10-07 17:14 308224 --sha-r- c:\windows\system32\avisynth.dll
2005-07-14 10:31 . 2005-07-14 10:31 27648 --sha-r- c:\windows\system32\AVSredirect.dll
2005-06-26 13:32 . 2005-06-26 13:32 616448 --sha-r- c:\windows\system32\cygwin1.dll
2005-06-21 20:37 . 2005-06-21 20:37 45568 --sha-r- c:\windows\system32\cygz.dll
2004-01-24 22:00 . 2004-01-24 22:00 70656 --sha-r- c:\windows\system32\i420vfw.dll
2006-04-27 08:24 . 2006-04-27 08:24 2945024 --sha-r- c:\windows\system32\Smab.dll
2005-02-28 11:16 . 2005-02-28 11:16 240128 --sha-r- c:\windows\system32\x.264.exe
2004-01-24 22:00 . 2004-01-24 22:00 70656 --sha-r- c:\windows\system32\yv12vfw.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-07-09 570664]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2008-03-06 241664]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2010-06-22 949376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Psi\\psi.exe"=
"c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\DreamCatcher\\Painkiller\\Bin\\Painkiller.exe"=
"c:\\Games\\EA GAMES\\MOHAA\\MOHAA.exe"=
"c:\\Garrysmod\\hl2.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\QIP Infium JadrisPack\\infium.exe"=
"c:\\Games\\TDU\\TestDriveUnlimited.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Jedi Knight Jedi Academy\\GameData\\jamp.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [22.6.2010 14:42 15424]
R2 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [13.11.2009 11:28 110592]
R2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [16.6.2009 8:58 20480]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [24.5.2010 19:16 27632]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [23.5.2010 17:49 11520]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [23.5.2010 18:09 691696]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [24.5.2010 19:16 13224]
S3 IODRV;IODRV;\??\d:\iodrv.sys --> d:\IODrv.sys [?]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2.6.2010 20:58 38224]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-02-25 09:12 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://seznam.cz/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-22 22:37
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(540)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(596)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll
.
Celkový čas: 2010-06-22 22:39:46
ComboFix-quarantined-files.txt 2010-06-22 20:39

Před spuštěním: Volných bajtů: 190 305 624 064
Po spuštění: Volných bajtů: 190 301 929 472

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 11339BA36663A09063F8605BF5FB2BBF

[bledulka]

Otestuj na http://www.virustotal.com


c:\windows\system32\x.264.exe
c:\windows\meta4.exe
c:\windows\MOTA113.exe
c:\windows\x2.64.exe

-Do okénka zkopíruj cestu k souboru , pokud napíše, že soubor byl už testován, dej otestovat znovu.
-Sem vlož link s výsledky.

[mara362]

c:\windows\system32\x.264.exe

Antivirus Verze Poslední aktualizace Výsledek
a-squared 5.0.0.30 2010.06.23 -
AhnLab-V3 2010.06.23.00 2010.06.23 -
AntiVir 8.2.2.6 2010.06.22 -
Antiy-AVL 2.0.3.7 2010.06.22 -
Authentium 5.2.0.5 2010.06.23 -
Avast 4.8.1351.0 2010.06.22 -
Avast5 5.0.332.0 2010.06.22 -
AVG 9.0.0.836 2010.06.22 -
BitDefender 7.2 2010.06.23 -
CAT-QuickHeal 10.00 2010.06.23 Trojan.Agent.ATV
ClamAV 0.96.0.3-git 2010.06.23 -
Comodo 5192 2010.06.23 -
DrWeb 5.0.2.03300 2010.06.23 -
eSafe 7.0.17.0 2010.06.22 -
eTrust-Vet 36.1.7660 2010.06.23 -
F-Prot 4.6.1.107 2010.06.22 -
F-Secure 9.0.15370.0 2010.06.23 -
Fortinet 4.1.133.0 2010.06.22 -
GData 21 2010.06.23 -
Ikarus T3.1.1.84.0 2010.06.23 -
Jiangmin 13.0.900 2010.06.15 -
Kaspersky 7.0.0.125 2010.06.23 -
McAfee 5.400.0.1158 2010.06.23 -
McAfee-GW-Edition 2010.1 2010.06.22 -
Microsoft 1.5902 2010.06.23 -
NOD32 5220 2010.06.23 -
Norman 6.05.10 2010.06.22 -
nProtect 2010-06-23.01 2010.06.23 Trojan/W32.Agent.240128.O
Panda 10.0.2.7 2010.06.22 -
PCTools 7.0.3.5 2010.06.23 -
Prevx 3.0 2010.06.23 -
Rising 22.53.02.04 2010.06.23 -
Sophos 4.54.0 2010.06.23 -
Sunbelt 6492 2010.06.23 -
Symantec 20101.1.0.89 2010.06.23 -
TheHacker 6.5.2.0.303 2010.06.23 -
TrendMicro 9.120.0.1004 2010.06.23 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.23 -
VBA32 3.12.12.5 2010.06.22 -
ViRobot 2010.6.21.3896 2010.06.23 -
VirusBuster 5.0.27.0 2010.06.22 -
Rozšiřující informace
File size: 240128 bytes
MD5...: 5fdd7d827c1cc58567367d03d24548ce
SHA1..: 9937882f96f025991634b2833c5f4bcaef70beb2
SHA256: fb38f3faf93a90cfe0b9f0c0d9317eac12c2ccedc37e3058175b6e67598e2b91
ssdeep: 6144:MsJLK5WOrC8bIg3h9N1gAxayMDYvWf5jAe2GFWANt:vJ25WOr7bIg3hhtx0
mwjAe2GFW
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xfd0f0
timedatestamp.....: 0x422343d4 (Mon Feb 28 16:16:20 2005)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0xc2000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0xc3000 0x3b000 0x3a400 7.89 e48e6951c44a76c049967dc96482543b
UPX2 0xfe000 0x1000 0x200 1.41 1f7725eb8b599d9111fe0eb839e1a6d3

( 2 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, ExitProcess
> WS2_32.dll: -

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: UPX compressed Win32 Executable (39.5%)
Win32 EXE Yoda's Crypter (34.3%)
Win32 Executable Generic (11.0%)
Win32 Dynamic Link Library (generic) (9.8%)
Generic Win/DOS Executable (2.5%)
packers (Kaspersky): UPX
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned


c:\windows\meta4.exe

Antivirus Verze Poslední aktualizace Výsledek
a-squared 5.0.0.30 2010.06.22 -
AhnLab-V3 2010.06.22.00 2010.06.22 -
AntiVir 8.2.2.6 2010.06.21 -
Antiy-AVL 2.0.3.7 2010.06.22 Backdoor/win32.Graybird.gen
Authentium 5.2.0.5 2010.06.22 -
Avast 4.8.1351.0 2010.06.21 -
Avast5 5.0.332.0 2010.06.21 -
AVG 9.0.0.787 2010.06.21 -
BitDefender 7.2 2010.06.22 -
CAT-QuickHeal 10.00 2010.06.22 Trojan.Agent.IRC
ClamAV 0.96.0.3-git 2010.06.22 -
Comodo 5180 2010.06.22 -
DrWeb 5.0.2.03300 2010.06.22 -
eSafe 7.0.17.0 2010.06.20 Suspicious File
eTrust-Vet 36.1.7657 2010.06.22 -
F-Prot 4.6.1.107 2010.06.21 -
F-Secure 9.0.15370.0 2010.06.22 -
Fortinet 4.1.133.0 2010.06.21 -
GData 21 2010.06.22 -
Ikarus T3.1.1.84.0 2010.06.22 -
Jiangmin 13.0.900 2010.06.15 -
Kaspersky 7.0.0.125 2010.06.22 -
McAfee 5.400.0.1158 2010.06.22 -
McAfee-GW-Edition 2010.1 2010.06.22 -
Microsoft 1.5902 2010.06.22 -
NOD32 5216 2010.06.21 -
Norman 6.05.06 2010.06.21 -
nProtect 2010-06-21.01 2010.06.21 Trojan/W32.Agent.217073
Panda 10.0.2.7 2010.06.21 -
PCTools 7.0.3.5 2010.06.22 -
Prevx 3.0 2010.06.23 -
Rising 22.53.01.04 2010.06.22 -
Sophos 4.54.0 2010.06.22 -
Sunbelt 6483 2010.06.21 -
Symantec 20101.1.0.89 2010.06.22 -
TheHacker 6.5.2.0.302 2010.06.22 -
TrendMicro 9.120.0.1004 2010.06.22 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.22 -
VBA32 3.12.12.5 2010.06.22 -
ViRobot 2010.6.21.3896 2010.06.22 Trojan.Win32.Agent.217073
VirusBuster 5.0.27.0 2010.06.21 -
Rozšiřující informace
File size: 217073 bytes
MD5...: fce9e5f5c7ce6d7b1ec49b5ce07070c9
SHA1..: 2ca7b4304072b5a2634bae8dbb496ab2ebbc921a
SHA256: 7939dfbfe0860998c18a2949d7cc177e9fe393886aa4160887adf7a48f9a503c
ssdeep: 6144:23v6nrDwW/2lNjZOLtZPfWC5pT0hrG7rGs:23vmIWCN8/P95lkxs
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xca540
timedatestamp.....: 0x3f624be0 (Fri Sep 12 22:42:40 2003)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x99000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.data 0x9a000 0x31000 0x30800 7.64 6ce4ec47baa8be574bc676d1d1289646
.rdata 0xcb000 0x1000 0x200 1.46 d221ad615082a40dbddfbb1887007f98

( 2 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, ExitProcess
> msvcrt.dll: _iob

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 EXE Yoda's Crypter (56.8%)
Win32 Executable Generic (18.2%)
Win32 Dynamic Link Library (generic) (16.2%)
Generic Win/DOS Executable (4.2%)
DOS Executable Generic (4.2%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
packers (Kaspersky): UPX
packers (Antiy-AVL): UPX 0.89.6 - 1.02 / 1.05 - 1.22
packers (F-Prot): UPX


c:\windows\MOTA113.exe

Antivirus Verze Poslední aktualizace Výsledek
a-squared 5.0.0.30 2010.06.23 -
AhnLab-V3 2010.06.23.00 2010.06.23 -
AntiVir 8.2.2.6 2010.06.22 -
Antiy-AVL 2.0.3.7 2010.06.22 -
Authentium 5.2.0.5 2010.06.23 -
Avast 4.8.1351.0 2010.06.22 -
Avast5 5.0.332.0 2010.06.22 -
AVG 9.0.0.836 2010.06.22 -
BitDefender 7.2 2010.06.23 -
CAT-QuickHeal 10.00 2010.06.23 Trojan.Agent.ATV
ClamAV 0.96.0.3-git 2010.06.23 PUA.Packed.tElock1.Private
Comodo 5192 2010.06.23 -
DrWeb 5.0.2.03300 2010.06.23 -
eSafe 7.0.17.0 2010.06.22 -
eTrust-Vet 36.1.7660 2010.06.23 -
F-Prot 4.6.1.107 2010.06.22 -
F-Secure 9.0.15370.0 2010.06.23 -
Fortinet 4.1.133.0 2010.06.22 -
GData 21 2010.06.23 -
Ikarus T3.1.1.84.0 2010.06.23 -
Jiangmin 13.0.900 2010.06.15 -
Kaspersky 7.0.0.125 2010.06.23 -
McAfee 5.400.0.1158 2010.06.23 -
McAfee-GW-Edition 2010.1 2010.06.22 Heuristic.LooksLike.Trojan.Rootkit.B
Microsoft 1.5902 2010.06.23 -
NOD32 5220 2010.06.23 -
Norman 6.05.10 2010.06.22 -
nProtect 2010-06-23.01 2010.06.23 -
Panda 10.0.2.7 2010.06.22 -
PCTools 7.0.3.5 2010.06.23 -
Prevx 3.0 2010.06.23 -
Rising 22.53.02.04 2010.06.23 -
Sophos 4.54.0 2010.06.23 Sus/ComPack-C
Sunbelt 6492 2010.06.23 -
Symantec 20101.1.0.89 2010.06.23 -
TheHacker 6.5.2.0.303 2010.06.23 -
TrendMicro 9.120.0.1004 2010.06.23 PAK_Generic.001
TrendMicro-HouseCall 9.120.0.1004 2010.06.23 -
VBA32 3.12.12.5 2010.06.22 -
ViRobot 2010.6.21.3896 2010.06.23 -
VirusBuster 5.0.27.0 2010.06.22 -
Rozšiřující informace
File size: 66560 bytes
MD5...: f3f62f42e5ea4e65736338c0c43ad5c0
SHA1..: d45071ec1fd1e805494dc04f5119f6d757e26729
SHA256: ed29a74ec976c7271606bc9b18cb903adcafa73962504624722389192c186684
ssdeep: 1536:VtNKGLMoklz+TmVjU+F8MWvm0WojgG0n5h58c6QD7iTr:VtNpLCVjUU8oWz
KH8/QDG
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x23bd6
timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)
machinetype.......: 0x14c (I386)

( 8 sections )
name viradd virsiz rawdsiz ntrpy md5
0x1000 0x19000 0xc800 8.00 40cf31ddb5b15044d0187938941a6d4f
0x1a000 0x1000 0x400 7.81 686f4ed16ed8c0a9b6ef919021544453
0x1b000 0x1000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
0x1c000 0x1000 0x600 7.86 a690ce98b383f35c95161ed71823dbf3
0x1d000 0x1000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
0x1e000 0x3000 0x200 7.61 c4fa6811afaae510c3f64a19f8ac2eec
.rsrc 0x21000 0x1000 0xa00 7.26 584df56f9e7ce3e64e9ba3b03146cdfd
0x22000 0x3000 0x2200 7.63 bdc435d67bcd91c373041cd55519f8f4

( 2 imports )
> kernel32.dll: GetModuleHandleA
> user32.dll: MessageBoxA

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: tElock compressed/encrypted Win32 executable (73.0%)
Win32 Dynamic Link Library (generic) (14.9%)
Win16/32 Executable Delphi generic (4.0%)
Generic Win/DOS Executable (3.9%)
DOS Executable Generic (3.9%)
packers (Kaspersky): PE_Patch, TeLock
packers (F-Prot): TeLock
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned


c:\windows\x2.64.exe

Antivirus Verze Poslední aktualizace Výsledek
a-squared 5.0.0.30 2010.06.23 -
AhnLab-V3 2010.06.23.00 2010.06.23 -
AntiVir 8.2.2.6 2010.06.22 -
Antiy-AVL 2.0.3.7 2010.06.22 -
Authentium 5.2.0.5 2010.06.23 -
Avast 4.8.1351.0 2010.06.22 -
Avast5 5.0.332.0 2010.06.22 -
AVG 9.0.0.836 2010.06.22 -
BitDefender 7.2 2010.06.23 -
CAT-QuickHeal 10.00 2010.06.23 -
ClamAV 0.96.0.3-git 2010.06.23 -
Comodo 5192 2010.06.23 -
DrWeb 5.0.2.03300 2010.06.23 -
eSafe 7.0.17.0 2010.06.22 -
eTrust-Vet 36.1.7660 2010.06.23 -
F-Prot 4.6.1.107 2010.06.22 -
F-Secure 9.0.15370.0 2010.06.23 -
Fortinet 4.1.133.0 2010.06.22 -
GData 21 2010.06.23 -
Ikarus T3.1.1.84.0 2010.06.23 -
Jiangmin 13.0.900 2010.06.15 -
Kaspersky 7.0.0.125 2010.06.23 -
McAfee 5.400.0.1158 2010.06.23 -
McAfee-GW-Edition 2010.1 2010.06.22 -
Microsoft 1.5902 2010.06.23 -
NOD32 5220 2010.06.23 -
Norman 6.05.10 2010.06.22 -
nProtect 2010-06-23.01 2010.06.23 -
Panda 10.0.2.7 2010.06.22 -
PCTools 7.0.3.5 2010.06.23 -
Prevx 3.0 2010.06.23 -
Rising 22.53.02.04 2010.06.23 -
Sophos 4.54.0 2010.06.23 -
Sunbelt 6492 2010.06.23 -
Symantec 20101.1.0.89 2010.06.23 -
TheHacker 6.5.2.0.303 2010.06.23 -
TrendMicro 9.120.0.1004 2010.06.23 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.23 -
VBA32 3.12.12.5 2010.06.22 -
ViRobot 2010.6.21.3896 2010.06.23 -
VirusBuster 5.0.27.0 2010.06.22 -
Rozšiřující informace
File size: 422400 bytes
MD5...: d1cdd4d4895fd5c1914728f4f77adf97
SHA1..: 5a5da8e75a99e18cfce7a244f992d6578fa46d67
SHA256: 72367e0460bd54ec0f374bd18eb59cbb014a47c1f8f39563b3177e2e1de1811d
ssdeep: 12288:8DEaUNZ+XpQaGMTWQurZECK6LYvSMZJTGKOEsUrEK:uCrkp0kWhWVZH6+l
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x11ea20
timedatestamp.....: 0x43476b6e (Sat Oct 08 06:47:10 2005)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0xb7000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0xb8000 0x67000 0x66c00 7.92 d45a92448defc72bb2cbf440d6963396
UPX2 0x11f000 0x1000 0x200 1.48 0888e24cc4a0a461cfbdd1df4062bd1e

( 2 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, ExitProcess
> MSVCRT.dll: exit

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: UPX compressed Win32 Executable (39.5%)
Win32 EXE Yoda's Crypter (34.3%)
Win32 Executable Generic (11.0%)
Win32 Dynamic Link Library (generic) (9.8%)
Generic Win/DOS Executable (2.5%)
packers (Kaspersky): UPX
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
packers (F-Prot): UPX

[jaro3]

Bledulka tady bude až večer.

Odmažeme nákazy a zbytek po COMODO.

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
File::
c:\windows\system32\drivers\sfi.dat
c:\windows\system32\SIntf16.dll
c:\windows\system32\Remove.exe
c:\windows\system32\ezsidmv.dat
c:\windows\ativpsrm.bin
c:\windows\meta4.exe
c:\windows\MOTA113.exe
c:\windows\system32\x.264.exe

Folder::
c:\program files\Comodo
c:\program files\ICQ6Toolbar
c:\windows\SxsCaPendDel

Driver::
IODRV

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému

Toto otestuj na Virustotal
c:\program files\Eset\pr_imon.dll
Pokud už byl soubor testován-klikni na otestovat znovu.

Až skončí test všech antivirů, vlož sem pak odkaz na stránku s výsledky.

[mara362]

CFScript:

ComboFix 10-06-22.03 - Marek 23.06.2010 15:35:52.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1023.727 [GMT 2:00]
Spuštěný z: c:\documents and settings\Marek\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Marek\Plocha\CFScript.txt
AV: Eset NOD32 Antivirus 2.70 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Rezidentní štít AV je zapnutý


FILE ::
"c:\windows\ativpsrm.bin"
"c:\windows\meta4.exe"
"c:\windows\MOTA113.exe"
"c:\windows\system32\drivers\sfi.dat"
"c:\windows\system32\ezsidmv.dat"
"c:\windows\system32\Remove.exe"
"c:\windows\system32\SIntf16.dll"
"c:\windows\system32\x.264.exe"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Comodo
c:\program files\ICQ6Toolbar
c:\program files\ICQ6Toolbar\config.xml
c:\program files\ICQ6Toolbar\Icons.bmp
c:\program files\ICQ6Toolbar\ICQ Service.exe
c:\program files\ICQ6Toolbar\icq6Toolbar.ico
c:\program files\ICQ6Toolbar\ICQToolBar.dll
c:\program files\ICQ6Toolbar\ICQUnToolbar.exe
c:\program files\ICQ6Toolbar\logo_small.gif
c:\program files\ICQ6Toolbar\ServiceStarter.exe
c:\program files\ICQ6Toolbar\short.wav
c:\program files\ICQ6Toolbar\Version.txt
c:\windows\ativpsrm.bin
c:\windows\meta4.exe
c:\windows\MOTA113.exe
c:\windows\SxsCaPendDel
c:\windows\system32\drivers\sfi.dat
c:\windows\system32\ezsidmv.dat
c:\windows\system32\Remove.exe
c:\windows\system32\SIntf16.dll
c:\windows\system32\x.264.exe

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_IODRV
-------\Service_IODRV


((((((((((((((((((((((((( Soubory vytvořené od 2010-05-23 do 2010-06-23 )))))))))))))))))))))))))))))))
.

2010-06-22 22:57 . 2010-06-22 22:58 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-06-22 22:57 . 2010-06-22 22:58 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-06-22 12:42 . 2010-06-22 12:41 512096 ----a-w- c:\windows\system32\drivers\amon.sys
2010-06-22 12:42 . 2010-06-22 12:41 298104 ----a-w- c:\windows\system32\imon.dll
2010-06-22 12:42 . 2010-06-22 12:41 15424 ----a-w- c:\windows\system32\drivers\nod32drv.sys
2010-06-22 12:37 . 2010-06-22 12:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-06-21 20:09 . 2010-06-21 20:10 -------- d-----w- c:\program files\RegCleaner
2010-06-20 12:24 . 2010-06-20 12:24 -------- d-----w- c:\program files\Opera
2010-06-20 12:06 . 2010-06-20 12:06 -------- d-----w- c:\windows\system32\Adobe
2010-06-14 16:27 . 2010-06-14 16:27 -------- d-----w- C:\VritualRoot
2010-06-14 16:25 . 2010-06-14 16:26 -------- d--h--w- c:\windows\$hf_mig$
2010-06-10 15:43 . 2010-06-10 15:43 -------- d-----w- c:\windows\system32\Lang
2010-06-07 23:44 . 2010-06-07 23:44 -------- d-----w- c:\program files\Google
2010-06-07 22:07 . 2010-06-07 22:07 -------- d-----w- c:\program files\AviSynth 2.5
2010-06-07 22:06 . 2010-06-07 22:06 -------- d-sh--w- c:\windows\system32\ShellDHCP
2010-06-06 20:38 . 2010-06-06 20:38 -------- d-----w- c:\program files\7-Zip
2010-06-04 13:03 . 2010-06-20 17:54 -------- d-----w- c:\documents and settings\Marek\old screens
2010-06-03 22:54 . 2010-06-06 20:10 -------- d-----w- C:\QIP Infium JadrisPack
2010-06-03 21:33 . 2010-06-03 21:34 -------- d-----w- c:\program files\ABBYY FineReader 6.0 Sprint
2010-06-03 21:29 . 2004-09-10 20:12 49152 ----a-w- c:\windows\system32\E_DCINST.DLL
2010-06-03 21:28 . 2005-12-09 01:03 71168 ----a-w- c:\windows\system32\E_FLBBEE.DLL
2010-06-03 21:28 . 2005-04-11 01:01 62976 ----a-w- c:\windows\system32\E_FD4BBEE.DLL
2010-06-03 21:28 . 2004-08-03 20:58 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2010-06-03 21:28 . 2004-08-03 20:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-06-03 21:27 . 2010-06-03 21:35 -------- d-----w- c:\program files\epson
2010-06-03 21:27 . 2005-02-24 22:00 46080 ----a-w- c:\windows\system32\escimgd.dll
2010-06-03 21:27 . 2005-02-24 22:00 29696 ----a-w- c:\windows\system32\escwiad.dll
2010-06-03 21:27 . 2005-02-24 22:00 22016 ----a-w- c:\windows\system32\esccmd.dll
2010-06-03 21:18 . 2004-08-03 21:01 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2010-06-03 21:18 . 2004-08-03 21:01 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2010-06-02 18:58 . 2010-03-29 13:24 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-02 18:58 . 2010-03-29 13:24 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-06-02 18:57 . 2010-06-02 18:58 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-31 13:18 . 2010-05-31 13:18 -------- d-----w- c:\documents and settings\LocalService\Plocha
2010-05-31 13:12 . 2010-05-31 13:11 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-05-29 10:23 . 2010-05-29 10:23 -------- d-----w- c:\program files\Common Files\Java
2010-05-29 10:23 . 2010-04-12 15:29 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-05-28 08:48 . 2010-05-28 08:48 -------- d-----w- c:\windows\Sun
2010-05-28 08:45 . 2010-05-29 10:23 -------- d-----w- c:\program files\Java
2010-05-28 07:25 . 2010-05-28 07:25 21840 ----a-w- c:\windows\system32\SIntfNT.dll
2010-05-28 07:25 . 2010-05-28 07:25 17212 ----a-w- c:\windows\system32\SIntf32.dll
2010-05-28 07:17 . 2010-05-28 07:17 -------- d-----w- c:\program files\A4Tech
2010-05-27 18:16 . 2010-05-27 18:24 -------- d-----w- c:\program files\TalonSoft
2010-05-27 17:44 . 2010-05-27 17:44 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-05-27 15:33 . 2010-06-15 21:20 -------- d-----w- c:\program files\LucasArts
2010-05-27 14:29 . 2010-05-27 14:29 -------- d-sh--w- c:\documents and settings\Marek\IECompatCache
2010-05-27 14:24 . 2010-05-27 14:24 -------- d-sh--w- c:\documents and settings\Marek\PrivacIE
2010-05-27 10:30 . 2010-05-27 10:30 -------- d-----w- c:\program files\Tetris
2010-05-27 10:14 . 2010-05-27 10:14 -------- d-sh--w- c:\documents and settings\Marek\IETldCache
2010-05-27 10:11 . 2010-05-27 10:12 -------- d-----w- c:\windows\system32\cs-CZ
2010-05-27 10:11 . 2010-05-27 10:12 -------- dc-h--w- c:\windows\ie8
2010-05-26 19:25 . 2004-08-17 13:49 54272 -c--a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2010-05-26 19:25 . 2004-08-17 13:49 54272 ----a-w- c:\windows\system32\vfwwdm32.dll
2010-05-26 11:33 . 2007-11-08 08:29 458752 ----a-w- c:\windows\system32\drivers\PAC7302.SYS
2010-05-26 11:33 . 2007-11-02 09:07 6656 ----a-w- c:\windows\system32\CoInst_071029.dll
2010-05-26 11:33 . 2010-05-26 11:33 -------- d-----w- c:\program files\ANC
2010-05-26 11:33 . 2006-10-12 09:57 14336 ----a-w- c:\windows\system32\P7302USD.dll
2010-05-26 11:33 . 2010-05-26 11:33 -------- d-----w- c:\program files\Common Files\PAC7302
2010-05-26 11:33 . 2010-05-26 11:33 -------- d-----w- c:\windows\PixArt
2010-05-26 11:22 . 2010-05-26 11:24 -------- d-----w- c:\program files\Common Files\Adobe
2010-05-25 13:42 . 2010-05-25 13:42 -------- d-----w- c:\program files\Rockstar Games
2010-05-24 23:37 . 2003-03-15 21:15 90112 ----a-w- c:\windows\unvise32.exe
2010-05-24 23:32 . 2010-05-24 23:32 -------- d-----w- c:\program files\DreamCatcher
2010-05-24 22:59 . 2010-05-24 22:59 -------- d-----w- c:\program files\Psi
2010-05-24 22:29 . 2010-05-24 22:29 -------- d-----w- c:\program files\EA GAMES
2010-05-24 22:20 . 2006-10-26 17:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2010-05-24 22:20 . 2006-10-26 17:56 32592 ----a-w- c:\windows\system32\msonpmon.dll
2010-05-24 22:19 . 2010-05-24 22:19 -------- d-----w- c:\program files\Microsoft Works
2010-05-24 15:03 . 2006-10-26 17:58 30512 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2010-05-24 15:03 . 2006-10-26 17:58 30512 ----a-w- c:\windows\system32\mdimon.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-22 22:57 . 2010-05-23 16:09 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-06-22 22:55 . 2010-05-23 23:20 -------- d-----w- c:\program files\ESET
2010-06-22 12:30 . 2010-05-23 16:12 -------- d-----r- c:\program files\Skype
2010-06-15 21:20 . 2010-05-23 15:57 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-15 10:16 . 2001-10-25 14:00 68736 ----a-w- c:\windows\system32\perfc005.dat
2010-06-15 10:16 . 2001-10-25 14:00 389664 ----a-w- c:\windows\system32\perfh005.dat
2010-06-14 19:58 . 2010-05-23 23:18 -------- d-----w- c:\program files\uTorrent
2010-06-03 21:38 . 2010-05-23 15:56 -------- d-----w- c:\program files\Common Files\InstallShield
2010-05-25 12:44 . 2010-05-24 12:43 -------- d-----w- c:\program files\Scorpions WinCheater
2010-05-24 23:10 . 2010-05-23 16:08 -------- d-----w- c:\program files\CCleaner
2010-05-24 22:18 . 2010-05-24 22:18 -------- d-----w- c:\program files\Microsoft.NET
2010-05-24 17:24 . 2010-05-24 17:24 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ggsemc_01007.Wdf
2010-05-24 17:24 . 2010-05-24 17:24 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ggflt_01007.Wdf
2010-05-24 17:24 . 2010-05-24 17:24 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2010-05-24 17:16 . 2010-05-24 17:16 27632 ----a-w- c:\windows\system32\drivers\seehcri.sys
2010-05-24 17:16 . 2010-05-24 17:16 25512 ----a-w- c:\windows\system32\drivers\ggsemc.sys
2010-05-24 17:16 . 2010-05-24 17:16 1112288 ----a-w- c:\windows\system32\WdfCoInstaller01007.dll
2010-05-24 17:16 . 2010-05-24 17:16 13224 ----a-w- c:\windows\system32\drivers\ggflt.sys
2010-05-24 17:15 . 2010-05-24 17:15 -------- d-----w- c:\program files\Sony Ericsson
2010-05-24 14:53 . 2010-05-24 12:10 -------- d-----w- c:\program files\World of Warcraft
2010-05-24 13:23 . 2010-05-24 13:23 -------- d-----w- c:\program files\ACDSee32
2010-05-24 13:12 . 2010-05-24 12:47 -------- d-----w- c:\program files\MyPhoneExplorer
2010-05-24 12:45 . 2010-05-24 12:45 -------- d-----w- c:\program files\eRightSoft
2010-05-24 12:44 . 2010-05-24 12:44 -------- d-----w- c:\program files\VirtualDub
2010-05-24 12:43 . 2010-05-24 12:43 -------- d-----w- c:\program files\CyberLink
2010-05-24 12:42 . 2010-05-24 12:42 -------- d-----w- c:\program files\mpegable
2010-05-24 12:42 . 2010-05-24 12:42 47104 ------w- c:\windows\AKDeInstall.exe
2010-05-24 12:41 . 2010-05-24 12:40 -------- d-----w- c:\program files\HyperSnap 6
2010-05-24 11:57 . 2010-05-24 11:57 -------- d-----w- c:\program files\PSPad editor
2010-05-24 11:33 . 2010-05-24 11:33 -------- d-----w- c:\program files\themes
2010-05-23 23:34 . 2010-05-23 23:34 -------- d-----w- c:\program files\Common Files\LightScribe
2010-05-23 23:32 . 2010-05-23 23:28 -------- d-----w- c:\program files\Common Files\Nero
2010-05-23 23:28 . 2010-05-23 23:28 -------- d-----w- c:\program files\Nero
2010-05-23 16:18 . 2010-05-23 16:17 -------- d-----w- c:\program files\Realtek AC97
2010-05-23 16:15 . 2010-05-23 16:14 -------- d-----w- c:\program files\Winamp
2010-05-23 16:14 . 2010-05-23 16:14 -------- d-----w- c:\program files\Winamp Detect
2010-05-23 16:12 . 2010-05-23 16:12 -------- d-----w- c:\program files\Common Files\Skype
2010-05-23 16:11 . 2010-05-23 16:10 -------- d-----w- c:\program files\QIP
2010-05-23 16:07 . 2010-05-23 16:07 -------- d-----w- c:\program files\Webteh
2010-05-23 16:06 . 2010-05-23 16:06 -------- d-----w- c:\program files\1stbenison
2010-05-23 16:03 . 2010-05-23 16:03 -------- d-----w- c:\program files\SiSLan
2010-05-23 16:01 . 2010-05-23 15:58 -------- d-----w- c:\program files\Common Files\ATI Technologies
2010-05-23 16:01 . 2010-05-23 15:57 -------- d-----w- c:\program files\ATI Technologies
2010-05-23 15:49 . 2010-05-23 15:49 -------- d-----w- c:\program files\Western Digital
2010-05-23 15:30 . 2010-05-23 15:07 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-05-23 15:30 . 2010-05-23 15:07 2426 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-05-23 15:30 . 2010-05-23 15:07 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-05-23 15:08 . 2010-05-23 15:08 -------- d-----w- c:\program files\microsoft frontpage
2010-05-23 15:04 . 2010-05-23 15:04 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-04-29 09:47 . 2010-04-29 09:47 499712 ----a-w- c:\windows\system32\msvcp71.dll
2005-10-13 19:27 . 2005-10-13 19:27 422400 --sha-r- c:\windows\x2.64.exe
2005-10-07 17:14 . 2005-10-07 17:14 308224 --sha-r- c:\windows\system32\avisynth.dll
2005-07-14 10:31 . 2005-07-14 10:31 27648 --sha-r- c:\windows\system32\AVSredirect.dll
2005-06-26 13:32 . 2005-06-26 13:32 616448 --sha-r- c:\windows\system32\cygwin1.dll
2005-06-21 20:37 . 2005-06-21 20:37 45568 --sha-r- c:\windows\system32\cygz.dll
2004-01-24 22:00 . 2004-01-24 22:00 70656 --sha-r- c:\windows\system32\i420vfw.dll
2006-04-27 08:24 . 2006-04-27 08:24 2945024 --sha-r- c:\windows\system32\Smab.dll
2004-01-24 22:00 . 2004-01-24 22:00 70656 --sha-r- c:\windows\system32\yv12vfw.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-06-22_20.37.57 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-06-23 13:42 . 2010-06-23 13:42 16384 c:\windows\temp\Perflib_Perfdata_658.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-07-09 570664]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2008-03-06 241664]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2010-06-22 949376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Psi\\psi.exe"=
"c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\DreamCatcher\\Painkiller\\Bin\\Painkiller.exe"=
"c:\\Games\\EA GAMES\\MOHAA\\MOHAA.exe"=
"c:\\Garrysmod\\hl2.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\QIP Infium JadrisPack\\infium.exe"=
"c:\\Games\\TDU\\TestDriveUnlimited.exe"=
"c:\\Program Files\\LucasArts\\Star Wars Jedi Knight Jedi Academy\\GameData\\jamp.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [23.5.2010 18:09 691696]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [22.6.2010 14:42 15424]
R2 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [13.11.2009 11:28 110592]
R2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [16.6.2009 8:58 20480]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [24.5.2010 19:16 27632]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [23.5.2010 17:49 11520]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [24.5.2010 19:16 13224]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2.6.2010 20:58 38224]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-02-25 09:12 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://seznam.cz/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-23 15:42
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x867DB1F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7873fc3
\Driver\ACPI -> ACPI.sys @ 0xf76dbcb8
\Driver\atapi -> 0x867db1f8
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a1afe
ParseProcedure -> ntoskrnl.exe @ 0x80570a6e
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a1afe
ParseProcedure -> ntoskrnl.exe @ 0x80570a6e
NDIS: SiS 900 PCI Fast Ethernet Adapter -> SendCompleteHandler -> NDIS.sys @ 0xf757caf9
PacketIndicateHandler -> NDIS.sys @ 0xf7587b21
SendHandler -> NDIS.sys @ 0xf757c938
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(564)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(620)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll

- - - - - - - > 'explorer.exe'(408)
c:\windows\system32\ieframe.dll
c:\windows\system32\Amhooker.dll
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\Eset\nod32krn.exe
c:\windows\system32\wdfmgr.exe
c:\windows\SOUNDMAN.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Celkový čas: 2010-06-23 15:45:51 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-06-23 13:45
ComboFix2.txt 2010-06-22 20:39

Před spuštěním: Volných bajtů: 190 279 512 064
Po spuštění: Volných bajtů: 190 187 216 896

- - End Of File - - A54129426812F7A8E94A9CB4837B973A


VirusTotal:

Antivirus Verze Poslední aktualizace Výsledek
a-squared 5.0.0.30 2010.06.23 -
AhnLab-V3 2010.06.23.01 2010.06.23 -
AntiVir 8.2.2.6 2010.06.23 -
Antiy-AVL 2.0.3.7 2010.06.23 -
Authentium 5.2.0.5 2010.06.23 -
Avast 4.8.1351.0 2010.06.23 -
Avast5 5.0.332.0 2010.06.23 -
AVG 9.0.0.836 2010.06.23 -
BitDefender 7.2 2010.06.23 -
CAT-QuickHeal 10.00 2010.06.23 -
ClamAV 0.96.0.3-git 2010.06.23 -
Comodo 5194 2010.06.23 -
DrWeb 5.0.2.03300 2010.06.23 -
eSafe 7.0.17.0 2010.06.22 -
eTrust-Vet 36.1.7661 2010.06.23 -
F-Prot 4.6.1.107 2010.06.22 -
F-Secure 9.0.15370.0 2010.06.23 -
Fortinet 4.1.133.0 2010.06.23 -
GData 21 2010.06.23 -
Ikarus T3.1.1.84.0 2010.06.23 -
Jiangmin 13.0.900 2010.06.15 -
Kaspersky 7.0.0.125 2010.06.23 -
McAfee 5.400.0.1158 2010.06.23 -
McAfee-GW-Edition 2010.1 2010.06.23 -
Microsoft 1.5902 2010.06.23 -
NOD32 5221 2010.06.23 -
Norman 6.05.10 2010.06.23 -
nProtect 2010-06-23.02 2010.06.23 -
Panda 10.0.2.7 2010.06.23 -
PCTools 7.0.3.5 2010.06.23 -
Rising 22.53.02.04 2010.06.23 -
Sophos 4.54.0 2010.06.23 -
Sunbelt 6493 2010.06.23 -
Symantec 20101.1.0.89 2010.06.23 -
TheHacker 6.5.2.0.303 2010.06.23 -
TrendMicro 9.120.0.1004 2010.06.23 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.23 -
VBA32 3.12.12.5 2010.06.23 -
ViRobot 2010.6.21.3896 2010.06.23 -
VirusBuster 5.0.27.0 2010.06.23 -
Rozšiřující informace
File size: 52280 bytes
MD5...: e367058bb58a44b817a1c26a98a472c8
SHA1..: e4bbf683ed79aa3dfa15c0472fcd4d5165149085
SHA256: f560c2598d4300ce934ebc1098ebef39ffc302d2908cec22b4788a675f873ec2
ssdeep: 384:EbyOAvKYlgZF08jpyDvTHY1fUdGQtcabrcgoLjABiqUAb0HSI6ZK36BV85iB
PL3A:LKlbp4j3XSab4mTbpN77bw
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1000
timedatestamp.....: 0x46440de4 (Fri May 11 06:32:04 2007)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x10 0x1000 0.03 d5fd4a4487d7283ae403de21c1b45360
.rsrc 0x2000 0x8f08 0x9000 3.93 cb8184bd4c7f9137828e04baedaf4410
.reloc 0xb000 0xc 0x1000 0.00 3808644f11ba1ee3cb2b6326fcd2e01a

( 0 imports )

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

nový log z HJT:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:46:57, on 23.6.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\PixArt\PAC7302\Monitor.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Opera\opera.exe
C:\Documents and Settings\Marek\Plocha\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [PAC7302_Monitor] C:\WINDOWS\PixArt\PAC7302\Monitor.exe
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP\qip.exe (HKCU)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: WD SmartWare Drive Manager (WDDMService) - WDC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
O23 - Service: WD SmartWare Background Service (WDSmartWareBackgroundService) - Memeo - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe

--
End of file - 7108 bytes

[jaro3]

Odinstaluj:
DAEMON Tools Toolbar


Smaž složku:
c:\program files\DAEMON Tools Toolbar

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

R3 - URLSearchHook: (no name) - - (no file)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab


Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Jak se chová PC?

[mara362]

Nerad to říkám, ale chová se poměrně stejně jako před čištěním. Mimo jiné ve správci úloh stále není vidět uživatelské jméno (user, system, local...)

[jaro3]

Zkusíme opravit.

Stáhni si Dial-a-fix

Control Panel applets - Pokusí se o opravu Ovládacích panelů.

Policies: Otevře přehled všech použitých omezení nastavených v registru, například na použití editoru registru, správce úloh atd. --zkopíruj pak sem
Klikni na službu(dej zatržítko) a potom na GO.

Pokud to nepomůže:
Klikni na kladívko-další možnosti:
SFC scan - Spustí nástroj pro kontrolu systémových souborů (případná potřeba instalačního media Windows).
Klikni na službu a potom na GO.

[bledulka]

Ještě doplním Jara3

Odinstaluj všechny virtuální jednotky (Daemon nebo alcohol)

Stáhni SPTD http://www.duplexsecure.com/en/downloads
-vyber verzi podle svého operačního systému. SPTD for Windows (32 bit) nebo (64b)
-ulož na plochu a spusť
- zvol možnost Uninstall
- restart PC



**********************************************

Stahni Gmer http://www.gmer.net/gmer.zip
-rozbal ho a spusť
-po prvním rychlém skenu klikni na tlačítko Save, uloží se log, který mi sem zkopíruješ.
-v pravém sloupci označ všechny položky fajfkou ve čtverečku a klikni na tlačítko scan
-až se sken dokončí, opět tlačítkem Save ulož log, který sem vložíš.


**********************************************

Stáhni MBR
http://www2.gmer.net/mbr/mbr.exe
-ulož ho na plochu
- start-spustit
do okénka zkopíruj
"%userprofile%\plocha\mbr" -t
ok
-na ploše se vytvoří log s názvem mbr.log, vlož ho sem

[mara362]

Takhle rozjebanej systém jsem snad ještě neměl

MBR:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK


GMER:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-06-24 00:20:31
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\Marek\LOCALS~1\Temp\uxriafod.sys


---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs amon.sys (Amon monitor/Eset )

---- EOF - GMER 1.0.15 ----

edit: správce úloh už dělá a ukazuje co má, jenom nejde updatnout NOD32. našel jsem ho kdysi na hardisku, společně s "fixem pro neverend trial". nikdy nebyly žádný problémy, proto ho používám doteď. Míval jsem ho také v kombinaci s Ad-Awarem a windowsáckým firewallem a v pohodě. COMODO jsem instaloval, protože jsem chtěl lepší firewall a protože v něm byl i Antivir, NOD nebyl třeba. to byla ale špatná volba. COMODO je naprostý PSYCHO! pořád něco odklikávat, po spuštění nějaké aplikace to dělá různý blbosti od padání do woken, přes blikání obrazovky... no prostě šílenost. příště radši Kerio a zvlášť antivir jinak to s chodem systému celkem teď jde. Jediný problém je takřka k ho*nu antivirus - neupdatuje. což se mi s ním nikdy nestalo!