prosim o kontrolu logu Vyřešeno

[milosb]

ok.musím dnes končiť,zajtra čaká oráca.poobede sa ozvem.zatial velká vďaka

[Reklama]

[jaro3]

Fajn ještě tenhle:

Ještě na VT:
C:\WINDOWS\system32\dllcache\cdrom.sys
C:\WINDOWS\system32\drivers\cdrom.sys


Použil si ten Dr.Web CureIt?? Pokud ne , tak ho vyzkoušej , všechy soubory ve win zkus léčit...
***
Abychom to zbytečně nenahrazovali a pak se to zpětně infikovalo znovu , udělej napřed toto:

Stahni AVPtool
-nainstaluj, nech provést sken všechn jednotek
-co najde nech léčit
-pak sem vlož log.

Jestli bude nejspíš trvat dlouho , tak budem pokračovat zítra..

[milosb]

ahoj.


C:\WINDOWS\system32\dllcache\cdrom.sys vo VT mi vypísalo tento soubor nebyl nalezen

http://www.virustotal.com/file-scan/rep ... 1285252051

log
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:51:37, on 23. 9. 2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [OEXPRESS] C:\Documents and Settings\All Users\Data aplikací\LangSoft\OETRN.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: setup_9.0.0.722_23.09.2010_14-26.lnk = C:\Documents and Settings\michal\Plocha\Virus Removal Tool\setup_9.0.0.722_23.09.2010_14-26\startup.exe
O8 - Extra context menu item: Stáhnout s IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Stáhnout s IDM obsah FLV videa - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Stáhnout s IDM všechny odkazy - C:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastaviť prekladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Preložiť &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Preložiť &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5928 bytes

[jaro3]

Ten AVP Tool jsi nedělal? Tak ho udělej dodatečně...

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
FCOPY::
C:\WINDOWS\system32\drivers\cdrom.sys | C:\WINDOWS\system32\dllcache\cdrom.sys
c:\windows\system32\user32.dll | c:\windows\system32\dllcache\user32.dll

File::
c:\windows\system32\ezsidmv.dat
c:\windows\system32\perfc005.dat
c:\windows\system32\perfh005.dat
c:\windows\Tasks\WGASetup.job
 c:\windows\system32\KB905474\wgasetup.exe

Firefox::
FF - ProfilePath - c:\documents and settings\michal\Data aplikací\Mozilla\Firefox\Profiles\p9kzbdip.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Softonic-Eng7 Customized Web Search
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.as ... 2405280&q=

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu .

[milosb]

ComboFix 10-09-22.06 - michal . 09. 2010 18:58:57.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1029.18.2047.1539 [GMT 2:00]
Running from: c:\documents and settings\michal\Plocha\ComboFix.exe
Command switches used :: c:\documents and settings\michal\Plocha\CFScript.txt
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

FILE ::
"c:\windows\system32\ezsidmv.dat"
"c:\windows\system32\KB905474\wgasetup.exe"
"c:\windows\system32\perfc005.dat"
"c:\windows\system32\perfh005.dat"
"c:\windows\Tasks\WGASetup.job"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ezsidmv.dat
c:\windows\system32\perfc005.dat
c:\windows\system32\perfh005.dat

.
--------------- FCopy ---------------

c:\windows\system32\drivers\cdrom.sys --> c:\windows\system32\dllcache\cdrom.sys
c:\windows\system32\user32.dll --> c:\windows\system32\dllcache\user32.dll
.
((((((((((((((((((((((((( Files Created from 2010-08-23 to 2010-09-23 )))))))))))))))))))))))))))))))
.

2010-09-23 16:58 . 2010-09-22 16:21 62976 ----a-w- c:\windows\system32\dllcache\cdrom.sys
2010-09-23 15:22 . 2010-09-23 15:22 7168 ----a-w- c:\windows\system32\drivers\utqyntk1.sys
2010-09-23 14:40 . 2009-10-22 11:54 37392 ----a-w- c:\windows\system32\drivers\35714112.sys
2010-09-23 14:40 . 2009-10-09 21:31 315408 ----a-w- c:\windows\system32\drivers\3571411.sys
2010-09-23 14:40 . 2009-09-25 15:59 128016 ----a-w- c:\windows\system32\drivers\35714111.sys
2010-09-23 09:43 . 2010-09-23 09:50 -------- d-----w- C:\filmy
2010-09-22 18:17 . 2010-09-22 18:17 -------- d-----w- c:\windows\system32\wbem\snmp
2010-09-22 18:17 . 2010-09-22 18:17 -------- d-----w- c:\windows\system32\xircom
2010-09-22 18:17 . 2010-09-22 18:17 -------- d-----w- c:\program files\microsoft frontpage
2010-09-22 18:16 . 2010-09-22 16:21 62976 ------w- c:\windows\system32\drivers\cdrom.sys
2010-09-21 19:39 . 2010-09-21 19:39 -------- d-----w- c:\program files\Uniblue
2010-09-21 12:20 . 2010-09-21 12:20 -------- d-----w- c:\program files\HD Tune
2010-09-21 09:02 . 2010-09-21 09:02 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-09-21 08:28 . 2008-04-14 06:52 578560 ----a-w- c:\windows\system32\dllcache\user32.dll
2010-09-21 07:51 . 2010-09-21 07:51 -------- d-sh--w- c:\documents and settings\michal\PrivacIE
2010-09-21 06:34 . 2010-09-21 06:34 -------- d-----w- c:\program files\Winamp Detect
2010-09-21 03:43 . 2010-09-21 03:43 -------- d-sh--w- c:\documents and settings\michal\IETldCache
2010-09-20 13:37 . 2010-09-20 13:38 -------- d-----w- c:\windows\ie8updates
2010-09-20 13:35 . 2010-09-20 13:37 -------- dc-h--w- c:\windows\ie8
2010-09-20 08:44 . 2010-09-20 08:44 -------- d--h--w- c:\windows\PIF
2010-09-19 18:48 . 2010-09-20 08:05 96 ---ha-w- c:\windows\system32\HsInfo.dat
2010-09-19 16:06 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-19 16:06 . 2010-09-22 16:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-19 16:06 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-19 15:54 . 2010-09-23 15:49 -------- d-----w- c:\documents and settings\michal\DoctorWeb
2010-09-19 15:28 . 2010-09-19 15:28 -------- d-----w- c:\program files\Trend Micro
2010-09-18 19:55 . 2010-09-18 19:55 -------- d-----w- c:\program files\CCleaner
2010-09-18 17:20 . 2010-07-09 22:38 61440 ----a-w- c:\windows\system32\OpenCL.dll
2010-09-18 17:20 . 2010-07-09 22:38 13549568 ----a-w- c:\windows\system32\nvoglnt.dll
2010-09-18 17:20 . 2010-07-09 22:38 4595712 ----a-w- c:\windows\system32\nvcuda.dll
2010-09-18 17:20 . 2010-07-09 22:38 2914408 ----a-w- c:\windows\system32\nvcuvid.dll
2010-09-18 17:20 . 2010-07-09 22:38 2506344 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-09-18 17:20 . 2010-07-09 22:38 236136 ----a-w- c:\windows\system32\nvcodins.dll
2010-09-18 17:20 . 2010-07-09 22:38 236136 ----a-w- c:\windows\system32\nvcod.dll
2010-09-18 17:20 . 2010-07-09 22:38 1388544 ----a-w- c:\windows\system32\nvapi.dll
2010-09-18 17:20 . 2010-07-09 22:38 10260480 ----a-w- c:\windows\system32\nvcompiler.dll
2010-09-18 17:20 . 2010-07-09 22:38 2195030 ----a-w- c:\windows\system32\nvdata.bin
2010-09-18 10:19 . 2010-09-20 10:32 -------- d-----w- c:\windows\system32\Adobe
2010-09-17 18:34 . 2010-09-17 18:44 -------- d-----w- c:\windows\SxsCaPendDel
2010-09-16 17:35 . 2010-09-16 17:35 -------- d-----w- c:\program files\8BallClub
2010-09-15 18:28 . 2005-01-12 09:19 456536 ----a-w- c:\windows\system32\XCEEDZIP.DLL
2010-09-15 18:28 . 2004-09-28 09:13 526184 ----a-w- c:\windows\system32\XceedCry.dll
2010-09-15 18:21 . 2010-09-15 18:21 -------- d-----w- c:\windows\system32\wbem\Repository
2010-09-15 18:11 . 2010-09-18 17:21 232968 ----a-w- c:\windows\system32\nvdrsdb0.bin
2010-09-15 18:11 . 2010-09-18 17:21 1 ----a-w- c:\windows\system32\nvdrssel.bin
2010-09-15 18:11 . 2010-09-18 17:21 232968 ----a-w- c:\windows\system32\nvdrsdb1.bin
2010-09-15 18:11 . 2010-09-18 17:22 -------- d-----w- c:\program files\NVIDIA Corporation
2010-09-15 16:51 . 2004-08-11 13:55 110602 ----a-w- c:\windows\system32\xcdsfx32.bin
2010-09-15 16:51 . 2010-09-15 18:29 -------- d-----w- c:\program files\Driver Magician
2010-09-15 14:09 . 2010-09-15 14:09 -------- d-----w- c:\program files\Common Files\DirectX
2010-09-14 20:45 . 2010-09-22 20:57 -------- d-----w- C:\moje
2010-09-14 20:44 . 2010-09-14 20:44 -------- d-----w- c:\program files\Conduit
2010-09-14 19:39 . 2010-09-14 19:40 -------- d-----w- c:\program files\Common Files\Adobe
2010-09-14 18:25 . 2009-11-18 17:33 79256 ----a-w- c:\windows\system32\npOGPPlugin.dll
2010-09-14 18:25 . 2004-01-12 15:00 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-09-14 18:25 . 2003-03-19 18:14 499712 ----a-w- c:\windows\system32\MSVCP71.DLL
2010-09-14 18:24 . 2010-09-19 18:28 -------- d-----w- c:\program files\Ogplanet
2010-09-14 17:41 . 2002-10-06 18:42 237568 ----a-w- c:\windows\system32\OggDS.dll
2010-09-14 17:41 . 2002-10-04 23:04 921600 ----a-w- c:\windows\system32\vorbisenc.dll
2010-09-14 17:41 . 2002-10-04 23:04 188416 ----a-w- c:\windows\system32\vorbis.dll
2010-09-14 17:41 . 2002-10-04 23:04 45056 ----a-w- c:\windows\system32\ogg.dll
2010-09-14 17:22 . 2010-06-18 11:39 16896 ------w- c:\windows\system32\dllcache\iecompat.dll
2010-09-14 17:22 . 2010-06-24 12:27 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll
2010-09-14 17:22 . 2010-06-24 12:27 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2010-09-14 17:22 . 2010-06-24 12:27 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll
2010-09-14 15:09 . 2010-09-16 18:33 -------- d-----w- C:\PCTRAN
2010-09-14 14:22 . 2010-03-10 06:17 420352 ----a-w- c:\windows\system32\dllcache\vbscript.dll
2010-09-14 14:21 . 2008-06-14 17:35 272128 ------w- c:\windows\system32\drivers\bthport.sys
2010-09-14 14:21 . 2008-06-14 17:35 272128 ------w- c:\windows\system32\dllcache\bthport.sys
2010-09-14 14:20 . 2010-06-21 14:18 354304 ------w- c:\windows\system32\dllcache\srv.sys
2010-09-14 14:20 . 2009-05-21 18:49 268288 ------w- c:\windows\system32\dllcache\httpext.dll
2010-09-14 14:20 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
2010-09-14 14:16 . 2009-02-06 10:10 227840 ------w- c:\windows\system32\dllcache\wmiprvse.exe
2010-09-14 14:16 . 2009-03-06 14:23 284160 ------w- c:\windows\system32\dllcache\pdh.dll
2010-09-14 14:16 . 2009-02-09 11:25 111104 ------w- c:\windows\system32\dllcache\services.exe
2010-09-14 14:16 . 2009-02-09 10:56 401408 ------w- c:\windows\system32\dllcache\rpcss.dll
2010-09-14 14:16 . 2009-02-09 10:56 473600 ------w- c:\windows\system32\dllcache\fastprox.dll
2010-09-14 14:16 . 2009-02-06 10:39 35328 ------w- c:\windows\system32\dllcache\sc.exe
2010-09-14 14:16 . 2009-02-09 10:56 684032 ------w- c:\windows\system32\dllcache\advapi32.dll
2010-09-14 14:16 . 2009-02-09 10:56 709632 ------w- c:\windows\system32\dllcache\ntdll.dll
2010-09-14 14:16 . 2009-02-09 10:56 453120 ------w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-09-14 14:15 . 2010-04-28 05:19 2148352 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-09-14 14:15 . 2010-04-28 05:19 2192256 ------w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-09-14 14:15 . 2010-04-28 05:19 2026496 ------w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-09-14 14:13 . 2009-03-21 14:09 988160 ------w- c:\windows\system32\dllcache\kernel32.dll
2010-09-14 14:13 . 2008-05-09 10:56 180224 ------w- c:\windows\system32\dllcache\scrobj.dll
2010-09-14 14:13 . 2008-05-09 10:56 172032 ------w- c:\windows\system32\dllcache\scrrun.dll
2010-09-14 14:13 . 2008-05-09 10:56 90112 ------w- c:\windows\system32\dllcache\wshext.dll
2010-09-14 14:13 . 2008-05-09 08:45 135168 ------w- c:\windows\system32\dllcache\cscript.exe
2010-09-14 14:13 . 2008-05-08 11:24 155648 ------w- c:\windows\system32\dllcache\wscript.exe
2010-09-14 14:10 . 2010-02-12 04:29 100864 ------w- c:\windows\system32\dllcache\6to4svc.dll
2010-09-14 14:10 . 2010-02-11 11:36 226880 ------w- c:\windows\system32\dllcache\tcpip6.sys
2010-09-14 14:10 . 2009-08-26 08:03 247326 ------w- c:\windows\system32\dllcache\strmdll.dll
2010-09-14 14:10 . 2009-05-07 15:33 346624 ------w- c:\windows\system32\dllcache\localspl.dll
2010-09-14 14:10 . 2010-06-24 21:30 1861120 ------w- c:\windows\system32\dllcache\win32k.sys
2010-09-14 14:05 . 2010-07-27 06:30 8466432 ------w- c:\windows\system32\dllcache\shell32.dll
2010-09-14 14:05 . 2010-06-18 13:36 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe
2010-09-14 14:05 . 2008-04-21 21:15 216576 ------w- c:\windows\system32\dllcache\wordpad.exe
2010-09-14 14:04 . 2010-04-20 05:32 285696 ------w- c:\windows\system32\dllcache\atmfd.dll
2010-09-14 14:02 . 2009-01-07 16:20 26144 ----a-w- c:\windows\system32\spupdsvc.exe
2010-09-14 13:28 . 2008-06-12 14:24 956928 ------w- c:\windows\system32\dllcache\msdtctm.dll
2010-09-14 13:28 . 2008-06-12 14:24 66560 ------w- c:\windows\system32\dllcache\mtxclu.dll
2010-09-14 13:28 . 2008-06-12 14:24 161792 ------w- c:\windows\system32\dllcache\msdtcuiu.dll
2010-09-14 13:28 . 2008-06-12 14:24 91648 ------w- c:\windows\system32\dllcache\mtxoci.dll
2010-09-14 13:28 . 2008-06-12 14:24 58880 ------w- c:\windows\system32\dllcache\msdtclog.dll
2010-09-14 13:27 . 2009-12-17 07:42 343552 ------w- c:\windows\system32\dllcache\mspaint.exe
2010-09-14 13:12 . 2010-09-14 13:27 -------- d-----w- c:\program files\Internet Download Manager
2010-09-14 13:08 . 2010-02-05 18:29 1294336 ------w- c:\windows\system32\dllcache\quartz.dll
2010-09-14 13:05 . 2010-02-24 11:57 457216 ------w- c:\windows\system32\dllcache\mrxsmb.sys
2010-09-14 13:05 . 2009-11-21 16:03 471552 ------w- c:\windows\system32\dllcache\aclayers.dll
2010-09-14 13:02 . 2009-10-15 16:32 81920 ------w- c:\windows\system32\dllcache\fontsub.dll
2010-09-14 13:02 . 2009-10-15 16:32 119808 ------w- c:\windows\system32\dllcache\t2embed.dll
2010-09-14 13:01 . 2008-05-01 14:37 331776 ------w- c:\windows\system32\dllcache\msadce.dll
2010-09-14 13:00 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-09-14 13:00 . 2009-12-09 05:55 726528 ----a-w- c:\windows\system32\dllcache\jscript.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-21 06:34 . 2010-09-21 06:33 -------- d-----w- c:\program files\Winamp
2010-09-20 12:28 . 2010-09-14 11:07 -------- d-----w- c:\program files\Windows Media Connect 2
2010-09-18 19:32 . 2010-09-14 11:23 -------- d-----w- c:\program files\Common Files\InstallShield
2010-09-15 15:38 . 2010-09-15 14:51 -------- d-----w- c:\program files\Crspace
2010-09-15 13:18 . 2010-09-14 11:11 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-09-15 13:18 . 2010-09-14 11:11 2426 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-09-15 13:17 . 2010-09-14 11:11 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-09-14 20:26 . 2010-09-14 11:52 -------- d-----w- c:\program files\Webteh
2010-09-14 15:25 . 2010-09-14 12:23 -------- d-----w- c:\program files\Ashampoo
2010-09-14 13:25 . 2010-09-14 12:54 -------- d-----w- c:\program files\Futuremark
2010-09-14 12:06 . 2010-09-14 12:05 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-09-14 11:50 . 2010-09-14 11:50 -------- d-----w- c:\program files\AIMP2
2010-09-14 11:47 . 2010-09-14 11:46 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-09-14 11:46 . 2010-09-14 11:46 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-09-14 11:43 . 2010-09-14 11:43 -------- d-----w- c:\program files\VS Revo Group
2010-09-14 11:36 . 2010-09-14 11:34 -------- d-----w- c:\program files\Google
2010-09-14 11:33 . 2010-09-14 11:33 -------- d-----w- c:\program files\ESET
2010-09-14 11:32 . 2010-09-14 11:32 -------- d-----w- c:\program files\Common Files\Skype
2010-09-14 11:32 . 2010-09-14 11:32 -------- d-----r- c:\program files\Skype
2010-09-14 11:27 . 2010-09-14 11:27 0 ----a-w- c:\windows\nsreg.dat
2010-09-14 11:08 . 2010-09-14 11:08 21812 ----a-w- c:\windows\system32\emptyregdb.dat
2010-08-17 13:17 . 2008-04-14 06:52 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-12 08:00 . 2010-09-14 12:05 108032 ----a-w- c:\windows\system32\ff_vfw.dll
2010-07-22 15:46 . 2008-04-14 06:51 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 06:19 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-07-09 22:38 . 2006-06-23 14:49 6343040 ----a-w- c:\windows\system32\nv4_disp.dll
2010-07-09 22:38 . 2006-06-23 14:49 10604128 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2010-07-09 14:24 . 2010-07-09 14:24 81920 ----a-w- c:\windows\system32\nvwddi.dll
2010-07-09 14:24 . 2010-07-09 14:24 277608 ----a-w- c:\windows\system32\nvmccs.dll
2010-07-09 14:24 . 2010-07-09 14:24 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-07-09 14:24 . 2010-07-09 14:24 155752 ----a-w- c:\windows\system32\nvsvc32.exe
2010-07-09 14:24 . 2010-07-09 14:24 145000 ----a-w- c:\windows\system32\nvcolor.exe
2010-07-09 14:24 . 2010-07-09 14:24 13923432 ----a-w- c:\windows\system32\nvcpl.dll
2010-06-30 12:33 . 2008-04-14 06:51 149504 ----a-w- c:\windows\system32\schannel.dll
.

------- Sigcheck -------

[-] 2009-02-14 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OEXPRESS"="c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE" [2010-09-14 26624]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2010-05-26 3220912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-05-14 2029640]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-07 1753192]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-03-08 128512]

c:\documents and settings\michal\Nabˇdka Start\Programy\Po spuçtŘnˇ\
setup_9.0.0.722_23.09.2010_14-26.lnk - c:\documents and settings\michal\Plocha\Virus Removal Tool\setup_9.0.0.722_23.09.2010_14-26\startup.exe [2010-9-23 72208]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Documents and Settings\\michal\\Data aplikací\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\8BallClub\\GameDirector.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8500:TCP"= 8500:TCP:HockeyDash
"13000:UDP"= 13000:UDP:HockeyDash

R0 35714112;35714112 Boot Guard Driver;c:\windows\system32\drivers\35714112.sys [23. 9. 2010 16:40 37392]
R1 35714111;35714111;c:\windows\system32\drivers\35714111.sys [23. 9. 2010 16:40 128016]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14. 5. 2009 15:47 107256]
R1 setup_9.0.0.722_23.09.2010_14-26drv;setup_9.0.0.722_23.09.2010_14-26drv;c:\windows\system32\drivers\3571411.sys [23. 9. 2010 16:40 315408]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [14. 5. 2009 15:47 731840]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [14. 9. 2010 13:34 136176]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [14. 9. 2010 13:43 27064]
S3 utqyntk1;AVZ Kernel Driver;c:\windows\system32\drivers\utqyntk1.sys [23. 9. 2010 17:22 7168]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [14. 9. 2010 13:46 691696]
.
Contents of the 'Scheduled Tasks' folder

2010-09-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-14 11:34]

2010-09-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-14 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.sk/
IE: Stáhnout s IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Stáhnout s IDM obsah FLV videa - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Stáhnout s IDM všechny odkazy - c:\program files\Internet Download Manager\IEGetAll.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
FF - ProfilePath - c:\documents and settings\michal\Data aplikací\Mozilla\Firefox\Profiles\p9kzbdip.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\michal\Data aplikací\IDM\idmmzcc3\components\idmmzcc.dll
FF - plugin: c:\docume~1\michal\DATAAP~1\POWERC~1\nppowerloader.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
FF - plugin: c:\windows\system32\npOGPPlugin.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-23 19:04
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\d62ae326-5297-65e9-0032-a638e61e82d]
@Denied: (Full) (AuthenticatedUsers)
@Denied: (Full) (Administrators)
"1w3ihl1oevhiy"=hex:37,36,62,65,61,38,30,31,2d,66,30,31,33,2d,34,65,37,32,2d,
62,39,38,61,2d,33,35,38,35,35,38,66,37,30,65,32,65
"19mzum9p92zx3"=hex:65,00,00,00,f8,00,00,00,cd,8e,a2,be,36,36,36,6d,69,6c,6f,
73,00,00,00,00,00,00,00,00,01,a8,be,76,13,f0,72,4e,b9,8a,35,85,58,f7,0e,2e,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1036)
c:\documents and settings\All Users\Data aplikací\LangSoft\TrnOEH.dll
c:\program files\Internet Download Manager\idmmkb.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\devldr32.exe
c:\program files\Internet Download Manager\IEMonitor.exe
.
**************************************************************************
.
Completion time: 2010-09-23 19:06:44 - machine was rebooted
ComboFix-quarantined-files.txt 2010-09-23 17:06
ComboFix2.txt 2010-09-22 18:19

Pre-Run: Volných bajtů: 124 107 071 488
Post-Run: Volných bajtů: 124 103 086 080

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 844EEE210F95DFEF335C56173B01225F

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
File::
c:\windows\system32\drivers\utqyntk1.sys
c:\windows\system32\drivers\35714112.sys
c:\windows\system32\drivers\3571411.sys
c:\windows\system32\drivers\35714111.sys

Folder::
c:\windows\SxsCaPendDel

Driver::
35714112
35714111
3571411
setup_9.0.0.722_23.09.2010_14-26drv
utqyntk1

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému

Toto otestuj na Virustotal
c:\windows\system32\dllcache\cdrom.sys
c:\windows\system32\drivers\cdrom.sys
c:\windows\system32\dllcache\user32.dll
c:\windows\system32\drivers\sptd.sys

Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/40 , nebo 1/40. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.

[milosb]

http://www.virustotal.com/file-scan/rep ... 1285264652
http://www.virustotal.com/file-scan/rep ... 1285264668
http://www.virustotal.com/file-scan/rep ... 1285264699
http://www.virustotal.com/file-scan/rep ... 1285264718

[jaro3]

Fajn , myslím , že je to OK , eSafe není optimální antivir...

Ještě ten log z Combofixu.

[milosb]

ten log z combofixu som uz poslal,alebo ešte raz?ako naschval mi skončil trial nodu,tak som dal avast mam ho nechať alebo odporučaš niečo iné?/mohlo by byť free/a chcel som sa opýtať ešte čo by som mal nainštalovať nech už nemam takéto problémy.

[jaro3]

Ten log si nedával z posledního scriptu..

Doporučuji Avast 5 (free):
http://www.avast.com/cs-cz/index

Nebo Avira free:
http://free-av.de/de/download/1/avira_a ... virus.html

+ Spybot nebo SpywareTerminator.

popř. úpřidat firewall free ( ZoneAlarm , Outpost , Comodo...))

[milosb]

ok uz to dnes nestihnem ale zajtra okolo 17 tej to posielam.zatial vďaka

[jaro3]

V pořádku , zítra večer..