prosim o kontrolu logu

[vyzul]

dakujem

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:21:07, on 14.4.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
D:\WINDOWS\System32\hkcmd.exe
D:\WINDOWS\system32\ezSP_Px.exe
D:\Program Files\Common Files\Java\Java Update\jusched.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\WINDOWS\system32\rundll32.exe
D:\Program Files\Skype\Phone\Skype.exe
D:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
D:\Program Files\Windows Live\Messenger\msnmsgr.exe
D:\Program Files\InstantEyedropper\InstantEyedropper.exe
D:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
D:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
D:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
D:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
D:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
D:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
D:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
D:\WINDOWS\system32\pctspk.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Skype\Plugin Manager\skypePM.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Mozilla Firefox\plugin-container.exe
D:\Documents and Settings\Administrator\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... p=aus&qkw=%s&tbid=60452
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 194.1.122.145:3128
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost,127.0.0.1;*.local
O2 - BHO: vShare Plugin - {043C5167-00BB-4324-AF7E-62013FAEDACF} - D:\Program Files\vShare\vshare_toolbar.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: adzgalore - {45213679-c98a-9a49-05ec-1e6ccc8922b7} - D:\WINDOWS\system32\dd04f824-f0ef-2eeb-4bb9-eac482b40e87.dll
O2 - BHO: (no name) - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: (no name) - {85A77577-A8CA-41b7-AA1E-DDAD4C0B12B1} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: adzgalore - {994B5FB4-0103-44A6-B6B3-C73572B362BC} - D:\WINDOWS\system32\nsd44.dll
O2 - BHO: (no name) - {B6F7ECB0-3DA6-4619-8F4D-A25AECF43209} - D:\WINDOWS\system32\mscorie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {53E0B6E8-A51D-448B-B692-40B67B285543} - (no file)
O3 - Toolbar: vShare Plugin - {043C5167-00BB-4324-AF7E-62013FAEDACF} - D:\Program Files\vShare\vshare_toolbar.dll
O4 - HKLM\..\Run: [IgfxTray] D:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] D:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Media Gateway] D:\Program Files\Media Gateway\MediaGateway.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] D:\WINDOWS\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Vtocasazasazas] rundll32.exe "D:\WINDOWS\isiyejeji.dll",Startup
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Kqidisub] rundll32.exe "D:\WINDOWS\shonrvfi.dll",Startup
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [{E7E75196-A7EF-DBD4-AEDF-96DEB4A74236}] "D:\Documents and Settings\Administrator\Application Data\Oqsoep\move.exe"
O4 - HKCU\..\Run: [Google Update] "D:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [instanteyedropper] "D:\Program Files\InstantEyedropper\InstantEyedropper.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Service Manager.lnk = D:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: Image Transfer.lnk = ?
O4 - Global Startup: Wireless-G Notebook Adapter.lnk = D:\Program Files\Linksys\Wireless-G Notebook Adapter\Gcc.exe
O4 - Global Startup: WDDMStatus.lnk = D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
O4 - Global Startup: WDSmartWare.lnk = D:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://D:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O10 - Unknown file in Winsock LSP: d:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 1197372111
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/sho ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: vsharechrome - {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - D:\Program Files\vShare\vshare_toolbar.dll
O18 - Filter hijack: text/html - {03974811-C15F-462c-B6B0-2D2336AA57D0} - (no file)
O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NICSer_WPC54G - Unknown owner - D:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: PACSPTISVR - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - D:\WINDOWS\system32\pctspk.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: WD SmartWare Drive Manager (WDDMService) - WDC - D:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
O23 - Service: WD SmartWare Background Service (WDSmartWareBackgroundService) - Memeo - D:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe

--
End of file - 9825 bytes

[Reklama]

[jaro3]

Fuj , takhle vypadá PC bez antiviru....

Odinstaluj:
vshare_toolbar

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... p=aus&qkw=%s&tbid=60452
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost,127.0.0.1;*.local
O2 - BHO: vShare Plugin - {043C5167-00BB-4324-AF7E-62013FAEDACF} - D:\Program Files\vShare\vshare_toolbar.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: adzgalore - {45213679-c98a-9a49-05ec-1e6ccc8922b7} - D:\WINDOWS\system32\dd04f824-f0ef-2eeb-4bb9-eac482b40e87.dll
O2 - BHO: (no name) - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: (no name) - {85A77577-A8CA-41b7-AA1E-DDAD4C0B12B1} - (no file)
O2 - BHO: adzgalore - {994B5FB4-0103-44A6-B6B3-C73572B362BC} - D:\WINDOWS\system32\nsd44.dll
O3 - Toolbar: (no name) - {53E0B6E8-A51D-448B-B692-40B67B285543} - (no file)
O3 - Toolbar: vShare Plugin - {043C5167-00BB-4324-AF7E-62013FAEDACF} - D:\Program Files\vShare\vshare_toolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Vtocasazasazas] rundll32.exe "D:\WINDOWS\isiyejeji.dll",Startup
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Kqidisub] rundll32.exe "D:\WINDOWS\shonrvfi.dll",Startup
O4 - HKCU\..\Run: [{E7E75196-A7EF-DBD4-AEDF-96DEB4A74236}] "D:\Documents and Settings\Administrator\Application Data\Oqsoep\move.exe"
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/sho ... wflash.cab
O18 - Filter hijack: text/html - {03974811-C15F-462c-B6B0-2D2336AA57D0} - (no file)
O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing)


Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Vypni si rez.ochrany i firewall.
Stáhni si Dr. Web CureIt
dej update , po aktualizaci dej start.
Tlacitky dole můzeš soubor léčit(systémové soubory), smazat, přesunout nebo přejmenovat

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Pokud budou problémy , spusť v nouz. režimu.

ProxyServer = 194.1.122.145:3128---používáš tu proxy?

[vyzul]

-hj som urobil
-atf tiez
-dr.web, asi v polke skenovania blikla modra obrazovka s bielym pismom a restartoval sa komp
-tu proxy nepouzivam
-log z malware:

Malwarebytes' Anti-Malware 1.50.1.1100
http://www.malwarebytes.org

Verzia databázy: 6372

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

16.4.2011 7:17:04
mbam-log-2011-04-16 (07-16-48).txt

Typ kontroly: Rýchla kontrola
Objektov kontrolovaných: 146319
Uplynutý čas: 13 min, 46 sek

Infikované služby pamäte: 0
Infikované moduly pamäte: 1
Infikované registračné kľúče: 28
Infikované registračné hodnoty: 5
Infikované položky registračných dát: 0
Infikované priečinky: 1
Infikované súbory: 11

Infikované služby pamäte:
(Škodlivé položky neboli zistené)

Infikované moduly pamäte:
d:\WINDOWS\isiyejeji.dll (Trojan.Hiloti) -> No action taken.

Infikované registračné kľúče:
HKEY_CLASSES_ROOT\AppID\{735C5A0C-F79F-47A1-8CA1-2A2E482662A8} (Adware.Winad) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{1E5F0D38-214B-4085-AD2A-D2290E6A2D2C} (Adware.MediaAccess) -> No action taken.
HKEY_CLASSES_ROOT\MediaGateway.Installer (Adware.MediaAccess) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{49BCC77A-79EB-4D50-A6DB-04E8202921C4} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{BD219B90-626B-40F4-BFDD-420240DFCA2C} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{21B4ACC4-8874-4AEC-AEAC-F567A249B4D4} (Adware.180Solutions) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{53E0B6E8-A51D-448B-B692-40B67B285543} (Adware.180Solutions) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6FD31ED6-7C94-4BBC-8E95-F927F4D3A949} (Adware.180Solutions) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{994B5FB4-0103-44A6-B6B3-C73572B362BC} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{BCA95E31-1FBF-4F84-8F23-1BA653007A1E} (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adzgalore (Trojan.Agent) -> No action taken.
HKEY_CLASSES_ROOT\adzgalore.optimizer (Trojan.Agent) -> No action taken.
HKEY_CLASSES_ROOT\adzgalore.optimizer.1 (Trojan.Agent) -> No action taken.
HKEY_CLASSES_ROOT\ClientAX.ClientInstaller (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\ClientAX.ClientInstaller.1 (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\ClientAX.RequiredComponent (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\ClientAX.RequiredComponent.1 (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\idid (Trojan.Sasfix) -> No action taken.
HKEY_CLASSES_ROOT\MediaGatewayX.Installer (Adware.180Solutions) -> No action taken.
HKEY_CLASSES_ROOT\Tldctl2.URLLink (Adware.NewDotNet) -> No action taken.
HKEY_CLASSES_ROOT\Tldctl2.URLLink.1 (Adware.NewDotNet) -> No action taken.
HKEY_CLASSES_ROOT\AppID\SeekmoTB.DLL (Adware.Seekmo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\seekmo (Adware.Seekmo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\adzgalore (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\AMeOpt (Adware.NetOptimizer) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\New.net (Adware.NewDotNet) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\salm (Adware.180Solutions) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\AMeOpt (Adware.NetOptimizer) -> No action taken.

Infikované registračné hodnoty:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Vtocasazasazas (Trojan.Hiloti) -> Value: Vtocasazasazas -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Value: bf -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Value: bk -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Value: iu -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Value: mu -> No action taken.

Infikované položky registračných dát:
(Škodlivé položky neboli zistené)

Infikované priečinky:
d:\program files\180searchassistant (Adware.180Solutions) -> No action taken.

Infikované súbory:
d:\WINDOWS\isiyejeji.dll (Trojan.Hiloti) -> No action taken.
d:\WINDOWS\system32\WhoisCL.exe (Trojan.BHO) -> No action taken.
d:\WINDOWS\system32\cpmsky-uninst.exe (Adware.AdPanel) -> No action taken.
d:\WINDOWS\system32\adzgalore-remove.exe (Trojan.Agent) -> No action taken.
d:\documents and settings\administrator\local settings\Temp\lcggskcw.dat (Rootkit.Agent) -> No action taken.
d:\WINDOWS\shonrvfi.dll (Trojan.Hiloti) -> No action taken.
d:\program files\mozilla firefox\components\nsbrowsergal.dll (Trojan.Agent) -> No action taken.
d:\program files\180searchassistant\salm_gdf.dat (Adware.180Solutions) -> No action taken.
d:\program files\180searchassistant\salmau.dat (Adware.180Solutions) -> No action taken.
d:\program files\180searchassistant\salm_kyf.dat (Adware.180Solutions) -> No action taken.
d:\WINDOWS\system32\drivers\Winnr72.sys (Rootkit.Agent) -> No action taken.

[jaro3]

. Takže spusť znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Ukaž výsledky
- ujisti se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Můžeš sem pak vložit nový log z MbAM.

Stáhni si TDSSKiller

Na svojí plochu.Ujisti se , že máš zavřeny všechny ostatní aplikace a prohlížeče. Rozbal soubor a spusť TDSSKiller.exe. Restartuj PC . Log z TDSSKilleru najdeš zde:
C:\TDSSKiller.2.2.7.1._(datum)_log.txt , vlož sem prosím celý obsah logu.

Poté:
Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud budou problémy , spusť ho v nouz. režimu.

[vyzul]

Malware log po vymazani

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verzia databázy: 6372

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

16.4.2011 16:27:12
mbam-log-2011-04-16 (16-27-12).txt

Typ kontroly: Rýchla kontrola
Objektov kontrolovaných: 146319
Uplynutý čas: 13 min, 46 sek

Infikované služby pamäte: 0
Infikované moduly pamäte: 1
Infikované registračné kľúče: 28
Infikované registračné hodnoty: 5
Infikované položky registračných dát: 0
Infikované priečinky: 1
Infikované súbory: 11

Infikované služby pamäte:
(Škodlivé položky neboli zistené)

Infikované moduly pamäte:
d:\WINDOWS\isiyejeji.dll (Trojan.Hiloti) -> Delete on reboot.

Infikované registračné kľúče:
HKEY_CLASSES_ROOT\AppID\{735C5A0C-F79F-47A1-8CA1-2A2E482662A8} (Adware.Winad) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1E5F0D38-214B-4085-AD2A-D2290E6A2D2C} (Adware.MediaAccess) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\MediaGateway.Installer (Adware.MediaAccess) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{49BCC77A-79EB-4D50-A6DB-04E8202921C4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{BD219B90-626B-40F4-BFDD-420240DFCA2C} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{21B4ACC4-8874-4AEC-AEAC-F567A249B4D4} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{53E0B6E8-A51D-448B-B692-40B67B285543} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6FD31ED6-7C94-4BBC-8E95-F927F4D3A949} (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{994B5FB4-0103-44A6-B6B3-C73572B362BC} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{BCA95E31-1FBF-4F84-8F23-1BA653007A1E} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adzgalore (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\adzgalore.optimizer (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\adzgalore.optimizer.1 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ClientAX.ClientInstaller (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ClientAX.ClientInstaller.1 (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ClientAX.RequiredComponent (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ClientAX.RequiredComponent.1 (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\idid (Trojan.Sasfix) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\MediaGatewayX.Installer (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Tldctl2.URLLink (Adware.NewDotNet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Tldctl2.URLLink.1 (Adware.NewDotNet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\SeekmoTB.DLL (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\seekmo (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\adzgalore (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\AMeOpt (Adware.NetOptimizer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\New.net (Adware.NewDotNet) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\salm (Adware.180Solutions) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\AMeOpt (Adware.NetOptimizer) -> Quarantined and deleted successfully.

Infikované registračné hodnoty:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Vtocasazasazas (Trojan.Hiloti) -> Value: Vtocasazasazas -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Value: bf -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Value: bk -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Value: iu -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Value: mu -> Quarantined and deleted successfully.

Infikované položky registračných dát:
(Škodlivé položky neboli zistené)

Infikované priečinky:
d:\program files\180searchassistant (Adware.180Solutions) -> Quarantined and deleted successfully.

Infikované súbory:
d:\WINDOWS\isiyejeji.dll (Trojan.Hiloti) -> Delete on reboot.
d:\WINDOWS\system32\WhoisCL.exe (Trojan.BHO) -> Quarantined and deleted successfully.
d:\WINDOWS\system32\cpmsky-uninst.exe (Adware.AdPanel) -> Quarantined and deleted successfully.
d:\WINDOWS\system32\adzgalore-remove.exe (Trojan.Agent) -> Quarantined and deleted successfully.
d:\documents and settings\administrator\local settings\Temp\lcggskcw.dat (Rootkit.Agent) -> Quarantined and deleted successfully.
d:\WINDOWS\shonrvfi.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.
d:\program files\mozilla firefox\components\nsbrowsergal.dll (Trojan.Agent) -> Quarantined and deleted successfully.
d:\program files\180searchassistant\salm_gdf.dat (Adware.180Solutions) -> Quarantined and deleted successfully.
d:\program files\180searchassistant\salmau.dat (Adware.180Solutions) -> Quarantined and deleted successfully.
d:\program files\180searchassistant\salm_kyf.dat (Adware.180Solutions) -> Quarantined and deleted successfully.
d:\WINDOWS\system32\drivers\Winnr72.sys (Rootkit.Agent) -> Delete on reboot.

Malware novy log

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Verzia databázy: 6372

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

16.4.2011 16:56:15
mbam-log-2011-04-16 (16-56-15).txt

Typ kontroly: Rýchla kontrola
Objektov kontrolovaných: 142880
Uplynutý čas: 7 min, 37 sek

Infikované služby pamäte: 0
Infikované moduly pamäte: 0
Infikované registračné kľúče: 0
Infikované registračné hodnoty: 0
Infikované položky registračných dát: 0
Infikované priečinky: 0
Infikované súbory: 0

Infikované služby pamäte:
(Škodlivé položky neboli zistené)

Infikované moduly pamäte:
(Škodlivé položky neboli zistené)

Infikované registračné kľúče:
(Škodlivé položky neboli zistené)

Infikované registračné hodnoty:
(Škodlivé položky neboli zistené)

Infikované položky registračných dát:
(Škodlivé položky neboli zistené)

Infikované priečinky:
(Škodlivé položky neboli zistené)

Infikované súbory:
(Škodlivé položky neboli zistené)

TDSS killer log

2011/04/16 17:06:21.0609 3072 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/04/16 17:06:22.0120 3072 ================================================================================
2011/04/16 17:06:22.0120 3072 SystemInfo:
2011/04/16 17:06:22.0120 3072
2011/04/16 17:06:22.0120 3072 OS Version: 5.1.2600 ServicePack: 2.0
2011/04/16 17:06:22.0120 3072 Product type: Workstation
2011/04/16 17:06:22.0120 3072 ComputerName: KATKA
2011/04/16 17:06:22.0120 3072 UserName: Administrator
2011/04/16 17:06:22.0120 3072 Windows directory: D:\WINDOWS
2011/04/16 17:06:22.0120 3072 System windows directory: D:\WINDOWS
2011/04/16 17:06:22.0120 3072 Processor architecture: Intel x86
2011/04/16 17:06:22.0120 3072 Number of processors: 1
2011/04/16 17:06:22.0120 3072 Page size: 0x1000
2011/04/16 17:06:22.0120 3072 Boot type: Normal boot
2011/04/16 17:06:22.0120 3072 ================================================================================
2011/04/16 17:06:23.0953 3072 Initialize success
2011/04/16 17:06:32.0054 1132 ================================================================================
2011/04/16 17:06:32.0054 1132 Scan started
2011/04/16 17:06:32.0054 1132 Mode: Manual;
2011/04/16 17:06:32.0054 1132 ================================================================================
2011/04/16 17:06:33.0626 1132 ac97intc (0f2d66d5f08ebe2f77bb904288dcf6f0) D:\WINDOWS\system32\drivers\ac97intc.sys
2011/04/16 17:06:33.0847 1132 ACPI (a10c7534f7223f4a73a948967d00e69b) D:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/04/16 17:06:33.0947 1132 ACPIEC (9859c0f6936e723e4892d7141b1327d5) D:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2011/04/16 17:06:34.0347 1132 aec (1ee7b434ba961ef845de136224c30fec) D:\WINDOWS\system32\drivers\aec.sys
2011/04/16 17:06:35.0099 1132 AFD (55e6e1c51b6d30e54335750955453702) D:\WINDOWS\System32\drivers\afd.sys
2011/04/16 17:06:37.0943 1132 Arp1394 (f0d692b0bffb46e30eb3cea168bbc49f) D:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/04/16 17:06:38.0724 1132 AsyncMac (02000abf34af4c218c35d257024807d6) D:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/04/16 17:06:38.0874 1132 atapi (cdfe4411a69c224bd1d11b2da92dac51) D:\WINDOWS\system32\DRIVERS\atapi.sys
2011/04/16 17:06:39.0235 1132 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) D:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/04/16 17:06:39.0435 1132 audstub (d9f724aa26c010a217c97606b160ed68) D:\WINDOWS\system32\DRIVERS\audstub.sys
2011/04/16 17:06:40.0376 1132 BCM42RLY (62db04646d81798582464c32ef1cc3b2) D:\WINDOWS\System32\BCM42RLY.SYS
2011/04/16 17:06:40.0647 1132 BCM43XX (e7debb46b9ef1f28932e533be4a3d1a9) D:\WINDOWS\system32\DRIVERS\bcmwl5.sys
2011/04/16 17:06:40.0777 1132 Beep (da1f27d85e0d1525f6621372e7b685e9) D:\WINDOWS\system32\drivers\Beep.sys
2011/04/16 17:06:40.0947 1132 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) D:\WINDOWS\system32\drivers\cbidf2k.sys
2011/04/16 17:06:41.0688 1132 CBTNDIS5 (181b4a19965024a2afa01fa2102b2a2d) D:\WINDOWS\system32\CBTNDIS5.SYS
2011/04/16 17:06:41.0958 1132 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) D:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/04/16 17:06:42.0249 1132 Cdaudio (c1b486a7658353d33a10cc15211a873b) D:\WINDOWS\system32\drivers\Cdaudio.sys
2011/04/16 17:06:42.0409 1132 Cdfs (cd7d5152df32b47f4e36f710b35aae02) D:\WINDOWS\system32\drivers\Cdfs.sys
2011/04/16 17:06:42.0529 1132 Cdrom (af9c19b3100fe010496b1a27181fbf72) D:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/04/16 17:06:42.0950 1132 CmBatt (4266be808f85826aedf3c64c1e240203) D:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/04/16 17:06:43.0330 1132 Compbatt (df1b1a24bf52d0ebc01ed4ece8979f50) D:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/04/16 17:06:44.0182 1132 Disk (00ca44e4534865f8a3b64f7c0984bff0) D:\WINDOWS\system32\DRIVERS\disk.sys
2011/04/16 17:06:44.0362 1132 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) D:\WINDOWS\system32\drivers\dmboot.sys
2011/04/16 17:06:44.0793 1132 dmio (f5e7b358a732d09f4bcf2824b88b9e28) D:\WINDOWS\system32\drivers\dmio.sys
2011/04/16 17:06:44.0873 1132 dmload (e9317282a63ca4d188c0df5e09c6ac5f) D:\WINDOWS\system32\drivers\dmload.sys
2011/04/16 17:06:45.0083 1132 DMusic (a6f881284ac1150e37d9ae47ff601267) D:\WINDOWS\system32\drivers\DMusic.sys
2011/04/16 17:06:45.0393 1132 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) D:\WINDOWS\system32\drivers\drmkaud.sys
2011/04/16 17:06:45.0764 1132 dwshd (d374a37734a69481c7dea32c3ca7275f) D:\WINDOWS\System32\drivers\dwshd.sys
2011/04/16 17:06:45.0974 1132 E100B (3fca03cbca11269f973b70fa483c88ef) D:\WINDOWS\system32\DRIVERS\e100b325.sys
2011/04/16 17:06:46.0134 1132 Fastfat (3117f595e9615e04f05a54fc15a03b20) D:\WINDOWS\system32\drivers\Fastfat.sys
2011/04/16 17:06:46.0305 1132 Fdc (ced2e8396a8838e59d8fd529c680e02c) D:\WINDOWS\system32\DRIVERS\fdc.sys
2011/04/16 17:06:46.0435 1132 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) D:\WINDOWS\system32\drivers\Fips.sys
2011/04/16 17:06:46.0575 1132 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) D:\WINDOWS\system32\drivers\Flpydisk.sys
2011/04/16 17:06:46.0795 1132 FltMgr (3d234fb6d6ee875eb009864a299bea29) D:\WINDOWS\system32\drivers\fltmgr.sys
2011/04/16 17:06:46.0906 1132 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) D:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/04/16 17:06:46.0986 1132 Ftdisk (6ac26732762483366c3969c9e4d2259d) D:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/04/16 17:06:47.0086 1132 Gpc (c0f1d4a21de5a415df8170616703debf) D:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/04/16 17:06:47.0236 1132 hamachi (d30b31375c40309425c21efe75db90bb) D:\WINDOWS\system32\DRIVERS\hamachi.sys
2011/04/16 17:06:47.0476 1132 HidUsb (1de6783b918f540149aa69943bdfeba8) D:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/04/16 17:06:47.0877 1132 HTTP (9f8b0f4276f618964fd118be4289b7cd) D:\WINDOWS\system32\Drivers\HTTP.sys
2011/04/16 17:06:48.0448 1132 i8042prt (5502b58eef7486ee6f93f3f164dcb808) D:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/04/16 17:06:48.0718 1132 ialm (0acebb31989cbf9a5663fe4a33d28d21) D:\WINDOWS\system32\DRIVERS\ialmnt5.sys
2011/04/16 17:06:48.0878 1132 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) D:\WINDOWS\system32\DRIVERS\imapi.sys
2011/04/16 17:06:49.0269 1132 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) D:\WINDOWS\system32\DRIVERS\intelide.sys
2011/04/16 17:06:49.0439 1132 ip6fw (4448006b6bc60e6c027932cfc38d6855) D:\WINDOWS\system32\drivers\ip6fw.sys
2011/04/16 17:06:49.0549 1132 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) D:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/04/16 17:06:49.0710 1132 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) D:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/04/16 17:06:49.0900 1132 IpNat (e2168cbc7098ffe963c6f23f472a3593) D:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/04/16 17:06:50.0070 1132 IPSec (64537aa5c003a6afeee1df819062d0d1) D:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/04/16 17:06:50.0200 1132 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) D:\WINDOWS\system32\DRIVERS\irenum.sys
2011/04/16 17:06:50.0371 1132 isapnp (e504f706ccb699c2596e9a3da1596e87) D:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/04/16 17:06:50.0531 1132 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) D:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/04/16 17:06:50.0771 1132 kbdhid (e182fa8e49e8ee41b4adc53093f3c7e6) D:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/04/16 17:06:50.0991 1132 kmixer (ba5deda4d934e6288c2f66caf58d2562) D:\WINDOWS\system32\drivers\kmixer.sys
2011/04/16 17:06:51.0192 1132 KSecDD (674d3e5a593475915dc6643317192403) D:\WINDOWS\system32\drivers\KSecDD.sys
2011/04/16 17:06:51.0913 1132 MASPINT (a2ae666cee860babe7fa6f1662b71737) D:\WINDOWS\system32\drivers\MASPINT.sys
2011/04/16 17:06:52.0113 1132 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) D:\WINDOWS\system32\drivers\mnmdd.sys
2011/04/16 17:06:52.0233 1132 Modem (6fc6f9d7acc36dca9b914565a3aeda05) D:\WINDOWS\system32\drivers\Modem.sys
2011/04/16 17:06:52.0293 1132 Mouclass (34e1f0031153e491910e12551400192c) D:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/04/16 17:06:52.0514 1132 mouhid (b1c303e17fb9d46e87a98e4ba6769685) D:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/04/16 17:06:52.0584 1132 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) D:\WINDOWS\system32\drivers\MountMgr.sys
2011/04/16 17:06:52.0864 1132 MRxDAV (29414447eb5bde2f8397dc965dbb3156) D:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/04/16 17:06:53.0135 1132 MRxSmb (fb6c89bb3ce282b08bdb1e3c179e1c39) D:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/04/16 17:06:53.0325 1132 Msfs (561b3a4333ca2dbdba28b5b956822519) D:\WINDOWS\system32\drivers\Msfs.sys
2011/04/16 17:06:53.0475 1132 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) D:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/04/16 17:06:53.0565 1132 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) D:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/04/16 17:06:53.0645 1132 MSPQM (1988a33ff19242576c3d0ef9ce785da7) D:\WINDOWS\system32\drivers\MSPQM.sys
2011/04/16 17:06:53.0805 1132 mssmbios (469541f8bfd2b32659d5d463a6714bce) D:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/04/16 17:06:54.0066 1132 MSTEE (bf13612142995096ab084f2db7f40f77) D:\WINDOWS\system32\drivers\MSTEE.sys
2011/04/16 17:06:54.0186 1132 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) D:\WINDOWS\system32\drivers\Mup.sys
2011/04/16 17:06:54.0376 1132 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) D:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/04/16 17:06:54.0537 1132 NDIS (558635d3af1c7546d26067d5d9b6959e) D:\WINDOWS\system32\drivers\NDIS.sys
2011/04/16 17:06:54.0797 1132 NdisIP (520ce427a8b298f54112857bcf6bde15) D:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/04/16 17:06:54.0887 1132 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) D:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/04/16 17:06:55.0017 1132 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) D:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/04/16 17:06:55.0117 1132 NdisWan (0b90e255a9490166ab368cd55a529893) D:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/04/16 17:06:55.0197 1132 NDProxy (59fc3fb44d2669bc144fd87826bb571f) D:\WINDOWS\system32\drivers\NDProxy.sys
2011/04/16 17:06:55.0308 1132 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) D:\WINDOWS\system32\DRIVERS\netbios.sys
2011/04/16 17:06:55.0388 1132 NetBT (0c80e410cd2f47134407ee7dd19cc86b) D:\WINDOWS\system32\DRIVERS\netbt.sys
2011/04/16 17:06:55.0538 1132 NIC1394 (5c5c53db4fef16cf87b9911c7e8c6fbc) D:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/04/16 17:06:55.0678 1132 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) D:\WINDOWS\system32\drivers\Npfs.sys
2011/04/16 17:06:55.0989 1132 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) D:\WINDOWS\system32\drivers\Ntfs.sys
2011/04/16 17:06:56.0169 1132 Null (73c1e1f395918bc2c6dd67af7591a3ad) D:\WINDOWS\system32\drivers\Null.sys
2011/04/16 17:06:56.0309 1132 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) D:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/04/16 17:06:56.0389 1132 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) D:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/04/16 17:06:56.0489 1132 NwlnkIpx (79ea3fcda7067977625b3363a2657c80) D:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
2011/04/16 17:06:56.0589 1132 NwlnkNb (56d34a67c05e94e16377c60609741ff8) D:\WINDOWS\system32\DRIVERS\nwlnknb.sys
2011/04/16 17:06:56.0730 1132 NwlnkSpx (c0bb7d1615e1acbdc99757f6ceaf8cf0) D:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
2011/04/16 17:06:56.0950 1132 NWRDR (3f18d9365be71c7b2e43b7cf4a0c1a10) D:\WINDOWS\system32\DRIVERS\nwrdr.sys
2011/04/16 17:06:57.0190 1132 odysseyIM4 (7af6ec0ea4261ecf7da084103be31ea8) D:\WINDOWS\system32\DRIVERS\odysseyIM4.sys
2011/04/16 17:06:57.0451 1132 ohci1394 (0951db8e5823ea366b0e408d71e1ba2a) D:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/04/16 17:06:57.0741 1132 P3 (3e16eff2a6fed2d8d7f5a66dfe65d183) D:\WINDOWS\system32\DRIVERS\p3.sys
2011/04/16 17:06:57.0991 1132 Parport (29744eb4ce659dfe3b4122deb45bc478) D:\WINDOWS\system32\DRIVERS\parport.sys
2011/04/16 17:06:58.0082 1132 PartMgr (3334430c29dc338092f79c38ef7b4cd0) D:\WINDOWS\system32\drivers\PartMgr.sys
2011/04/16 17:06:58.0212 1132 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) D:\WINDOWS\system32\drivers\ParVdm.sys
2011/04/16 17:06:58.0502 1132 PCI (8086d9979234b603ad5bc2f5d890b234) D:\WINDOWS\system32\DRIVERS\pci.sys
2011/04/16 17:06:59.0534 1132 Pcmcia (82a087207decec8456fbe8537947d579) D:\WINDOWS\system32\DRIVERS\pcmcia.sys
2011/04/16 17:07:00.0956 1132 pfc (5903fa75200807ad739286bbf40c4904) D:\WINDOWS\system32\drivers\pfc.sys
2011/04/16 17:07:01.0216 1132 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) D:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/04/16 17:07:01.0477 1132 PSched (48671f327553dcf1d27f6197f622a668) D:\WINDOWS\system32\DRIVERS\psched.sys
2011/04/16 17:07:01.0537 1132 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) D:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/04/16 17:07:01.0667 1132 Ptserli (4ea68256ba3ddfe5238e35af71c529aa) D:\WINDOWS\system32\DRIVERS\ptserli.sys
2011/04/16 17:07:01.0867 1132 PxHelp20 (951d4769ba5b8a3c58404b5cef4a65ca) D:\WINDOWS\system32\DRIVERS\PxHelp20.sys
2011/04/16 17:07:03.0219 1132 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) D:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/04/16 17:07:03.0439 1132 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) D:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/04/16 17:07:03.0660 1132 RasPppoe (7306eeed8895454cbed4669be9f79faa) D:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/04/16 17:07:03.0730 1132 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) D:\WINDOWS\system32\DRIVERS\raspti.sys
2011/04/16 17:07:03.0970 1132 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) D:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/04/16 17:07:04.0080 1132 RDPCDD (4912d5b403614ce99c28420f75353332) D:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/04/16 17:07:04.0361 1132 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) D:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/04/16 17:07:04.0591 1132 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) D:\WINDOWS\system32\drivers\RDPWD.sys
2011/04/16 17:07:04.0871 1132 redbook (b31b4588e4086d8d84adbf9845c2402b) D:\WINDOWS\system32\DRIVERS\redbook.sys
2011/04/16 17:07:05.0032 1132 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) D:\WINDOWS\system32\Drivers\RootMdm.sys
2011/04/16 17:07:05.0352 1132 Secdrv (90a3935d05b494a5a39d37e71f09a677) D:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/04/16 17:07:05.0683 1132 serenum (a2d868aeeff612e70e213c451a70cafb) D:\WINDOWS\system32\DRIVERS\serenum.sys
2011/04/16 17:07:05.0933 1132 Serial (cd9404d115a00d249f70a371b46d5a26) D:\WINDOWS\system32\DRIVERS\serial.sys
2011/04/16 17:07:06.0293 1132 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) D:\WINDOWS\system32\drivers\Sfloppy.sys
2011/04/16 17:07:06.0734 1132 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) D:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/04/16 17:07:06.0924 1132 SNC (1a992c8136c015453e82041c35b299da) D:\WINDOWS\system32\DRIVERS\SonyNC.sys
2011/04/16 17:07:07.0125 1132 sonypvs1 (dfadfc2c86662f40759bf02add27d569) D:\WINDOWS\system32\DRIVERS\sonypvs1.sys
2011/04/16 17:07:07.0465 1132 SPI (bfd0e6f53957af8156084c436b825f70) D:\WINDOWS\system32\DRIVERS\SonyPI.sys
2011/04/16 17:07:07.0715 1132 splitter (0ce218578fff5f4f7e4201539c45c78f) D:\WINDOWS\system32\drivers\splitter.sys
2011/04/16 17:07:07.0906 1132 sptd (a199171385be17973fd800fa91f8f78a) D:\WINDOWS\system32\Drivers\sptd.sys
2011/04/16 17:07:07.0906 1132 Suspicious file (NoAccess): D:\WINDOWS\system32\Drivers\sptd.sys. md5: a199171385be17973fd800fa91f8f78a
2011/04/16 17:07:07.0926 1132 sptd - detected Locked file (1)
2011/04/16 17:07:08.0216 1132 sr (e41b6d037d6cd08461470af04500dc24) D:\WINDOWS\system32\DRIVERS\sr.sys
2011/04/16 17:07:08.0386 1132 Srv (7a4f147cc6b133f905f6e65e2f8669fb) D:\WINDOWS\system32\DRIVERS\srv.sys
2011/04/16 17:07:08.0657 1132 streamip (284c57df5dc7abca656bc2b96a667afb) D:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/04/16 17:07:08.0877 1132 swenum (03c1bae4766e2450219d20b993d6e046) D:\WINDOWS\system32\DRIVERS\swenum.sys
2011/04/16 17:07:09.0087 1132 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) D:\WINDOWS\system32\drivers\swmidi.sys
2011/04/16 17:07:10.0249 1132 sysaudio (650ad082d46bac0e64c9c0e0928492fd) D:\WINDOWS\system32\drivers\sysaudio.sys
2011/04/16 17:07:10.0439 1132 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) D:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/04/16 17:07:10.0710 1132 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) D:\WINDOWS\system32\drivers\TDPIPE.sys
2011/04/16 17:07:10.0910 1132 TDTCP (ed0580af02502d00ad8c4c066b156be9) D:\WINDOWS\system32\drivers\TDTCP.sys
2011/04/16 17:07:11.0140 1132 TermDD (a540a99c281d933f3d69d55e48727f47) D:\WINDOWS\system32\DRIVERS\termdd.sys
2011/04/16 17:07:11.0651 1132 Udfs (12f70256f140cd7d52c58c7048fde657) D:\WINDOWS\system32\drivers\Udfs.sys
2011/04/16 17:07:12.0132 1132 Update (ced744117e91bdc0beb810f7d8608183) D:\WINDOWS\system32\DRIVERS\update.sys
2011/04/16 17:07:12.0653 1132 usbaudio (45a0d14b26c35497ad93bce7e15c9941) D:\WINDOWS\system32\drivers\usbaudio.sys
2011/04/16 17:07:12.0833 1132 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) D:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/04/16 17:07:13.0053 1132 usbhub (c72f40947f92cea56a8fb532edf025f1) D:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/04/16 17:07:13.0293 1132 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) D:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/04/16 17:07:13.0494 1132 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/04/16 17:07:13.0714 1132 usbuhci (f8fd1400092e23c8f2f31406ef06167b) D:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/04/16 17:07:13.0934 1132 VgaSave (8a60edd72b4ea5aea8202daf0e427925) D:\WINDOWS\System32\drivers\vga.sys
2011/04/16 17:07:14.0345 1132 Vmodem (b289d19df6103352d3c4b13c0ed79331) D:\WINDOWS\system32\DRIVERS\vmodem.sys
2011/04/16 17:07:14.0565 1132 VolSnap (ee4660083deba849ff6c485d944b379b) D:\WINDOWS\system32\drivers\VolSnap.sys
2011/04/16 17:07:14.0796 1132 Vpctcom (4a4448332075c5a909df123c21616b2a) D:\WINDOWS\system32\DRIVERS\vpctcom.sys
2011/04/16 17:07:15.0076 1132 Vvoice (120e61aac05f00c867a32de493dab9b4) D:\WINDOWS\system32\DRIVERS\vvoice.sys
2011/04/16 17:07:15.0316 1132 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) D:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/04/16 17:07:15.0897 1132 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) D:\WINDOWS\system32\drivers\wdmaud.sys
2011/04/16 17:07:16.0368 1132 WpdUsb (cf4def1bf66f06964dc0d91844239104) D:\WINDOWS\system32\Drivers\wpdusb.sys
2011/04/16 17:07:16.0518 1132 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) D:\WINDOWS\System32\drivers\ws2ifsl.sys
2011/04/16 17:07:16.0779 1132 WSTCODEC (d5842484f05e12121c511aa93f6439ec) D:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/04/16 17:07:17.0029 1132 WudfPf (f15feafffbb3644ccc80c5da584e6311) D:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/04/16 17:07:17.0279 1132 WudfRd (28b524262bce6de1f7ef9f510ba3985b) D:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/04/16 17:07:17.0650 1132 ================================================================================
2011/04/16 17:07:17.0650 1132 Scan finished
2011/04/16 17:07:17.0650 1132 ================================================================================
2011/04/16 17:07:17.0720 1036 Detected object count: 1
2011/04/16 17:07:26.0673 1036 Locked file(sptd) - User select action: Skip
2011/04/16 17:07:34.0504 4000 Deinitialize success

ComboFix log

ComboFix 11-04-15.06 - Administrator 16.04.2011 17:21:10.1.1 - FAT32x86
Spuštěný z: d:\documents and settings\Administrator\Desktop\ComboFix.exe
d:\windows\system32\vbscript.dll chybí
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
d:\documents and settings\Administrator\Local Settings\Application Data\{4FA3C749-0A48-4BAC-9321-7D4288905B5D}
d:\documents and settings\Administrator\Local Settings\Application Data\{4FA3C749-0A48-4BAC-9321-7D4288905B5D}\chrome.manifest
d:\documents and settings\Administrator\Local Settings\Application Data\{4FA3C749-0A48-4BAC-9321-7D4288905B5D}\chrome\content\_cfg.js
d:\documents and settings\Administrator\Local Settings\Application Data\{4FA3C749-0A48-4BAC-9321-7D4288905B5D}\chrome\content\overlay.xul
d:\documents and settings\Administrator\Local Settings\Application Data\{4FA3C749-0A48-4BAC-9321-7D4288905B5D}\install.rdf
d:\documents and settings\Administrator\WINDOWS
d:\program files\internet optimizer
d:\windows\system32\drivers\vtkwoocf.sys
d:\windows\XSxS
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-16 do 2011-04-16 )))))))))))))))))))))))))))))))
.
.
2011-04-16 04:58 . 2011-04-16 04:58 -------- d-----w- d:\documents and settings\Administrator\Application Data\Malwarebytes
2011-04-16 04:58 . 2010-12-20 16:09 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2011-04-16 04:58 . 2011-04-16 04:58 -------- d-----w- d:\documents and settings\All Users\Application Data\Malwarebytes
2011-04-16 04:58 . 2010-12-20 16:08 20952 ----a-w- d:\windows\system32\drivers\mbam.sys
2011-04-16 04:58 . 2011-04-16 04:58 -------- d-----w- d:\program files\Malwarebytes' Anti-Malware
2011-04-16 04:50 . 2011-04-16 04:50 211696 ----a-w- d:\windows\system32\drivers\dwshd.sys
2011-04-16 04:32 . 2011-04-16 04:32 -------- d-----w- d:\documents and settings\Administrator\DoctorWeb
2011-04-09 00:28 . 2011-04-09 00:28 -------- d-----w- d:\program files\Xenocode
2011-04-06 03:26 . 2011-04-06 03:26 -------- d-----w- d:\program files\7-Zip
2011-03-29 06:40 . 2011-03-29 06:40 -------- d-----w- d:\program files\UP
2011-03-29 04:03 . 2011-03-29 04:03 -------- d-----w- d:\documents and settings\Administrator\Application Data\gtk-2.0
2011-03-29 03:40 . 2011-03-29 03:40 -------- d-----w- d:\documents and settings\Administrator\.thumbnails
2011-03-29 03:37 . 2011-03-29 03:37 -------- d-----w- d:\documents and settings\Administrator\.gimp-2.6
2011-03-29 03:31 . 2011-03-29 03:31 -------- d-----w- d:\program files\GIMP-2.0
2011-03-29 00:06 . 2011-03-29 00:06 -------- d-----w- d:\program files\InstantEyedropper
2011-03-24 01:32 . 2011-03-24 01:32 -------- d-----w- D:\FOUND.015
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-16 03:11 . 2004-10-01 15:28 98304 ----a-w- d:\windows\DUMP8121.tmp
2011-03-13 18:51 . 2008-07-15 15:38 73728 ----a-w- d:\windows\system32\javacpl.cpl
2011-03-13 18:51 . 2011-03-13 18:52 472808 ----a-w- d:\windows\system32\deployJava1.dll
2008-02-08 17:08 . 2008-02-08 17:08 72280 ----a-w- d:\program files\setup.exe
2008-02-08 17:07 . 2008-02-08 17:07 33296384 ----a-w- d:\program files\kis.en.msi
2007-11-24 09:21 . 2007-11-24 09:21 3380048 ----a-w- d:\program files\LimeWireWin.exe
2007-08-02 15:43 . 2007-08-02 15:43 536 ----a-w- d:\program files\setup.reg
2009-01-05 15:22 . 2008-10-23 09:25 654336 ----a-w- d:\program files\mozilla firefox\components\nsadzgalore.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="d:\program files\Skype\Phone\Skype.exe" [2011-01-26 15026056]
"instanteyedropper"="d:\program files\InstantEyedropper\InstantEyedropper.exe" [2007-10-17 352256]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="d:\windows\System32\igfxtray.exe" [2004-08-20 155648]
"HotKeysCmds"="d:\windows\System32\hkcmd.exe" [2004-08-20 118784]
"ezShieldProtector for Px"="d:\windows\system32\ezSP_Px.exe" [2002-08-20 40960]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\ctfmon.exe" [2004-08-03 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dwshd.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Messenger\\msmsgs.exe"=
"d:\\Documents and Settings\\All Users\\Application Data\\Spontania4IM\\spontaniavideo.exe"=
"d:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"d:\\Program Files\\Java\\jre1.6.0_07\\bin\\javaw.exe"=
"d:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R3 WDC_SAM;WD SCSI Pass Thru driver;d:\windows\system32\DRIVERS\wdcsam.sys [x]
S0 sptd;sptd;d:\windows\System32\Drivers\sptd.sys [2011-01-08 436792]
S3 Ptserli;PCTEL Serial Device Driver for INTEL;d:\windows\system32\DRIVERS\ptserli.sys [2001-08-17 128286]
S3 SPI;Sony Programmable I/O Control Device;d:\windows\system32\DRIVERS\SonyPI.sys [2001-08-17 37040]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-04-13 d:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-492894223-854245398-500Core.job
- d:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-01-02 02:29]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyServer = 194.1.122.145:3128
IE: &ICQ Toolbar Search - d:\program files\ICQToolbar\toolbaru.dll/SEARCH.HTML
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://d:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://d:\windows\Java\classes\xmldso.cab
FF - ProfilePath - d:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dxxzma7m.Juraj a Katka\
FF - prefs.js: browser.search.defaulturl - hxxp://www3.searchonthego.net/search.php?q=
FF - prefs.js: browser.startup.homepage - hxxp://www.azet.sk/
FF - prefs.js: keyword.URL - hxxp://www3.searchonthego.net/search.php?q=
FF - prefs.js: network.proxy.type - 4
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - d:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - d:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - Ext: z: {34255a77-3aab-d12b-6731-9effec4aa33a} - d:\program files\Mozilla Firefox\extensions\{34255a77-3aab-d12b-6731-9effec4aa33a}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - d:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: vShare: vshare@toolbar - %profile%\extensions\vshare@toolbar
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - d:\program files\Java\jre6\lib\deploy\jqs\ff
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
BHO-{B6F7ECB0-3DA6-4619-8F4D-A25AECF43209} - d:\windows\system32\mscorie.dll
HKLM-Run-Media Gateway - d:\program files\Media Gateway\MediaGateway.exe
AddRemove-MWASPI - d:\mwaspi\uninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-16 17:34
Windows 5.1.2600 Service Pack 2 FAT NTAPI
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1960408961-492894223-854245398-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*,%Q*_
]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1960408961-492894223-854245398-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*,%Q*_
\OpenWithList]
@Class="Shell"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):42,ab,7c,d6,cf,97,69,2d,7d,bc,b7,bc,2e,88,bf,aa,e4,fb,14,41,83,
8b,cc,d9,69,05,05,36,80,23,39,22,f9,ab,08,ba,42,64,cc,ed,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{679d2329-c3aa-431c-ae3b-599bf48a2f96}]
@Denied: (Full) (Everyone)
"Model"=dword:0000014a
"Therad"=dword:0000001e
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,ab,9e,50,1b,eb,77,d1,ab,b5,66,4a,d0,23,02,d0,61,c2,0c,62,e1,ee,21,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(1924)
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
d:\program files\Bonjour\mDNSResponder.exe
d:\program files\Java\jre6\bin\jqs.exe
d:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
d:\program files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
d:\program files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
d:\windows\system32\pctspk.exe
.
**************************************************************************
.
Celkový čas: 2011-04-16 17:39:53 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-04-16 15:39
.
Před spuštěním: 436 486 144 bytes free
Po spuštění: 887 193 600 voľných bajtov
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
C:\="Microsoft Windows"
.
- - End Of File - - 1B7FB4904232CA9F24ED18BAF501EB31

[jaro3]

Odinstaluj:
LimeWire--pokud máš

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

KillAll::
File::
d:\program files\kis.en.msi
d:\program files\LimeWireWin.exe
d:\program files\setup.reg
d:\program files\mozilla firefox\components\nsadzgalore.dll
d:\program files\setup.exe
d:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-492894223-854245398-500Core.job
d:\windows\DUMP8121.tmp

Folder::
D:\FOUND.015
d:\windows\DUMP8121.tmp

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

DDS::
uInternet Settings,ProxyServer = 194.1.122.145:3128
IE: &ICQ Toolbar Search - d:\program files\ICQToolbar\toolbaru.dll/SEARCH.HTML

Firefox::
FF - ProfilePath - d:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dxxzma7m.Juraj a Katka\
FF - prefs.js: browser.search.defaulturl - hxxp://www3.searchonthego.net/search.php?q=
FF - prefs.js: browser.startup.homepage - hxxp://www.azet.sk/
FF - prefs.js: keyword.URL - hxxp://www3.searchonthego.net/search.php?q=
FF - Ext: vShare: vshare@toolbar - %profile%\extensions\vshare@toolbar

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{679d2329-c3aa-431c-ae3b-599bf48a2f96}]

MIA::
d:\windows\system32\vbscript.dll

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT


Upozornění : Může se stát, že po aplikaci skriptu a restartu počítače Windows nenaběhnou, pak znovu restartuj počítač, mačkej F8 a pak zvol poslední známou funkční konfiguraci.


V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému

Toto otestuj na Virustotal
d:\windows\system32\drivers\dwshd.sys

Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/40 , nebo 1/40. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.

Start-spustit-napiš: notepad ,do něho vlož tento celý text:

Kód: Vybrat vše

dir \vbscript.dll /a h /s > File.txt

uložit na plochu s názvem: find.bat (typ souboru- všechny soubory)
Najdi ho na ploše, poklepej na něj a počkej až se okno zavře a objeví se soubor.txt
Vlož sem potom celý text z tohoto souboru.