Prosim o kotrolu - services.exe 100% CPU + nejde net

[Shimi]

pri stahovani sem chytnul asi nakyho trojana, adaware ani avast si s tim neporadili a po restartovani pc
mam services.exe na 100 procent vytezujici CPU a nejspis blokujici i vsechny porty ponevadz mi nejde net



Logfile of HijackThis v1.99.1
Scan saved at 11:09:22, on 29.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Ad-Aware 2007\aawservice.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\Ad-Aware 2007\Ad-Watch2007.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\Gene6 FTP Server\G6FTPTray.exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\Program Files\MSI\PCAlert4.exe
C:\Program Files\CLCL\CLCL.exe
C:\Program Files\Miranda\miranda32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Gene6 FTP Server\G6FTPSERVER.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Total Commander\TOTALCMD.EXE
c:\FTP\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://update.microsoft.com/windowsupda ... aspx?ln=cs
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O1 - Hosts: 81.30.226.227 L2authd.lineage2.com
O1 - Hosts: 81.30.226.227 L2testauthd.lineage2.com
O2 - BHO: (no name) - {055FD26D-3A88-4e15-963D-DC8493744B1D} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Program Files\PC Translator\WEBIE.DLL
O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Program Files\PC Translator\WEBIE.DLL
O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [Comodo Firewall] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SystemSv12] C:\WINDOWS\system32\newmaxxsv234.exe
O4 - HKLM\..\Run: [mstaskmgr.exe] C:\WINDOWS\system32\mstaskmgr.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Ad-Aware 2007\Ad-Watch2007.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [G6FTP Server Tray Monitor] "C:\Program Files\Gene6 FTP Server\G6FTPTray.exe"
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [noskrnl] C:\WINDOWS\noskrnl.exe
O4 - Startup: CLCL.lnk = C:\Program Files\CLCL\CLCL.exe
O4 - Startup: xchat.lnk = C:\Program Files\XChat\xchat.exe
O4 - Startup: Zástupce - Miranda.lnk = C:\Program Files\Miranda\miranda32.exe
O4 - Global Startup: PC Alert 4.lnk = C:\Program Files\MSI\PCAlert4.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi ... p=ZNfox000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout pomocí FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Stáhnout vše pomocí FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Program Files\PC Translator\WEBIE.DLL
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQ5.1\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQ5.1\ICQLite.exe
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Program Files\PC Translator\WEBIE.DLL
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Program Files\PC Translator\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Program Files\PC Translator\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Program Files\PC Translator\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Program Files\PC Translator\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Program Files\PC Translator\WEBIE.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedow ... in9USA.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Ad-Aware 2007\aawservice.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Gene6 FTP Server (G6FTPServer) - Gene6 - C:\Program Files\Gene6 FTP Server\G6FTPSERVER.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware Sandra Lite 2005\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware Sandra Lite 2005\RpcSandraSrv.exe

[Reklama]

[memphisto]

řekl bych že chyba je tady:
O4 - HKLM\..\Run: [mstaskmgr.exe] C:\WINDOWS\system32\mstaskmgr.exe
O4 - HKLM\..\Run: [SystemSv12] C:\WINDOWS\system32\newmaxxsv234.exe

najdi ty soubory a otestuj na virustotalu

jinak fixni:
O2 - BHO: (no name) - {055FD26D-3A88-4e15-963D-DC8493744B1D} - (no file)
O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)
O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O4 - HKCU\..\Run: [noskrnl] C:\WINDOWS\noskrnl.exe
O4 - Startup: CLCL.lnk = C:\Program Files\CLCL\CLCL.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/t.....p=ZNfox000
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

aha.sry zapomněl jsem

[Shimi]

bohuzel na tom pc jak jsem rekl mi nejde internet takze na virus total je asi neotestuju...
zkusim fixnout

[Shimi]

services.exe uz nezatezuje procak ale internet nejde porad...

[Baron Prášil]

pošli nový log z HJT

[Shimi]

net furt nejde,v siti jakoby pripojenej sem ale pakety netecou a miranda hlasi ze ma ucpany vsechny porty tak nevim co to muze blokovat

Logfile of HijackThis v1.99.1
Scan saved at 16:58:08, on 29.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Ad-Aware 2007\Ad-Watch2007.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Total Commander\TOTALCMD.EXE
c:\Program Files\CLCL\CLCL.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Gene6 FTP Server\G6FTPSERVER.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
c:\FTP\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Program Files\PC Translator\WEBIE.DLL
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Program Files\PC Translator\WEBIE.DLL
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [Comodo Firewall] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Ad-Aware 2007\Ad-Watch2007.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [G6FTP Server Tray Monitor] "C:\Program Files\Gene6 FTP Server\G6FTPTray.exe"
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: CLCL.lnk = C:\Program Files\CLCL\CLCL.exe
O4 - Startup: xchat.lnk = C:\Program Files\XChat\xchat.exe
O4 - Startup: Zástupce - Miranda.lnk = C:\Program Files\Miranda\miranda32.exe
O4 - Global Startup: PC Alert 4.lnk = C:\Program Files\MSI\PCAlert4.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout pomocí FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Stáhnout vše pomocí FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Program Files\PC Translator\WEBIE.DLL
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQ5.1\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQ5.1\ICQLite.exe
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Program Files\PC Translator\WEBIE.DLL
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Program Files\PC Translator\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Program Files\PC Translator\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Program Files\PC Translator\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Program Files\PC Translator\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Program Files\PC Translator\WEBIE.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Ad-Aware 2007\aawservice.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Gene6 FTP Server (G6FTPServer) - Gene6 - C:\Program Files\Gene6 FTP Server\G6FTPSERVER.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware Sandra Lite 2005\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware Sandra Lite 2005\RpcSandraSrv.exe

[Shimi]

jinak mwav rika

Objekt "minibug Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "flashget Unclassified" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "killav.nbd Browser Hijacker" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "killav.nbd Browser Hijacker" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "funwebproducts Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "mysearch Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "NULLBYTE Spyware/Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "trojan-downloader.bat.ftp.ab Trojan-Downloader" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "trojan-downloader.bat.ftp.ab Trojan-Downloader" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "savenow Adware" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "shangxing BackDoor" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Objekt "shangxing BackDoor" nalezen v souborovém systému! Provedené akce: Nic nebylo provedeno.
Záznam "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" odkazuje na neplatný objekt ".mds". Provedené akce: Nic nebylo provedeno.

[Baron Prášil]

oba logy jsou ok.

předpokládám,že firewall jsi vypnout zkusil.

takže pošli log z
COMBOFIXu
Stáhni si ComboFix (by sUBs) a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem klávesy 1
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log, který se ti zobrazí, jinak ho najdeš zde: C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

[Shimi]

ComboFix 07-10-29.1 - Simon 2007-10-29 17:18:11.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.659 [GMT 1:00]
Running from: C:\Documents and Settings\Simon\Plocha\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\regedit.com
C:\WINDOWS\system32\taskmgr.com

.
((((((((((((((((((((((((( Files Created from 2007-09-28 to 2007-10-29 )))))))))))))))))))))))))))))))
.

2007-10-29 17:15 <DIR> d-------- C:\Program Files\WinXP Manager
2007-10-29 17:14 <DIR> d-a------ C:\WINDOWS\system32\systems.txt
2007-10-29 13:31 1,580 --a------ C:\WINDOWS\system32\tmp.reg
2007-10-29 13:30 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-10-29 13:30 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-10-29 13:30 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-10-29 13:30 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-10-29 13:30 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-10-29 13:29 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-10-29 13:29 <DIR> d-------- C:\Documents and Settings\Simon\Data aplikací\SUPERAntiSpyware.com
2007-10-29 13:29 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\SUPERAntiSpyware.com
2007-10-29 13:09 <DIR> d-a------ C:\WINDOWS\zts2.exe
2007-10-29 13:09 <DIR> d-a------ C:\WINDOWS\system32\vcmgcd32.dll
2007-10-29 13:09 <DIR> d-a------ C:\WINDOWS\system32\iifgfgf.dll
2007-10-29 13:09 <DIR> d-a------ C:\WINDOWS\system32\Delete_Me_Dummy_systems.txt
2007-10-29 13:09 <DIR> d-a------ C:\WINDOWS\rundll16.exe
2007-10-29 13:09 <DIR> d-a------ C:\WINDOWS\rundl132.dll
2007-10-29 13:09 <DIR> d-a------ C:\WINDOWS\logo1_.exe
2007-10-29 11:57 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-29 11:50 147,968 --a------ C:\WINDOWS\R.COM
2007-10-29 11:50 137,216 --a------ C:\WINDOWS\system32\T.COM
2007-10-29 11:39 <DIR> d-------- C:\Program Files\CCleaner
2007-10-28 19:34 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2007-10-25 22:43 <DIR> d-------- C:\Program Files\Symbian
2007-10-23 14:42 <DIR> d-------- C:\Program Files\Glary Utilities
2007-10-23 14:16 <DIR> d-------- C:\Program Files\Ad-Aware 2007
2007-10-23 14:16 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\Lavasoft
2007-10-23 13:54 <DIR> d-------- C:\Program Files\VideoLAN
2007-10-23 13:52 294,912 --a------ C:\WINDOWS\TrnWord.dll
2007-10-23 13:51 516,096 --a------ C:\WINDOWS\UN32.EXE
2007-10-20 12:32 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2007-10-20 12:32 739,840 --a------ C:\WINDOWS\system32\divx.dll
2007-10-20 12:32 282,624 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-10-20 12:32 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll
2007-10-20 12:32 81,920 --a------ C:\WINDOWS\system32\dpl100.dll
2007-10-20 12:32 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-10-08 18:29 <DIR> d-------- C:\Program Files\foobar2000
2007-10-08 18:29 <DIR> d-------- C:\Documents and Settings\Simon\Data aplikací\foobar2000

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-29 12:29 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-10-28 19:36 --------- d-----w C:\Program Files\Avast4
2007-10-28 19:32 --------- d-----w C:\Program Files\BSplayerPro
2007-10-25 21:45 --------- d-----w C:\Program Files\FlashGet
2007-10-25 21:37 --------- d-----w C:\Program Files\Total Commander
2007-10-23 14:06 --------- d-----w C:\Program Files\Winamp
2007-10-23 13:49 --------- d-----w C:\Documents and Settings\Simon\Data aplikací\GlarySoft
2007-10-23 13:25 --------- d-----w C:\Program Files\System Mechanic 5 Professional
2007-10-23 13:24 --------- d-----w C:\Program Files\Common Files\stardock
2007-10-23 13:13 --------- d-----w C:\Documents and Settings\Simon\Data aplikací\Lavasoft
2007-10-23 12:52 --------- d-----w C:\Program Files\PC Translator
2007-10-19 18:45 --------- d-----w C:\Documents and Settings\Simon\Data aplikací\Zoner
2007-10-09 18:40 --------- d-----w C:\Program Files\Codec Pack - All In 1
2007-10-06 14:26 --------- d-----w C:\Program Files\Easy CD-DA Extractor 9
2007-09-26 19:21 --------- d-----w C:\Program Files\Rainlendar2
2007-09-25 17:09 --------- d-----w C:\Program Files\MSI
2007-09-25 17:06 --------- d-----w C:\Program Files\Setup Files
2007-09-24 15:29 --------- d-----w C:\Documents and Settings\Simon\Data aplikací\Silver Style Entertainment
2007-09-24 10:17 --------- d-----w C:\Documents and Settings\Simon\Data aplikací\X-Chat 2
2007-09-24 10:07 --------- d-----w C:\Program Files\Last.fm
2007-09-24 10:07 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Last.fm
2007-09-23 17:51 --------- d-----w C:\Program Files\Miranda
2007-09-23 13:17 --------- d-----w C:\Program Files\mIRC
2007-09-04 16:56 164,352 ----a-w C:\WINDOWS\system32\unrar.dll
2006-11-15 13:24 1 ----a-w C:\Documents and Settings\Simon\SI.bin
2003-03-16 01:00 7,216 -c--a-w C:\WINDOWS\inf\RAMDISK.SYS
.

((((((((((((((((((((((((((((( snapshot@2007-10-29_12.05.03.06 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-10-29 12:29:49 29,696 ----a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF11.exe
+ 2007-10-29 12:29:49 18,944 ----a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
+ 2007-10-29 12:29:49 65,024 ----a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
+ 2007-10-29 15:57:10 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_c4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Comodo Firewall"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-02-08 11:44]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 11:22]
"Ad-Watch"="C:\Program Files\Ad-Aware 2007\Ad-Watch2007.exe" [2007-10-23 14:15]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-17 14:49]
"CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 16:34]
"G6FTP Server Tray Monitor"="C:\Program Files\Gene6 FTP Server\G6FTPTray.exe" [2006-01-26 15:06]
"Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2007-07-24 08:12]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]

C:\Documents and Settings\Simon\Nabídka Start\Programy\Po spuštění\
CLCL.lnk - C:\Program Files\CLCL\CLCL.exe [2005-02-11 18:58:10]
xchat.lnk - C:\Program Files\XChat\xchat.exe [2007-05-28 16:59:33]
Zástupce - Miranda.lnk - C:\Program Files\Miranda\miranda32.exe [2007-09-23 18:50:25]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění\
PC Alert 4.lnk - C:\Program Files\MSI\PCAlert4.exe [2007-09-25 18:09:11]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsMenu"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

R2 G6FTPServer;Gene6 FTP Server;"C:\Program Files\Gene6 FTP Server\G6FTPSERVER.EXE"
R2 SVKP;SVKP;\??\C:\WINDOWS\system32\SVKP.sys
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys
S3 dump_wmimmc;dump_wmimmc;\??\C:\WINDOWS\system32\drivers\dump_wmimmc.sys
S3 rtl8029;Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\RTL8029.SYS
S3 Siemens_Sx1Swup;Siemens_Sx1Swup.SvcDesc%;C:\WINDOWS\system32\Drivers\Siemens_Sx1Swup.sys

.
**************************************************************************

catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-29 17:19:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-29 17:20:21
C:\ComboFix2.txt ... 2007-10-29 12:05
.
--- E O F ---

[Baron Prášil]

použij Avenger http://www.spyware.cz/go.php?p=spyware&t=aplikace&id=35

a skript

Files to delete:
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\SrchSTS.exe
C:\WINDOWS\system32\Process.exe
C:\WINDOWS\R.COM
C:\WINDOWS\system32\T.COM
C:\WINDOWS\system32\drivers\dump_wmimmc.sys

po restartu pošli log z avengeru

toto
C:\WINDOWS\system32\systems.txt
nech zkontrolovat tady
http://www.virustotal.com/flash/index_en.html

[Shimi]

sem dement! byl sem tak podezrivavej ze sem si smazal tcpip.sys proto mi nesla sit
diky moc vsem za pomoc

[Baron Prášil]

nemáš za co.ale tamto sou šmejdi,tak ještě pošli ten log z Avengeru