zavirované PC, svchost.exe vytěžuje CPU, siszyd32.exe

[hrasek]

Pře chvílí jsem vlezl na nějakou zavirovanou stránku a NOD mi zahlásil že přesunul do karantény "Win32/Rootkit.Kryptik.AF trojský kůň". V karanténě se objevilo několik souborů z adresáře Windows/system32/drivers. Když se do toho adresáře podívám tak je tam soubor "gkiigjyt.sys" s dnešním datem - takže 100% pozůstatek toho viru. Po restartu se stalo přesně to co jsme předpokládal, PC je vytížené na 100% programem svchost.exe a ve složce po spuštění je umístěn soubor "siszyd32.exe". Navíc mi v PC běží divný proces "Petr.exe.exe".
Takže jsem si hezky zaviroval počítač

Zde je log z RSIT. Prosím o pomoc. Předem moc děkuji.



Logfile of random's system information tool 1.06 (written by random/random)
Run by Petr at 2009-12-23 21:16:09
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 7 GB (17%) free of 40 GB
Total RAM: 1014 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:16:52, on 23.12.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\odClientService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\CtrlVol.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\OdTray.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Serv-U\ServUTray.exe
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat_sl.exe
C:\Program Files\Rainlendar\Rainlendar.exe
C:\Program Files\CoolMon\CoolMon.exe
C:\Documents and Settings\Petr\Nabídka Start\Programy\Po spuštění\siszyd32.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Documents and Settings\Petr\Plocha\RSIT.exe
C:\Program Files\Utility\Hijackthis\Petr.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Program Files\pctranslator\WEBIE.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Program Files\pctranslator\WEBIE.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [OdTray.exe] "C:\Program Files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\OdTray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [sysgif32] C:\WINDOWS\TEMP\~TM85F9.tmp
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ServUTrayIcon] C:\Program Files\Serv-U\ServUTray.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Myš.lnk = ?
O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe
O4 - Startup: CoolMon.lnk = C:\Program Files\CoolMon\CoolMon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: siszyd32.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O9 - Extra 'Tools' menuitem: Nastavení aplikace &Gears - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Program Files\pctranslator\WEBIE.DLL
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Program Files\pctranslator\WEBIE.DLL
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Program Files\pctranslator\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Program Files\pctranslator\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Program Files\pctranslator\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Program Files\pctranslator\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Program Files\pctranslator\WEBIE.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Shar ... vSniff.cab
O16 - DPF: {361E6B79-4A69-4376-B0F2-3D1EBEE9D7E2} (RtspVaPgCtrl Class) - http://gen.din.cz/RtspVaPgDec.cab
O16 - DPF: {575A6BF1-1460-4907-9157-BECB7DCAC655} (TVSLiveControl Class) - http://nadatel.truecam.net/rel/webViewer.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O16 - DPF: {73FDD716-9BCE-42F7-8B13-DB4F7587B8D1} (WViewCtl Class) - http://ns.standalone4ch.com/webview2/webview.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos-be ... canner.cab
O16 - DPF: {8FEED82A-42A6-4117-A803-7EC3EB9339E0} (ClientControl Class) - http://192.168.0.99/plugin/client.cab
O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://192.168.0.99/plugin/h263ctrl.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Google Update Service (gupdate1c90bc12c0fd2c0) (gupdate1c90bc12c0fd2c0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Odyssey Client (odClientService) - Funk Software, Inc. - C:\Program Files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\odClientService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: TSM - Unknown owner - C:\DOCUME~1\Petr\LOCALS~1\Temp\TSM.exe (file missing)
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

--
End of file - 12915 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\Program Files\pctranslator\WEBIE.DLL [2006-10-01 360448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-10-30 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2006-12-18 231160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-10-30 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53}]
Google Gears Helper - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll [2009-10-16 2101248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-10-30 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\Program Files\pctranslator\WEBIE.DLL [2006-10-01 360448]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2006-12-18 231160]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe [2003-04-24 110592]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2003-04-24 610304]
"nod32kui"=C:\Program Files\Eset\nod32kui.exe [2006-09-26 917504]
"AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2003-02-14 88107]
"LaunchAp"=C:\Program Files\Launch Manager\LaunchAp.exe [2002-12-02 32768]
"HotkeyApp"=C:\Program Files\Launch Manager\HotkeyApp.exe [2003-01-09 57418]
"CtrlVol"=C:\Program Files\Launch Manager\CtrlVol.exe [2002-10-23 163840]
"Wbutton"=C:\Program Files\Launch Manager\Wbutton.exe [2003-01-09 53248]
"OdTray.exe"=C:\Program Files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\OdTray.exe [2003-12-16 626746]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2006-09-26 98304]
"CloneCDTray"=C:\Program Files\CloneCD\CloneCDTray.exe [2004-12-27 57344]
"PinnacleDriverCheck"=C:\WINDOWS\system32\PSDrvCheck.exe [2004-03-10 406016]
"snpstd3"=C:\WINDOWS\vsnpstd3.exe [2005-09-05 339968]
"TrueImageMonitor.exe"=C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe [2007-02-09 1165680]
"AcronisTimounterMonitor"=C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe [2007-02-09 1945960]
"Acronis Scheduler2 Service"=C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe [2007-02-09 149024]
"igfxtray"=C:\WINDOWS\system32\igfxtray.exe [2005-07-19 94208]
"igfxhkcmd"=C:\WINDOWS\system32\h [2008-11-07 1592]
"igfxpers"=C:\WINDOWS\system32\igfxpers.exe [2005-07-19 114688]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-10-30 136600]
"Acrobat Assistant 7.0"=C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe [2008-04-23 483328]
""= []
"sysgif32"=C:\WINDOWS\TEMP\~TM85F9.tmp []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]
"ServUTrayIcon"=C:\Program Files\Serv-U\ServUTray.exe [2002-02-03 68608]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe

C:\Documents and Settings\Petr\Nabídka Start\Programy\Po spuštění
Myš.lnk -
Rainlendar.lnk - C:\Program Files\Rainlendar\Rainlendar.exe
CoolMon.lnk - C:\Program Files\CoolMon\CoolMon.exe
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
siszyd32.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-07-19 135168]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
relog_ap

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"NoDrives"=
"NoDriveAutoRun"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\WINDOWS\System32\java.exe"="C:\WINDOWS\System32\java.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\Trillian\trillian.exe"="C:\Program Files\Trillian\trillian.exe:*:Enabled:Trillian"
"C:\Program Files\Azureus\Azureus.exe"="C:\Program Files\Azureus\Azureus.exe:*:Enabled:Azureus"
"C:\Program Files\Hamachi\hamachi.exe"="C:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"C:\Program Files\Serv-U\ServUDaemon.exe"="C:\Program Files\Serv-U\ServUDaemon.exe:*:Enabled:ServUDaemon.exe"
"C:\Program Files\xwinlogon\XWin.exe"="C:\Program Files\xwinlogon\XWin.exe:*:Enabled:XWin"
"C:\Program Files\totalcmd\TOTALCMD.EXE"="C:\Program Files\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows"
"C:\Program Files\Reallusion\CrazyTalk for Skype\CT4Skype.exe"="C:\Program Files\Reallusion\CrazyTalk for Skype\CT4Skype.exe:*:Enabled:CrazyTalk"
"C:\Program Files\FreeCall.com\FreeCall\FreeCall.exe"="C:\Program Files\FreeCall.com\FreeCall\FreeCall.exe:*:Enabled:FreeCall"
"C:\WINDOWS\System32\dplaysvr.exe"="C:\WINDOWS\System32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Program Files\ASUS\Wireless Router Utilities\DiscoveryR.exe"="C:\Program Files\ASUS\Wireless Router Utilities\DiscoveryR.exe:*:Enabled:ASUS Device Discovery Application"
"C:\Program Files\KN_StrongDC\StrongDC.exe"="C:\Program Files\KN_StrongDC\StrongDC.exe:*:Enabled:StrongDC++"
"C:\Program Files\Java\JRE6\launch4j-tmp\JDownloader.exe"="C:\Program Files\Java\JRE6\launch4j-tmp\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\MoZiGo\MoZiGo.exe"="C:\Program Files\MoZiGo\MoZiGo.exe:*:Enabled:Pomôcka geokešera"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Disabled:Java(TM) Platform SE binary"
"C:\Program Files\DreamCom\DreamCom.exe"="C:\Program Files\DreamCom\DreamCom.exe:*:Disabled:DreamCom"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{87decb00-cb7c-11de-93d6-000e355709c4}]
shell\AutoRun\command - I:\__DTMEDIA\DTMedia.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f0572de1-3e1a-11dc-bba0-005056c00008}]
shell\AutoRun\command - L:\USBNB.exe


======List of files/folders created in the last 1 months======

2009-12-23 21:08:35 ----D---- C:\rsit
2009-12-11 10:35:06 ----HD---- C:\WINDOWS\$NtUninstallKB970430$
2009-12-11 10:34:39 ----HD---- C:\WINDOWS\$NtUninstallKB974318$
2009-12-11 10:33:34 ----HD---- C:\WINDOWS\$NtUninstallKB976325$
2009-12-11 10:32:53 ----HD---- C:\WINDOWS\$NtUninstallKB973904$
2009-12-11 10:32:35 ----HD---- C:\WINDOWS\$NtUninstallKB974392$
2009-12-11 10:32:19 ----HD---- C:\WINDOWS\$NtUninstallKB971737$
2009-11-25 08:10:05 ----HD---- C:\WINDOWS\$NtUninstallKB976098-v2$
2009-11-25 08:09:45 ----HD---- C:\WINDOWS\$NtUninstallKB973687$

======List of files/folders modified in the last 1 months======

2009-12-23 21:13:10 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-12-23 21:12:20 ----A---- C:\WINDOWS\wincmd.ini
2009-12-23 20:55:32 ----A---- C:\WINDOWS\TRNCOM.INI
2009-12-23 20:25:42 ----A---- C:\WINDOWS\wcx_ftp.ini
2009-12-21 23:43:34 ----A---- C:\WINDOWS\system32\PWWSGDI.INI
2009-12-21 01:08:58 ----A---- C:\WINDOWS\WTRAN32.INI
2009-12-19 15:27:36 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-12-11 10:34:54 ----A---- C:\WINDOWS\imsins.BAK

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Hotkey;Hotkey; C:\WINDOWS\system32\d [2008-09-11 1592]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\D [2008-09-11 1592]
R1 PCLEPCI;PCLEPCI; \??\C:\WINDOWS\system32\drivers\pclepci.sys []
R1 PQNTDrv;PQNTDrv; C:\WINDOWS\system32\d [2008-09-11 1592]
R1 Wbutton;Wbutton; C:\WINDOWS\system32\d [2008-09-11 1592]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\d [2008-09-11 1592]
R2 AMON;AMON; \??\C:\WINDOWS\system32\drivers\amon.sys []
R2 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\D [2008-09-11 1592]
R2 giveio;giveio; \??\C:\WINDOWS\giveio.sys []
R2 Hardlock;Hardlock; \??\C:\WINDOWS\system32\drivers\hardlock.sys []
R2 hcmon;VMware hcmon; \??\C:\WINDOWS\system32\Drivers\hcmon.sys []
R2 irda;Protokol IrDA; C:\WINDOWS\system32\D [2008-09-11 1592]
R2 PWSYSDRV;PWSYSDRV; \??\C:\WINDOWS\system32\drivers\PWSYSDRV.sys []
R2 tifsfilter;Acronis True Image FS Filter; C:\WINDOWS\system32\D [2008-09-11 1592]
R2 VMnetBridge;VMware Bridge Protocol; C:\WINDOWS\system32\D [2008-09-11 1592]
R2 VMnetuserif;VMware Network Application Interface; \??\C:\WINDOWS\system32\drivers\vmnetuserif.sys []
R2 VMparport;VMware VMparport; \??\C:\WINDOWS\system32\Drivers\VMparport.sys []
R2 vmx86;VMware vmx86; \??\C:\WINDOWS\system32\Drivers\vmx86.sys []
R2 vstor2;Vstor2 Virtual Storage Driver; \??\C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vstor2.sys []
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\D [2008-09-11 1592]
R3 ASAPIW2k;ASAPIW2K; C:\WINDOWS\system32\d [2008-09-11 1592]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\WINDOWS\system32\D [2008-09-11 1592]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\D [2008-09-11 1592]
R3 cs429x;Cirrus Logic WDM Audio Codec Driver; C:\WINDOWS\system32\d [2008-09-11 1592]
R3 dtscsi;dtscsi; C:\WINDOWS\System32\D [2008-09-11 1592]
R3 ElbyCDFL;ElbyCDFL; C:\WINDOWS\System32\D [2008-09-11 1592]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\D [2008-09-11 1592]
R3 ialm;ialm; C:\WINDOWS\system32\D [2008-09-11 1592]
R3 MarvinBus;Pinnacle Marvin Bus; C:\WINDOWS\system32\D [2008-09-11 1592]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\D [2008-09-11 1592]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\D [2008-09-11 1592]
R3 odysseyIM3;Odyssey Network Services Miniport; C:\WINDOWS\system32\D [2008-09-11 1592]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\d [2008-09-11 1592]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\D [2008-09-11 1592]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\D [2008-09-11 1592]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\D [2008-09-11 1592]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\D [2008-09-11 1592]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\D [2008-09-11 1592]
R3 w29n51;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows XP; C:\WINDOWS\system32\D [2008-09-11 1592]
R3 WBMS;Winbond Memory Stick Storage (MS) Device Driver; C:\WINDOWS\System32\D [2008-09-11 1592]
R3 WBSD;Winbond Secure Digital Storage (SD/MMC) Device Driver; C:\WINDOWS\System32\D [2008-09-11 1592]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\D [2008-09-11 1592]
S1 mailKmd;mailKmd; C:\WINDOWS\system32\d [2008-09-11 1592]
S3 61883;61883 Unit Device; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 adusbmdm6501;AnyDATA CDMA USB Modem Driver (PID 6501); C:\WINDOWS\system32\D [2008-09-11 1592]
S3 adusbser6501;AnyDATA CDMA USB Serial Port (PID 6501); C:\WINDOWS\system32\D [2008-09-11 1592]
S3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 ASINDIS5;ASINDIS5 Protocol Driver; \??\C:\WINDOWS\system32\ASINDIS5.SYS []
S3 Avc;AVC Device; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 catchme;catchme; C:\WINDOWS\system32\d [2008-09-11 1592]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 CO_Mon;CO_Mon; \??\C:\WINDOWS\system32\Drivers\CO_Mon.sys []
S3 FTDIBUS;USB Serial Converter Driver; C:\WINDOWS\system32\d [2008-09-11 1592]
S3 FTSER2K;USB Serial Port Driver; C:\WINDOWS\system32\d [2008-09-11 1592]
S3 grmnusb;grmnusb; C:\WINDOWS\system32\d [2008-09-11 1592]
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 k750bus;Sony Ericsson 750 driver (WDM); C:\WINDOWS\system32\D [2008-09-11 1592]
S3 MSDV;Microsoft DV Camera and VCR; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 MSIRCOMM;Microsoft IR Communications Driver; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\d [2008-09-11 1592]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 nm;Ovladač programu Sledování sítě; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 NPF;WinPcap Packet Driver (NPF); C:\WINDOWS\system32\d [2008-09-11 1592]
S3 NSCIRDA;NSC Infrared Device Driver; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\NSNDIS5.SYS []
S3 RTCore32;RTCore32; C:\WINDOWS\system32\d [2008-09-11 1592]
S3 Ser2pl;Prolific2 Serial port driver; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 sermouse;Ovladač sériové myši; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 SNPSTD3;StarCam Clip; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); C:\WINDOWS\system32\D [2008-09-11 1592]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\d [2008-09-11 1592]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 VMnetAdapter;VMware Virtual Ethernet Adapter Driver; C:\WINDOWS\system32\D [2008-09-11 1592]
S3 vmusb;VMware USB Client Driver; C:\WINDOWS\System32\D [2008-09-11 1592]
S3 WinDriver6;WinDriver6; C:\WINDOWS\system32\d [2008-09-11 1592]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\D [2008-09-11 1592]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\D [2008-09-11 1592]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AcrSch2Svc;Acronis Scheduler2 Service; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [2007-02-09 407072]
R2 Irmon;Sledování infračerveného přenosu; C:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-10-30 152984]
R2 NOD32krn;NOD32 Kernel Service; C:\Program Files\Eset\nod32krn.exe [2006-09-26 495616]
R2 odClientService;Odyssey Client; C:\Program Files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\odClientService.exe [2003-12-16 131072]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-10 38912]
R2 VMAuthdService;VMware Authorization Service; C:\Program Files\VMware\VMware Workstation\vmware-authd.exe [2006-08-04 217088]
R2 VMnetDHCP;VMware DHCP Service; C:\WINDOWS\system32\vmnetdhcp.exe [2006-08-04 106496]
R2 vmount2;VMware Virtual Mount Manager Extended; C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe [2006-08-04 262144]
R2 VMware NAT Service;VMware NAT Service; C:\WINDOWS\system32\vmnat.exe [2006-08-04 135168]
S2 gupdate1c90bc12c0fd2c0;Google Update Service (gupdate1c90bc12c0fd2c0); C:\Program Files\Google\Update\GoogleUpdate.exe [2008-08-31 133104]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2006-09-30 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 Macromedia Licensing Service;Macromedia Licensing Service; C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe [2008-04-22 68096]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2007-06-29 92792]
S3 TSM;TSM; C:\DOCUME~1\Petr\LOCALS~1\Temp\TSM.exe []

-----------------EOF-----------------

[motji]

Dobrý večer

:arrow:combofix stahněte takto:
-pravým myšítkem klikněte na odkaz combofixu --uložit jako.. ,a teď to přejmenujte na Potvora.com a uložte.

Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-souhlaste s instalací konzole pro zotavení

- ComboFix je třeba spustit pod účtem s právy administrátora

- Před použitím vypněte všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary

- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího se okna

- Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, skopírujte celý jeho obsah sem

[hrasek]

Promiňte ale nějak nechápu smysl toho "a teď to přejmenujte na Potvora.com..."
Stáhnul jsem si na plochu combofix. Mám jej tedy spustit a dát sem log?

[motji]

Když už ho máte na ploše, spustte ho

[hrasek]

Teda ten combofix je docela drsné řešení. Smazal mi třeba komplet adresář C:/Utility kde jsem programy jao putty, winscp apod., které 100% nejsou škodlivé. Navíc se mi teď i odisntalovala zabudovaná čtečka paměťovek, modem a v podstatě všechny části notebooku. Ve správci zařízení je u půlky zařízení vykřičník. Počítač po restartu (který udělal sám combofix) bylo nutné spustit přes "poslední známá funkční konfigurace"... Je takový průběh normální?

Log byl příliš velký, tak jsem ho musel zkráti (bylo tam pár 1000 řádků týkajících se pořád jednoho adresáře - v logu je o tom poznáka)



ComboFix 09-12-22.09 - Petr 23.12.2009 21:56:24.2.1 - FAT32x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1014.602 [GMT 1:00]
Spuštěný z: c:\documents and settings\Petr\Plocha\ComboFix.exe
AV: Eset NOD32 Antivirus 2.50 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\INSTALL.LOG
c:\program files\Utility
c:\program files\Utility\Extra_POI_Editor\Extra_POI_Editor.exe
c:\program files\Utility\Extra_POI_Editor\Extra_POI_Editor_Help.chm
c:\program files\Utility\Extra_POI_Editor\Help_ Read_Me_First.txt
c:\program files\Utility\Extra_POI_Editor\Help_Read_Me_First.txt
c:\program files\Utility\Extra_POI_Editor\License - EULA.txt
c:\program files\Utility\Extra_POI_Editor\readme.txt
c:\program files\Utility\Garmin_MS_FIX\!Cti.txt
c:\program files\Utility\Garmin_MS_FIX\!For_translators.txt
c:\program files\Utility\Garmin_MS_FIX\!ReadMe.txt
c:\program files\Utility\Garmin_MS_FIX\LOG_MapSourceFix.txt
c:\program files\Utility\Garmin_MS_FIX\MapSourceFix.exe
c:\program files\Utility\Hijackthis\backups\backup-20081029-101920-235
c:\program files\Utility\Hijackthis\backups\backup-20081029-101920-612
c:\program files\Utility\Hijackthis\backups\backup-20081029-101920-840
c:\program files\Utility\Hijackthis\HijackThis Logfileauswertung.URL
c:\program files\Utility\Hijackthis\Hijackthis.cz.URL
c:\program files\Utility\Hijackthis\HijackThis.exe
c:\program files\Utility\Hijackthis\hijackthis.log
c:\program files\Utility\Hijackthis\Petr.exe
c:\program files\Utility\HLCheck.exe
c:\program files\Utility\HLCheck.ini
c:\program files\Utility\ipscan2.exe
c:\program files\Utility\Jdownloader\.junique\115654c07.lock

.... tady byl snad 1000 řádkový výpis toho co bylo vše z adresáře
c:\program files\Utility\Jdownloader\ smazáno

c:\program files\Utility\konvertor.exe
c:\program files\Utility\putty.exe
c:\program files\Utility\SpaceMonger.exe
c:\program files\Utility\virtualni_disketa\vfd21-050404\copying.txt
c:\program files\Utility\virtualni_disketa\vfd21-050404\readme.txt
c:\program files\Utility\virtualni_disketa\vfd21-050404\readmej.txt
c:\program files\Utility\virtualni_disketa\vfd21-050404\vfd.dll
c:\program files\Utility\virtualni_disketa\vfd21-050404\vfd.exe
c:\program files\Utility\virtualni_disketa\vfd21-050404\vfd.sys
c:\program files\Utility\virtualni_disketa\vfd21-050404\vfdhelp.txt
c:\program files\Utility\virtualni_disketa\vfd21-050404\vfdhelpj.txt
c:\program files\Utility\virtualni_disketa\vfd21-050404\vfdwin.exe
c:\program files\Utility\winscp370.exe
c:\windows\system32\d
c:\windows\system32\ieuinit.inf

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ElbyCDIO
-------\Legacy_gkiigjyt
-------\Legacy_Hardlock
-------\Legacy_irda
-------\Legacy_NPF
-------\Legacy_OdysseyNetProv
-------\Legacy_PCLEPCI
-------\Legacy_PQNTDrv
-------\Legacy_PWSYSDRV
-------\Legacy_RTCore32
-------\Legacy_sptd
-------\Legacy_tifsfilter
-------\Service_adusbmdm6501
-------\Service_adusbser6501
-------\Service_ASAPIW2k
-------\Service_Avc
-------\Service_bcm4sbxp
-------\Service_cs429x
-------\Service_ElbyCDFL
-------\Service_ElbyCDIO
-------\Service_FTDIBUS
-------\Service_FTSER2K
-------\Service_gkiigjyt
-------\Service_grmnusb
-------\Service_Hardlock
-------\Service_Hotkey
-------\Service_irda
-------\Service_k750bus
-------\Service_mailKmd
-------\Service_MarvinBus
-------\Service_MSDV
-------\Service_MSIRCOMM
-------\Service_NdisIP
-------\Service_NPF
-------\Service_NSCIRDA
-------\Service_odysseyIM3
-------\Service_OdysseyNetProv
-------\Service_PCLEPCI
-------\Service_PQNTDrv
-------\Service_PWSYSDRV
-------\Service_Rasirda
-------\Service_Rdpgcea
-------\Service_RTCore32
-------\Service_sbp2port
-------\Service_Ser2pl
-------\Service_sermouse
-------\Service_SLIP
-------\Service_snapman
-------\Service_SNPSTD3
-------\Service_sptd
-------\Service_SynTP
-------\Service_tifsfilter
-------\Service_timounter
-------\Service_w29n51
-------\Service_WBMS
-------\Service_WBSD
-------\Service_Wbutton
-------\Service_WinDriver6
-------\Service_WpdUsb


((((((((((((((((((((((((( Soubory vytvořené od 2009-11-23 do 2009-12-23 )))))))))))))))))))))))))))))))
.

2009-12-23 20:08 . 2009-12-23 20:08 -------- d-----w- C:\rsit
2009-12-17 10:00 . 2009-12-17 10:00 -------- d-----w- c:\documents and settings\Petr\geokuk

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-19 14:27 . 2001-10-25 13:00 70324 ----a-w- c:\windows\system32\perfc005.dat
2009-12-19 14:27 . 2001-10-25 13:00 392860 ----a-w- c:\windows\system32\perfh005.dat
2009-12-18 08:39 . 2009-06-24 20:19 730 ----a-w- c:\windows\NView09.dat
2009-10-31 16:45 . 2008-11-07 12:00 2944 ----a-w- c:\windows\system32\WSSPOOL.TMP
2009-10-29 05:48 . 2004-08-17 12:49 663040 ----a-w- c:\windows\system32\wininet.dll
2009-10-21 06:03 . 2004-08-17 12:49 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 06:03 . 2004-08-17 12:49 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 14:58 . 2004-08-03 20:00 263552 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:53 . 2004-08-17 12:49 267776 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:54 . 2004-08-17 12:49 112640 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:54 . 2004-08-17 12:49 69632 ----a-w- c:\windows\system32\raschap.dll
2009-10-08 15:12 . 2009-09-28 10:31 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-09-28 10:32 . 2009-09-28 10:31 249856 ------w- c:\windows\Setup1.exe
2009-09-25 06:58 . 2004-08-17 12:49 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-09-17 14:26 . 2009-09-17 14:26 459 ----a-w- c:\program files\Uninstall Mp3 Codec.lnk
1999-06-26 09:44 . 2009-09-17 14:26 6649 ----a-w- c:\program files\rdmp3faq.txt
1999-06-26 09:32 . 2009-09-17 14:26 6193 ----a-w- c:\program files\radium.nfo
1999-06-23 23:47 . 2009-09-17 14:26 19968 ----a-w- c:\program files\RaMp3Cfg.exe
1998-09-05 12:36 . 2009-09-17 14:26 14728 ----a-w- c:\program files\performance-graph.GIF
2006-12-07 15:04 . 2006-12-07 15:04 18 --sh--w- c:\windows\WINPROD.DLL
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 16:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 16:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 16:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 16:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 16:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 16:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 16:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 16:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2008-01-16 16:52 80384 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ServUTrayIcon"="c:\program files\Serv-U\ServUTray.exe" [2002-02-03 68608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-04-24 110592]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-04-24 610304]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2006-09-25 917504]
"AGRSMMSG"="AGRSMMSG.exe" [2003-02-14 88107]
"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2002-12-02 32768]
"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2003-01-09 57418]
"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2002-10-23 163840]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2003-01-09 53248]
"OdTray.exe"="c:\program files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\OdTray.exe" [2003-12-16 626746]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-26 98304]
"CloneCDTray"="c:\program files\CloneCD\CloneCDTray.exe" [2004-12-27 57344]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-10 406016]
"snpstd3"="c:\windows\vsnpstd3.exe" [2005-09-05 339968]
"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2007-02-09 1165680]
"AcronisTimounterMonitor"="c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2007-02-09 1945960]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2007-02-09 149024]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-07-19 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-07-19 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-07-19 114688]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-10-30 136600]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 483328]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2008-11-7 25214]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\WINDOWS\\System32\\java.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Trillian\\trillian.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"c:\\Program Files\\Serv-U\\ServUDaemon.exe"=
"c:\\Program Files\\xwinlogon\\XWin.exe"=
"c:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Reallusion\\CrazyTalk for Skype\\CT4Skype.exe"=
"c:\\Program Files\\FreeCall.com\\FreeCall\\FreeCall.exe"=
"c:\\WINDOWS\\System32\\dplaysvr.exe"=
"c:\\Program Files\\ASUS\\Wireless Router Utilities\\DiscoveryR.exe"=
"c:\\Program Files\\KN_StrongDC\\StrongDC.exe"=
"c:\\Program Files\\Java\\JRE6\\launch4j-tmp\\JDownloader.exe"=
"c:\\Program Files\\MoZiGo\\MoZiGo.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\DreamCom\\DreamCom.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

S2 gupdate1c90bc12c0fd2c0;Google Update Service (gupdate1c90bc12c0fd2c0);c:\program files\Google\Update\GoogleUpdate.exe [1.9.2008 01:27 133104]
S3 ASINDIS5;ASINDIS5 Protocol Driver;c:\windows\system32\asindis5.sys [17.3.2008 14:16 16302]
S3 TSM;TSM;c:\docume~1\Petr\LOCALS~1\Temp\TSM.exe --> c:\docume~1\Petr\LOCALS~1\Temp\TSM.exe [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.9.2006 01:48 642560]
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\program files\pctranslator\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\program files\pctranslator\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\program files\pctranslator\WEBIE.DLL
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\program files\pctranslator\WEBIE.DLL
LSP: c:\program files\NetLimiter\nl_lsp.dll
DPF: {361E6B79-4A69-4376-B0F2-3D1EBEE9D7E2} - hxxp://gen.din.cz/RtspVaPgDec.cab
DPF: {575A6BF1-1460-4907-9157-BECB7DCAC655} - hxxp://nadatel.truecam.net/rel/webViewer.cab
DPF: {73FDD716-9BCE-42F7-8B13-DB4F7587B8D1} - hxxp://ns.standalone4ch.com/webview2/webview.cab
DPF: {8FEED82A-42A6-4117-A803-7EC3EB9339E0} - hxxp://192.168.0.99/plugin/client.cab
FF - ProfilePath - c:\documents and settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\djdntahk.default\
FF - prefs.js: browser.search.selectedEngine - Geocaching - Quicksearch
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - component: c:\documents and settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\djdntahk.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - component: c:\documents and settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\djdntahk.default\extensions\{DD43485F-44CC-4452-A6C6-69356A7E33DA}\platform\WINNT_x86-msvc\components\ahWinUtils_32.dll
FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff35\gears.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-HijackThis - c:\program files\Utility\Hijackthis\HijackThis.exe
AddRemove-Network Play System - c:\program files\Electronic Arts\Network Play System\uninst.isu



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-23 22:11
Windows 5.1.2600 Service Pack 2 FAT NTAPI

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\gkiigjyt]

.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1072)
c:\program files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\odLogin.dll

- - - - - - - > 'lsass.exe'(1136)
c:\windows\system32\relog_ap.dll
c:\program files\NetLimiter\nl_lsp.dll
c:\windows\system32\nl_msgc.dll

- - - - - - - > 'explorer.exe'(772)
c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
c:\program files\TortoiseSVN\bin\TortoiseStub.dll
c:\program files\TortoiseSVN\bin\TortoiseSVN.dll
c:\program files\TortoiseSVN\bin\intl3_tsvn.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\Audiodev.dll
c:\windows\system32\WMVCore.DLL
c:\windows\system32\WMASF.DLL
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\odClientService.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Eset\nod32krn.exe
c:\windows\system32\wdfmgr.exe
c:\program files\VMware\VMware Workstation\vmware-authd.exe
c:\program files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
c:\windows\system32\vmnat.exe
c:\windows\system32\vmnetdhcp.exe
c:\windows\AGRSMMSG.exe
c:\program files\Adobe\Acrobat 7.0\Acrobat\Acrobat_sl.exe
c:\program files\CoolMon\CoolMon.exe
c:\program files\TortoiseSVN\bin\TSVNCache.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\taskmgr.exe
.
**************************************************************************
.
Celkový čas: 2009-12-23 22:16:53 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-12-23 21:16

Před spuštěním: 6 870 827 008
Po spuštění: 7 186 366 464

- - End Of File - - C464BAC6CDA09ACCFCED3A4C8CE350BC

[hrasek]

Jinak teda onen zmíněný "gkiigjyt.sys" tam pořád je ale počítač již běží normálně. Takže hádám teď jen smažeme ten "gkiigjyt.sys" a ze sožky po spuštění ten "siszyd32.exe". Raději ale počkám až co mi poradíte.

[motji]

Normální to není, nevím proč to combofix smazal. Ale na Disku c je složka qoboox, v ní jsou ty soubory - pokud nějaký chcete, můžete ho vytáhnout - přejmenovat - smazat koncovku vir.
Poprosím Vás, zkuste některý z těch programů, o kterých si myslíte že jsou v pořádku, otestovat na www.virustotal.com
Dejte soubor otestovat na http://www.virustotal.com
Do okénka zkopírujte cestu k souboru , pokud napíše, že soubor byl už testován, dejte otestovat znovu.
Sem vložte link s výsledky.

Na výsledky počkám.
Pokud to chcete zpět, můžete udělat obnovu systému, ale polovinu driverů co combofix smazal byla od viru

[hrasek]

Udělám co říkáte (s tím otestování).
Co se obnovy týče, tak na to kašlu. Raději si ty programy (putty, winscp, apod) stáhnu znova. Je možné, že byly nějakým způsobem nakaženy. Faktem je žš složku C:/programfiles/utility mi i spybot ojakživa (asi 4 roky) hlásí jako napadenou malwarem ale nic podezřelého v ní opravdu nebylo. Co mě trochu zaráží jsou ty odinstalované ovladače od všeho. Má trochu strach teď restartovat PC zda by pak vůbec naběhlo.

[motji]

Máte když tak instalační cd?
Ale pokud ted pc naběhlo, mělo by to být ok, jen si je doinstalujte.
Zatím se mi tohle u combofixu ještě nestalo, jedině že by ty ovladače byly také napadeny . Sice občas něco smaže co nemá, ale ne takto hromadně
Zkuste nějaký ovladač z karantény combofixu otestovat, osobně by mě to také zajímalo, nebo ty chybějící hned doinstalujte, zbytek smažeme přes něco jiného

[hrasek]

Tak vše co jsme na virustotal nechat otestovat prošlo. Opravdu to byly normální utilitky typu putty apod. které jsou 100% čisté. Já si to vysvětluju tak že přímo v adrsáři C/program files/utility byl nějaký vir či co a combofix prostě smázl vše z toho adresáře. To už si nějak dám do pořádku. Teď bych se jen chtěl zeptat, co bude potřeba smazat.

Osobně se mi nelíbí že ve složce po spuštění je pořád ten "siszyd32.exe" a ve složce windows/drivers je "gkiigjyt.sys" který má čas vytvoření neustále aktuální (pořád se mění na současnou hodnotu času).

[hrasek]

Jinak nemám problém si ty ovladače a vše potřebné doinstalovat. Teď bych chtěl spíš nějak dokončit to odvirování a promazání bordelu. Mám sem hodit log ještě z něčeho?

[motji]

Můžete prosím z karantény combofixu otestovat tento pravděpodobně soubor?
C:\WINDOWS\system32\D

V logu Rsitu jde vidět, že na něj byla vázána více jak polovina driverů, proto je combofix smazal, určitě se jednalo o šmejda.

Jdu napsat skript na smazání toho zbytku, ted je na Vás, zda doinstalujete ty chybějící ovladače hned, nebo to risknete, po skriptu se pc restartuje
Ty programy co jsou ok si můžete přestěhovat z karantény combofixu, jen jim umažte příponu vir

[hrasek]

Radši ty drivery nahodím teď. Je ale divné, že byly smazány naprosto všechny drivery a PC teď normálně jede. Až na to že ve správci zařízení je u každé druhé položky křížek.

[motji]

Stáhněte Avenger
http://swandog46.geekstogo.com/avenger.exe

-spustíte program a potvrdíte kliknutím na ok,tím potvrzujete, že všechny činnosti s tím spojené činíte na vlastní riziko.
-Po odkliknutí se objeví hlavní okno programu,do bílého okna něj zkopírujte tento skript:

Kód: Vybrat vše

drivers to delete:
gkiigjyt
TSM

Files to delete:
c:\docume~1\Petr\LOCALS~1\Temp\TSM.exe
C:\WINDOWS\System32\drivers\gkiigjyt.sys
C:\Documents and Settings\Petr\Nabídka Start\Programy\Po spuštění\siszyd32.exe
C:\WINDOWS\TEMP\~TM85F9.tmp

-zaškrtněte políčko scan for rootkits

a klikněte na tlačítko Execute.
-Potom se objeví okno,kde kliknutím Yes potvrdíte spuštění skriptu. Pak znovu tlačítkem yes potvrdíte restart počítače.
-Po restartu by se měl otevřít poznámkový blok s logem o vykonání skriptu, bude také uložený v C:\avenger.txt.
-Log vložte sem


tuhle složku znáte?
c:\documents and settings\Petr\geokuk

Já tu budu asi do půlnoci, tak snad to dáme nějak do pořádku

[hrasek]

Geokuk je v pořádku (resp jsme si ji tam dal sám a neměl by to být vir) - to je javovská aplikace na geocaching. Více o tom programu viz www.geocaching.cz

Log je zde:

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "gkiigjyt" deleted successfully.
Driver "TSM" deleted successfully.

Error: file "c:\docume~1\Petr\LOCALS~1\Temp\TSM.exe" not found!
Deletion of file "c:\docume~1\Petr\LOCALS~1\Temp\TSM.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

File "C:\WINDOWS\System32\drivers\gkiigjyt.sys" deleted successfully.
File "C:\Documents and Settings\Petr\Nabídka Start\Programy\Po spuštění\siszyd32.exe" deleted successfully.

Error: file "C:\WINDOWS\TEMP\~TM85F9.tmp" not found!
Deletion of file "C:\WINDOWS\TEMP\~TM85F9.tmp" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.