Zavírený PC!!!

Zpráva

iwqa007 · #1 Příspěvek od **iwqa007** » 10 led 2010 13:18

Všimla som si, že PC sa spomalilo a pc mi bráni prístup do niektorých dokumentov a zložiek, čo predtým nerobilo

LOG z RSIT:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Sivý at 2010-01-10 13:17:00
Systém Microsoft Windows XP Professional Service Pack 3, v.3180
System drive C: has 15 GB (38%) free of 40 GB
Total RAM: 767 MB (39% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:17:45, on 10.1.2010
Platform: Windows XP SP3, v.3180 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\SpyBlocker Software\spyblocker.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Sivý\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Sivý.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.cas.sk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cas.sk
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66020
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66020
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) -  - (no file)
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EmailBHO - {647FD14A-C4F1-46F4-8FC3-0B40F54226F7} - C:\Program Files\jZip\WebmailPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [SpyBlocker] C:\Program Files\SpyBlocker Software\spyblocker.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [ukl] C:\Documents and Settings\All Users\Application Data\uklpr\wmpusrvc.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastaviť prekladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Preložiť &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Preložiť &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - (no file)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--
End of file - 9411 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job
C:\WINDOWS\tasks\Úklid 1 kliknutím.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll [2008-10-26 503808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{647FD14A-C4F1-46F4-8FC3-0B40F54226F7}]
jZip Webmail plugin - C:\Program Files\jZip\WebmailPlugin.dll [2008-07-02 591296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-10-29 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-10-29 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-10-29 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\Documents and Settings\All Users\Application Data\LangSoft\WebIE.dll [2008-10-26 503808]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SpyBlocker"=C:\Program Files\SpyBlocker Software\spyblocker.exe [2009-03-26 565248]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2010-01-07 429392]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-16 13529088]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"ukl"=C:\Documents and Settings\All Users\Application Data\uklpr\wmpusrvc.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2007-07-19 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\WINDOWS\system32\NvCpl.dll [2008-05-16 13529088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2009-05-26 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RelevantKnowledge]
C:\program files\relevantknowledge\rlvknlg.exe [2009-09-18 1760896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-05-30 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2007-05-30 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Electronic Arts\EADM\Core.exe"="C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Ares\Ares.exe"="C:\Program Files\Ares\Ares.exe:*:Enabled:Ares p2p for windows"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\SpyBlocker Software\spyblocker.exe"="C:\Program Files\SpyBlocker Software\spyblocker.exe:*:Enabled:SpyBlocker"
"C:\Program Files\Psi\psi.exe"="C:\Program Files\Psi\psi.exe:*:Enabled:psi"
"c:\program files\relevantknowledge\rlvknlg.exe"="c:\program files\relevantknowledge\rlvknlg.exe:*:Enabled:rlvknlg.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ea477691-c6cb-11de-bf8b-00115b658220}]
shell\AutoRun\command - H:\Launcher.exe


======List of files/folders created in the last 1 months======

2010-01-10 13:08:00 ----D---- C:\rsit
2010-01-10 12:56:24 ----HDC---- C:\WINDOWS\ie8
2010-01-10 12:56:24 ----D---- C:\WINDOWS\system32\sk-SK
2010-01-10 12:54:27 ----A---- C:\WINDOWS\system32\msdbg2.dll
2010-01-10 12:54:24 ----N---- C:\WINDOWS\system32\msrating.dll.mui
2010-01-10 12:54:23 ----N---- C:\WINDOWS\system32\mshta.exe.mui
2010-01-10 12:54:14 ----N---- C:\WINDOWS\system32\iedkcs32.dll.mui
2010-01-10 12:54:13 ----N---- C:\WINDOWS\system32\ie4uinit.exe.mui
2010-01-08 23:36:21 ----D---- C:\Program Files\Xilisoft
2010-01-08 23:35:50 ----A---- C:\WINDOWS\cadkasdeinst01e.exe
2010-01-08 23:27:17 ----D---- C:\Program Files\RelevantKnowledge
2010-01-08 23:02:41 ----A---- C:\WINDOWS\system32\wddsditdsdfpsini.dll
2010-01-08 20:25:37 ----D---- C:\Program Files\Trend Micro
2010-01-08 20:25:19 ----D---- C:\Program Files\Hijack this
2010-01-08 20:16:32 ----D---- C:\Documents and Settings\Sivý\Application Data\AnvSoft
2010-01-08 15:01:27 ----D---- C:\Program Files\OJOsoft
2010-01-08 12:17:45 ----D---- C:\Program Files\ImTOO
2010-01-08 11:54:37 ----D---- C:\Program Files\MMRR Software
2010-01-08 11:49:24 ----D---- C:\Program Files\Free Video Cutter
2010-01-08 11:37:16 ----D---- C:\Documents and Settings\Sivý\Application Data\ImTOO Software Studio
2010-01-07 15:31:26 ----D---- C:\Program Files\Psi
2010-01-07 15:31:14 ----D---- C:\Documents and Settings\All Users\Application Data\uklpr
2010-01-07 15:31:14 ----D---- C:\Documents and Settings\All Users\Application Data\ukl
2009-12-28 13:02:23 ----D---- C:\Program Files\Common Files\Common Share
2009-12-27 18:48:55 ----A---- C:\WINDOWS\system32\cygz.dll
2009-12-27 18:48:55 ----A---- C:\WINDOWS\system32\cygwin1.dll
2009-12-27 18:48:55 ----A---- C:\WINDOWS\cygz.dll
2009-12-27 18:48:55 ----A---- C:\WINDOWS\cygwin1.dll
2009-12-27 18:48:39 ----D---- C:\Temp
2009-12-23 09:11:28 ----A---- C:\WINDOWS\system32\ppsynthesis.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\xvidcore.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\TomsMoComp_ff.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\pthreadGC2.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\libmplayer.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\libmpeg2_ff.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\libavcodec.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\ff_x264.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\ff_wmv9.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\ff_vfw.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\ff_unrar.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\ff_tremor.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\ff_theora.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\ff_samplerate.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\ff_realaac.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\ff_libmad.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\ff_libfaad2.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\ff_libdts.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\ff_liba52.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\ff_kernelDeint.dll
2009-12-23 09:11:12 ----A---- C:\WINDOWS\system32\audxlib.dll
2009-12-19 10:33:33 ----D---- C:\Program Files\Cumik
2009-12-11 23:37:17 ----A---- C:\WINDOWS\iun6002.exe
2009-12-11 23:37:11 ----D---- C:\Program Files\Codec Pack - All In 1
2009-12-11 23:36:41 ----A---- C:\WINDOWS\Codec Pack - All In 1 Setup Log.txt
2009-12-11 11:16:29 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-12-11 09:27:33 ----D---- C:\Program Files\Cracklock
2009-12-11 09:27:31 ----D---- C:\Program Files\TrojanHunter 4.2
2009-12-11 09:27:31 ----D---- C:\Program Files\Net Tools(2)
2009-12-11 09:27:25 ----D---- C:\Program Files\XeroBank(3)
2009-12-11 09:27:25 ----D---- C:\Program Files\XeroBank
2009-12-11 09:27:24 ----D---- C:\WINDOWS\Cooking Academy 2

======List of files/folders modified in the last 1 months======

2010-01-10 13:17:37 ----D---- C:\WINDOWS\Temp
2010-01-10 13:02:55 ----D---- C:\WINDOWS
2010-01-10 13:02:53 ----AD---- C:\WINDOWS\system32
2010-01-10 13:02:18 ----D---- C:\WINDOWS\Media
2010-01-10 13:02:18 ----D---- C:\Program Files\Internet Explorer
2010-01-10 13:02:17 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-01-10 13:02:17 ----HD---- C:\WINDOWS\inf
2010-01-10 13:02:17 ----D---- C:\WINDOWS\Help
2010-01-10 13:01:30 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-01-10 13:00:57 ----HD---- C:\WINDOWS\msdownld.tmp
2010-01-10 13:00:44 ----RD---- C:\Program Files
2010-01-10 12:59:04 ----D---- C:\WINDOWS\system32\CatRoot2
2010-01-10 12:54:49 ----D---- C:\WINDOWS\Debug
2010-01-10 12:52:14 ----RASH---- C:\boot.ini
2010-01-10 12:52:14 ----A---- C:\WINDOWS\win.ini
2010-01-10 12:52:14 ----A---- C:\WINDOWS\system.ini
2010-01-09 09:44:15 ----D---- C:\Documents and Settings\Sivý\Application Data\vlc
2010-01-09 08:55:23 ----D---- C:\Documents and Settings\Sivý\Application Data\dvdcss
2010-01-08 23:26:05 ----D---- C:\Program Files\Common Files
2010-01-08 21:56:04 ----D---- C:\WINDOWS\system32\drivers
2010-01-08 20:29:57 ----DC---- C:\Program Files\ESET
2010-01-08 12:50:34 ----A---- C:\WINDOWS\NeroDigital.ini
2010-01-08 11:51:19 ----D---- C:\WINDOWS\Prefetch
2010-01-07 18:39:35 ----D---- C:\Program Files\Mozilla Firefox
2010-01-07 15:32:28 ----D---- C:\WINDOWS\system32\config
2010-01-07 15:32:04 ----D---- C:\WINDOWS\system32\wbem
2010-01-07 15:32:03 ----D---- C:\WINDOWS\Registration
2010-01-07 15:31:26 ----D---- C:\Program Files\The KMPlayer
2009-12-29 15:02:56 ----D---- C:\Program Files\ICQ6.5
2009-12-28 16:47:13 ----D---- C:\Program Files\DAEMON Tools
2009-12-28 16:37:40 ----D---- C:\Program Files\%temp&
2009-12-28 14:20:49 ----A---- C:\WINDOWS\imsins.BAK
2009-12-28 11:38:37 ----D---- C:\Program Files\Common Files\DVDVideoSoft
2009-12-25 19:04:07 ----AD---- C:\Documents and Settings\All Users\Application Data\Temp
2009-12-25 19:03:42 ----D---- C:\Program Files\Spyware Doctor
2009-12-24 13:31:32 ----SHD---- C:\WINDOWS\Installer
2009-12-24 13:31:32 ----D---- C:\Config.Msi
2009-12-24 13:31:28 ----D---- C:\Program Files\Microsoft Silverlight
2009-12-24 13:14:06 ----D---- C:\Program Files\iWin.com
2009-12-24 13:01:44 ----D---- C:\Program Files\Perfect Uninstaller
2009-12-22 15:56:01 ----HD---- C:\Program Files\InstallShield Installation Information
2009-12-17 17:34:41 ----SD---- C:\Documents and Settings\Sivý\Application Data\Microsoft
2009-12-17 17:34:40 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-12-12 13:55:21 ----D---- C:\WINDOWS\system32\Restore

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK7;AMD K7 Processor Driver; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2007-07-18 37376]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-05-14 107256]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2009-05-14 94360]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2009/06/09 13:34:04]; \??\C:\Program Files\CyberLink\PowerDVD9\000.fcl []
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-05-14 114472]
R2 rspndr;Link-Layer Topology Discovery Responder; C:\WINDOWS\system32\DRIVERS\rspndr.sys [2007-07-18 62848]
R3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS [2004-02-24 400384]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-05-14 622172]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 MBAMProtector;MBAMProtector; \??\C:\WINDOWS\system32\drivers\mbam.sys []
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-16 6557408]
R3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\system32\DRIVERS\sisnic.sys [2007-07-18 32768]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2007-07-18 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2007-07-18 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2007-07-18 17152]
S3 ay6l2erk;ay6l2erk; C:\WINDOWS\system32\drivers\ay6l2erk.sys []
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2008-05-07 17536]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2008-05-07 20864]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632]
S3 PEEK5;PEEK5 Protocol Driver; \??\G:\Marika\KUZLO\BOX\PEEK5.SYS []
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2008-06-06 8064]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2007-07-18 15104]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2007-07-18 25728]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2008-05-07 8064]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2007-07-18 26368]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 WS2IFSL;Prostredie podpory poskytovateľa služby Windows Socket 2.0 Non-IFS Service; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-05-29 144712]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-05-14 731840]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-10-29 152984]
R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2010-01-07 236368]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2001-02-23 270336]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-16 159812]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service; C:\WINDOWS\System32\TUProgSt.exe [2009-10-08 603904]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2007-07-19 14336]
S2 UxTuneUp;TuneUp Theme Extension; C:\WINDOWS\System32\svchost.exe [2007-07-19 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 getPlusHelper;getPlus(R) Helper; C:\WINDOWS\System32\svchost.exe [2007-07-19 14336]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-05-30 541992]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-26 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2009-09-23 358600]
S3 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2009-09-23 1141200]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-08-07 575488]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service; C:\WINDOWS\System32\TuneUpDefragService.exe [2009-10-08 360192]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\wmpnetwk.exe [2006-10-18 913408]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

#2 Příspěvek od **Rudy** » 10 led 2010 13:48

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

iwqa007 · #3 Příspěvek od **iwqa007** » 10 led 2010 14:32

LOG COMBOFIX

Kód: Vybrat vše

ComboFix 10-01-04.01 - Sivý 10.01.2010  14:03:34.1.1 - x86
Systém Microsoft Windows XP Professional  5.1.2600.3.1250.421.1033.18.767.418 [GMT 1:00]
Running from: c:\documents and settings\Sivý\Desktop\ComboFix.exe
 * Resident AV is active

.
[i] ADS - system32: deleted 12 bytes in 1 streams. [/i]

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\ICQ6.5\ICQLRun.exe
c:\program files\RelevantKnowledge
c:\program files\RelevantKnowledge\rlls.dll
c:\program files\RelevantKnowledge\rloci.bin
c:\program files\RelevantKnowledge\rlservice.exe
c:\program files\RelevantKnowledge\rlvknlg.exe
c:\program files\WinPCap
c:\program files\WinPCap\INSTALL.LOG
c:\windows\regedit.com
c:\windows\system32\drivers\RKHit.sys
c:\windows\system32\taskmgr.com
c:\windows\system32\wddsditdsdfpsini.dll

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_RKHIT


(((((((((((((((((((((((((   Files Created from 2009-12-10 to 2010-01-10  )))))))))))))))))))))))))))))))
.

2010-01-10 12:08 . 2010-01-10 12:08	--------	d-----w-	C:\rsit
2010-01-10 11:56 . 2010-01-10 12:00	--------	dc-h--w-	c:\windows\ie8
2010-01-10 11:56 . 2010-01-10 11:59	--------	d-----w-	c:\windows\system32\sk-SK
2010-01-10 11:54 . 2009-01-07 17:20	265720	----a-w-	c:\windows\system32\msdbg2.dll
2010-01-10 11:54 . 2009-03-08 03:33	420352	-c----w-	c:\windows\system32\dllcache\vbscript.dll
2010-01-10 11:54 . 2009-01-07 17:20	134144	-c----w-	c:\windows\system32\dllcache\sqmapi.dll
2010-01-10 11:54 . 2009-03-08 03:33	726528	-c----w-	c:\windows\system32\dllcache\jscript.dll
2010-01-10 11:54 . 2009-03-08 03:33	18944	-c----w-	c:\windows\system32\dllcache\corpol.dll
2010-01-08 22:36 . 2010-01-08 22:36	--------	d-----w-	c:\program files\Xilisoft
2010-01-08 22:35 . 2010-01-08 22:35	74752	----a-w-	c:\windows\cadkasdeinst01e.exe
2010-01-08 19:25 . 2010-01-08 19:25	--------	d-----w-	c:\program files\Trend Micro
2010-01-08 19:25 . 2010-01-08 19:29	--------	d-----w-	c:\program files\Hijack this
2010-01-08 14:01 . 2010-01-08 19:21	--------	d-----w-	c:\program files\OJOsoft
2010-01-08 11:17 . 2010-01-08 22:12	--------	d-----w-	c:\program files\ImTOO
2010-01-08 10:54 . 2010-01-08 10:57	--------	d-----w-	c:\program files\MMRR Software
2010-01-08 10:49 . 2010-01-08 11:57	--------	d-----w-	c:\program files\Free Video Cutter
2010-01-07 14:32 . 2010-01-07 14:32	--------	d-----w-	c:\windows\system32\wbem\Repository
2010-01-07 14:31 . 2010-01-07 14:31	--------	d-----w-	c:\program files\Psi
2010-01-07 14:31 . 2010-01-07 14:31	--------	d-----w-	c:\documents and settings\All Users\Application Data\uklpr
2010-01-07 14:31 . 2010-01-07 14:31	--------	d-----w-	c:\documents and settings\All Users\Application Data\ukl
2009-12-28 12:02 . 2010-01-08 14:01	--------	d-----w-	c:\program files\Common Files\Common Share
2009-12-27 17:48 . 2009-12-27 17:56	--------	d-----w-	c:\temp\font
2009-12-27 17:48 . 2009-12-27 17:51	35328	----a-w-	c:\windows\system32\cygz.dll
2009-12-27 17:48 . 2009-12-27 17:51	35328	----a-w-	c:\windows\cygz.dll
2009-12-27 17:48 . 2009-12-27 17:51	1126281	----a-w-	c:\windows\system32\cygwin1.dll
2009-12-27 17:48 . 2009-12-27 17:51	1126281	----a-w-	c:\windows\cygwin1.dll
2009-12-27 17:48 . 2009-12-27 19:06	--------	d-----w-	C:\Temp
2009-12-19 09:33 . 2009-12-19 09:33	--------	d-----w-	c:\program files\Cumik
2009-12-11 22:37 . 2009-12-11 22:36	737280	----a-w-	c:\windows\iun6002.exe
2009-12-11 22:37 . 2009-12-11 22:37	--------	d-----w-	c:\program files\Codec Pack - All In 1

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-10 13:07 . 2009-08-23 18:14	--------	d-----w-	c:\program files\ICQ6.5
2010-01-09 07:53 . 2009-12-11 10:16	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-01-08 20:55 . 2010-01-02 20:42	5115824	----a-w-	c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-08 19:29 . 2009-07-03 15:53	--------	dc----w-	c:\program files\ESET
2010-01-07 15:07 . 2009-12-11 10:16	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-12-11 10:16	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-01-07 14:31 . 2008-12-29 10:22	--------	d-----w-	c:\program files\The KMPlayer
2009-12-28 15:47 . 2009-09-15 11:35	--------	d-----w-	c:\program files\DAEMON Tools
2009-12-28 15:37 . 2008-11-28 15:01	--------	d-----w-	c:\program files\%temp&
2009-12-28 10:38 . 2009-07-05 13:24	--------	d-----w-	c:\program files\Common Files\DVDVideoSoft
2009-12-25 18:04 . 2008-12-07 19:24	--------	d---a-w-	c:\documents and settings\All Users\Application Data\Temp
2009-12-25 18:03 . 2009-10-24 11:30	--------	d-----w-	c:\program files\Spyware Doctor
2009-12-24 12:31 . 2009-03-28 16:59	--------	d-----w-	c:\program files\Microsoft Silverlight
2009-12-24 12:14 . 2009-11-23 19:14	--------	d-----w-	c:\program files\iWin.com
2009-12-24 12:01 . 2009-02-24 18:25	--------	d-----w-	c:\program files\Perfect Uninstaller
2009-12-22 14:56 . 2008-10-14 06:59	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-12-20 14:43 . 2009-12-20 14:43	99972	----a-w-	c:\documents and settings\All Users\Application Data\uklpr\unukl.exe
2009-12-17 16:34 . 2009-09-15 12:04	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-11 08:27 . 2009-12-11 08:27	--------	d-----w-	c:\program files\Cracklock
2009-12-11 08:27 . 2009-12-11 08:27	--------	d-----w-	c:\program files\TrojanHunter 4.2
2009-12-11 08:27 . 2009-12-11 08:27	--------	d-----w-	c:\program files\Net Tools(2)
2009-12-11 08:27 . 2009-12-11 08:27	--------	d-----w-	c:\program files\XeroBank
2009-12-11 08:27 . 2009-12-11 08:27	--------	d-----w-	c:\program files\XeroBank(3)
2009-12-08 20:01 . 2009-12-08 20:01	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-07 12:43 . 2009-12-07 12:43	275648	----a-w-	c:\documents and settings\All Users\Application Data\uklpr\appface.dll
2009-11-27 18:34 . 2008-10-26 10:01	--------	d-----w-	c:\program files\TRANSLAT
2009-11-23 19:15 . 2009-11-23 19:15	--------	d-----w-	c:\documents and settings\All Users\Application Data\iWin Games
2009-11-22 18:28 . 2009-11-22 11:40	--------	d-----w-	c:\program files\JojosFashionShow2_at
2009-10-28 10:30 . 2009-10-28 10:15	796672	----a-w-	c:\windows\GPInstall.exe
2009-10-22 11:48 . 2009-10-22 11:46	6766681	----a-w-	c:\windows\REGBK01.ZIP
2009-10-19 15:50 . 2009-11-15 10:22	188170	----a-w-	c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1051.dat
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyBlocker"="c:\program files\SpyBlocker Software\spyblocker.exe" [2009-03-26 565248]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-01-07 429392]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2007-07-19 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-05-16 12:01	13529088	----a-w-	c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 15:18	413696	----a-w-	c:\program files\QuickTime\QTTask.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"OEXPRESS"=c:\documents and settings\All Users\Application Data\LangSoft\OETRN.EXE
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"ares"="c:\program files\Ares\Ares.exe" -h
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" -silent
"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe"
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"nwiz"=nwiz.exe /install
"SoundMan"=SOUNDMAN.EXE
"SiSUSBRG"=c:\windows\SiSUSBrg.exe
"WinampAgent"="c:\program files\Winamp\winampa.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" /OM
"BDRegion"=c:\program files\Cyberlink\Shared Files\brs.exe
"PDVD9LanguageShortcut"="c:\program files\CyberLink\PowerDVD9\Language\Language.exe"
"RemoteControl9"="c:\program files\CyberLink\PowerDVD9\PDVD9Serv.exe"
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"SpyBlocker"=c:\program files\SpyBlocker Software\spyblocker.exe
"THGuard"="c:\program files\TrojanHunter 4.2\THGuard.exe"
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\SpyBlocker Software\\spyblocker.exe"=
"c:\\Program Files\\Psi\\psi.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [24.10.2009 12:31 207280]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.10.2008 9:58 717296]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 14:47 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [14.5.2009 14:49 94360]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2009/06/09 13:34];c:\program files\CyberLink\PowerDVD9\000.fcl [28.2.2009 18:40 87536]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [14.5.2009 14:47 731840]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11.12.2009 11:16 236368]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11.12.2009 11:16 19160]
S3 PEEK5;PEEK5 Protocol Driver;\??\g:\marika\KUZLO\BOX\PEEK5.SYS --> g:\marika\KUZLO\BOX\PEEK5.SYS [?]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [24.10.2009 12:30 358600]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper	REG_MULTI_SZ   	getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-01-10 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 19:36]

2010-01-10 c:\windows\Tasks\Úklid 1 kliknutím.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 19:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.tipovani.cz/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Application Data\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Application Data\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Application Data\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Application Data\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Application Data\LangSoft\WebIE.dll
FF - ProfilePath - c:\documents and settings\Sivý\Application Data\Mozilla\Firefox\Profiles\p8m86hrn.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.mjjsource.eu/forum2
FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar&search=
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.notify.interval - 600000
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKLM-Explorer_Run-ukl - c:\documents and settings\All Users\Application Data\uklpr\wmpusrvc.exe
MSConfigStartUp-RelevantKnowledge - c:\program files\relevantknowledge\rlvknlg.exe
AddRemove-{d08d9f98-1c78-4704-87e6-368b0023d831} - c:\program files\relevantknowledge\rlvknlg.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-10 14:11
Windows 5.1.2600 Service Pack 3, v.3180 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ... 

scanning hidden files ...  

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys PCTCore.sys ACPI.sys hal.dll >>UNKNOWN [0x82FDD1F8]<< 
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7573f28
\Driver\ACPI -> ACPI.sys @ 0xf73aecb8
\Driver\atapi -> 0x82fdd1f8
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a049d
 ParseProcedure -> ntoskrnl.exe @ 0x8056ebf9
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a049d
 ParseProcedure -> ntoskrnl.exe @ 0x8056ebf9
NDIS: SiS 900 PCI Fast Ethernet Adapter -> SendCompleteHandler -> NDIS.sys @ 0xf7224b0a
 PacketIndicateHandler -> NDIS.sys @ 0xf722fa21
 SendHandler -> NDIS.sys @ 0xf7224949
Warning: possible MBR rootkit infection !
user & kernel MBR OK 

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{B154377D-700F-42cc-9474-23858FBDF4BD}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD9\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1004336348-484061587-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{142AFEAD-B9A9-F75F-D0D9-4FE646624D11}*]
"habdlihlfmfbkaif"=hex:6b,61,64,67,66,62,63,66,6a,68,67,61,70,6d,6c,65,63,66,
   69,67,6b,6c,00,01
"iahlfmpmbdkcmagjop"=hex:6b,61,64,67,62,63,67,6d,6d,68,6a,67,67,66,65,6b,70,6b,
   67,6e,6d,65,00,01

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{142AFEAD-B9A9-F75F-D0D9-4FE646624D11}\InProcServer32*]
"jaflnehhnaangmbcegad"=hex:6b,61,64,67,62,63,67,6d,6d,68,6a,67,67,66,65,6b,70,
   6b,67,6e,6d,65,00,01
"iafldineaeljepdeeo"=hex:6b,61,64,67,66,62,63,66,6a,68,67,61,70,6d,6c,65,63,66,
   69,67,6b,6c,00,01
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2240)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\wpdshserviceobj.dll
c:\program files\Nokia\Nokia PC Suite 7\phonebrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_slk.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\windows\System32\TUProgSt.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\WgaTray.exe
.
**************************************************************************
.
Completion time: 2010-01-10  14:17:28 - machine was rebooted
ComboFix-quarantined-files.txt  2010-01-10 13:17

Pre-Run: 16 391 573 504 bytes free
Post-Run: 14 adresárov, 16 303 845 376 voľných bajtov

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - D587BCE0B8614737A94153555D9ADC00

#4 Příspěvek od **Rudy** » 10 led 2010 16:14

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

Folder::
c:\program files\RelevantKnowledge

Regnull::
[HKEY_USERS\S-1-5-21-1004336348-484061587-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{142AFEAD-B9A9-F75F-D0D9-4FE646624D11}*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{142AFEAD-B9A9-F75F-D0D9-4FE646624D11}\InProcServer32*]

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Obrázek

iwqa007 · #5 Příspěvek od **iwqa007** » 10 led 2010 19:36

Kód: Vybrat vše

ComboFix 10-01-04.01 - Sivý 10.01.2010  19:24:46.2.1 - x86
Systém Microsoft Windows XP Professional  5.1.2600.3.1250.421.1033.18.767.510 [GMT 1:00]
Running from: c:\documents and settings\Sivý\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Sivý\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
 * Resident AV is active

.

(((((((((((((((((((((((((   Files Created from 2009-12-10 to 2010-01-10  )))))))))))))))))))))))))))))))
.

2010-01-10 12:08 . 2010-01-10 12:08	--------	d-----w-	C:\rsit
2010-01-10 11:56 . 2010-01-10 12:00	--------	dc-h--w-	c:\windows\ie8
2010-01-10 11:56 . 2010-01-10 11:59	--------	d-----w-	c:\windows\system32\sk-SK
2010-01-10 11:54 . 2009-01-07 17:20	265720	----a-w-	c:\windows\system32\msdbg2.dll
2010-01-10 11:54 . 2009-03-08 03:33	420352	-c----w-	c:\windows\system32\dllcache\vbscript.dll
2010-01-10 11:54 . 2009-01-07 17:20	134144	-c----w-	c:\windows\system32\dllcache\sqmapi.dll
2010-01-10 11:54 . 2009-03-08 03:33	726528	-c----w-	c:\windows\system32\dllcache\jscript.dll
2010-01-10 11:54 . 2009-03-08 03:33	18944	-c----w-	c:\windows\system32\dllcache\corpol.dll
2010-01-08 22:36 . 2010-01-08 22:36	--------	d-----w-	c:\program files\Xilisoft
2010-01-08 22:35 . 2010-01-08 22:35	74752	----a-w-	c:\windows\cadkasdeinst01e.exe
2010-01-08 19:25 . 2010-01-08 19:25	--------	d-----w-	c:\program files\Trend Micro
2010-01-08 19:25 . 2010-01-08 19:29	--------	d-----w-	c:\program files\Hijack this
2010-01-08 14:01 . 2010-01-08 19:21	--------	d-----w-	c:\program files\OJOsoft
2010-01-08 11:17 . 2010-01-08 22:12	--------	d-----w-	c:\program files\ImTOO
2010-01-08 10:54 . 2010-01-08 10:57	--------	d-----w-	c:\program files\MMRR Software
2010-01-08 10:49 . 2010-01-08 11:57	--------	d-----w-	c:\program files\Free Video Cutter
2010-01-07 14:32 . 2010-01-07 14:32	--------	d-----w-	c:\windows\system32\wbem\Repository
2010-01-07 14:31 . 2010-01-07 14:31	--------	d-----w-	c:\program files\Psi
2010-01-07 14:31 . 2010-01-07 14:31	--------	d-----w-	c:\documents and settings\All Users\Application Data\uklpr
2010-01-07 14:31 . 2010-01-07 14:31	--------	d-----w-	c:\documents and settings\All Users\Application Data\ukl
2010-01-02 20:42 . 2010-01-08 20:55	5115824	----a-w-	c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-12-28 12:02 . 2010-01-08 14:01	--------	d-----w-	c:\program files\Common Files\Common Share
2009-12-27 17:48 . 2009-12-27 17:56	--------	d-----w-	c:\temp\font
2009-12-27 17:48 . 2009-12-27 17:51	35328	----a-w-	c:\windows\system32\cygz.dll
2009-12-27 17:48 . 2009-12-27 17:51	35328	----a-w-	c:\windows\cygz.dll
2009-12-27 17:48 . 2009-12-27 17:51	1126281	----a-w-	c:\windows\system32\cygwin1.dll
2009-12-27 17:48 . 2009-12-27 17:51	1126281	----a-w-	c:\windows\cygwin1.dll
2009-12-27 17:48 . 2009-12-27 19:06	--------	d-----w-	C:\Temp
2009-12-20 14:43 . 2009-12-20 14:43	99972	----a-w-	c:\documents and settings\All Users\Application Data\uklpr\unukl.exe
2009-12-19 09:33 . 2009-12-19 09:33	--------	d-----w-	c:\program files\Cumik
2009-12-11 22:37 . 2009-12-11 22:36	737280	----a-w-	c:\windows\iun6002.exe
2009-12-11 22:37 . 2009-12-11 22:37	--------	d-----w-	c:\program files\Codec Pack - All In 1

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-10 13:07 . 2009-08-23 18:14	--------	d-----w-	c:\program files\ICQ6.5
2010-01-09 07:53 . 2009-12-11 10:16	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-01-08 19:29 . 2009-07-03 15:53	--------	dc----w-	c:\program files\ESET
2010-01-07 15:07 . 2009-12-11 10:16	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-12-11 10:16	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-01-07 14:31 . 2008-12-29 10:22	--------	d-----w-	c:\program files\The KMPlayer
2009-12-28 15:47 . 2009-09-15 11:35	--------	d-----w-	c:\program files\DAEMON Tools
2009-12-28 15:37 . 2008-11-28 15:01	--------	d-----w-	c:\program files\%temp&
2009-12-28 10:38 . 2009-07-05 13:24	--------	d-----w-	c:\program files\Common Files\DVDVideoSoft
2009-12-25 18:04 . 2008-12-07 19:24	--------	d---a-w-	c:\documents and settings\All Users\Application Data\Temp
2009-12-25 18:03 . 2009-10-24 11:30	--------	d-----w-	c:\program files\Spyware Doctor
2009-12-24 12:31 . 2009-03-28 16:59	--------	d-----w-	c:\program files\Microsoft Silverlight
2009-12-24 12:14 . 2009-11-23 19:14	--------	d-----w-	c:\program files\iWin.com
2009-12-24 12:01 . 2009-02-24 18:25	--------	d-----w-	c:\program files\Perfect Uninstaller
2009-12-22 14:56 . 2008-10-14 06:59	--------	d--h--w-	c:\program files\InstallShield Installation Information
2009-12-17 16:34 . 2009-09-15 12:04	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-11 08:27 . 2009-12-11 08:27	--------	d-----w-	c:\program files\Cracklock
2009-12-11 08:27 . 2009-12-11 08:27	--------	d-----w-	c:\program files\TrojanHunter 4.2
2009-12-11 08:27 . 2009-12-11 08:27	--------	d-----w-	c:\program files\Net Tools(2)
2009-12-11 08:27 . 2009-12-11 08:27	--------	d-----w-	c:\program files\XeroBank
2009-12-11 08:27 . 2009-12-11 08:27	--------	d-----w-	c:\program files\XeroBank(3)
2009-12-08 20:01 . 2009-12-08 20:01	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-07 12:43 . 2009-12-07 12:43	275648	----a-w-	c:\documents and settings\All Users\Application Data\uklpr\appface.dll
2009-11-27 18:34 . 2008-10-26 10:01	--------	d-----w-	c:\program files\TRANSLAT
2009-11-23 19:15 . 2009-11-23 19:15	--------	d-----w-	c:\documents and settings\All Users\Application Data\iWin Games
2009-11-22 18:28 . 2009-11-22 11:40	--------	d-----w-	c:\program files\JojosFashionShow2_at
2009-10-28 10:30 . 2009-10-28 10:15	796672	----a-w-	c:\windows\GPInstall.exe
2009-10-22 11:48 . 2009-10-22 11:46	6766681	----a-w-	c:\windows\REGBK01.ZIP
2009-10-19 15:50 . 2009-11-15 10:22	188170	----a-w-	c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1051.dat
.

(((((((((((((((((((((((((((((   SnapShot@2010-01-10_13.11.08   )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-10 18:23 . 2010-01-10 18:23	16384              c:\windows\Temp\Perflib_Perfdata_158.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyBlocker"="c:\program files\SpyBlocker Software\spyblocker.exe" [2009-03-26 565248]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-01-07 429392]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2007-07-19 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-05-16 12:01	13529088	----a-w-	c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 15:18	413696	----a-w-	c:\program files\QuickTime\QTTask.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"OEXPRESS"=c:\documents and settings\All Users\Application Data\LangSoft\OETRN.EXE
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"ares"="c:\program files\Ares\Ares.exe" -h
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" -silent
"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe"
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"nwiz"=nwiz.exe /install
"SoundMan"=SOUNDMAN.EXE
"SiSUSBRG"=c:\windows\SiSUSBrg.exe
"WinampAgent"="c:\program files\Winamp\winampa.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" /OM
"BDRegion"=c:\program files\Cyberlink\Shared Files\brs.exe
"PDVD9LanguageShortcut"="c:\program files\CyberLink\PowerDVD9\Language\Language.exe"
"RemoteControl9"="c:\program files\CyberLink\PowerDVD9\PDVD9Serv.exe"
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"SpyBlocker"=c:\program files\SpyBlocker Software\spyblocker.exe
"THGuard"="c:\program files\TrojanHunter 4.2\THGuard.exe"
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\SpyBlocker Software\\spyblocker.exe"=
"c:\\Program Files\\Psi\\psi.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [24.10.2009 12:31 207280]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 14:47 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [14.5.2009 14:49 94360]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2009/06/09 13:34];c:\program files\CyberLink\PowerDVD9\000.fcl [28.2.2009 18:40 87536]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [14.5.2009 14:47 731840]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11.12.2009 11:16 236368]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11.12.2009 11:16 19160]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.10.2008 9:58 717296]
S3 PEEK5;PEEK5 Protocol Driver;\??\g:\marika\KUZLO\BOX\PEEK5.SYS --> g:\marika\KUZLO\BOX\PEEK5.SYS [?]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [24.10.2009 12:30 358600]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper	REG_MULTI_SZ   	getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-01-10 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 19:36]

2010-01-10 c:\windows\Tasks\Úklid 1 kliknutím.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 19:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.tipovani.cz/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Application Data\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Application Data\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Application Data\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Application Data\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Application Data\LangSoft\WebIE.dll
FF - ProfilePath - c:\documents and settings\Sivý\Application Data\Mozilla\Firefox\Profiles\p8m86hrn.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.mjjsource.eu/forum2
FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar&search=
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.notify.interval - 600000
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-10 19:30
Windows 5.1.2600 Service Pack 3, v.3180 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ... 

scanning hidden files ...  

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{B154377D-700F-42cc-9474-23858FBDF4BD}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD9\000.fcl"
.
Completion time: 2010-01-10  19:33:42
ComboFix-quarantined-files.txt  2010-01-10 18:33
ComboFix2.txt  2010-01-10 13:17

Pre-Run: 16 314 191 872 bytes free
Post-Run: 14 adresárov, 16 245 940 224 voľných bajtov

- - End Of File - - BC4CF37AF4E1B6BD84733EA641E156DA

#6 Příspěvek od **Rudy** » 10 led 2010 19:39

Log již vypadá čistý.

iwqa007 · #7 Příspěvek od **iwqa007** » 10 led 2010 19:44

ĎAKUJEM,ale pc mi stále bráni do priečinku

#8 Příspěvek od **Rudy** » 10 led 2010 19:47

Zkuste obnovu systému k datu, kdy korektně fungoval.

iwqa007 · #9 Příspěvek od **iwqa007** » 10 led 2010 19:52

Vďaka, ale nevyskáču mi z toho malware

#10 Příspěvek od **Rudy** » 10 led 2010 20:05

PC jsme vyčistili. Případně dáte nový log z RSIT. Někdy se to může stát.

VIRY.CZ

Zavírený PC!!!

Zavírený PC!!!

Re: Zavírený PC!!!

Re: Zavírený PC!!!

Re: Zavírený PC!!!

Re: Zavírený PC!!!

Re: Zavírený PC!!!

Re: Zavírený PC!!!

Re: Zavírený PC!!!

Re: Zavírený PC!!!

Re: Zavírený PC!!!