Prosím o kontrolu logu z RSIT

[myrabel]

Zdravim,
prosim o pomoc s tim samým sráčem z FB co se tu řeší. PC sem projela s UnHackMe, Ashampoo, CCleaner ... není zpomalenej, funguje docela dobře, jen to "spolkne" jakejkoliv nově nainstalovanej antivir. První antivir, který to sežralo mam po veškerém mazání stále v pc, nejde s nim nic dělat. Vše v PC funguje, stránka FB je zablokovaná.
Předem děkuju za pomoc.

Log :


Logfile of random's system information tool 1.09 (written by random/random)
Run by datart at 2011-07-28 11:28:06
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 14 GB (46%) free of 31 GB
Total RAM: 1013 MB (47% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:28:10, on 28.7.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Ashampoo\Ashampoo Anti-Malware\AAMW_Service.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSound_XP.exe
C:\Documents and Settings\datart\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\datart\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\datart\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\Notepad.exe
C:\Documents and Settings\datart\Dokumenty\Downloads\RSIT (1).exe
C:\Program Files\trend micro\datart.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... tbid=60347
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.crawler.com/homepage.aspx?tbid=60347
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60347
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60347
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60347
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60347
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: &Crawler Toolbar Helper - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\18.1.0.37\IPSBHO.DLL
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\datart\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [UnHackMe Monitor] C:\Program Files\UnHackMe\hackmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: SRS Premium Sound.lnk = C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSound_XP.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ashampoo Anti-Malware Service (AAMWService) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo Anti-Malware\AAMW_Service.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Microsoft Antimalware Service (MsMpSvc) - Unknown owner - C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (file missing)
O23 - Service: Norton AntiVirus (NAV) - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe

--
End of file - 6000 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-843090595-3167829700-2627882714-1005Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-843090595-3167829700-2627882714-1005UA.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\datart\Data aplikací\Mozilla\Firefox\Profiles\hhq56c2o.default

prefs.js - "browser.startup.homepage" - "http://www.crawler.com/homepage.aspx?tbid=60347"
prefs.js - "extensions.enabledItems" - "anttoolbar@ant.com:2.4.2rc1, {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}:3.2.5.2, {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25, jqs@sun.com:1.0, {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26, {4B3803EA-5230-4DC3-A7FC-33638F3D3542}:1.4, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.18"

"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff
"{4B3803EA-5230-4DC3-A7FC-33638F3D3542}"=C:\Program Files\Crawler\Toolbar\firefox\
"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF
"{BBDA0591-3099-440a-AA10-41764D9DB4DB}"=C:\Documents and Settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\IPSFFPlgn\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

C:\Program Files\Mozilla Firefox\components\
browser.xpt
browserdirprovider.dll
brwsrcmp.dll
components.list
FeedConverter.js
FeedProcessor.js
FeedWriter.js
fuelApplication.js
GPSDGeolocationProvider.js
jsconsole-clhandler.js
NetworkGeolocationProvider.js
nsAddonRepository.js
nsBadCertHandler.js
nsBlocklistService.js
nsBrowserContentHandler.js
nsBrowserGlue.js
nsContentDispatchChooser.js
nsContentPrefService.js
nsDefaultCLH.js
nsDownloadManagerUI.js
nsExtensionManager.js
nsFormAutoComplete.js
nsHandlerService.js
nsHelperAppDlg.js
nsINIProcessor.js
nsIQTScriptablePlugin.xpt
nsLivemarkService.js
nsLoginInfo.js
nsLoginManager.js
nsLoginManagerPrompter.js
nsMicrosummaryService.js
nsPlacesAutoComplete.js
nsPlacesDBFlush.js
nsPlacesTransactionsService.js
nsPrivateBrowsingService.js
nsProxyAutoConfig.js
nsSafebrowsingApplication.js
nsSearchService.js
nsSearchSuggestions.js
nsSessionStartup.js
nsSessionStore.js
nsSetDefaultBrowser.js
nsSidebar.js
nsTaggingService.js
nsTryToClose.js
nsUpdateService.js
nsUpdateServiceStub.js
nsUpdateTimerManager.js
nsUrlClassifierLib.js
nsUrlClassifierListManager.js
nsURLFormatter.js
nsWebHandlerApp.js
pluginGlue.js
storage-Legacy.js
storage-mozStorage.js
txEXSLTRegExFunctions.js
WebContentConverter.js

C:\Program Files\Mozilla Firefox\plugins\
npdeployJava1.dll
npnul32.dll
nppdf32.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npqtplugin6.dll
npqtplugin7.dll
QuickTimePlugin.class

C:\Program Files\Mozilla Firefox\searchplugins\
crawlersrch.xml
google.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Documents and Settings\datart\Data aplikací\Mozilla\Firefox\Profiles\hhq56c2o.default\extensions\
anttoolbar@ant.com
{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}

C:\Documents and Settings\datart\Data aplikací\Mozilla\Firefox\Profiles\hhq56c2o.default\searchplugins\
conduit.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files\Norton AntiVirus\Engine\18.1.0.37\IPSBHO.DLL [2010-06-13 80248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - &Crawler Toolbar - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2011-07-14 1237240]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2010-07-16 141336]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2010-07-16 173592]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2010-07-16 141336]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2010-03-18 19520544]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2009-08-29 1557800]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2010-11-30 74752]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-05-26 413696]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-04-08 254696]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2011-05-27 40368]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-29 937920]
"tray_ico"= []
"tray_ico2"= []
"tray_ico3"= []
"tray_ico4"= []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Google Update"=C:\Documents and Settings\datart\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2011-02-16 136176]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2011-06-15 15141768]
"UnHackMe Monitor"=C:\Program Files\UnHackMe\hackmon.exe [2010-11-11 594200]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
SRS Premium Sound.lnk - C:\Program Files\SRS Labs\SRS Premium Sound\SRSPremiumSound_XP.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2010-07-16 205312]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\wxpdrivers]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0
"EnableSecureUIAPaths"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Winamp\winamp.exe"="C:\Program Files\Winamp\winamp.exe:*:Enabled:Winamp"
"C:\Program Files\Metin2\metin2.bin"="C:\Program Files\Metin2\metin2.bin:*:Enabled:metin2"
"C:\Program Files\Metin2\metin2client.bin"="C:\Program Files\Metin2\metin2client.bin:*:Enabled:metin2client"
"C:\Documents and Settings\datart\Dokumenty\Downloads\Flash-Player.exe"="C:\Documents and Settings\datart\Dokumenty\Downloads\Flash-Player.exe:*:Enabled:C:\Documents and Settings\datart\Dokumenty\Downloads\Flash-Player.exe"
"C:\WINDOWS\update.1\svchost.exe"="C:\WINDOWS\update.1\svchost.exe:*:Enabled:C:\WINDOWS\update.1\svchost.exe"
"C:\WINDOWS\services32.exe"="C:\WINDOWS\services32.exe:*:Enabled:C:\WINDOWS\services32.exe"
"C:\WINDOWS\update.tray-2-0\svchost.exe"="C:\WINDOWS\update.tray-2-0\svchost.exe:*:Enabled:C:\WINDOWS\update.tray-2-0\svchost.exe"
"C:\WINDOWS\update.2\svchost.exe"="C:\WINDOWS\update.2\svchost.exe:*:Enabled:C:\WINDOWS\update.2\svchost.exe"
"C:\WINDOWS\update.3\svchost.exe"="C:\WINDOWS\update.3\svchost.exe:*:Enabled:C:\WINDOWS\update.3\svchost.exe"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"mixer1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave2"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer2"=wdmaud.drv

======File associations======

.txt - open - Notepad.exe %1

======List of files/folders created in the last 1 month======

2011-07-28 11:24:34 ----D---- C:\Program Files\trend micro
2011-07-28 11:24:33 ----D---- C:\rsit
2011-07-28 11:09:04 ----D---- C:\Program Files\Symantec
2011-07-28 11:09:04 ----D---- C:\Program Files\Common Files\Symantec Shared
2011-07-28 11:09:04 ----A---- C:\WINDOWS\system32\S32EVNT1.DLL
2011-07-28 11:09:04 ----A---- C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2011-07-28 11:08:16 ----D---- C:\WINDOWS\system32\drivers\NAV
2011-07-28 11:08:12 ----D---- C:\Program Files\Norton AntiVirus
2011-07-28 11:07:30 ----D---- C:\Program Files\NortonInstaller
2011-07-26 19:25:26 ----D---- C:\Program Files\Ashampoo
2011-07-26 17:43:37 ----RSHD---- C:\desktop.ini
2011-07-26 17:43:37 ----RSHD---- C:\comment.htt
2011-07-26 17:43:37 ----RSHD---- C:\autorun.inf
2011-07-26 17:18:34 ----A---- C:\WINDOWS\system32\PARTIZAN.TXT
2011-07-26 17:14:49 ----A---- C:\WINDOWS\system32\drivers\regguard.sys
2011-07-26 17:10:20 ----A---- C:\WINDOWS\system32\Partizan.exe
2011-07-26 17:10:20 ----A---- C:\WINDOWS\system32\drivers\Partizan.sys
2011-07-26 17:09:51 ----RASHOT---- C:\WINDOWS\winstart.bat
2011-07-26 17:09:44 ----A---- C:\WINDOWS\system32\drivers\UnHackMeDrv.sys
2011-07-26 17:09:39 ----D---- C:\Program Files\UnHackMe
2011-07-26 15:48:18 ----A---- C:\WINDOWS\system32\muweb.dll
2011-07-26 15:48:18 ----A---- C:\WINDOWS\system32\mucltui.dll
2011-07-26 15:46:55 ----ASH---- C:\hiberfil.sys
2011-07-26 15:45:47 ----HD---- C:\WINDOWS\update.tray-7-0-lnk
2011-07-26 15:45:47 ----HD---- C:\WINDOWS\update.tray-7-0
2011-07-26 15:43:55 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2011-07-26 15:43:55 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2011-07-26 15:43:52 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2011-07-26 15:43:52 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2011-07-26 15:43:51 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2011-07-26 15:43:50 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2011-07-26 15:43:50 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2011-07-26 15:43:50 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2011-07-26 15:43:25 ----A---- C:\WINDOWS\system32\aswBoot.exe
2011-07-26 15:43:25 ----A---- C:\WINDOWS\avastSS.scr
2011-07-26 15:43:11 ----D---- C:\Program Files\AVAST Software
2011-07-26 13:21:12 ----D---- C:\Documents and Settings\datart\Data aplikací\Simply Super Software
2011-07-26 13:20:20 ----D---- C:\Documents and Settings\datart\Data aplikací\TrojanHunter
2011-07-26 12:53:57 ----R---- C:\WINDOWS\system32\streamhlp.dll
2011-07-25 22:04:38 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2011-07-25 21:23:05 ----D---- C:\Program Files\Crawler
2011-07-25 20:17:27 ----A---- C:\WINDOWS\system32\drivers\Cat.DB
2011-07-25 20:16:44 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2011-07-25 20:13:20 ----D---- C:\Documents and Settings\All Users\Data aplikací\PC Tools
2011-07-25 19:29:06 ----D---- C:\Program Files\CCleaner
2011-07-24 13:02:41 ----A---- C:\WINDOWS\w_distrib_iplist.txt
2011-07-24 13:01:52 ----HD---- C:\WINDOWS\update.3
2011-07-22 17:37:02 ----D---- C:\WINDOWS\ufa
2011-07-22 17:37:02 ----D---- C:\WINDOWS\rpcminer
2011-07-22 17:37:02 ----D---- C:\WINDOWS\phoenix
2011-07-22 17:36:56 ----A---- C:\WINDOWS\ddh_iplist.txt
2011-07-22 17:36:15 ----A---- C:\WINDOWS\iecheck_iplist.txt
2011-07-22 17:36:02 ----A---- C:\WINDOWS\btc_client_iplist.txt
2011-07-22 17:35:54 ----HD---- C:\WINDOWS\update.2
2011-07-22 17:35:37 ----HD---- C:\WINDOWS\update.5.0
2011-07-22 17:35:36 ----A---- C:\WINDOWS\unrar.exe
2011-07-22 17:34:44 ----A---- C:\WINDOWS\iplist.txt
2011-07-22 17:33:56 ----A---- C:\WINDOWS\front_ip_list.txt
2011-07-22 17:33:40 ----D---- C:\WINDOWS\av_ico
2011-07-22 17:31:00 ----HD---- C:\WINDOWS\update.1
2011-07-22 17:30:50 ----HD---- C:\WINDOWS\update.tray-2-0-lnk
2011-07-22 17:30:50 ----HD---- C:\WINDOWS\update.tray-2-0
2011-07-22 17:26:09 ----D---- C:\Program Files\Common Files\Adobe
2011-07-22 17:26:09 ----D---- C:\Program Files\Adobe
2011-07-22 17:23:57 ----A---- C:\WINDOWS\winlog-ids.txt
2011-07-22 17:23:57 ----A---- C:\WINDOWS\winlog-dirs.txt
2011-07-13 22:20:42 ----HDC---- C:\WINDOWS\$NtUninstallKB2507938$
2011-07-13 22:18:17 ----HDC---- C:\WINDOWS\$NtUninstallKB2555917$
2011-07-07 19:09:08 ----D---- C:\Program Files\Common Files\Java
2011-07-07 19:08:34 ----A---- C:\WINDOWS\system32\javaws.exe
2011-07-07 19:08:34 ----A---- C:\WINDOWS\system32\javaw.exe
2011-07-07 19:08:34 ----A---- C:\WINDOWS\system32\java.exe
2011-07-05 06:48:43 ----D---- C:\Program Files\Microsoft Office
2011-07-05 06:48:20 ----D---- C:\Program Files\MSECache
2011-06-29 14:13:44 ----D---- C:\Documents and Settings\datart\Data aplikací\Sony Setup
2011-06-29 14:13:20 ----D---- C:\Program Files\Sony Setup
2011-06-29 14:12:14 ----A---- C:\WINDOWS\system32\hidserv.dll
2011-06-29 14:12:08 ----A---- C:\WINDOWS\system32\drivers\kbdhid.sys
2011-06-29 09:16:43 ----HDC---- C:\WINDOWS\$NtUninstallKB2541763$

======List of files/folders modified in the last 1 month======

2011-07-28 11:28:01 ----D---- C:\WINDOWS\Temp
2011-07-28 11:24:45 ----D---- C:\WINDOWS\Prefetch
2011-07-28 11:24:34 ----D---- C:\Program Files
2011-07-28 11:22:26 ----D---- C:\Documents and Settings\datart\Data aplikací\Skype
2011-07-28 11:20:37 ----D---- C:\Documents and Settings\All Users\Data aplikací\Norton
2011-07-28 11:20:33 ----SHD---- C:\System Volume Information
2011-07-28 11:20:20 ----D---- C:\WINDOWS\system32\CatRoot2
2011-07-28 11:19:04 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-07-28 11:18:07 ----D---- C:\WINDOWS
2011-07-28 11:17:57 ----D---- C:\WINDOWS\system32
2011-07-28 11:09:04 ----D---- C:\WINDOWS\system32\drivers
2011-07-28 11:09:04 ----D---- C:\Program Files\Common Files
2011-07-27 16:43:29 ----SHD---- C:\WINDOWS\Installer
2011-07-27 16:43:27 ----D---- C:\WINDOWS\WinSxS
2011-07-27 16:43:26 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-07-26 17:54:06 ----D---- C:\Program Files\Anti-Virus&Spyware
2011-07-26 15:51:51 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-07-26 15:48:17 ----HD---- C:\WINDOWS\inf
2011-07-26 15:46:16 ----A---- C:\boot.ini
2011-07-25 21:12:29 ----RD---- C:\Program Files\Skype
2011-07-25 21:10:33 ----D---- C:\Program Files\OEM
2011-07-25 19:36:47 ----D---- C:\Documents and Settings\datart\Data aplikací\Winamp
2011-07-25 19:36:20 ----D---- C:\WINDOWS\Logs
2011-07-25 19:36:20 ----D---- C:\WINDOWS\Debug
2011-07-24 15:55:31 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2011-07-24 12:55:51 ----D---- C:\Documents and Settings\datart\Data aplikací\skypePM
2011-07-22 17:38:00 ----D---- C:\WINDOWS\system32\Restore
2011-07-22 17:36:17 ----D---- C:\WINDOWS\system32\drivers\etc
2011-07-22 17:26:22 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2011-07-22 00:04:59 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype Extras
2011-07-13 22:20:44 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-07-13 22:18:30 ----A---- C:\WINDOWS\system32\MRT.exe
2011-07-13 10:19:44 ----HD---- C:\WINDOWS\$hf_mig$
2011-07-07 19:08:29 ----D---- C:\Program Files\Java
2011-07-05 06:52:51 ----SD---- C:\Documents and Settings\datart\Data aplikací\Microsoft
2011-07-05 06:48:49 ----RSD---- C:\WINDOWS\Fonts
2011-07-04 11:46:25 ----D---- C:\Program Files\Mozilla Firefox

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2009-04-28 44944]
R0 SymDS;Symantec Data Store; C:\WINDOWS\system32\drivers\NAV\1201000.025\SYMDS.SYS [2010-06-13 339504]
R0 SymEFA;Symantec Extended File Attributes; C:\WINDOWS\system32\drivers\NAV\1201000.025\SYMEFA.SYS [2010-07-29 666672]
R1 BHDrvx86;BHDrvx86; \??\C:\Documents and Settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx86.sys []
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-12-21 115008]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2010-12-21 94872]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 MpFilter;Microsoft Malware Protection Driver; C:\WINDOWS\system32\DRIVERS\MpFilter.sys [2011-04-18 165648]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL); C:\WINDOWS\system32\drivers\NAV\1201000.025\SRTSPX.SYS [2010-07-29 50096]
R1 SymIRON;Symantec Iron Driver; C:\WINDOWS\system32\drivers\NAV\1201000.025\Ironx86.SYS [2010-06-27 134704]
R1 SYMTDI;Symantec Network Dispatch Driver; C:\WINDOWS\system32\drivers\NAV\1201000.025\SYMTDI.SYS [2010-07-13 369072]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-12-21 141264]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2010-07-16 1754912]
R3 IDSxpx86;IDSxpx86; \??\C:\Documents and Settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSxpx86.sys []
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2010-03-18 5878304]
R3 NAVENG;NAVENG; \??\C:\Documents and Settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20100813.009\NAVENG.SYS []
R3 NAVEX15;NAVEX15; \??\C:\Documents and Settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20100813.009\NAVEX15.SYS []
R3 ReallusionVirtualAudio;Reallusion Virtual Audio; C:\WINDOWS\system32\DRIVERS\RLVrtAuCbl.sys [2007-03-19 31616]
R3 RT80x86;Ralink 802.11n Wireless Driver; C:\WINDOWS\system32\DRIVERS\RT2860.sys [2010-02-04 1323040]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2009-10-31 176768]
R3 SRTSP;Symantec Real Time Storage Protection; C:\WINDOWS\system32\drivers\NAV\1201000.025\SRTSP.SYS [2010-07-29 489008]
R3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS []
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2009-08-29 228784]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]
S0 Partizan;Partizan; C:\WINDOWS\system32\drivers\Partizan.sys [2011-07-26 35816]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2009-11-18 1691480]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfo.sys []
S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2009-11-18 1395800]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 RegGuard;RegGuard; \??\C:\WINDOWS\system32\Drivers\regguard.sys []
S3 RtsUIR;Realtek IR Driver; C:\WINDOWS\system32\DRIVERS\Rts516xIR.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2008-04-14 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AAMWService;Ashampoo Anti-Malware Service; C:\Program Files\Ashampoo\Ashampoo Anti-Malware\AAMW_Service.exe [2011-04-14 1312640]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-05-04 153376]
R2 NAV;Norton AntiVirus; C:\Program Files\Norton AntiVirus\Engine\18.1.0.37\ccSvcHst.exe [2010-07-23 126904]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe []

-----------------EOF-----------------

[vyosek]

Zdravim, pekny den preji a vitam Vas u nas na foru

Stahnete RogueKiller http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe

• Ukoncete vsechny programy
• Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce
• Zvolte moznost 2 a potvrte enterem
• Utilita provede svou cinnost a da log - ten sem vlozte
• Nyni znovu, ale zvolte moznost 3 a pote jeste 4 - logy opet vlozte

[myrabel]

Děkuji .)


možnost 2 log


RogueKiller V5.2.8 [07/23/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: datart [Admin rights]
Mode: Remove -- Date : 07/28/2011 11:52:51

Bad processes: 0

Registry Entries: 5
[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)
[HJ] HKLM\[...]\Security Center : AntiVirusDisableNotify (1) -> REPLACED (0)
[HJ] HKLM\[...]\Security Center : FirewallDisableNotify (1) -> REPLACED (0)
[HJ] HKLM\[...]\Security Center : UpdatesDisableNotify (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

HOSTS File:
127.0.0.1 localhost
127.0.0.1 vkontakte.ru
127.0.0.1 www.vkontakte.ru
127.0.0.1 login.vk.com
127.0.0.1 vk.com
127.0.0.1 www.vk.com
127.0.0.1 odnoklassniki.ru
127.0.0.1 www.odnoklassniki.ru
127.0.0.1 facebook.com
127.0.0.1 www.facebook.com
127.0.0.1 af-za.facebook.com
127.0.0.1 az-az.facebook.com
127.0.0.1 id-id.facebook.com
127.0.0.1 ms-my.facebook.com
127.0.0.1 bs-ba.facebook.com
127.0.0.1 ca-es.facebook.com
127.0.0.1 cs-cz.facebook.com
127.0.0.1 cy-gb.facebook.com
127.0.0.1 da-dk.facebook.com
127.0.0.1 de-de.facebook.com
[...]


Finished : << RKreport[1].txt >>
RKreport[1].txt

[myrabel]

dělám to dobře, když si před každou novou možností program znovu stáhnu a zadám možnost?

možnost 3 log:


RogueKiller V5.2.8 [07/23/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: datart [Admin rights]
Mode: HOSTSFix -- Date : 07/28/2011 11:56:44

Bad processes: 0

HOSTS File:
127.0.0.1 localhost
127.0.0.1 vkontakte.ru
127.0.0.1 www.vkontakte.ru
127.0.0.1 login.vk.com
127.0.0.1 vk.com
127.0.0.1 www.vk.com
127.0.0.1 odnoklassniki.ru
127.0.0.1 www.odnoklassniki.ru
127.0.0.1 facebook.com
127.0.0.1 www.facebook.com
127.0.0.1 af-za.facebook.com
127.0.0.1 az-az.facebook.com
127.0.0.1 id-id.facebook.com
127.0.0.1 ms-my.facebook.com
127.0.0.1 bs-ba.facebook.com
127.0.0.1 ca-es.facebook.com
127.0.0.1 cs-cz.facebook.com
127.0.0.1 cy-gb.facebook.com
127.0.0.1 da-dk.facebook.com
127.0.0.1 de-de.facebook.com
[...]


Resetted HOSTS:
127.0.0.1 localhost

Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt

[myrabel]

možnost 4 log:



RogueKiller V5.2.8 [07/23/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: datart [Admin rights]
Mode: ProxyFix -- Date : 07/28/2011 12:02:17

Bad processes: 0

Registry Entries: 0

Finished : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt

[vyosek]

Vyborne, jdeme dale

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

[myrabel]

musela sem ke správnému fachání combofix odinstalovat norton antivir a ted mi to hlásí, že nemám konzoly pro zotavení (??) tak stahuji....

[myrabel]

pardooon čtu to pozorněji a už radši 3krááát, o konzoly se píše, jen sem to přehlédla,.. jeduuu dál

[myrabel]

Log combofix:


ComboFix 11-07-28.01 - datart 28.07.2011 12:20:29.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1013.549 [GMT 2:00]
Spuštěný z: c:\documents and settings\datart\Dokumenty\Downloads\ComboFix.exe
AV: Ashampoo Anti-MalWare *Disabled/Outdated* {91BDFB4E-BA7E-4ABC-9472-A79BA394CA4B}
AV: Norton AntiVirus *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Anti-Virus&Spyware
c:\program files\Anti-Virus&Spyware\EGhostLog.txt
c:\windows\btc_client_iplist.txt
c:\windows\ddh_iplist.txt
c:\windows\front_ip_list.txt
c:\windows\geoiplist
c:\windows\geoiplist.rar
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\loader2.exe_ok
c:\windows\phoenix
c:\windows\phoenix.rar
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\__init__.pyc
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\proc_list1.log
c:\windows\rpcminer
c:\windows\rpcminer.rar
c:\windows\rpcminer\bitcoinminercuda_10.cubin
c:\windows\rpcminer\bitcoinminercuda_11.cubin
c:\windows\rpcminer\bitcoinminercuda_20.cubin
c:\windows\rpcminer\bitcoinmineropencl.cl
c:\windows\rpcminer\cudart32_32_16.dll
c:\windows\rpcminer\curllib.dll
c:\windows\rpcminer\libeay32.dll
c:\windows\rpcminer\libsasl.dll
c:\windows\rpcminer\openldap.dll
c:\windows\rpcminer\rpcminer-4way.exe
c:\windows\rpcminer\rpcminer-cpu.exe
c:\windows\rpcminer\rpcminer-cuda.exe
c:\windows\rpcminer\rpcminer-opencl.exe
c:\windows\rpcminer\ssleay32.dll
c:\windows\system32\drivers\etc\HSTS~1
c:\windows\ufa.rar
c:\windows\update.1
c:\windows\update.2
c:\windows\update.3
c:\windows\update.3\svchost.exe
c:\windows\update.5.0
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
c:\windows\winsetupapi.log
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-28 do 2011-07-28 )))))))))))))))))))))))))))))))
.
.
2011-07-28 09:24 . 2011-07-28 09:28 -------- d-----w- c:\program files\trend micro
2011-07-28 09:24 . 2011-07-28 09:24 -------- d-----w- C:\rsit
2011-07-28 09:08 . 2011-07-28 10:14 -------- d-----w- c:\program files\Norton AntiVirus
2011-07-26 17:53 . 2011-07-26 17:53 -------- d-----w- c:\documents and settings\datart\Local Settings\Data aplikací\Ashampoo
2011-07-26 17:25 . 2011-07-26 17:25 -------- d-----w- c:\program files\Ashampoo
2011-07-26 15:43 . 2011-07-26 15:43 -------- d-----r- C:\comment.htt
2011-07-26 15:14 . 2011-07-27 05:26 24416 ----a-w- c:\windows\system32\drivers\regguard.sys
2011-07-26 15:10 . 2011-07-26 15:10 37600 ----a-w- c:\windows\system32\Partizan.exe
2011-07-26 15:10 . 2011-07-26 15:10 35816 ----a-w- c:\windows\system32\drivers\Partizan.sys
2011-07-26 15:09 . 2011-07-26 15:09 2 --shatr- c:\windows\winstart.bat
2011-07-26 15:09 . 2010-11-11 10:44 12808 ----a-w- c:\windows\system32\drivers\UnHackMeDrv.sys
2011-07-26 15:09 . 2011-07-26 15:25 -------- d-----w- c:\program files\UnHackMe
2011-07-26 13:48 . 2009-08-06 17:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2011-07-26 13:48 . 2009-08-06 17:23 215920 ----a-w- c:\windows\system32\muweb.dll
2011-07-26 13:45 . 2011-07-26 13:45 -------- d--h--w- c:\windows\update.tray-7-0
2011-07-26 13:45 . 2011-07-26 13:45 -------- d--h--w- c:\windows\update.tray-7-0-lnk
2011-07-26 13:43 . 2011-07-04 11:36 309848 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-26 13:43 . 2011-07-04 11:32 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-07-26 13:43 . 2011-07-04 11:35 43608 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-26 13:43 . 2011-07-04 11:32 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-26 13:43 . 2011-07-04 11:36 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-07-26 13:43 . 2011-07-04 11:35 102616 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-07-26 13:43 . 2011-07-04 11:35 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-07-26 13:43 . 2011-07-04 11:32 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-07-26 13:43 . 2011-07-04 11:43 40112 ----a-w- c:\windows\avastSS.scr
2011-07-26 13:43 . 2011-07-04 11:43 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-07-26 13:43 . 2011-07-26 13:43 -------- d-----w- c:\program files\AVAST Software
2011-07-26 11:21 . 2011-07-26 11:21 -------- d-----w- c:\documents and settings\datart\Data aplikací\Simply Super Software
2011-07-26 11:20 . 2011-07-26 11:20 -------- d-----w- c:\documents and settings\datart\Data aplikací\TrojanHunter
2011-07-25 20:04 . 2010-04-01 11:49 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2011-07-25 19:23 . 2011-07-25 19:23 -------- d-----w- c:\program files\Crawler
2011-07-25 18:16 . 2010-04-01 11:47 -------- d---a-w- c:\documents and settings\All Users\Data aplikací\TEMP
2011-07-25 18:13 . 2011-07-25 19:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\PC Tools
2011-07-25 17:29 . 2011-07-25 17:29 -------- d-----w- c:\program files\CCleaner
2011-07-22 15:37 . 2011-07-22 15:37 -------- d-----w- c:\windows\ufa
2011-07-22 15:35 . 2011-07-22 15:37 246272 ----a-w- c:\windows\unrar.exe
2011-07-22 15:33 . 2011-07-26 13:47 -------- d-----w- c:\windows\av_ico
2011-07-22 15:30 . 2011-07-22 15:30 -------- d--h--w- c:\windows\update.tray-2-0
2011-07-22 15:30 . 2011-07-22 15:30 -------- d--h--w- c:\windows\update.tray-2-0-lnk
2011-07-22 15:26 . 2011-07-22 15:26 -------- d-----w- c:\program files\Common Files\Adobe
2011-07-22 15:23 . 2011-07-22 15:23 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2011-07-07 17:09 . 2011-07-07 17:09 -------- d-----w- c:\program files\Common Files\Java
2011-07-05 04:48 . 2011-07-05 04:48 -------- d-----w- c:\program files\MSECache
2011-06-29 12:15 . 2011-06-29 12:15 -------- d-----w- c:\documents and settings\datart\Local Settings\Data aplikací\ESET
2011-06-29 12:13 . 2011-06-29 12:13 -------- d-----w- c:\documents and settings\datart\Data aplikací\Sony Setup
2011-06-29 12:13 . 2011-06-29 12:15 -------- d-----w- c:\program files\Sony Setup
2011-06-29 12:12 . 2008-04-14 06:51 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2011-06-29 12:12 . 2008-04-14 06:51 21504 ----a-w- c:\windows\system32\hidserv.dll
2011-06-29 12:12 . 2008-04-14 05:59 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2011-06-29 12:12 . 2008-04-14 05:59 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-18 07:35 . 2011-06-18 07:35 80 ----a-w- c:\documents and settings\datart\Data aplikací\tintsnft.sys
2011-06-06 11:35 . 1980-01-01 00:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-04 02:52 . 2011-04-28 15:15 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-05-04 00:25 . 2011-04-28 15:15 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-05-02 15:32 . 2010-09-28 09:54 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25 . 1980-01-01 00:00 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19 . 1980-01-01 00:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-02-16 20:37 . 2011-02-16 20:36 568696 ----a-w- c:\program files\ChromeSetup.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-06-15 15141768]
"UnHackMe Monitor"="c:\program files\UnHackMe\hackmon.exe" [2010-11-11 594200]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-07-16 141336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-07-16 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-07-16 141336]
"RTHDCPL"="RTHDCPL.EXE" [2010-03-18 19520544]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-08-28 1557800]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-11-30 74752]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-05-27 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-29 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
SRS Premium Sound.lnk - c:\program files\SRS Labs\SRS Premium Sound\SRSPremiumSound_XP.exe [2009-10-28 3372336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0Partizan
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"c:\\Documents and Settings\\datart\\Dokumenty\\Downloads\\Flash-Player.exe"=
"c:\\WINDOWS\\update.tray-2-0\\svchost.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [21.12.2010 15:04 115008]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [21.12.2010 13:47 94872]
R2 AAMWService;Ashampoo Anti-Malware Service;c:\program files\Ashampoo\Ashampoo Anti-Malware\AAMW_Service.exe [26.7.2011 19:26 1312640]
R3 ReallusionVirtualAudio;Reallusion Virtual Audio;c:\windows\system32\drivers\RLVrtAuCbl.sys [28.9.2010 19:17 31616]
R3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [28.9.2010 17:37 1323040]
R4 IDSxpx86;IDSxpx86;\??\c:\documents and settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSxpx86.sys --> c:\documents and settings\All Users\Data aplikací\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSxpx86.sys [?]
R4 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1201000.025\SYMDS.SYS --> c:\windows\system32\drivers\NAV\1201000.025\SYMDS.SYS [?]
R4 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1201000.025\SYMEFA.SYS --> c:\windows\system32\drivers\NAV\1201000.025\SYMEFA.SYS [?]
S0 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys [26.7.2011 17:10 35816]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [28.9.2010 15:36 1691480]
S3 RegGuard;RegGuard;c:\windows\system32\drivers\regguard.sys [26.7.2011 17:14 24416]
S3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
.
--- Ostatní služby/ovladače v paměti ---
.
*Deregistered* - BHDrvx86
*Deregistered* - NAVENG
*Deregistered* - NAVEX15
*Deregistered* - UnHackMeDrv
.
Obsah adresáře 'Naplánované úlohy'
.
2011-07-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.crawler.com/homepage.aspx?tbid=60347
IE: Crawler Search - tbr:iemenu
TCP: DhcpNameServer = 192.168.11.11
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\documents and settings\datart\Data aplikací\Mozilla\Firefox\Profiles\hhq56c2o.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1750559&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.crawler.com/homepage.aspx?tbid=60347
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Ant Video Downloader: anttoolbar@ant.com - %profile%\extensions\anttoolbar@ant.com
FF - Ext: BS Player Community Toolbar: {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - %profile%\extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Crawler Toolbar: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - c:\program files\Crawler\Toolbar\firefox
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM-Run-tray_ico - (no file)
HKLM-Run-tray_ico2 - (no file)
HKLM-Run-tray_ico3 - (no file)
HKLM-Run-tray_ico4 - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-28 12:25
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
Celkový čas: 2011-07-28 12:27:09
ComboFix-quarantined-files.txt 2011-07-28 10:27
.
Před spuštěním: Volných bajtů: 14 946 717 696
Po spuštění: Volných bajtů: 15 162 519 552
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=AlwaysOff /fastdetect
.
- - End Of File - - 8A67E68FAE59DAE963CC76E1A6F72DCE

[vyosek]

Ono Norton sel do pryc ale pujdou i nakonec ty ostatni - havet je poskodila...

Kdyby byl nejaky problem, tak napiste

[myrabel]

díky, co dál?

[vyosek]

Dejte mi chvilicku, napisu docistovaci skript

[vyosek]

Jen takovy maly dotaz, ono se jedna o firemni nebo domaci PC

[myrabel]

jde o domácí PC

[vyosek]

Proc se uzivatel jmenuje Datart