Facebook vir (s RSIT)

[Hanz666]

Logfile of random's system information tool 1.09 (written by random/random)
Run by Honza at 2011-08-22 08:21:38
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 15 GB (29%) free of 51 GB
Total RAM: 2560 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:22:05, on 22.8.2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\SOUNDMAN.EXE
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\update.tray-2-0\svchost.exe
C:\Windows\l1rezerv.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Honza\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Users\Honza\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Honza\Desktop\RSIT.exe
C:\Program Files\trend micro\Honza.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.smartwebsearch.net/index.php?from=3
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Result Optimizator - {D7BE8ED1-B138-48FD-BB22-9779A39130B1} - C:\Program Files\SaveTubeVideo.com\SaveTubeVideo\SearchBHO.dll
O2 - BHO: ShowBarObj Class - {2863E737-DD3F-4280-9AF8-E9E79C16F312} - C:\Program Files\SaveTubeVideo.com\SaveTubeVideo\MinBHO.dll
O2 - BHO: GamePlayLabsBHO - {984A9162-8891-4D19-8CFE-17648BB4E1EC} - C:\Users\Honza\AppData\Local\GamePlayLabs Plugin\BHO.dll (file missing)
O2 - BHO: Search Result Optimizator - {D7BE8ED1-B138-48FD-BB22-9779A39130B1} - C:\Program Files\SaveTubeVideo.com\SaveTubeVideo\SearchBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Save Tube Video - {F334C7B0-8774-4d5b-BD7A-4F448D03A1AE} - C:\Program Files\SaveTubeVideo.com\SaveTubeVideo\SaveTubeVideo.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [egui] "E:\Program files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TNOD UP] "E:\Program Files\TNod User & Password Finder\TNODUP.exe" /i
O4 - HKLM\..\Run: [WinampAgent] "E:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [wxpdrv] C:\Windows\services32.exe
O4 - HKLM\..\Run: [tray_ico0] C:\Windows\update.tray-2-0\svchost.exe
O4 - HKLM\..\Run: [2552409.exe] "C:\Users\Honza\AppData\Local\Temp\2552409.exe"
O4 - HKLM\..\Run: [sysdriver32.exe] "C:\Windows\sysdriver32.exe" rezerv
O4 - HKLM\..\Run: [sysdriver32_.exe] "C:\Windows\sysdriver32_.exe" rezerv
O4 - HKLM\..\Run: [4434209.exe] "C:\Windows\Temp\4434209.exe"
O4 - HKLM\..\Run: [9184797.exe] "C:\Windows\Temp\9184797.exe"
O4 - HKLM\..\Run: [50869100-loader2.exe] "C:\Windows\Temp\50869100-loader2.exe"
O4 - HKLM\..\Run: [3842923.exe] "C:\Windows\Temp\3842923.exe"
O4 - HKLM\..\Run: [l1rezerv.exe] "C:\Windows\l1rezerv.exe"
O4 - HKLM\..\Run: [systemup] "C:\Windows\systemup.exe" stand
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Google Update] "C:\Users\Honza\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: ddservice - Unknown owner - C:\Windows\update.7.1\svchostdriver.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - Unknown owner - E:\Program files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (file missing)
O23 - Service: ESET Service (ekrn) - Unknown owner - E:\Program files\ESET\ESET NOD32 Antivirus\ekrn.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: srvbtcclient - Unknown owner - C:\Windows\update.5.0\svchost.exe
O23 - Service: srviecheck - Unknown owner - C:\Windows\update.2\svchost.exe
O23 - Service: srvsysdriver32 - Unknown owner - C:\Windows\sysdriver32.exe
O23 - Service: STI Simulator - Unknown owner - C:\Windows\System32\PAStiSvc.exe
O23 - Service: wxpdrivers - Unknown owner - C:\Windows\update.1\svchost.exe

--
End of file - 6600 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore1cc5223927ed96c.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1622515577-2608472290-2080195198-1000Core1cc4e9057fa610a.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1622515577-2608472290-2080195198-1000UA.job
C:\Windows\tasks\User_Feed_Synchronization-{116B0E6C-2B09-4589-8B8B-74711F74D5A7}.job
C:\Windows\tasks\{11A99E4C-C5CF-41CE-A828-96B30F776130}.job
C:\Windows\tasks\{155463D0-3B22-492C-B8E8-92E1FA47023F}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2863E737-DD3F-4280-9AF8-E9E79C16F312}]
ShowBarObj Class - C:\Program Files\SaveTubeVideo.com\SaveTubeVideo\MinBHO.dll [2010-11-02 220672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{984A9162-8891-4D19-8CFE-17648BB4E1EC}]
GamePlayLabsBHO Class - C:\Users\Honza\AppData\Local\GamePlayLabs Plugin\BHO.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D7BE8ED1-B138-48FD-BB22-9779A39130B1}]
Search Result Optimizator - C:\Program Files\SaveTubeVideo.com\SaveTubeVideo\SearchBHO.dll [2010-10-27 111616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-07-21 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{F334C7B0-8774-4d5b-BD7A-4F448D03A1AE} - Save Tube Video - C:\Program Files\SaveTubeVideo.com\SaveTubeVideo\SaveTubeVideo.dll [2010-11-02 693248]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2011-01-05 988480]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\Windows\SOUNDMAN.EXE [2009-04-14 604704]
"egui"=E:\Program files\ESET\ESET NOD32 Antivirus\egui.exe /hide /waitservice []
"TNOD UP"=E:\Program Files\TNod User & Password Finder\TNODUP.exe [2010-04-02 1811968]
"WinampAgent"=E:\Program Files\Winamp\winampa.exe []
"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2011-03-21 1230704]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-04-08 254696]
"wxpdrv"=C:\Windows\services32.exe [2011-08-21 1213440]
"tray_ico"= []
"tray_ico0"=C:\Windows\update.tray-2-0\svchost.exe [2011-08-21 1213440]
"tray_ico1"= []
"tray_ico2"= []
"tray_ico3"= []
"tray_ico4"= []
"2552409.exe"=C:\Users\Honza\AppData\Local\Temp\2552409.exe [2011-08-21 258048]
"sysdriver32.exe"=C:\Windows\sysdriver32.exe [2011-08-21 258048]
"sysdriver32_.exe"=C:\Windows\sysdriver32_.exe [2011-08-21 258048]
"4434209.exe"=C:\Windows\Temp\4434209.exe [2011-08-21 258048]
"9184797.exe"=C:\Windows\Temp\9184797.exe [2011-08-21 634880]
"50869100-loader2.exe"=C:\Windows\Temp\50869100-loader2.exe [2011-08-21 258048]
"3842923.exe"=C:\Windows\Temp\3842923.exe [2011-08-21 258048]
"l1rezerv.exe"=C:\Windows\l1rezerv.exe [2011-08-21 232960]
"systemup"=C:\Windows\systemup.exe [2011-08-22 139776]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]
"Google Update"=C:\Users\Honza\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-04 136176]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]

C:\Users\Honza\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
OpenOffice.org 3.2.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\wxpdrivers]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableSecureUIAPaths"=0
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"VIDC.XFR1"=xfcodec.dll
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-08-22 08:21:39 ----D---- C:\Program Files\trend micro
2011-08-22 08:21:38 ----D---- C:\rsit
2011-08-22 08:19:51 ----A---- C:\Windows\systemup.exe
2011-08-21 22:05:25 ----D---- C:\32788R22FWJFW
2011-08-21 22:04:26 ----A---- C:\Bug.txt
2011-08-21 20:58:22 ----D---- C:\Windows\system32\appmgmt
2011-08-21 20:31:38 ----A---- C:\Windows\l1rezerv.exe
2011-08-21 20:27:11 ----HD---- C:\Windows\update.7.1
2011-08-21 20:27:01 ----A---- C:\Windows\iecheck_iplist.txt
2011-08-21 20:26:02 ----HD---- C:\Windows\update.2
2011-08-21 20:24:52 ----D---- C:\Windows\ufa
2011-08-21 20:24:52 ----D---- C:\Windows\rpcminer
2011-08-21 20:24:52 ----D---- C:\Windows\phoenix
2011-08-21 20:21:51 ----A---- C:\Windows\btc_client_iplist.txt
2011-08-21 20:21:27 ----A---- C:\Windows\unrar.exe
2011-08-21 20:21:25 ----HD---- C:\Windows\update.5.0
2011-08-21 20:19:49 ----A---- C:\Windows\iplist.txt
2011-08-21 20:19:23 ----A---- C:\Windows\sysdriver32_.exe
2011-08-21 20:19:09 ----A---- C:\Windows\sysdriver32.exe
2011-08-21 20:18:50 ----A---- C:\Windows\front_ip_list.txt
2011-08-21 20:18:28 ----D---- C:\Windows\av_ico
2011-08-21 20:17:00 ----HD---- C:\Windows\update.1
2011-08-21 20:16:59 ----HD---- C:\Windows\update.tray-2-0-lnk
2011-08-21 20:16:59 ----HD---- C:\Windows\update.tray-2-0
2011-08-21 20:05:45 ----A---- C:\Windows\winlog-ids.txt
2011-08-21 20:05:45 ----A---- C:\Windows\winlog-dirs.txt
2011-08-21 20:05:38 ----A---- C:\Windows\services32.exe
2011-08-14 12:57:21 ----D---- C:\Users\Honza\AppData\Roaming\Mumble
2011-08-10 17:32:13 ----A---- C:\Windows\system32\mshtmled.dll
2011-08-10 17:32:10 ----A---- C:\Windows\system32\iertutil.dll
2011-08-10 17:32:08 ----A---- C:\Windows\system32\ieui.dll
2011-08-10 17:32:07 ----A---- C:\Windows\system32\jscript.dll
2011-08-10 17:32:06 ----A---- C:\Windows\system32\jsproxy.dll
2011-08-10 17:32:06 ----A---- C:\Windows\system32\jscript9.dll
2011-08-10 17:32:04 ----A---- C:\Windows\system32\wininet.dll
2011-08-10 17:32:02 ----A---- C:\Windows\system32\urlmon.dll
2011-08-10 17:32:01 ----A---- C:\Windows\system32\url.dll
2011-08-10 17:32:01 ----A---- C:\Windows\system32\ieframe.dll
2011-08-10 17:31:56 ----A---- C:\Windows\system32\mshtml.dll
2011-08-09 22:14:08 ----A---- C:\Windows\system32\xmllite.dll
2011-08-09 22:14:01 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-08-09 22:13:56 ----A---- C:\Windows\system32\ntkrnlpa.exe
2011-08-09 22:13:45 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2011-08-09 22:13:33 ----A---- C:\Windows\system32\drivers\tcpip.sys
2011-08-09 22:13:29 ----A---- C:\Windows\system32\kernel32.dll
2011-08-09 22:13:28 ----A---- C:\Windows\system32\winsrv.dll
2011-08-09 22:13:28 ----A---- C:\Windows\system32\KernelBase.dll
2011-08-09 22:13:28 ----A---- C:\Windows\system32\conhost.exe
2011-08-09 22:13:27 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-09 22:13:27 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2011-08-09 22:13:27 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-09 22:13:27 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2011-08-09 22:13:27 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-09 22:13:27 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2011-08-09 22:13:27 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2011-08-09 22:13:26 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2011-08-09 22:13:26 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-09 22:13:26 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2011-08-09 22:13:26 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-09 22:13:26 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2011-08-09 22:13:26 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-09 22:13:25 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2011-08-09 22:13:25 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-09 22:13:25 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2011-08-09 22:13:25 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2011-08-09 22:13:25 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2011-08-09 22:13:25 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-09 22:13:25 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2011-08-09 22:13:24 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2011-08-09 22:13:24 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2011-08-09 22:13:24 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2011-08-09 22:13:24 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-09 22:13:24 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-09 22:13:24 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2011-08-09 22:13:23 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2011-08-09 22:13:23 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2011-08-09 22:13:20 ----A---- C:\Windows\system32\odbcjt32.dll
2011-08-09 22:13:20 ----A---- C:\Windows\system32\odbccu32.dll
2011-08-09 22:13:20 ----A---- C:\Windows\system32\odbccr32.dll
2011-08-09 22:13:19 ----A---- C:\Windows\system32\odbctrac.dll
2011-08-09 22:13:19 ----A---- C:\Windows\system32\odbccp32.dll
2011-08-04 17:57:22 ----D---- C:\Program Files\Common Files\Java
2011-08-04 17:56:51 ----A---- C:\Windows\system32\javaws.exe
2011-08-04 17:56:51 ----A---- C:\Windows\system32\javaw.exe
2011-08-04 17:56:50 ----A---- C:\Windows\system32\java.exe
2011-07-23 18:39:48 ----D---- C:\ProgramData\Blizzard Entertainment
2011-07-23 07:39:28 ----D---- C:\Program Files\Common Files\Blizzard Entertainment

======List of files/folders modified in the last 1 month======

2011-08-22 08:22:05 ----D---- C:\Windows\Temp
2011-08-22 08:21:39 ----RD---- C:\Program Files
2011-08-22 08:19:51 ----D---- C:\Windows
2011-08-22 08:19:01 ----D---- C:\Windows\system32\config
2011-08-21 22:04:24 ----D---- C:\Windows\System32
2011-08-21 21:29:00 ----HD---- C:\ProgramData
2011-08-21 21:25:54 ----SHD---- C:\Windows\Installer
2011-08-21 21:24:36 ----D---- C:\Windows\system32\catroot2
2011-08-21 20:59:43 ----D---- C:\Program Files\Common Files
2011-08-21 20:59:00 ----SHD---- C:\System Volume Information
2011-08-21 20:49:17 ----D---- C:\Windows\Minidump
2011-08-21 20:26:32 ----D---- C:\Windows\system32\drivers\etc
2011-08-15 19:26:37 ----D---- C:\ProgramData\PMB Files
2011-08-11 03:29:39 ----RSD---- C:\Windows\assembly
2011-08-11 03:29:39 ----D---- C:\Windows\Microsoft.NET
2011-08-11 03:05:00 ----D---- C:\Windows\inf
2011-08-11 03:05:00 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-08-10 22:11:18 ----D---- C:\Users\Honza\AppData\Roaming\Xfire
2011-08-10 17:37:20 ----D---- C:\Windows\winsxs
2011-08-10 17:35:34 ----D---- C:\Windows\system32\migration
2011-08-10 17:35:34 ----D---- C:\Windows\system32\drivers
2011-08-10 17:35:34 ----D---- C:\Program Files\Internet Explorer
2011-08-10 17:33:17 ----D---- C:\Windows\system32\catroot
2011-08-10 17:27:01 ----A---- C:\Windows\system32\MRT.exe
2011-08-04 17:56:42 ----D---- C:\Program Files\Java
2011-08-03 23:23:22 ----D---- C:\Windows\Tasks
2011-07-30 14:50:12 ----D---- C:\Users\Honza\AppData\Roaming\mIRC

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-12-27 691696]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-07-29 115008]
R2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys [2011-02-08 281760]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-07-29 136632]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2010-07-29 96920]
R2 irda;IrDA Protocol; C:\Windows\system32\DRIVERS\irda.sys [2009-07-14 96768]
R2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys [2011-02-08 25888]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\Windows\system32\drivers\RTKVAC.SYS [2009-06-18 4172832]
R3 atikmdag;atikmdag; C:\Windows\system32\drivers\atikmdag.sys [2009-07-14 4194816]
R3 irsir;Microsoft Serial Infrared Driver; C:\Windows\system32\DRIVERS\irsir.sys [2008-01-19 20992]
R3 RTL8023xp;Realtek 10/100 NIC Family NDIS x86 Driver; C:\Windows\system32\DRIVERS\Rtnicxp.sys [2009-07-14 43008]
S3 aatqk5kk;aatqk5kk; C:\Windows\system32\drivers\aatqk5kk.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 26176]
S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x32.sys [2009-07-14 347264]
S3 PAC207;VideoCAM GE111; C:\Windows\system32\DRIVERS\pfc027.sys [2005-04-08 162176]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 15872]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 XDva370;XDva370; \??\C:\Windows\system32\XDva370.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ddservice;ddservice; C:\Windows\update.7.1\svchostdriver.exe [2011-08-21 382464]
R2 Irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2011-03-04 75136]
R2 srvbtcclient;srvbtcclient; C:\Windows\update.5.0\svchost.exe [2011-08-21 355840]
R2 srviecheck;srviecheck; C:\Windows\update.2\svchost.exe [2011-08-21 634880]
R2 srvsysdriver32;srvsysdriver32; C:\Windows\sysdriver32.exe [2011-08-21 258048]
R2 STI Simulator;STI Simulator; C:\Windows\System32\PAStiSvc.exe [2005-01-14 53248]
R2 wxpdrivers;wxpdrivers; C:\Windows\update.1\svchost.exe [2011-08-21 1213440]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 ekrn;ESET Service; E:\Program files\ESET\ESET NOD32 Antivirus\ekrn.exe []
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-12-04 136176]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 EhttpSrv;ESET HTTP Server; E:\Program files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe []
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-12-04 136176]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-09-30 1343400]

-----------------EOF-----------------

[Hanz666]

často se mi sám od sebe restartuje PC

[motji]

Dobré ranko
Jak by se vám nerestartoval. když máte pc plný virů .

Stáhněte Roguekiller http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
-ukončete všechny spuštěné programy
-spusťte program, pro visty/win 7 spustte pravým tlačítkem myši - jako správce
-použijte volbu 2 - enter
-pak použijte postupně i volby 3,4,5
-vložte zde logy



Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT
-MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu.
-Log zkopírujte sem.

[Hanz666]

RogueKiller V5.3.3 [08/18/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User: Honza [Admin rights]
Mode: Remove -- Date : 08/22/2011 08:59:34

Bad processes: 9
[HJ NAME] svchost.exe -- c:\windows\update.5.0\svchost.exe -> KILLED [TermProc]
[SVCHOST] svchost.exe -- c:\windows\update.tray-2-0\svchost.exe -> KILLED [TermProc]
[HJ NAME] svchost.exe -- c:\windows\update.2\svchost.exe -> KILLED [TermProc]
[SVCHOST] svchost.exe -- c:\windows\update.5.0\svchost.exe -> KILLED [TermProc]
[SUSP PATH] l1rezerv.exe -- c:\windows\l1rezerv.exe -> KILLED [TermProc]
[SUSP PATH] systemup.exe -- c:\windows\systemup.exe -> KILLED [TermProc]
[SUSP PATH] sysdriver32.exe -- c:\windows\sysdriver32.exe -> KILLED [TermProc]
[HJ NAME] svchost.exe -- c:\windows\update.1\svchost.exe -> KILLED [TermProc]
[SVCHOST] svchost.exe -- c:\windows\update.2\svchost.exe -> KILLED [TermProc]

Registry Entries: 29
[SUSP PATH] HKLM\[...]\Run : wxpdrv (C:\Windows\services32.exe) -> DELETED
[HJ NAME] HKLM\[...]\Run : tray_ico0 (C:\Windows\update.tray-2-0\svchost.exe) -> DELETED
[SUSP PATH] HKLM\[...]\Run : 2552409.exe ("C:\Users\Honza\AppData\Local\Temp\2552409.exe") -> DELETED
[SUSP PATH] HKLM\[...]\Run : sysdriver32.exe ("C:\Windows\sysdriver32.exe" rezerv) -> DELETED
[SUSP PATH] HKLM\[...]\Run : sysdriver32_.exe ("C:\Windows\sysdriver32_.exe" rezerv) -> DELETED
[SUSP PATH] HKLM\[...]\Run : 4434209.exe ("C:\Windows\Temp\4434209.exe") -> DELETED
[SUSP PATH] HKLM\[...]\Run : 9184797.exe ("C:\Windows\Temp\9184797.exe") -> DELETED
[SUSP PATH] HKLM\[...]\Run : 50869100-loader2.exe ("C:\Windows\Temp\50869100-loader2.exe") -> DELETED
[SUSP PATH] HKLM\[...]\Run : 3842923.exe ("C:\Windows\Temp\3842923.exe") -> DELETED
[SUSP PATH] HKLM\[...]\Run : l1rezerv.exe ("C:\Windows\l1rezerv.exe") -> DELETED
[SUSP PATH] HKLM\[...]\Run : systemup ("C:\Windows\systemup.exe" stand) -> DELETED
[] HKLM\[...]\Windows : () -> ACCESS DENIED
[BLACKLIST] HKLM\[...]\services : srvbtcclient (C:\Windows\update.5.0\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srviecheck (C:\Windows\update.2\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srvsysdriver32 (C:\Windows\sysdriver32.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : wxpdrivers (C:\Windows\update.1\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srvbtcclient (C:\Windows\update.5.0\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srviecheck (C:\Windows\update.2\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srvsysdriver32 (C:\Windows\sysdriver32.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : wxpdrivers (C:\Windows\update.1\svchost.exe srv) -> DELETED
[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)
[HJ] HKLM\[...]\Security Center : AntiVirusDisableNotify (1) -> REPLACED (0)
[HJ] HKLM\[...]\Security Center : FirewallDisableNotify (1) -> REPLACED (0)
[HJ] HKLM\[...]\Security Center : UpdatesDisableNotify (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKCU\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[] HKLM\[...]\Windows : () -> ACCESS DENIED

Particular Files / Folders:

HOSTS File:
127.0.0.1 localhost
127.0.0.1 facebook.com
127.0.0.1 www.facebook.com
127.0.0.1 af-za.facebook.com
127.0.0.1 az-az.facebook.com
127.0.0.1 id-id.facebook.com
127.0.0.1 ms-my.facebook.com
127.0.0.1 bs-ba.facebook.com
127.0.0.1 ca-es.facebook.com
127.0.0.1 cs-cz.facebook.com
127.0.0.1 cy-gb.facebook.com
127.0.0.1 da-dk.facebook.com
127.0.0.1 de-de.facebook.com
127.0.0.1 et-ee.facebook.com
127.0.0.1 en-gb.facebook.com
127.0.0.1 es-la.facebook.com
127.0.0.1 eo-eo.facebook.com
127.0.0.1 eu-es.facebook.com
127.0.0.1 tl-ph.facebook.com
127.0.0.1 fo-fo.facebook.com
[...]


Finished : << RKreport[1].txt >>
RKreport[1].txt

[Hanz666]

RogueKiller V5.3.3 [08/18/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User: Honza [Admin rights]
Mode: HOSTSFix -- Date : 08/22/2011 09:00:17

Bad processes: 0

HOSTS File:
127.0.0.1 localhost
127.0.0.1 facebook.com
127.0.0.1 www.facebook.com
127.0.0.1 af-za.facebook.com
127.0.0.1 az-az.facebook.com
127.0.0.1 id-id.facebook.com
127.0.0.1 ms-my.facebook.com
127.0.0.1 bs-ba.facebook.com
127.0.0.1 ca-es.facebook.com
127.0.0.1 cs-cz.facebook.com
127.0.0.1 cy-gb.facebook.com
127.0.0.1 da-dk.facebook.com
127.0.0.1 de-de.facebook.com
127.0.0.1 et-ee.facebook.com
127.0.0.1 en-gb.facebook.com
127.0.0.1 es-la.facebook.com
127.0.0.1 eo-eo.facebook.com
127.0.0.1 eu-es.facebook.com
127.0.0.1 tl-ph.facebook.com
127.0.0.1 fo-fo.facebook.com
[...]


Resetted HOSTS:
127.0.0.1 localhost

Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt

[Hanz666]

RogueKiller V5.3.3 [08/18/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User: Honza [Admin rights]
Mode: ProxyFix -- Date : 08/22/2011 09:00:23

Bad processes: 0

Registry Entries: 0

Finished : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt

[Hanz666]

RogueKiller V5.3.3 [08/18/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion- ... ntees.html

Operating System: Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User: Honza [Admin rights]
Mode: DNSFix -- Date : 08/22/2011 09:00:27

Bad processes: 0


Registry Entries: 0

Finished : << RKreport[4].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt

[Hanz666]

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Verze databáze: 7533

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

22.8.2011 9:44:50
mbam-log-2011-08-22 (09-44-44).txt

Typ kontroly: Úplný test (C:\|E:\|)
Testované objekty: 297909
Uplynulý čas: 36 minut, 36 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 40
Infikované hodnoty v registru: 6
Infikované datové položky v registru: 0
Infikované složky: 13
Infikované soubory: 106

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_CLASSES_ROOT\CLSID\{2863E737-DD3F-4280-9AF8-E9E79C16F312} (Adware.SkyMediaPack) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{27BA317E-7BBD-4EBE-A06A-47F076D9D6F7} (Adware.SkyMediaPack) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{2574231F-9D6F-4B0E-9041-5DD7484564AD} (Adware.SkyMediaPack) -> No action taken.
HKEY_CLASSES_ROOT\MinBHO.ShowBarObj.1 (Adware.SkyMediaPack) -> No action taken.
HKEY_CLASSES_ROOT\MinBHO.ShowBarObj (Adware.SkyMediaPack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2863E737-DD3F-4280-9AF8-E9E79C16F312} (Adware.SkyMediaPack) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2863E737-DD3F-4280-9AF8-E9E79C16F312} (Adware.SkyMediaPack) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2863E737-DD3F-4280-9AF8-E9E79C16F312} (Adware.SkyMediaPack) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{D7BE8ED1-B138-48FD-BB22-9779A39130B1} (Redir.GSearch) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{A1A1E70D-58C5-4349-83B6-BE9682B9874D} (Redir.GSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{4BF423F5-1689-4003-8A05-829048C7D869} (Redir.GSearch) -> No action taken.
HKEY_CLASSES_ROOT\SearchBHO.CSearchBHO.1 (Redir.GSearch) -> No action taken.
HKEY_CLASSES_ROOT\SearchBHO.CSearchBHO (Redir.GSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D7BE8ED1-B138-48FD-BB22-9779A39130B1} (Redir.GSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{D7BE8ED1-B138-48FD-BB22-9779A39130B1} (Redir.GSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D7BE8ED1-B138-48FD-BB22-9779A39130B1} (Redir.GSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{F334C7B0-8774-4d5b-BD7A-4F448D03A1AE} (Adware.SkyLab) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{70EF8B2A-3A34-4913-AAFC-5A2827E0B1B1} (Adware.SkyLab) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{AD49CE2B-B922-4E2A-AAD9-C1565855C7BC} (Adware.SkyLab) -> No action taken.
HKEY_CLASSES_ROOT\KBBar.KBBarBand.1 (Adware.SkyLab) -> No action taken.
HKEY_CLASSES_ROOT\KBBar.KBBarBand (Adware.SkyLab) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{F334C7B0-8774-4D5B-BD7A-4F448D03A1AE} (Adware.SkyLab) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{F334C7B0-8774-4D5B-BD7A-4F448D03A1AE} (Adware.SkyLab) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TNod (Trojan.Agent.CK) -> No action taken.
HKEY_CURRENT_USER\Software\SkyMedia (Adware.SkyMedia) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\sysdriver32.exe (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\systeminfog (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SaveTubeVideo_is1 (Adware.SkyLab) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\SERVICES32.EXE (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers (Trojan.Agent) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{B8D27088-FF5F-4B7C-98DC-0E91A1696286} (Adware.SkyLab) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{984A9162-8891-4D19-8CFE-17648BB4E1EC} (Spyware.GamePlayLabs) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{984A9162-8891-4D19-8CFE-17648BB4E1EC} (Spyware.GamePlayLabs) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{199C34A4-5436-403F-A250-219E16672570} (Spyware.GamePlayLabs) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{8E7AD93B-3E87-423D-947F-A321FA7E31C4} (Spyware.GamePlayLabs) -> No action taken.
HKEY_CLASSES_ROOT\BHO.GamePlayLabsBHO.1 (Spyware.GamePlayLabs) -> No action taken.
HKEY_CLASSES_ROOT\BHO.GamePlayLabsBHO (Spyware.GamePlayLabs) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{984A9162-8891-4D19-8CFE-17648BB4E1EC} (Spyware.GamePlayLabs) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{984A9162-8891-4D19-8CFE-17648BB4E1EC} (Spyware.GamePlayLabs) -> No action taken.

Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TNOD UP (Trojan.Agent.CK) -> Value: TNOD UP -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{D7BE8ED1-B138-48FD-BB22-9779A39130B1} (Redir.GSearch) -> Value: {D7BE8ED1-B138-48FD-BB22-9779A39130B1} -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{F334C7B0-8774-4D5B-BD7A-4F448D03A1AE} (Adware.SkyLab) -> Value: {F334C7B0-8774-4D5B-BD7A-4F448D03A1AE} -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{D7BE8ED1-B138-48FD-BB22-9779A39130B1} (Redir.GSearch) -> Value: {D7BE8ED1-B138-48FD-BB22-9779A39130B1} -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{F334C7B0-8774-4d5b-BD7A-4F448D03A1AE} (Adware.SkyLab) -> Value: {F334C7B0-8774-4d5b-BD7A-4F448D03A1AE} -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Services32.exe\close (Trojan.Agent) -> Value: close -> No action taken.

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
c:\Windows\rpcminer (Trojan.BCMiner) -> No action taken.
c:\program files\savetubevideo.com (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\content (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\locale (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\locale\en-US (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\skin (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\components (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\google custom search (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\searchhelper (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\searchhelper\content (Adware.SkyLab) -> No action taken.

Infikované soubory:
e:\program files\tnod user & password finder\TNODUP.exe (Trojan.Agent.CK) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\MinBHO.dll (Adware.SkyMediaPack) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\searchbho.dll (Redir.GSearch) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\savetubevideo.dll (Adware.SkyLab) -> No action taken.
c:\Users\Honza\Desktop\TNODUP.exe (Trojan.Agent.CK) -> No action taken.
c:\Windows\Temp\1590112.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\16610_myunrar2.exe (Trojan.Dropper) -> No action taken.
c:\Windows\Temp\86257742.exe (Trojan.Downloader) -> No action taken.
c:\Windows\Temp\9559617.exe (Trojan.Agent) -> No action taken.
e:\downloads\mediapluginsetup.exe (Spyware.GamePlayLabs) -> No action taken.
e:\downloads\ESET\eset nod32 antivirus 4 v4.2.64.12 100% works licence 32bit a 64bit cz\eset nod32 antivirus 4 4.2.64.12 32 a 64bit cz\TNODUP\tnodup setup.exe (Trojan.Agent.CK) -> No action taken.
e:\downloads\ESET\eset nod32 antivirus 4 v4.2.64.12 100% works licence 32bit a 64bit cz\eset nod32 antivirus 4 4.2.64.12 32 a 64bit cz\TNODUP\TNODUP.exe (Trojan.Agent.CK) -> No action taken.
e:\program files\tnod user & password finder\uninst-tnod.exe (Trojan.Agent.CK) -> No action taken.
c:\Windows\systemup.exe (Trojan.Agent.Gen) -> No action taken.
c:\Users\Honza\AppData\Local\Temp\2552409.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\2326711.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\2427289.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\2705458.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\3842923.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\3986650.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\4434209.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\6770414.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\8308196.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\8651004.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\9184797.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\9924210.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\50869100-loader2.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\157764468.exe (Trojan.FakeAlert.Gen) -> No action taken.
c:\Windows\l1rezerv.exe (Trojan.Agent) -> No action taken.
c:\Windows\sysdriver32.exe (Trojan.Delf) -> No action taken.
c:\Windows\sysdriver32_.exe (Trojan.Delf) -> No action taken.
c:\Windows\update.2\svchost.exe (Backdoor.Agent) -> No action taken.
c:\Windows\update.5.0\svchost.exe (Trojan.Downloader) -> No action taken.
c:\Windows\update.1\svchost.exe (Trojan.Agent) -> No action taken.
c:\Windows\services32.exe (Trojan.Agent) -> No action taken.
c:\Windows\rpcminer\bitcoinmineropencl.cl (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\bitcoinminercuda_10.cubin (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\bitcoinminercuda_11.cubin (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\bitcoinminercuda_20.cubin (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\cudart32_32_16.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\curllib.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\libeay32.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\libsasl.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\openldap.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-4way.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-cpu.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-cuda.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-opencl.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\ssleay32.dll (Trojan.BCMiner) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\browserstartpage.dll (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\Config.dat (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\downloader.exe (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\flvsplitter.ax (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\googlechromeextansion.exe (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\index.htm (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\installhelper.exe (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\lame.ax (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\preferencesoriginal (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\RegSetup.exe (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\starburnrds.dll (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\transport_dll.dll (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\unins000.dat (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\unins000.exe (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\Web Data (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\web data-journal (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\allkeywords.txt (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome.manifest (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\install.rdf (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\searchtoolbar@skywebsearch.com (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\content\about.xul (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\content\googlefeed.xml (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\content\googlesearch.htm (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\content\registerdialog.js (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\content\registerdialog.xul (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\content\settings.js (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\content\skysearchtoolbar.js (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\content\skysearchtoolbar.xul (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\content\startabout.js (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\content\unregister.xul (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\locale\en-US\skysearchtoolbar.dtd (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\locale\en-US\toolbar.properties (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\skin\about.png (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\skin\aboutDlg.png (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\skin\addvideo.png (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\skin\bigbutton.png (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\skin\burnit.png (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\skin\gripper.png (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\skin\icon.png (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\skin\icon16-16.png (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\skin\register.png (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\skin\savevideo.png (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\skin\savevideo2.png (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\skin\search.png (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\skin\settings.png (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\skin\showstatus.png (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\skin\skysearchtoolbar.css (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\skin\smile!.png (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\chrome\skin\videooftheday.png (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\components\ISwslib.xpt (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\components\nsirdshistoryservice.js (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\components\nsirdshistoryservice.xpt (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\components\rdstb-autocomplete.js (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\FF\components\swslib.dll (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\google custom search\index.htm (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\google custom search\manifest.json (Adware.SkyLab) -> No action taken.
c:\program files\savetubevideo.com\savetubevideo\google custom search\redirect.html (Adware.SkyLab) -> No action taken.

[motji]

Vše smažte.


Spusťte combofix podle tohoto návodu
http://www.bleepingcomputer.com/combofi ... t-combofix

[Hanz666]

Mockrát děkuju, zdá se být vše vpořádku

[motji]

Prosila bych ten log z combofixu, bude potřeba něco domazat. Ale budu tu až v noci,asi po 9.hodině

[Hanz666]

ComboFix 11-08-22.02 - Honza 22.08.2011 9:57.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1250.420.1029.18.2560.1586 [GMT 2:00]
Spuštěný z: c:\users\Honza\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\CFLog
c:\windows\btc_client_iplist.txt
c:\windows\front_ip_list.txt
c:\windows\geoiplist
c:\windows\geoiplist.rar
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\loader2.exe_ok
c:\windows\phoenix
c:\windows\phoenix.rar
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\__init__.pyc
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\proc_list1.log
c:\windows\rpcminer.rar
c:\windows\system32\drivers\etc\HSTS~1
c:\windows\ufa.rar
c:\windows\update.1
c:\windows\update.2
c:\windows\update.5.0
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
c:\windows\winsetupapi.log
E:\install.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-22 do 2011-08-22 )))))))))))))))))))))))))))))))
.
.
2011-08-22 08:02 . 2011-08-22 08:04 -------- d-----w- c:\users\Honza\AppData\Local\temp
2011-08-22 07:05 . 2011-08-22 07:05 -------- d-----w- c:\users\Honza\AppData\Roaming\Malwarebytes
2011-08-22 07:05 . 2010-11-29 15:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-22 07:05 . 2011-08-22 07:05 -------- d-----w- c:\programdata\Malwarebytes
2011-08-22 07:05 . 2010-11-29 15:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-22 06:21 . 2011-08-22 06:22 -------- d-----w- c:\program files\trend micro
2011-08-22 06:21 . 2011-08-22 06:22 -------- d-----w- C:\rsit
2011-08-21 20:04 . 2011-08-21 20:05 302592 ----a-w- c:\windows\system32\cmd.execf
2011-08-21 18:27 . 2011-08-21 18:27 -------- d--h--w- c:\windows\update.7.1
2011-08-21 18:24 . 2011-08-21 18:24 -------- d-----w- c:\windows\ufa
2011-08-21 18:21 . 2011-08-21 18:24 246272 ----a-w- c:\windows\unrar.exe
2011-08-21 18:18 . 2011-08-21 18:18 -------- d-----w- c:\windows\av_ico
2011-08-21 18:16 . 2011-08-21 18:16 -------- d--h--w- c:\windows\update.tray-2-0
2011-08-21 18:16 . 2011-08-21 18:16 -------- d--h--w- c:\windows\update.tray-2-0-lnk
2011-08-20 13:27 . 2011-08-12 02:44 7152464 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{B6C2F776-A945-462C-A055-3967B49E40FC}\mpengine.dll
2011-08-14 10:57 . 2011-08-20 13:58 -------- d-----w- c:\users\Honza\AppData\Roaming\Mumble
2011-08-09 20:14 . 2011-06-23 04:33 3912576 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-08-04 15:57 . 2011-08-04 15:57 -------- d-----w- c:\program files\Common Files\Java
2011-07-23 16:39 . 2011-07-23 16:40 -------- d-----w- c:\programdata\Blizzard Entertainment
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-24 05:47 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2011-06-16 12:49 . 2010-10-02 15:00 138160 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-06-16 12:49 . 2011-03-05 09:15 271200 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-06-16 12:49 . 2010-10-02 15:00 271200 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-06-16 12:32 . 2010-10-02 15:00 271200 ----a-w- c:\windows\system32\PnkBstrB.ex0
2011-06-11 02:29 . 2011-07-12 22:39 2334208 ----a-w- c:\windows\system32\win32k.sys
2011-05-24 17:14 . 2010-09-30 10:13 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-05-24 10:44 . 2011-06-29 03:59 293376 ----a-w- c:\windows\system32\umpnpmgr.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2009-04-14 604704]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"Malwarebytes' Anti-Malware (reboot)"="e:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-11-29 963976]
.
c:\users\Honza\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 ekrn;ESET Service;e:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [x]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-04 136176]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-04 136176]
R3 PAC207;VideoCAM GE111;c:\windows\system32\DRIVERS\pfc027.sys [2005-04-08 162176]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-30 1343400]
R3 XDva370;XDva370;c:\windows\system32\XDva370.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-12-27 691696]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-07-29 115008]
S2 ddservice;ddservice;c:\windows\update.7.1\svchostdriver.exe [2011-08-21 382464]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-07-29 136632]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-07-29 96920]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-08-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cc5223927ed96c.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-12 13:53]
.
2011-07-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1622515577-2608472290-2080195198-1000Core1cc4e9057fa610a.job
- c:\users\Honza\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-04 13:53]
.
2011-01-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1622515577-2608472290-2080195198-1000UA.job
- c:\users\Honza\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-04 13:53]
.
2011-04-27 c:\windows\Tasks\User_Feed_Synchronization-{116B0E6C-2B09-4589-8B8B-74711F74D5A7}.job
- c:\windows\system32\msfeedssync.exe [2011-04-27 17:22]
.
2011-07-01 c:\windows\Tasks\{11A99E4C-C5CF-41CE-A828-96B30F776130}.job
- c:\program files\Skype\Phone\Skype.exe [2011-06-15 13:02]
.
2011-06-09 c:\windows\Tasks\{155463D0-3B22-492C-B8E8-92E1FA47023F}.job
- c:\program files\Skype\Phone\Skype.exe [2011-06-15 13:02]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.smartwebsearch.net/index.php?from=3
uInternet Settings,ProxyOverride = <local>
TCP: DhcpNameServer = 217.170.96.24 217.170.96.2
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM-Run-egui - e:\program files\ESET\ESET NOD32 Antivirus\egui.exe
HKLM-Run-WinampAgent - e:\program files\Winamp\winampa.exe
HKLM-Run-tray_ico - (no file)
HKLM-Run-tray_ico1 - (no file)
HKLM-Run-tray_ico2 - (no file)
HKLM-Run-tray_ico3 - (no file)
HKLM-Run-tray_ico4 - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\taskhost.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\System32\PAStiSvc.exe
c:\windows\system32\conhost.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Celkový čas: 2011-08-22 10:08:34 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-22 08:08
.
Před spuštěním: Volných bajtů: 15 043 342 336
Po spuštění: Volných bajtů: 23 563 382 784
.
- - End Of File - - D97FC3C6086541F9540A01CA330E04C5

[JaRon]

zaskocim:
Presun ComboFix
na plochu (ak tam este nie je)

otvor si Poznamkovy blok - notepad

do neho zkopiruj skript z nasledujiceho okna:

Kód: Vybrat vše

Driver::
XDva370

Folder::
c:\windows\update.7.1
c:\windows\ufa

uloz vytvoreny textovy soubor ako CFScript.txt na plochu

po ulozeni uchop vytvoreny skript lavym tlacitkom mysi a presun ho nad ikonu Combofixu, nad nim skript upust:



po aplikacii by mal vzniknut dalsi log, ten vloz sem

[Hanz666]

Použité ovládací přepínače :: c:\users\Honza\Desktop\CFScript.txt
AV: ESET NOD32 Antivirus 4.2 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 4.2 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\ufa
c:\windows\ufa\ufa.exe
c:\windows\update.7.1
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_XDVA370
-------\Service_XDva370
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-22 do 2011-08-22 )))))))))))))))))))))))))))))))
.
.
2011-08-22 11:48 . 2011-08-22 11:50 -------- d-----w- c:\users\Honza\AppData\Local\temp
2011-08-22 11:48 . 2011-08-22 11:48 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-22 08:27 . 2011-08-22 08:27 -------- d-----w- c:\program files\ESET
2011-08-22 07:05 . 2011-08-22 07:05 -------- d-----w- c:\users\Honza\AppData\Roaming\Malwarebytes
2011-08-22 07:05 . 2010-11-29 15:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-22 07:05 . 2011-08-22 07:05 -------- d-----w- c:\programdata\Malwarebytes
2011-08-22 07:05 . 2010-11-29 15:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-22 06:21 . 2011-08-22 06:22 -------- d-----w- c:\program files\trend micro
2011-08-22 06:21 . 2011-08-22 06:22 -------- d-----w- C:\rsit
2011-08-21 20:04 . 2011-08-21 20:05 302592 ----a-w- c:\windows\system32\cmd.execf
2011-08-21 18:21 . 2011-08-21 18:24 246272 ----a-w- c:\windows\unrar.exe
2011-08-21 18:18 . 2011-08-21 18:18 -------- d-----w- c:\windows\av_ico
2011-08-21 18:16 . 2011-08-22 11:26 -------- d--h--w- c:\windows\update.tray-2-0-lnk
2011-08-21 18:16 . 2011-08-21 18:16 -------- d--h--w- c:\windows\update.tray-2-0
2011-08-20 13:27 . 2011-08-12 02:44 7152464 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{B6C2F776-A945-462C-A055-3967B49E40FC}\mpengine.dll
2011-08-14 10:57 . 2011-08-20 13:58 -------- d-----w- c:\users\Honza\AppData\Roaming\Mumble
2011-08-09 20:14 . 2011-06-23 04:33 3912576 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-08-04 15:57 . 2011-08-04 15:57 -------- d-----w- c:\program files\Common Files\Java
2011-07-23 16:39 . 2011-07-23 16:40 -------- d-----w- c:\programdata\Blizzard Entertainment
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-24 05:47 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2011-06-16 12:49 . 2010-10-02 15:00 138160 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-06-16 12:49 . 2011-03-05 09:15 271200 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-06-16 12:49 . 2010-10-02 15:00 271200 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-06-16 12:32 . 2010-10-02 15:00 271200 ----a-w- c:\windows\system32\PnkBstrB.ex0
2011-06-11 02:29 . 2011-07-12 22:39 2334208 ----a-w- c:\windows\system32\win32k.sys
2011-05-24 17:14 . 2010-09-30 10:13 222080 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2009-04-14 604704]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"Malwarebytes' Anti-Malware (reboot)"="e:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-11-29 963976]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-08-12 2215064]
.
c:\users\Honza\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableSecureUIAPaths"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-04 136176]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-04 136176]
R3 PAC207;VideoCAM GE111;c:\windows\system32\DRIVERS\pfc027.sys [2005-04-08 162176]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-30 1343400]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-12-27 691696]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-07-29 115008]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-07-29 136632]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-08-12 810144]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-07-29 96920]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2011-08-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cc5223927ed96c.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-12 13:53]
.
2011-07-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1622515577-2608472290-2080195198-1000Core1cc4e9057fa610a.job
- c:\users\Honza\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-04 13:53]
.
2011-08-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1622515577-2608472290-2080195198-1000UA.job
- c:\users\Honza\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-04 13:53]
.
2011-07-01 c:\windows\Tasks\{11A99E4C-C5CF-41CE-A828-96B30F776130}.job
- c:\program files\Skype\Phone\Skype.exe [2011-06-15 13:02]
.
2011-06-09 c:\windows\Tasks\{155463D0-3B22-492C-B8E8-92E1FA47023F}.job
- c:\program files\Skype\Phone\Skype.exe [2011-06-15 13:02]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.smartwebsearch.net/index.php?from=3
uInternet Settings,ProxyOverride = <local>
TCP: DhcpNameServer = 217.170.96.24 217.170.96.2
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\taskhost.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\System32\PAStiSvc.exe
c:\windows\system32\conhost.exe
c:\windows\SOUNDMAN.EXE
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Celkový čas: 2011-08-22 13:53:35 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-22 11:53
.
Před spuštěním: Volných bajtů: 23 646 257 152
Po spuštění: Volných bajtů: 23 342 247 936
.
- - End Of File - - 427C93F07EA9ED26C6912E4877FAD010

[motji]

Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

File::
c:\windows\unrar.exe

Folder::
c:\windows\av_ico
c:\windows\update.tray-2-0-lnk
 c:\windows\update.tray-2-0

-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:




-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci