facebook vir

[pasecak]

Log z programu RSIT:

Logfile of random's system information tool 1.09 (written by random/random)
Run by Lukas at 2011-10-31 16:20:26
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 231 GB (48%) free of 477 GB
Total RAM: 4094 MB (65% free)

HijackThis download failed

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
winlogon.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
atieclxx
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe" -s
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
"c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sECSQLEXPRESS
C:\Windows\system32\DRIVERS\o2flash.exe
"c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe"
"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
taskeng.exe {C84CFF07-2994-45AF-8F3A-EE565A73D408}
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe" -boot
"C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe"
"C:\Program Files (x86)\Anti-Vibrate Oscar Editor\OscarEditor.exe" Minimum
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
C:\Windows\system32\svchost.exe -k imgsvc
"C:\QIP Infium JadrisPack\qip.exe" /isolated /autorun
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
"C:\Program Files (x86)\BitTorrent\BitTorrent.exe"
"C:\Program Files (x86)\Camera Assistant Software for Toshiba\traybar.exe" /start
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM"
"C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe"
"C:\Program Files (x86)\Edgecam\Cam\cls.exe"
"C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe"
"C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe"
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
"C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\\TosA2dp.exe"
"C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\\TosBtHid.exe"
"C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\\TosBtHsp.exe"
"C:\QIP Infium JadrisPack\Plugins\GadgetEngine\GadgetEngine.exe" -Embedding
"C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe" -CtxID "#Hewlett-Packard#HP Deskjet F2100 series#1303145707" -Startup
"C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe"
"C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe" -Embedding
"C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe"
"C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe" -Embedding
"C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe"
"C:\Program Files (x86)\Nero\Update\NASvc.exe"
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\Opera\opera.exe"
"C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe" /o /eo /l /b /id 3028
"C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe" --channel=3932.0058F7F8.1028118354 --type=renderer /o /eo /l /b /id 3028
"C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-f3948ea0-bac2-44fe-8b06-1c4dbc9875fe -SystemEventPortName:HostProcess-6982b74a-f627-446a-87ab-db4e6d3e9742 -IoCancelEventPortName:HostProcess-596cf63f-3283-4d41-b4d5-829676ea4856 -NonStateChangingEventPortName:HostProcess-16c64fc6-7c66-477f-9acd-226084e57a89 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:d094d48e-bcc9-4330-91ce-5d2f69b7b2a7
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 508 512 520 65536 516
"E:\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3945649828-885204155-1438880752-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3945649828-885204155-1438880752-1000UA.job
C:\Windows\tasks\SlimDrivers Startup.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Lukas\AppData\Roaming\Mozilla\Firefox\Profiles\o9wczqg1.default

prefs.js - "browser.startup.homepage" - "www.seznam.cz"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files (x86)\Mozilla Firefox\plugins\
np-mswmp.dll
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Lukas\AppData\Roaming\Mozilla\Firefox\Profiles\o9wczqg1.default\extensions\
engine@conduit.com
{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
HP Print Enhancer - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20 328248]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}]
C:\PROGRA~2\SITERA~1\SiteRank.dll [2011-04-01 351448]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-09-05 63912]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
Conduit Engine - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll [2010-11-29 3908192]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
MyAshampoo Toolbar - C:\Program Files (x86)\MyAshampoo\tbMyAs.dll [2010-11-29 3908192]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-03-15 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}]
HP Smart BHO Class - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20 509496]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - MyAshampoo Toolbar - C:\Program Files (x86)\MyAshampoo\tbMyAs.dll [2010-11-29 3908192]
{30F9B915-B755-4826-820B-08FBA6BD249D} - Conduit Engine - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll [2010-11-29 3908192]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"cAudioFilterAgent"=C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [2000-01-01 503864]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\Lukas\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-14 136176]
"OscarEditor"=C:\Program Files (x86)\Anti-Vibrate Oscar Editor\OscarEditor.exe [2009-12-22 2647040]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1475584]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]
"Infium"=C:\QIP Infium JadrisPack\qip.exe [2010-09-27 5896656]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2011-04-18 17095048]
"BitTorrent"=C:\Program Files (x86)\BitTorrent\BitTorrent.exe [2011-05-12 400760]
"MediaGet2"=C:\Users\Lukas\AppData\Local\MediaGet2\mediaget.exe --minimized []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-12-01 98304]
"Camera Assistant Software"=C:\Program Files (x86)\Camera Assistant Software for Toshiba\traybar.exe [2009-04-10 417792]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-10-29 249064]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"ITSecMng"=C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START []
"SiteRanker"=C:\Program Files (x86)\SiteRanker\SiteRankTray.exe [2011-09-12 320000]
"hpqSRMon"=C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [2008-07-22 150528]
"HP Software Update"=C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [2007-05-08 54840]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06 937920]
"LogMeIn Hamachi Ui"=C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2011-08-15 1955208]
"wxpdrv"=C:\Windows\update.1\svchost.exe [2011-10-30 1109504]
"2239195.exe"=C:\Users\Lukas\AppData\Local\Temp\2 [2011-10-28 16384]
"sysdriver32.exe"=C:\Windows\sysdriver32.exe [2011-10-30 258048]
"sysdriver32_.exe"=C:\Windows\sysdriver32_.exe [2011-10-30 258048]
"612788.exe"=C:\Windows\Temp\612788.exe [2011-10-30 258048]
"1377789.exe"=C:\Users\Lukas\AppData\Local\Temp\1377789.exe [2011-10-30 258048]
"675396.exe"=C:\Windows\Temp\675396.exe [2011-10-30 1942528]
"6501228.exe"=C:\Windows\Temp\6501228.exe [2011-10-30 258048]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth Manager.lnk - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
CLS12.50.lnk - C:\Program Files (x86)\Edgecam\Cam\cls.exe
HP Digital Imaging Monitor.lnk - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\wxpdrivers]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableSecureUIAPaths"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-10-31 16:20:26 ----D---- C:\rsit
2011-10-31 16:20:26 ----D---- C:\Program Files\trend micro
2011-10-30 16:42:42 ----D---- C:\Program Files (x86)\AMD APP
2011-10-30 16:31:30 ----D---- C:\ATI
2011-10-30 16:24:07 ----D---- C:\Windows\ufa
2011-10-30 16:24:07 ----D---- C:\Windows\rpcminer
2011-10-30 16:24:07 ----D---- C:\Windows\phoenix
2011-10-30 16:23:40 ----A---- C:\Windows\btc_client_iplist.txt
2011-10-30 16:22:33 ----HD---- C:\Windows\update.5.0
2011-10-30 16:21:37 ----A---- C:\Windows\iecheck_iplist.txt
2011-10-30 16:21:23 ----A---- C:\Windows\unrar.exe
2011-10-30 16:21:14 ----HD---- C:\Windows\update.2
2011-10-30 16:20:50 ----A---- C:\Windows\iplist.txt
2011-10-30 16:20:39 ----A---- C:\Windows\sysdriver32_.exe
2011-10-30 16:20:24 ----A---- C:\Windows\sysdriver32.exe
2011-10-30 16:20:09 ----A---- C:\Windows\front_ip_list.txt
2011-10-30 16:19:54 ----A---- C:\Windows\services32.exe
2011-10-30 16:19:53 ----HD---- C:\Windows\update.1
2011-10-29 20:07:45 ----D---- C:\Program Files (x86)\Stronghold Crusader1
2011-10-13 21:22:58 ----A---- C:\Windows\system32\win32k.sys
2011-10-13 21:22:54 ----A---- C:\Windows\system32\ieframe.dll
2011-10-13 21:22:51 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-10-13 21:22:49 ----A---- C:\Windows\system32\mshtml.dll
2011-10-13 21:22:47 ----A---- C:\Windows\system32\wininet.dll
2011-10-13 21:22:46 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-10-13 21:22:46 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-10-13 21:22:46 ----A---- C:\Windows\system32\urlmon.dll
2011-10-13 21:22:45 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-10-13 21:22:45 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2011-10-13 21:22:45 ----A---- C:\Windows\SYSWOW64\ieui.dll
2011-10-13 21:22:45 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-10-13 21:22:45 ----A---- C:\Windows\system32\msfeeds.dll
2011-10-13 21:22:45 ----A---- C:\Windows\system32\ieui.dll
2011-10-13 21:22:45 ----A---- C:\Windows\system32\iertutil.dll
2011-10-13 21:22:44 ----A---- C:\Windows\SYSWOW64\url.dll
2011-10-13 21:22:44 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-10-13 21:22:44 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2011-10-13 21:22:44 ----A---- C:\Windows\system32\url.dll
2011-10-13 21:22:44 ----A---- C:\Windows\system32\mshtmled.dll
2011-10-13 21:22:44 ----A---- C:\Windows\system32\jsproxy.dll
2011-10-13 21:22:33 ----A---- C:\Windows\SYSWOW64\psisdecd.dll
2011-10-13 21:22:33 ----A---- C:\Windows\system32\psisdecd.dll
2011-10-13 21:22:23 ----A---- C:\Windows\SYSWOW64\oleaut32.dll
2011-10-13 21:22:23 ----A---- C:\Windows\SYSWOW64\oleacc.dll
2011-10-13 21:22:23 ----A---- C:\Windows\system32\oleacc.dll
2011-10-13 21:22:22 ----A---- C:\Windows\system32\oleaut32.dll
2011-10-09 17:13:05 ----D---- C:\ae016c94f096c2d464647791139a0d
2011-10-09 17:12:34 ----D---- C:\2de9fad857fbb93b6e28a6aa7bef
2011-10-08 15:28:40 ----D---- C:\ProgramData\SafeNet Sentinel
2011-10-08 15:27:53 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2011-10-08 15:25:00 ----D---- C:\Program Files\Microsoft SQL Server
2011-10-08 15:24:57 ----D---- C:\Program Files (x86)\Microsoft SQL Server
2011-10-08 15:24:37 ----A---- C:\Windows\SYSWOW64\tsccvid.dll
2011-10-08 15:24:36 ----A---- C:\Windows\SYSWOW64\SNTI386.DLL
2011-10-08 15:24:36 ----A---- C:\Windows\SYSWOW64\RNBOVDD.DLL
2011-10-08 15:24:36 ----A---- C:\Windows\SYSWOW64\drivers\SENTINEL.SYS
2011-10-08 15:24:35 ----D---- C:\Windows\SYSWOW64\RNBOSENT
2011-10-08 15:24:35 ----A---- C:\Windows\SYSWOW64\drivers\hardlock.sys
2011-10-08 15:24:23 ----A---- C:\Windows\SYSWOW64\haspvdd.dll
2011-10-08 15:24:23 ----A---- C:\Windows\SYSWOW64\haspdos.sys
2011-10-08 15:24:23 ----A---- C:\Windows\SYSWOW64\drivers\Haspnt.sys
2011-10-08 15:23:45 ----A---- C:\Windows\SYSWOW64\VBAR332.DLL
2011-10-08 15:23:45 ----A---- C:\Windows\SYSWOW64\msxbse35.dll
2011-10-08 15:23:45 ----A---- C:\Windows\SYSWOW64\mstext35.dll
2011-10-08 15:23:45 ----A---- C:\Windows\SYSWOW64\msrpfs35.dll
2011-10-08 15:23:45 ----A---- C:\Windows\SYSWOW64\msrepl35.dll
2011-10-08 15:23:45 ----A---- C:\Windows\SYSWOW64\msrd2x35.dll
2011-10-08 15:23:45 ----A---- C:\Windows\SYSWOW64\mspdox35.dll
2011-10-08 15:23:45 ----A---- C:\Windows\SYSWOW64\msltus35.dll
2011-10-08 15:23:45 ----A---- C:\Windows\SYSWOW64\msjter35.dll
2011-10-08 15:23:45 ----A---- C:\Windows\SYSWOW64\msjt4jlt.dll
2011-10-08 15:23:45 ----A---- C:\Windows\SYSWOW64\msjint35.dll
2011-10-08 15:23:45 ----A---- C:\Windows\SYSWOW64\msjet35.dll
2011-10-08 15:23:45 ----A---- C:\Windows\SYSWOW64\msexch35.dll
2011-10-08 15:23:45 ----A---- C:\Windows\SYSWOW64\msexcl35.dll
2011-10-08 15:23:45 ----A---- C:\Windows\SYSWOW64\JETCOMP.exe
2011-10-08 15:23:41 ----N---- C:\Windows\SYSWOW64\msxml4a.dll
2011-10-08 15:23:41 ----N---- C:\Windows\SYSWOW64\Msvcp50.dll
2011-10-08 15:23:41 ----N---- C:\Windows\SYSWOW64\HHActiveX.dll
2011-10-08 15:22:03 ----D---- C:\Program Files (x86)\Edgecam
2011-10-05 18:22:15 ----D---- C:\Program Files (x86)\Team17

======List of files/folders modified in the last 1 month======

2011-10-31 16:20:27 ----D---- C:\Windows\Prefetch
2011-10-31 16:20:26 ----RD---- C:\Program Files
2011-10-31 16:20:24 ----D---- C:\Windows\Temp
2011-10-31 16:17:12 ----D---- C:\Windows\System32
2011-10-31 16:17:12 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-10-31 16:17:11 ----D---- C:\Windows\inf
2011-10-31 16:16:11 ----D---- C:\Users\Lukas\AppData\Roaming\Skype
2011-10-31 16:16:07 ----D---- C:\Users\Lukas\AppData\Roaming\BitTorrent
2011-10-31 12:39:53 ----D---- C:\Windows\system32\drivers
2011-10-30 21:47:16 ----D---- C:\Windows\system32\config
2011-10-30 18:59:15 ----D---- C:\Windows\SysWOW64
2011-10-30 18:53:52 ----D---- C:\Program Files (x86)\Opera
2011-10-30 17:55:12 ----SHD---- C:\System Volume Information
2011-10-30 16:42:43 ----SHD---- C:\Windows\Installer
2011-10-30 16:42:43 ----HD---- C:\Config.Msi
2011-10-30 16:42:42 ----RD---- C:\Program Files (x86)
2011-10-30 16:24:07 ----D---- C:\Windows
2011-10-30 16:21:36 ----D---- C:\Windows\system32\drivers\etc
2011-10-27 21:33:18 ----D---- C:\Windows\Registration
2011-10-27 19:49:59 ----D---- C:\Program Files (x86)\Diablo II
2011-10-17 06:56:15 ----D---- C:\Windows\debug
2011-10-16 16:11:31 ----D---- C:\Program Files (x86)\SiteRanker
2011-10-14 18:08:30 ----D---- C:\Windows\Microsoft.NET
2011-10-14 18:08:22 ----RSD---- C:\Windows\assembly
2011-10-14 16:52:54 ----D---- C:\Windows\winsxs
2011-10-14 16:51:46 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2011-10-14 16:50:41 ----D---- C:\Windows\SYSWOW64\migration
2011-10-14 16:50:41 ----D---- C:\Windows\system32\migration
2011-10-14 16:50:41 ----D---- C:\Windows\ehome
2011-10-14 16:50:41 ----D---- C:\Program Files\Internet Explorer
2011-10-14 16:50:41 ----D---- C:\Program Files (x86)\Internet Explorer
2011-10-14 16:41:54 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-10-14 16:41:29 ----D---- C:\Program Files (x86)\Common Files
2011-10-14 05:04:10 ----A---- C:\Windows\system32\MRT.exe
2011-10-14 05:03:29 ----D---- C:\ProgramData\Microsoft Help
2011-10-13 21:22:17 ----D---- C:\Windows\system32\catroot
2011-10-13 21:21:52 ----D---- C:\Windows\system32\catroot2
2011-10-12 06:18:59 ----D---- C:\Windows\system32\wdi
2011-10-08 15:28:40 ----HD---- C:\ProgramData
2011-10-08 15:26:27 ----D---- C:\Program Files (x86)\Microsoft.NET
2011-10-08 15:24:36 ----D---- C:\Windows\SYSWOW64\drivers
2011-10-08 15:24:27 ----D---- C:\Windows\system32\DriverStore
2011-10-08 15:24:23 ----D---- C:\Windows\SYSWOW64\Setup
2011-10-08 15:19:31 ----D---- C:\Windows\system32\Tasks
2011-10-01 11:54:30 ----D---- C:\Program Files (x86)\FMS

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 TVALZ;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver; C:\Windows\system32\DRIVERS\TVALZ_O.SYS [2007-11-09 26968]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2011-03-17 254528]
R1 Tosrfcom;Bluetooth RFCOMM; C:\Windows\System32\Drivers\tosrfcom.sys [2010-11-29 82224]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2000-01-01 6175744]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2000-01-01 684544]
R3 CnxtHdmiAudService;Conexant UAA HDMI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDMI64.sys [2000-01-01 684544]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 33856]
R3 NETwLv64; Ovladač adaptéru řady Intel(R) Wireless WiFi Link 5000 pro systém Windows Vista 64 Bit; C:\Windows\system32\DRIVERS\NETwLv64.sys [2000-01-01 7533568]
R3 O2MDRDR;O2MDRDR; C:\Windows\system32\DRIVERS\o2mdx64.sys [2009-07-13 64160]
R3 sdbus;sdbus; C:\Windows\system32\drivers\sdbus.sys [2010-11-20 109056]
R3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
R3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
R3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
R3 tosporte;Bluetooth COM Port; C:\Windows\system32\DRIVERS\tosporte.sys [2009-06-17 54664]
R3 tosrfbd;Bluetooth RFBUS; C:\Windows\system32\DRIVERS\tosrfbd.sys [2010-12-12 291760]
R3 tosrfec;Bluetooth ACPI; C:\Windows\system32\DRIVERS\tosrfec.sys [2010-06-18 18872]
R3 Tosrfhid;Bluetooth RFHID; C:\Windows\system32\DRIVERS\Tosrfhid.sys [2010-08-30 94528]
R3 Tosrfusb;Bluetooth USB Controller; C:\Windows\system32\DRIVERS\tosrfusb.sys [2010-12-02 67384]
R3 UVCFTR;UVCFTR; C:\Windows\System32\Drivers\UVCFTR_S.SYS [2009-04-10 20520]
S2 Hardlock;Hardlock; \??\C:\Windows\system32\drivers\hardlock.sys []
S2 Haspnt;Haspnt; \??\C:\Windows\system32\drivers\Haspnt.sys []
S2 Sentinel;Sentinel; C:\Windows\System32\Drivers\SENTINEL.SYS []
S3 Dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2009-07-14 145920]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\drivers\Dot4Prt.sys [2010-11-20 19968]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2009-07-14 43008]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series – ovladač adaptéru pro 64bitový systém Windows Vista; C:\Windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]
S3 O2SDRDR;O2SDRDR; C:\Windows\system32\DRIVERS\o2sdx64.sys [2000-01-01 49696]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 20992]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 SWDUMon;SWDUMon; C:\Windows\system32\DRIVERS\SWDUMon.sys [2011-10-31 15672]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 tosrfbnp;Bluetooth RFBNEP; C:\Windows\System32\Drivers\tosrfbnp.sys [2010-11-11 50864]
S3 tosrfnds;Bluetooth Personal Area Network; C:\Windows\system32\DRIVERS\tosrfnds.sys [2009-07-24 26472]
S3 TosRfSnd;Bluetooth Audio; C:\Windows\system32\drivers\tosrfsnd.sys [2010-04-26 63488]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2000-01-01 202752]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine; C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-08-15 2329480]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R2 MSSQL$ECSQLEXPRESS;SQL Server (ECSQLEXPRESS); c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
R2 NAUpdate;@C:\Program Files (x86)\Nero\Update\NASvc.exe,-200; C:\Program Files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
R2 O2FLASH;O2FLASH; C:\Windows\system32\DRIVERS\o2flash.exe [2000-01-01 65536]
R2 SQLBrowser;SQL Server Browser; c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2010-12-10 238944]
R2 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2010-12-10 153440]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R3 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service; C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2010-04-12 196976]
S2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S2 srvbtcclient;srvbtcclient; C:\Windows\update.5.0\svchost.exe [2011-10-30 344576]
S2 srviecheck;srviecheck; C:\Windows\update.2\svchost.exe [2011-10-30 1942528]
S2 srvsysdriver32;srvsysdriver32; C:\Windows\sysdriver32.exe [2011-10-30 258048]
S2 wxpdrivers;wxpdrivers; C:\Windows\update.1\svchost.exe [2011-10-30 1109504]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-03-17 1255736]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2010-12-10 44384]

-----------------EOF-----------------

[cernohous13]

Zdravím,

stáhni a spusť http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe
dej volbu 2 - vytvořený log sem zkopíruj

opakuj s volbou 3 a 4 (logy mi dej)

Stáhni a nainstaluj MBAM zde http://www.download.com/Malwarebytes-An ... tag=button
Spustit > na 3.záložce "Aktualizace" > Kontrola aktualizací
následně na 1.záložce "Kontrolor" -> Úplná kontrola -> Prohledat
po ukončení -> Zobrazit výsledky -> zkontrolovat zda je vše označeno -> Odstranit označené
vyběhne log, ve kterém budou záznamy tohoto typu:
Infikované adresáře:
C:\Program Files\xxxxxx -> Quarantined and deleted successfully.
ten bych rád viděl

[pasecak]

log z volby 2:
RogueKiller V6.1.5 [10/29/2011] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: hxxp://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: Lukas [Admin rights]
Mode: Remove -- Date : 10/31/2011 17:48:07

Bad processes: 4
[SERVICE] srvbtcclient -- C:\Windows\update.5.0\svchost.exe srv -> STOPPED
[SERVICE] srviecheck -- C:\Windows\update.2\svchost.exe srv -> STOPPED
[SERVICE] srvsysdriver32 -- C:\Windows\sysdriver32.exe srv -> STOPPED
[SERVICE] wxpdrivers -- C:\Windows\update.1\svchost.exe srv -> STOPPED

Registry Entries: 13
[SUSP PATH] HKCU\[...]\Run : MediaGet2 (C:\Users\Lukas\AppData\Local\MediaGet2\mediaget.exe --minimized) -> DELETED
[BLACKLIST] HKLM\[...]\services : srvbtcclient (C:\Windows\update.5.0\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srviecheck (C:\Windows\update.2\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srvsysdriver32 (C:\Windows\sysdriver32.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : wxpdrivers (C:\Windows\update.1\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srvbtcclient (C:\Windows\update.5.0\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srviecheck (C:\Windows\update.2\svchost.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : srvsysdriver32 (C:\Windows\sysdriver32.exe srv) -> DELETED
[BLACKLIST] HKLM\[...]\services : wxpdrivers (C:\Windows\update.1\svchost.exe srv) -> DELETED
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED ()
[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED ()
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED ()
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED ()

Particular Files / Folders:

Driver: [NOT LOADED]

HOSTS File:
127.0.0.1 localhost
127.0.0.1 facebook.com
127.0.0.1 www.facebook.com
127.0.0.1 af-za.facebook.com
127.0.0.1 az-az.facebook.com
127.0.0.1 id-id.facebook.com
127.0.0.1 ms-my.facebook.com
127.0.0.1 bs-ba.facebook.com
127.0.0.1 ca-es.facebook.com
127.0.0.1 cs-cz.facebook.com
127.0.0.1 cy-gb.facebook.com
127.0.0.1 da-dk.facebook.com
127.0.0.1 de-de.facebook.com
127.0.0.1 et-ee.facebook.com
127.0.0.1 en-gb.facebook.com
127.0.0.1 es-la.facebook.com
127.0.0.1 eo-eo.facebook.com
127.0.0.1 eu-es.facebook.com
127.0.0.1 tl-ph.facebook.com
127.0.0.1 fo-fo.facebook.com
[...]


Finished : << RKreport[1].txt >>
RKreport[1].txt



log z volby 3:
RogueKiller V6.1.5 [10/29/2011] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: hxxp://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: Lukas [Admin rights]
Mode: HOSTSFix -- Date : 10/31/2011 17:48:39

Bad processes: 0

Driver: [NOT LOADED]

HOSTS File:
127.0.0.1 localhost
127.0.0.1 facebook.com
127.0.0.1 www.facebook.com
127.0.0.1 af-za.facebook.com
127.0.0.1 az-az.facebook.com
127.0.0.1 id-id.facebook.com
127.0.0.1 ms-my.facebook.com
127.0.0.1 bs-ba.facebook.com
127.0.0.1 ca-es.facebook.com
127.0.0.1 cs-cz.facebook.com
127.0.0.1 cy-gb.facebook.com
127.0.0.1 da-dk.facebook.com
127.0.0.1 de-de.facebook.com
127.0.0.1 et-ee.facebook.com
127.0.0.1 en-gb.facebook.com
127.0.0.1 es-la.facebook.com
127.0.0.1 eo-eo.facebook.com
127.0.0.1 eu-es.facebook.com
127.0.0.1 tl-ph.facebook.com
127.0.0.1 fo-fo.facebook.com
[...]


Resetted HOSTS:
127.0.0.1 localhost

Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt



log z volby 4:

RogueKiller V6.1.5 [10/29/2011] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: hxxp://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: Lukas [Admin rights]
Mode: ProxyFix -- Date : 10/31/2011 17:48:57

Bad processes: 0

Driver: [NOT LOADED]

Registry Entries: 0

Finished : << RKreport[3].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt




log z MBAM:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Verze databáze: 7622

Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514

31.10.2011 18:35:25
mbam-log-2011-10-31 (18-35-25).txt

Typ: Úplná kontrola (C:\|)
Kontrolované objekty: 365293
Uplynulý čas: 37 minut, 39 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 5
Infikované hodnoty v registru: 9
Infikované datové položky v registru: 3
Infikované složky: 1
Infikované soubory: 33

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\sysdriver32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\systeminfog (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\SERVICES32.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers (Trojan.Agent) -> Quarantined and deleted successfully.

Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2239195.exe (Trojan.Agent) -> Value: 2239195.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysdriver32.exe (Trojan.Agent) -> Value: sysdriver32.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysdriver32_.exe (Trojan.Agent) -> Value: sysdriver32_.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\612788.exe (Trojan.Agent) -> Value: 612788.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1377789.exe (Trojan.Agent) -> Value: 1377789.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6501228.exe (Trojan.Agent) -> Value: 6501228.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wxpdrv (Trojan.Agent) -> Value: wxpdrv -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\675396.exe (Trojan.Downloader.Gen) -> Value: 675396.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Services32.exe\close (Trojan.Agent) -> Value: close -> Quarantined and deleted successfully.

Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infikované složky:
c:\Windows\rpcminer (Trojan.BCMiner) -> Quarantined and deleted successfully.

Infikované soubory:
c:\Users\Lukas\AppData\Local\Temp\2239195.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\sysdriver32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\sysdriver32_.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\Temp\612788.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Lukas\AppData\Local\Temp\1377789.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\Temp\6501228.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files (x86)\diablo ii\diablo 2 crack.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\qip infium jadrispack\qip infium jadrispack.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Users\Lukas\Desktop\diablo 2 full game + datadisk cz (pc hra)\diablo 2 full game + datadisk cz (pc hra)\diablo 2 cd key generator.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
c:\Users\Lukas\Desktop\rk_quarantine\sysdriver32.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Lukas\downloads\diablo 2 + lod (1\diablo 2 + lod (1.12a patch, nocd fix)\diablo 2 cd key generator.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
c:\Windows\Temp\6858768.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\83797_myunrar2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Windows\update.5.0\svchost.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Temp\7845216.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Public\Desktop\mp3 downloader.lnk (Rogue.Link) -> Quarantined and deleted successfully.
c:\Windows\Temp\974796632.exe (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinmineropencl.cl (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinminercuda_10.cubin (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinminercuda_11.cubin (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinminercuda_20.cubin (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\cudart32_32_16.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\curllib.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\libeay32.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\libsasl.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\openldap.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-4way.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-cpu.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-cuda.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-opencl.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\ssleay32.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\update.1\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\Temp\675396.exe (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.

[cernohous13]

Príma, jedeme dál

Stáhni si : ComboFix
a ulož ho na plochu.
návod na použití: http://www.bleepingcomputer.com/combofi ... t-combofix
Ukonči všechna aktivní okna,vypni Antispy a Antivir a spusť ho. (ignoruj hlášky o spuštěných - jsou virem poškozené)
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Odmítni stažení Konzole...
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna a nic nespouštěj
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Kdyby ti po použití ComboFixu systém nenaběhl - při restartu F8 a poslední známá funkční konfigurace