Zavirovaný PC - stále nové viry

[Kodas]

Tak tady to je

ComboFix 12-04-13.01 - Milan 14.04.2012 0:57.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1033.18.2047.1436 [GMT 2:00]
Spuštěný z: c:\documents and settings\Milan\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Milan\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ZoneAlarm Free Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
FILE ::
"c:\windows\tasks\Adobe Flash Player Updater.job"
"c:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-1004336348-436374069-1801674531-1003Core.job"
"c:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-1004336348-436374069-1801674531-1003UA.job"
"c:\windows\tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\tasks\Adobe Flash Player Updater.job
c:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-1004336348-436374069-1801674531-1003Core.job
c:\windows\tasks\FacebookUpdateTaskUserS-1-5-21-1004336348-436374069-1801674531-1003UA.job
c:\windows\tasks\GoogleUpdateTaskMachineCore.job
c:\windows\tasks\GoogleUpdateTaskMachineUA.job
.
c:\windows\system32\drivers\tcpip.sys . . . je infikován!!
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_GUPDATE
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-03-13 do 2012-04-13 )))))))))))))))))))))))))))))))
.
.
2012-04-12 22:53 . 2012-04-12 22:54 -------- d-----w- C:\rsit
2012-04-09 20:39 . 2012-04-09 20:39 -------- d-----w- C:\NVIDIA
2012-04-09 13:21 . 2012-04-09 13:21 -------- d-----r- C:\MSOCache
2012-04-09 13:17 . 2012-04-09 13:17 -------- d-----w- C:\totalcmd
2012-04-08 15:58 . 2012-04-08 15:58 -------- d-----w- C:\win rar cz full
2012-04-08 15:38 . 2012-04-08 15:38 -------- d-----w- C:\Riot Games
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-08 14:01 . 2001-08-23 11:00 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-14 10:21 . 2012-03-14 10:21 3186 ----a-w- c:\windows\system32\presetup.cmd
2012-03-14 10:21 . 2012-03-14 10:21 28672 ----a-w- c:\windows\system32\setupold.exe
2012-03-14 09:44 . 2011-10-25 12:52 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-14 09:44 . 2009-11-27 17:23 17920 ----a-w- c:\windows\system32\msyuv.dll
2012-03-14 09:44 . 2009-11-27 16:28 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2012-03-14 09:44 . 2008-04-22 17:03 483328 ----a-w- c:\windows\system32\wzcsvc.dll
2012-03-14 09:44 . 2008-04-14 05:42 52736 ----a-w- c:\windows\system32\wzcsapi.dll
2012-03-14 09:44 . 2008-04-14 05:42 35328 ----a-w- c:\windows\system32\pid.dll
2012-03-14 09:44 . 2008-04-14 05:42 15360 ----a-w- c:\windows\system32\pjlmon.dll
2012-03-14 09:44 . 2008-04-14 05:41 20992 ----a-w- c:\windows\system32\hid.dll
2012-03-14 09:44 . 2008-04-14 05:41 52224 ----a-w- c:\windows\system32\dmutil.dll
2012-03-14 09:44 . 2008-04-14 05:41 47104 ----a-w- c:\windows\system32\cnbjmon.dll
2012-03-14 09:44 . 2008-04-14 00:30 30080 ----a-w- c:\windows\system32\drivers\modem.sys
2012-03-14 09:44 . 2008-04-14 00:26 12288 ----a-w- c:\windows\system32\drivers\tunmp.sys
2012-03-14 09:44 . 2008-04-14 00:26 14592 ----a-w- c:\windows\system32\drivers\ndisuio.sys
2012-03-14 09:44 . 2008-04-14 00:21 61824 ----a-w- c:\windows\system32\drivers\nic1394.sys
2012-03-14 09:44 . 2008-04-14 00:21 60800 ----a-w- c:\windows\system32\drivers\arp1394.sys
2012-03-14 09:44 . 2008-04-14 00:16 25344 ----a-w- c:\windows\system32\drivers\sonydcam.sys
2012-03-14 09:44 . 2008-04-14 00:15 15872 ----a-w- c:\windows\system32\drivers\usbintel.sys
2012-03-14 09:44 . 2008-04-14 00:15 25728 ----a-w- c:\windows\system32\drivers\usbcamd2.sys
2012-03-14 09:44 . 2008-04-14 00:15 25600 ----a-w- c:\windows\system32\drivers\usbcamd.sys
2012-03-14 09:44 . 2008-04-14 00:10 80128 ----a-w- c:\windows\system32\drivers\parport.sys
2012-03-14 09:44 . 2008-04-14 00:09 4352 ----a-w- c:\windows\system32\drivers\swenum.sys
2012-03-14 09:44 . 2008-04-14 00:09 23040 ----a-w- c:\windows\system32\drivers\mouclass.sys
2012-03-14 09:44 . 2008-04-14 00:06 15488 ----a-w- c:\windows\system32\drivers\mssmbios.sys
2012-03-14 09:44 . 2008-04-14 00:06 63744 ----a-w- c:\windows\system32\drivers\mf.sys
2012-03-14 09:44 . 2008-04-14 00:01 37760 ----a-w- c:\windows\system32\drivers\amdk7.sys
2012-03-14 09:44 . 2008-04-14 00:01 37376 ----a-w- c:\windows\system32\drivers\amdk6.sys
2012-03-14 09:44 . 2008-04-14 00:01 36736 ----a-w- c:\windows\system32\drivers\crusoe.sys
2012-03-14 09:44 . 2008-04-14 00:01 42752 ----a-w- c:\windows\system32\drivers\p3.sys
2012-03-14 09:44 . 2008-04-14 00:01 35840 ----a-w- c:\windows\system32\drivers\processr.sys
2012-03-14 09:41 . 2009-11-27 16:28 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2012-03-14 09:41 . 2001-08-17 22:37 77891 ----a-w- c:\windows\system32\usrmlnka.exe
2012-03-14 09:41 . 2001-08-17 22:37 69700 ----a-w- c:\windows\system32\usrshuta.exe
2012-03-14 09:41 . 2001-08-17 22:37 61508 ----a-w- c:\windows\system32\usrprbda.exe
2012-03-14 09:41 . 2001-08-17 22:36 55296 ----a-w- c:\windows\system32\dvdplay.exe
2012-03-14 09:41 . 2001-08-17 22:36 3200 ----a-w- c:\windows\system32\wowfax.dll
2012-03-14 09:41 . 2001-08-17 22:36 13824 ----a-w- c:\windows\system32\wowfaxui.dll
2012-03-14 09:41 . 2001-08-17 22:36 86073 ----a-w- c:\windows\system32\usrfaxa.dll
2012-03-14 09:41 . 2001-08-17 22:36 77890 ----a-w- c:\windows\system32\usrdpa.dll
2012-03-14 09:41 . 2001-08-17 22:36 77883 ----a-w- c:\windows\system32\usrrtosa.dll
2012-03-14 09:41 . 2001-08-17 22:36 69699 ----a-w- c:\windows\system32\usrcoina.dll
2012-03-14 09:41 . 2001-08-17 22:36 61500 ----a-w- c:\windows\system32\usrcntra.dll
2012-03-14 09:41 . 2001-08-17 22:36 53305 ----a-w- c:\windows\system32\usrlbva.dll
2012-03-14 09:41 . 2001-08-17 22:36 49211 ----a-w- c:\windows\system32\usrvpa.dll
2012-03-14 09:41 . 2001-08-17 22:36 49211 ----a-w- c:\windows\system32\usrsdpia.dll
2012-03-14 09:41 . 2001-08-17 22:36 49209 ----a-w- c:\windows\system32\usrv80a.dll
2012-03-14 09:41 . 2001-08-17 22:36 45116 ----a-w- c:\windows\system32\usrvoica.dll
2012-03-14 09:41 . 2001-08-17 22:36 41019 ----a-w- c:\windows\system32\usrsvpia.dll
2012-03-14 09:41 . 2001-08-17 22:36 323641 ----a-w- c:\windows\system32\usrdtea.dll
2012-03-14 09:41 . 2001-08-17 22:36 102457 ----a-w- c:\windows\system32\usrv42a.dll
2012-03-14 09:41 . 2001-08-17 22:36 8192 ----a-w- c:\windows\system32\streamci.dll
2012-03-14 09:41 . 2001-08-17 22:36 72192 ----a-w- c:\windows\system32\sprio800.dll
2012-03-14 09:41 . 2001-08-17 22:36 70656 ----a-w- c:\windows\system32\sprio600.dll
2012-03-14 09:41 . 2001-08-17 22:36 69632 ----a-w- c:\windows\system32\spnike.dll
2012-03-14 09:41 . 2001-08-17 22:36 157696 ----a-w- c:\windows\system32\paqsp.dll
2012-03-14 09:41 . 2001-08-17 22:36 147968 ----a-w- c:\windows\system32\mdwmdmsp.dll
2012-03-14 09:41 . 2001-08-17 14:06 21376 ----a-w- c:\windows\system32\drivers\tsbvcap.sys
2012-03-14 09:41 . 2001-08-17 14:02 262528 ----a-w- c:\windows\system32\drivers\cinemst2.sys
2012-03-14 09:41 . 2001-08-17 14:02 58112 ----a-w- c:\windows\system32\drivers\vdmindvd.sys
2012-03-14 09:41 . 2001-08-17 14:01 51712 ----a-w- c:\windows\system32\drivers\tosdvd.sys
2012-03-14 09:41 . 2001-08-17 13:57 12160 ----a-w- c:\windows\system32\drivers\fsvga.sys
2012-03-14 09:41 . 2001-08-17 13:52 18688 ----a-w- c:\windows\system32\drivers\cdaudio.sys
2012-03-14 09:41 . 2001-08-17 13:48 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2012-03-14 09:41 . 2001-08-17 13:24 12032 ----a-w- c:\windows\system32\drivers\riodrv.sys
2012-03-14 09:41 . 2001-08-17 13:24 12032 ----a-w- c:\windows\system32\drivers\rio8drv.sys
2012-03-14 09:41 . 2001-08-17 13:24 12032 ----a-w- c:\windows\system32\drivers\nikedrv.sys
2012-03-14 09:41 . 2001-08-17 13:24 11776 ----a-w- c:\windows\system32\drivers\cpqdap01.sys
2012-03-14 09:30 . 2012-03-14 09:30 361600 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-03-14 09:30 . 2012-03-14 09:30 218624 ----a-w- c:\windows\system32\uxtheme.dll
2012-03-14 09:30 . 2012-03-14 09:30 140288 ----a-w- c:\windows\system32\sfc_os.dll
2012-03-14 09:29 . 2012-03-14 10:38 990208 ----a-w- c:\windows\system32\syssetup.dll
2012-03-14 09:28 . 2012-03-14 09:28 398416 ----a-w- c:\windows\system\VBRUN300.DLL
2012-03-14 09:28 . 2012-03-14 09:28 722192 ----a-w- c:\windows\system\VB40032.DLL
2012-03-14 09:28 . 2012-03-14 09:28 356992 ----a-w- c:\windows\system\VBRUN200.DLL
2012-03-14 09:28 . 2012-03-14 09:28 271264 ----a-w- c:\windows\system\VBRUN100.DLL
2012-03-14 09:28 . 2012-03-14 09:28 935632 ----a-w- c:\windows\system\VB40016.DLL
2012-03-14 09:28 . 2012-03-14 09:28 210944 ----a-w- c:\windows\system32\msvcrt10.dll
2012-03-14 09:28 . 2012-03-14 09:28 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2012-03-14 09:28 . 2012-03-14 09:28 44536 ----a-w- c:\windows\system32\wups2.dll
2012-03-14 09:28 . 2012-03-14 09:28 223232 ----a-w- c:\windows\system32\wksprt.exe
2012-03-14 09:28 . 2012-03-14 09:28 12800 ----a-w- c:\windows\system32\wksprtps.dll
2012-03-14 09:28 . 2001-08-23 11:00 21496 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-03-14 09:28 . 2001-08-23 11:00 17400 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-03-14 09:28 . 2001-08-23 11:00 14840 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-03-14 09:28 . 2001-08-23 11:00 14840 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-03-14 09:28 . 2012-03-14 09:28 29184 ----a-w- c:\windows\system32\drivers\usbccid.sys
2012-03-14 09:28 . 2001-08-23 11:00 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
2012-03-14 09:28 . 2012-03-14 09:28 57344 ----a-w- c:\windows\system32\uexfat.dll
2012-03-14 09:28 . 2012-03-14 09:28 46080 ----a-w- c:\windows\system32\tswbprxy.exe
2012-03-14 09:28 . 2001-08-23 11:00 192912 ----a-w- c:\windows\system32\SecProc_ssp_isv.dll
2012-03-14 09:28 . 2001-08-23 11:00 562064 ----a-w- c:\windows\system32\SecProc_isv.dll
2012-03-14 09:28 . 2001-08-23 11:00 192904 ----a-w- c:\windows\system32\SecProc_ssp.dll
2012-03-14 09:28 . 2012-03-14 09:28 62848 ----a-w- c:\windows\system32\drivers\rspndr.sys
2012-03-14 09:28 . 2012-03-14 09:28 558984 ----a-w- c:\windows\system32\SecProc.dll
2012-03-14 09:28 . 2012-03-14 09:28 10752 ----a-w- c:\windows\system32\rspndr.exe
2012-03-14 09:28 . 2001-08-23 11:00 361872 ----a-w- c:\windows\system32\RmActivate_ssp_isv.exe
2012-03-14 09:28 . 2001-08-23 11:00 575880 ----a-w- c:\windows\system32\RmActivate_isv.exe
2012-03-14 09:28 . 2001-08-23 11:00 362888 ----a-w- c:\windows\system32\RmActivate_ssp.exe
2012-03-13 04:38 . 2012-04-08 13:37 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2012-03-14 . 474D3DCCB57DEFCD917311EEC47204B9 . 361600 . . [5.1.2600.6009] . . c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((( SnapShot@2012-04-13_15.22.39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-04-13 23:02 . 2012-04-13 23:02 16384 c:\windows\temp\Perflib_Perfdata_1c4.dat
+ 2012-04-13 16:11 . 2012-04-13 16:11 62464 c:\windows\Installer\2ce7c8.msi
+ 2012-04-13 16:10 . 2012-04-13 16:10 28672 c:\windows\Installer\2ce7c3.msi
+ 2012-04-13 16:10 . 2012-04-13 16:10 41472 c:\windows\Installer\2ce7be.msi
+ 2008-07-29 03:23 . 2008-07-29 03:23 626688 c:\windows\WinSxS\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e\msvcr90.dll
+ 2008-07-29 03:23 . 2008-07-29 03:23 856576 c:\windows\WinSxS\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e\msvcp90.dll
+ 2008-07-29 01:51 . 2008-07-29 01:51 245760 c:\windows\WinSxS\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_a17e7c1e\msvcm90.dll
+ 2011-12-18 19:04 . 2011-12-18 19:04 525840 c:\windows\system32\vsdatant.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-06 23:15 123536 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-06 4241512]
"RTHDCPL"="RTHDCPL.EXE" [2011-12-05 20065384]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-10-08 16744256]
"NvMediaCenter"="NvMCTray.dll" [2011-10-08 203072]
"nwiz"="c:\program files\NVIDIA Corporation\nview\nwiz.exe" [2011-10-08 1632360]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2011-11-03 738944]
"ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2011-12-18 73360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
LOLRecorder.lnk - c:\program files\LOLReplay\LOLRecorder.exe [2012-2-25 495104]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, credssp.dll, digest.dll, msnsspc.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update]
2012-04-10 11:51 137536 ----atw- c:\documents and settings\Milan\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
"c:\\Documents and Settings\\Milan\\Local Settings\\Application Data\\Facebook\\Video\\Skype\\FacebookVideoCalling.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56200:TCP"= 56200:TCP:Pando Media Booster
"56200:UDP"= 56200:UDP:Pando Media Booster
.
R0 mv61xxmm;mv61xxmm;c:\windows\system32\drivers\mv61xxmm.sys [31.1.2012 20:27 13616]
R0 mv64xxmm;mv64xxmm;c:\windows\system32\drivers\mv64xxmm.sys [31.1.2012 20:27 5632]
R0 mvxxmm;mvxxmm;c:\windows\system32\drivers\mvxxmm.sys [31.1.2012 20:27 13616]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [8.4.2012 15:46 612184]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [8.4.2012 15:46 337880]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [8.4.2012 15:46 20696]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [9.4.2012 22:40 2253120]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 20:16 130384]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [8.4.2012 15:08 253600]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [8.4.2012 15:56 1691480]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 20:16 753504]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\documents and settings\Milan\Application Data\Mozilla\Firefox\Profiles\12zqd9kg.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-04-14 01:02
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(5984)
c:\windows\system32\WININET.dll
c:\windows\system32\msi.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Internet Explorer\mui\0405\browselc.dll
c:\progra~1\SPYBOT~1\SDHelper.dll
c:\program files\Microsoft Office\Office12\1029\GrooveIntlResource.dll
c:\program files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RunDLL32.exe
.
**************************************************************************
.
Celkový čas: 2012-04-14 01:04:40 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-04-13 23:04
.
Před spuštěním: 478 551 535 616 bytes free
Po spuštění: Volných bajtů: 478 324 113 408
.
- - End Of File - - 7422FEDA002148D04A9D8957B979B6F8

[vyosek]

Odinstalujte Spybot - Search & Destroy - program ma uz nejlepsi leta davno za sebou a posledni cca 3 roky neni schopen celit aktualnim hrozbam

• Nahrady za Spybota:
  • Spyware Terminator - info o nem http://www.viry.cz/forum/viewtopic.php?f=29&t=44730
  • SuperAntiSpyare - info o nem http://www.viry.cz/forum/viewtopic.php?f=29&t=51359
• Samozrejme pouzivejte jen jeden z nich
• Osobne doporucuji SuperAntiSpyware

Stahnete OTM http://oldtimer.geekstogo.com/OTM.exe

• Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
• Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

• Kód: Vybrat vše

  :reg
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Security Providers]
  "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
  
  :files
  %windir%\system32\*.tmp.dll /s
  %windir%\system32\SET*.tmp /s
  %windir%\*.tmp
  
  :commands
  [RESETHOSTS]
  [EMPTYTEMP]
  [EMPTYFLASH]

• Kliknete na cervene tlacitko MoveIt!
• Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte

[Kodas]

Tak tady to je

All processes killed
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Security Providers\\"SecurityProviders"|"msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" /E : value set successfully!
========== FILES ==========
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOWS\system32\SET*.tmp not found.
File/Folder C:\WINDOWS\*.tmp not found.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Google Chrome cache emptied: 6512281 bytes
->Flash cache emptied: 456 bytes

User: Milan
->Temp folder emptied: 24570392 bytes
->Temporary Internet Files folder emptied: 1652006 bytes
->FireFox cache emptied: 123524782 bytes
->Google Chrome cache emptied: 52977719 bytes
->Flash cache emptied: 5323 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 23060 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 200,00 mb

[Kodas]

Netuším proč, ale z žádného prohlížeče nejde spusti google.cz avšak jiné stránky jdou

[vyosek]

Stahnete RogueKiller http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe

• Ukoncete vsechny programy
• Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce
• Pockejte na dokonceni PreScanu
• Zvolte moznost Prohledat (scan)
• Po dokonceni skenu kliknete na Zpráva (Report)- otevre se log, ten sem vlozte

[Kodas]

Tak ten google už jde, avšak někdy při brouzdání internetem na mě vyskočí avast, že zablokoval google.com/pagead/drt/ui jinak zde přikládám log

RogueKiller V7.3.2 [03/20/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Podpora: http://www.geekstogo.com/forum/files/fi ... guekiller/
Operační systém: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Spuštěno v: Normální režim
Uživatel: Milan [Práva správce]
Mód: Kontrola -- Datum: 04/16/2012 00:38:08

¤¤¤ Škodlivé procesy: 0 ¤¤¤

¤¤¤ Záznamy Registrů: 0 ¤¤¤

¤¤¤ Zvláštní soubory / Složky: ¤¤¤

¤¤¤ Ovladač: [NAHRÁNO] ¤¤¤
IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : atapi.sys -> HOOKED ([INLINE] atapi.sys @ 0xB7F11852)

¤¤¤ Nákaza : ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
ÿþ1

¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: ST3500418AS +++++
--- User ---
[MBR] e9cee13456e256234b0c8bf34c35cea1
[BSP] 837236b83d0272d89eb438459ab83727 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 476929 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Dokončeno : << RKreport[4].txt >>
RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt

[vyosek]

Udelejte krok dle navodu kolegyne

Smažte cache Opery/Firefoxu bud ručně nebo ATF Cleanerem
http://www.slunecnice.cz/sw/atf-cleaner/

- v menu nahoře vyberte záložku Firefox / Opera a klikněte na ni
- zatrhněte Select All a pak klikněte na Empty Selected

pozor - přijdete o všechna hesla uložená ve FF /Opere!

- Na záložce main zaškrtněte All users temp a potvrdte Empty selected

Napiste co PC

[Kodas]

Děkuji, moc jste mi pomohl konečně mám zase čisté PC nicméně ten avast s tou hláškou ohledně google stejně občas vyběhne, avšak to už přežiju Děkuji vám

[vyosek]

No ciste nevim, kdyz nam neco stale skace...

Dejte prosim screen toho hlaseni kdyz vyskoci...

[Kodas]

Zdravím omlouvám se za neaktivitu, tady to je

ps.: dělá to u všech prohlížečů

EDIT: omlouvám se už vidím že to nejede ten obrázek mi sem nešel poslat prý je moc velký tak jsem ho dal sem: http://leteckaposta.cz/763632675

[vyosek]

Ja bych chtell screen - fotku - toho hlaseni

[Kodas]

Tak jsem nechal PC testovat avastem a našel jsem 9 překvapení 8 trojanů a 1 malware-gen

[vyosek]

Tak poprosim o screen virove truhly at se podivame kde jsou...

[Kodas]

Tady je, akorát je trošku větší http://leteckaposta.cz/887750956

[vyosek]

Havet se usadila v bodech obnoveni - smazte je dle navodu kolegy riffa http://www.viry.cz/forum/viewtopic.php?f=11&t=47040