Prosím o kontrolu - AdWare

Zpráva

Lord_3D · #1 Příspěvek od **Lord_3D** » 11 lis 2012 21:34

Zdravím, rodičom sa dnes podarilo nachytať nejaký milý adware kt. sa pustí fullscreen ihneď po zapnutí PC a človeka nepustí ani na plochu. Naštastie sa mi podarilo zistiť, že pri vypnutom internete sa tento program nespúšta, tak som mohol urobiť RSIT log.

Prosím o jeho kontrolu a vopred ďakujem.
L.

Logfile of random's system information tool 1.09 (written by random/random)
Run by Maťko at 2012-11-11 21:29:20
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 8 GB (17%) free of 46 GB
Total RAM: 1023 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:29:23, on 11. 11. 2012
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Razer\razerhid.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Maťko\Local Settings\Application Data\Skype\SkypePM.exe
C:\Program Files\EIZO\ScreenSlicer\ESCSlicer.exe
C:\Program Files\Launchy\Launchy.exe
C:\Program Files\Razer\razerofa.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\FileZilla Server\FileZilla Server.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlSvc.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Maťko\Desktop\RSIT.exe
C:\Documents and Settings\Maťko\Desktop\Maťko.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [ScreenManager Pro for LCD (DDCCI)] C:\Program Files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] C:\Documents and Settings\Maťko\Local Settings\Application Data\Skype\SkypePM.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe
O4 - Startup: VNC Server.lnk = C:\Program Files\RealVNC\VNC4\winvnc4.exe
O4 - Global Startup: EIZO ScreenSlicer.lnk = ?
O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Locate Spot on Map by GPS - C:\Program Files\Opanda\IExif 2.3\IExifMap.htm
O8 - Extra context menu item: View Exif/GPS/IPTC with IExif - C:\Program Files\Opanda\IExif 2.3\IExifCom.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe LM Service AdobeAlerter (AdobeAlerter) - Unknown owner - C:\WINDOWS\system32\wpv121238436518.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Program Files\FileZilla Server\FileZilla Server.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LcdctrlSvc - EIZO NANAO CORPORATION - C:\Program Files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlSvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 8926 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AdobeAAMUpdater-1.0-MATKO-Maťko.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Maťko\Application Data\Mozilla\Firefox\Profiles\tq48cpgt.default

prefs.js - "browser.startup.homepage" - "http://www.google.sk/"
prefs.js - "extensions.enabledItems" - "jqs@sun.com:1.0, {239c61a8-e55f-11db-8314-0800200c9a66}:2.1.4, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.23, kempelton_large-fx@arvidaxelsson.se:3.2.1, {07b2a769-ed19-4483-87ce-c643914c81bb}:3.0.0.91"

"bkmrksync@nokia.com"=C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\
"jqs@sun.com"=C:\Program Files\Java\jre6\lib\deploy\jqs\ff

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=]
"Description"=iTunes Detector Plug-in
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Apple.com/iTunes,version=1.0]
"Description"=
"Path"=C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@bittorrent.com/BitTorrentDNA]
"Description"=Delivery Network Acceleration by BitTorrent™
"Path"=C:\Program Files\DNA\plugins\npbtdna.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1]
"Description"=Yahoo! activeX Plug-in Bridge
"Path"=C:\Program Files\Yahoo!\Common\npyaxmpb.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\plugins\
npdeploytk.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npqtplugin6.dll
npqtplugin7.dll
QuickTimePlugin.class

C:\Program Files\Mozilla Firefox\searchplugins\
atlas-sk.xml
azet-sk.xml
dunaj-sk.xml
eBay.xml
google.xml
slovnik-sk.xml
wikipedia-sk.xml
zoznam-sk.xml

C:\Documents and Settings\Maťko\Application Data\Mozilla\Firefox\Profiles\tq48cpgt.default\extensions\
kempelton_large-fx@arvidaxelsson.se
{07b2a769-ed19-4483-87ce-c643914c81bb}
{1AF3FC34-0725-4485-A939-6B40EB7CA96A}
{F8A55C97-3DB6-4961-A81D-0DE0080E53CB}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 853672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2003-03-27 53248]
"razer"=C:\Program Files\Razer\razerhid.exe [2005-05-17 147456]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-06-29 7573504]
"nwiz"=nwiz.exe /install []
"SW20"=C:\WINDOWS\system32\sw20.exe [2006-06-29 208896]
"SW24"=C:\WINDOWS\system32\sw24.exe [2006-06-29 69632]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2006-06-29 86016]
"PRONoMgr.exe"=C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe [2003-03-11 86016]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-11-10 417792]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-11-12 141600]
"AdobeAAMUpdater-1.0"=C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-07-03 499608]
"SwitchBoard"=C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"AdobeCS5.5ServiceManager"=C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [2011-01-12 1523360]
"ScreenManager Pro for LCD (DDCCI)"=C:\Program Files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe [2010-02-18 7421952]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2012-10-23 5074384]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"=C:\Program Files\RocketDock\RocketDock.exe [2007-03-18 630784]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]
"Skype"=C:\Documents and Settings\Maťko\Local Settings\Application Data\Skype\SkypePM.exe [2004-08-04 45992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileZilla Server Interface]
C:\Program Files\FileZilla Server\FileZilla Server Interface.exe [2009-12-31 1208832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ScreenManager Pro for LCD]
C:\Program Files\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe []

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
EIZO ScreenSlicer.lnk - C:\WINDOWS\Installer\{292A177D-723F-4537-9985-BC8BFCD8B63D}\ESCSlicer.exe1_87A06423E78E426E924121140A36B659.exe
Launchy.lnk - C:\Program Files\Launchy\Launchy.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

C:\Documents and Settings\Maťko\Start Menu\Programs\Startup
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Launchy.lnk - C:\Program Files\Launchy\Launchy.exe
VNC Server.lnk - C:\Program Files\RealVNC\VNC4\winvnc4.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\Install\Moja Miranda\M!raNda.Pack-Lord_3D v1\Miranda IM\miranda32.exe"="D:\Install\Moja Miranda\M!raNda.Pack-Lord_3D v1\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"D:\Install\Moja Miranda\Skusobna\Miranda IM\miranda32.exe"="D:\Install\Moja Miranda\Skusobna\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\RealVNC\VNC4\winvnc4.exe"="C:\Program Files\RealVNC\VNC4\winvnc4.exe:*:Enabled:VNC Server Free Edition for Win32"
"C:\Program Files\RealVNC\VNC4\vncviewer.exe"="C:\Program Files\RealVNC\VNC4\vncviewer.exe:*:Enabled:VNC Viewer Free Edition for Win32"
"D:\Install\Moja Miranda\M!raNda.Pack-Lord_3D v1 na 7.0\Miranda IM - ICQ+\miranda32.exe"="D:\Install\Moja Miranda\M!raNda.Pack-Lord_3D v1 na 7.0\Miranda IM - ICQ+\miranda32.exe:*:Enabled:Miranda IM"
"D:\Install\Moja Miranda\M!raNda.Pack-Lord_3D v1 na 7.0\^Zaloha 8.0.0.1 - NS\Miranda IM - ICQ+\miranda32.exe"="D:\Install\Moja Miranda\M!raNda.Pack-Lord_3D v1 na 7.0\^Zaloha 8.0.0.1 - NS\Miranda IM - ICQ+\miranda32.exe:*:Enabled:Miranda IM"
"D:\Install\Moja Miranda\L3d.2008\miranda32.exe"="D:\Install\Moja Miranda\L3d.2008\miranda32.exe:*:Enabled:Miranda IM"
"D:\Install\Moja Miranda\SKINTEST\Miranda IM - ICQ+\miranda32.exe"="D:\Install\Moja Miranda\SKINTEST\Miranda IM - ICQ+\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\Winamp\winamp.exe"="C:\Program Files\Winamp\winamp.exe:*:Enabled:Winamp"
"C:\Program Files\Opera\Opera.exe"="C:\Program Files\Opera\Opera.exe:*:Enabled:Opera Internet Browser"
"F:\F -Moje dokumenty\Matúš\Install\Miranda 8.0\miranda32.exe"="F:\F -Moje dokumenty\Matúš\Install\Miranda 8.0\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Hamachi\hamachi.exe"="C:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi"
"D:\mIRC\mirc.exe"="D:\mIRC\mirc.exe:*:Enabled:mIRC"
"C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe"="C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"F:\F -Moje dokumenty\Matúš\Install\RatioMaster\RatioMaster.exe"="F:\F -Moje dokumenty\Matúš\Install\RatioMaster\RatioMaster.exe:*:Enabled:Ratio Master"
"C:\WINDOWS\system32\java.exe"="C:\WINDOWS\system32\java.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Java\jre6\bin\java.exe"="C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"F:\F -Moje dokumenty\Matúš\Install\Miranda 0.9 # 1 Alfa\miranda32.exe"="F:\F -Moje dokumenty\Matúš\Install\Miranda 0.9 # 1 Alfa\miranda32.exe:*:Enabled:Miranda IM"
"F:\F -Moje dokumenty\Matúš\Install\RatioMaster\RatioMaster-vs.exe"="F:\F -Moje dokumenty\Matúš\Install\RatioMaster\RatioMaster-vs.exe:*:Enabled:Ratio Master"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"F:\F -Moje dokumenty\Miranda 0.9 # 1 Alfa\miranda32.exe"="F:\F -Moje dokumenty\Miranda 0.9 # 1 Alfa\miranda32.exe:*:Enabled:Miranda IM"
"F:\F -Moje dokumenty\Matúš\Install\Warcraft III\war3.exe"="F:\F -Moje dokumenty\Matúš\Install\Warcraft III\war3.exe:*:Enabled:Warcraft III"
"C:\Documents and Settings\Maťko\Desktop\Lordiik\WaaaghTV\wtvClient.exe"="C:\Documents and Settings\Maťko\Desktop\Lordiik\WaaaghTV\wtvClient.exe:*:Enabled:wtvClient"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=i420vfw.dll
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"VIDC.ACDV"=ACDV.dll
"VIDC.MPG4"=mpg4c32.dll
"VIDC.MP42"=mpg4c32.dll
"vidc.yv12"=yv12vfw.dll
"msacm.lhacm"=lhacm.acm

======List of files/folders created in the last 3 months======

2012-11-11 17:42:46 ----D---- C:\Documents and Settings\Maťko\Application Data\ESET
2012-11-11 17:40:49 ----D---- C:\Documents and Settings\All Users\Application Data\ESET
2012-10-08 08:21:08 ----A---- C:\WINDOWS\system32\drivers\epfwtdi.sys
2012-10-08 08:21:08 ----A---- C:\WINDOWS\system32\drivers\epfwndis.sys
2012-10-08 08:21:08 ----A---- C:\WINDOWS\system32\drivers\epfw.sys
2012-10-08 08:21:08 ----A---- C:\WINDOWS\system32\drivers\ehdrv.sys
2012-10-08 08:21:06 ----A---- C:\WINDOWS\system32\drivers\eamon.sys

======List of files/folders modified in the last 3 months======

2012-11-24 14:30:11 ----D---- C:\Documents and Settings\Maťko\Application Data\Media Player Classic
2012-11-11 20:38:54 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-11-11 20:21:29 ----D---- C:\WINDOWS\Temp
2012-11-11 19:13:02 ----D---- C:\WINDOWS
2012-11-11 19:12:45 ----HD---- C:\WINDOWS\inf
2012-11-11 18:59:19 ----D---- C:\WINDOWS\system32
2012-11-11 18:48:24 ----D---- C:\WINDOWS\Prefetch
2012-11-11 17:42:34 ----SHD---- C:\WINDOWS\Installer
2012-11-11 17:42:04 ----D---- C:\WINDOWS\system32\drivers
2012-11-11 17:41:43 ----D---- C:\WINDOWS\system32\CatRoot2
2012-11-11 17:40:49 ----D---- C:\Program Files\ESET
2012-10-31 17:17:33 ----A---- C:\WINDOWS\NeroDigital.ini
2012-10-31 17:17:21 ----D---- C:\Documents and Settings\Maťko\Application Data\uTorrent
2012-10-28 10:53:16 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 a347bus;a347bus; C:\WINDOWS\system32\DRIVERS\a347bus.sys [2004-04-30 160640]
R0 a347scsi;a347scsi; C:\WINDOWS\System32\Drivers\a347scsi.sys [2004-04-30 5248]
R0 agp440;Intel AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agp440.sys [2004-08-03 42368]
R0 giveio;giveio; C:\WINDOWS\system32\giveio.sys [1996-04-03 5248]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2009-02-18 43872]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2005-08-10 50688]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2005-05-16 6656]
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x); C:\WINDOWS\System32\drivers\sfvfs02.sys [2005-11-03 63488]
R1 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2012-10-08 159832]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2012-10-08 121216]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2012-10-08 62512]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 36096]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-03 14848]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2008-07-07 56108]
R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2006-07-24 5632]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2012-10-08 149568]
R2 irda;IrDA Protocol; C:\WINDOWS\system32\DRIVERS\irda.sys [2004-08-03 87424]
R2 WinI2C-DDC;WinI2C-DDC Kernel Mode Driver; \??\C:\WINDOWS\system32\drivers\DDCDrv.sys []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2003-04-01 719052]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2012-10-08 40376]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-05-21 25280]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-06-29 3663040]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2006-11-24 10368]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 RT61;RT61 Wireless Driver; C:\WINDOWS\system32\DRIVERS\RT61.sys [2010-04-02 520800]
R3 RTL8023xp;Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2004-07-16 70400]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2006-04-19 20608]
R3 vncmirror;vncmirror; C:\WINDOWS\system32\DRIVERS\vncmirror.sys [2010-04-09 4608]
S3 catchme;catchme; \??\C:\DOCUME~1\MAKO~1\LOCALS~1\Temp\catchme.sys []
S3 CnxEtP;Conexant AccessRunner USB ADSL Adapter Filter Driver; C:\WINDOWS\system32\DRIVERS\CnxEtP.sys []
S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver; C:\WINDOWS\system32\DRIVERS\CnxEtU.sys []
S3 CnxTgNP;Conexant AccessRunner ADSL WAN PPPoE Adapter Driver; C:\WINDOWS\system32\DRIVERS\CnxTgNP.sys []
S3 GarenaPEngine;GarenaPEngine; \??\C:\DOCUME~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp []
S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS []
S3 k750bus;Sony Ericsson 750 driver (WDM); C:\WINDOWS\system32\DRIVERS\k750bus.sys []
S3 k750mdfl;Sony Ericsson 750 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\k750mdfl.sys []
S3 k750mdm;Sony Ericsson 750 USB WMC Modem Drivers; C:\WINDOWS\system32\DRIVERS\k750mdm.sys []
S3 k750mgmt;Sony Ericsson 750 USB WMC Device Management Drivers; C:\WINDOWS\system32\DRIVERS\k750mgmt.sys []
S3 k750obex;Sony Ericsson 750 USB WMC OBEX Interface Drivers; C:\WINDOWS\system32\DRIVERS\k750obex.sys []
S3 MSICPL;MSICPL; \??\E:\install4\MSICPL.sys []
S3 MSIRCOMM;Microsoft IR Communications Driver; C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys [2004-08-03 22016]
S3 nm;Network Monitor Driver; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2004-08-04 40320]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2008-09-15 17664]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2008-09-15 22016]
S3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 32512]
S3 npkcrypt;npkcrypt; \??\F:\Instal\Lineage II\system\npkcrypt.sys []
S3 NTACCESS;NTACCESS; \??\E:\NTACCESS.sys []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 Razerlow;Razerlow USB Filter Driver; C:\WINDOWS\System32\Drivers\Razerlow.sys [2005-04-24 13225]
S3 SetupNTGLM7X;SetupNTGLM7X; \??\E:\NTGLM7X.sys []
S3 ssm_bus;SAMSUNG Mobile USB Device II 1.0 driver (WDM); C:\WINDOWS\system32\DRIVERS\ssm_bus.sys [2007-05-02 83592]
S3 ssm_mdfl;SAMSUNG Mobile USB Modem II 1.0 Filter; C:\WINDOWS\system32\DRIVERS\ssm_mdfl.sys [2007-05-02 15112]
S3 ssm_mdm;SAMSUNG Mobile USB Modem II 1.0 Drivers; C:\WINDOWS\system32\DRIVERS\ssm_mdm.sys [2007-05-02 109704]
S3 STIrUsb;SigmaTel USB-IrDA Dongle; C:\WINDOWS\system32\DRIVERS\irstusb.sys [2001-08-17 26624]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2008-09-15 8064]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-08-28 40448]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2004-08-03 25600]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2008-09-15 8064]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2005-01-28 18944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2012-10-23 1329304]
R2 FileZilla Server;FileZilla Server FTP server; C:\Program Files\FileZilla Server\FileZilla Server.exe [2009-12-31 703488]
R2 Irmon;Infrared Monitor; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-09 152984]
R2 LcdctrlSvc;LcdctrlSvc; C:\Program Files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlSvc.exe [2010-02-16 90112]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2001-02-23 270336]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-06-29 143426]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-06-13 75064]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2009-06-17 189072]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-11-12 545568]
R3 WinVNC4;VNC Server Version 4; C:\Program Files\RealVNC\VNC4\WinVNC4.exe [2010-04-09 1484152]
S2 AdobeAlerter;Adobe LM Service AdobeAlerter; C:\WINDOWS\system32\wpv121238436518.exe run []
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2006-11-23 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-09-22 654848]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-07-31 720896]
S3 NetSvc;Intel NCS NetService; C:\Program Files\Intel\NCS\Sync\NetSvc.exe [2003-03-03 143360]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2005-08-02 86016]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]
S3 SwitchBoard;SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

-----------------EOF-----------------=

#2 Příspěvek od **vyosek** » 11 lis 2012 21:52

Zdravim

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane
Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe

Rkill iExplore.exe:
http://download.bleepingcomputer.com/gr ... xplore.exe

Rkill uSeRiNiT.exe:
http://download.bleepingcomputer.com/gr ... eRiNiT.exe

Rkill WiNlOgOn.exe:
http://download.bleepingcomputer.com/gr ... NlOgOn.exe
Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
Na plose vznikne log Rkill.txt ten mi sem vlozte
Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

Lord_3D · #3 Příspěvek od **Lord_3D** » 11 lis 2012 22:11

Zdravím, ďakujem za skorú odpoveď

Po pustení Combofixu kontrola zlyhá pri bode: "Attempting to create a new System Restore point" a vyhodí hlášku:
"This machine does not have Microsoft Windows recovery console installed....Click Yes to have ComboFix download/install it. NOTE: The requires an active internet connection". No problém je ten, že akonáhle pripojím internet. pustí sa daný AdWare a už s PC nič neurobím.

EDIT: Dal som "Nie" a vyzerá to tak, že kontrola ComboFix-om ďalej pokračuje. Keď sa ukončí, vložím sem log.

Prikladám aspoň log z RKill:

Rkill 2.4.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 11/11/2012 10:00:57 PM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 2

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* C:\Documents and Settings\Maťko\Local Settings\Application Data\Skype\SkypePM.exe (PID: 2016) [UP-HEUR]
* C:\WINDOWS\system32\nvsvc32.exe (PID: 984) [WD-HEUR]

2 proccesses terminated!

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* System Restore Disabled

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = dword:00000001

* Windows Firewall Disabled

[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = dword:00000000

Checking Windows Service Integrity:

* System Restore Service (srservice) is not Running.
Startup Type set to: Automatic

* System Restore Filter Driver (sr) is not Running.
Startup Type set to: Disabled

* RpcSs => %SystemRoot%\system32\svchost.exe -k rpcss [Incorrect ImagePath]

Searching for Missing Digital Signatures:

* C:\WINDOWS\System32\drivers\atapi.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\atapi.sys : 95 360 : 08/03/2004 11:59 PM : cdfe4411a69c224bd1d11b2da92dac51 [Pos Repl]
+-> C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys : 95 360 : 08/04/2004 02:00 PM : cdfe4411a69c224bd1d11b2da92dac51 [Pos Repl]

* C:\WINDOWS\System32\UxTheme.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\uxtheme.dll : 218 624 : 08/07/2004 11:36 AM : 222c0432d24b67498c62676f0eeedce2 [Pos Repl]

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost

Program finished at: 11/11/2012 10:01:59 PM
Execution time: 0 hours(s), 1 minute(s), and 1 seconds(s)

Lord_3D · #4 Příspěvek od **Lord_3D** » 11 lis 2012 22:35

Prikladám ešte log z ComboFixu, ospravedlňujem sa za Double-post, ale chcel som aby to bolo prehľadné.

ComboFix 12-11-10.01 - Maťko . 11. 2012 22:13:32.4.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1033.18.1023.532 [GMT 1:00]
Running from: c:\documents and settings\MaŁko\Desktop\ComboFix.exe
AV: ESET Smart Security 6.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *Disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Maťko\Local Settings\Application Data\Skype\SkypePM.exe
c:\windows\system32\MUI\041b\tourstart.exe
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
c:\windows\XSxS
.
.
((((((((((((((((((((((((( Files Created from 2012-10-11 to 2012-11-11 )))))))))))))))))))))))))))))))
.
.
2012-11-11 18:12 . 2012-11-11 18:12 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\ESET
2012-11-11 16:42 . 2012-11-11 16:42 -------- d-----w- c:\documents and settings\Maťko\Application Data\ESET
2012-11-11 16:40 . 2012-11-11 16:40 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 07:21 . 2012-10-08 07:21 62512 ----a-w- c:\windows\system32\drivers\epfwtdi.sys
2012-10-08 07:21 . 2012-10-08 07:21 40376 ----a-w- c:\windows\system32\drivers\epfwndis.sys
2012-10-08 07:21 . 2012-10-08 07:21 149568 ----a-w- c:\windows\system32\drivers\epfw.sys
2012-10-08 07:21 . 2012-10-08 07:21 121216 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2012-10-08 07:21 . 2012-10-08 07:21 159832 ----a-w- c:\windows\system32\drivers\eamon.sys
2012-03-19 18:22 . 2011-10-19 15:31 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2005-05-13 16:12 217073 --sha-r- c:\windows\meta4.exe
2005-10-24 10:13 66560 --sha-r- c:\windows\MOTA113.exe
2005-10-13 20:27 422400 --sha-r- c:\windows\x2.64.exe
2005-10-07 18:14 308224 --sha-r- c:\windows\system32\avisynth.dll
2005-07-14 11:31 27648 --sha-r- c:\windows\system32\AVSredirect.dll
2005-06-26 14:32 616448 --sha-r- c:\windows\system32\cygwin1.dll
2005-06-21 21:37 45568 --sha-r- c:\windows\system32\cygz.dll
2004-01-24 23:00 70656 --sha-r- c:\windows\system32\i420vfw.dll
2006-04-27 09:24 2945024 --sha-r- c:\windows\system32\Smab.dll
2005-02-28 12:16 240128 --sha-r- c:\windows\system32\x.264.exe
2004-01-24 23:00 70656 --sha-r- c:\windows\system32\yv12vfw.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
[7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\atapi.sys
[-] 2004-08-03 21:59 . !HASH: COULD NOT OPEN FILE !!!!! . 95360 . . [------] . . c:\windows\system32\drivers\atapi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-03-18 630784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-03-27 53248]
"razer"="c:\program files\Razer\razerhid.exe" [2005-05-17 147456]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-29 7573504]
"nwiz"="nwiz.exe" [2006-06-29 1519616]
"SW20"="c:\windows\system32\sw20.exe" [2006-06-29 208896]
"SW24"="c:\windows\system32\sw24.exe" [2006-06-29 69632]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-06-29 86016]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-07-03 499608]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"ScreenManager Pro for LCD (DDCCI)"="c:\program files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe" [2010-02-18 7421952]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2012-10-23 5074384]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 53760]
.
c:\documents and settings\Maťko\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Launchy.lnk - c:\program files\Launchy\Launchy.exe [2008-3-18 274432]
VNC Server.lnk - c:\program files\RealVNC\VNC4\winvnc4.exe [2008-2-16 1484152]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
EIZO ScreenSlicer.lnk - c:\windows\Installer\{292A177D-723F-4537-9985-BC8BFCD8B63D}\ESCSlicer.exe1_87A06423E78E426E924121140A36B659.exe [2012-6-14 61440]
Launchy.lnk - c:\program files\Launchy\Launchy.exe [2008-3-18 274432]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileZilla Server Interface]
2009-12-30 23:25 1208832 ----a-w- c:\program files\FileZilla Server\FileZilla Server Interface.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Install\\Moja Miranda\\M!raNda.Pack-Lord_3D v1\\Miranda IM\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\Skusobna\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"=
"d:\\Install\\Moja Miranda\\M!raNda.Pack-Lord_3D v1 na 7.0\\Miranda IM - ICQ+\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\M!raNda.Pack-Lord_3D v1 na 7.0\\^Zaloha 8.0.0.1 - NS\\Miranda IM - ICQ+\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\L3d.2008\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\SKINTEST\\Miranda IM - ICQ+\\miranda32.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\Miranda 8.0\\miranda32.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"d:\\mIRC\\mirc.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\RatioMaster\\RatioMaster.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\Miranda 0.9 # 1 Alfa\\miranda32.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\RatioMaster\\RatioMaster-vs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"f:\\F -Moje dokumenty\\Miranda 0.9 # 1 Alfa\\miranda32.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\Warcraft III\\war3.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:WAR.3.TFT
"5900:TCP"= 5900:TCP:VNC
"21:TCP"= 21:TCP:21
.
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [23. 11. 2006 23:47 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [23. 11. 2006 23:47 5248]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [8. 10. 2012 8:21 121216]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [23. 10. 2012 17:38 1329304]
R2 LcdctrlSvc;LcdctrlSvc;c:\program files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlSvc.exe [16. 2. 2010 18:01 90112]
R2 WinI2C-DDC;WinI2C-DDC Kernel Mode Driver;c:\windows\system32\drivers\ddcdrv.sys [10. 12. 2009 9:41 10240]
S2 AdobeAlerter;Adobe LM Service AdobeAlerter;c:\windows\system32\wpv121238436518.exe run --> c:\windows\system32\wpv121238436518.exe run [?]
S3 CnxEtP;Conexant AccessRunner USB ADSL Adapter Filter Driver;c:\windows\system32\DRIVERS\CnxEtP.sys --> c:\windows\system32\DRIVERS\CnxEtP.sys [?]
S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\DRIVERS\CnxEtU.sys --> c:\windows\system32\DRIVERS\CnxEtU.sys [?]
S3 CnxTgNP;Conexant AccessRunner ADSL WAN PPPoE Adapter Driver;c:\windows\system32\DRIVERS\CnxTgNP.sys --> c:\windows\system32\DRIVERS\CnxTgNP.sys [?]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp --> c:\docume~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2. 8. 2005 22:10 32512]
S3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\drivers\Razerlow.sys [14. 3. 2007 14:45 13225]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19. 2. 2010 12:37 517096]
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-01 c:\windows\Tasks\AdobeAAMUpdater-1.0-MATKO-Maťko.job
- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-07-03 13:12]
.
2012-10-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.sk/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Locate Spot on Map by GPS - c:\program files\Opanda\IExif 2.3\IExifMap.htm
IE: View Exif/GPS/IPTC with IExif - c:\program files\Opanda\IExif 2.3\IExifCom.htm
FF - ProfilePath - c:\documents and settings\Maťko\Application Data\Mozilla\Firefox\Profiles\tq48cpgt.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/
FF - prefs.js: network.proxy.type - 2
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-Skype - c:\documents and settings\Maťko\Local Settings\Application Data\Skype\SkypePM.exe
MSConfigStartUp-ScreenManager Pro for LCD - c:\program files\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe
AddRemove-Money S3 - c:\program files\CIGLER SOFTWARE\Common Files\Money S3\Setup\Uninst.exe
AddRemove-Steam App 10 - c:\program files\Valve\Steam\steam.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-11 22:27
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(2984)
c:\program files\RocketDock\RocketDock.dll
c:\program files\EIZO\ScreenSlicer\liblatticehook.dll
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\FileZilla Server\FileZilla Server.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\EIZO\ScreenSlicer\ESCSlicer.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Razer\razerofa.exe
c:\windows\system32\wdfmgr.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2012-11-11 22:33:45 - machine was rebooted
ComboFix-quarantined-files.txt 2012-11-11 21:33
.
Pre-Run: 12 381 089 792 bytes free
Post-Run: 12 403 523 584 bytes free
.
- - End Of File - - 6314AC7904060215C907FCCD7397E4DB

#5 Příspěvek od **vyosek** » 12 lis 2012 16:58

Rozdeleni do dvou postu je v poradku

Stahnete SPTD http://www.duplexsecure.com/en/downloads

Vyberte z uvedene stranky verzi dle sveho operacniho systemu (32(x86)bit ci 64(x64)bit)
Ulozte na plochu a spustte
Zvolte moznost Uninstall a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte

Stahnete Defogger http://www.jpshortstuff.247fixes.com/Defogger.exe

Ulozte na plochu a spustte
Kliknete na Disable a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

KillAll::

FCopy::
C:\WINDOWS\system32\dllcache\uxtheme.dll | C:\WINDOWS\System32\UxTheme.dll
c:\windows\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys | C:\WINDOWS\system32\dllcache\atapi.sys

Collect::
c:\windows\meta4.exe
c:\windows\MOTA113.exe
c:\windows\x2.64.exe
c:\windows\system32\avisynth.dll
c:\windows\system32\AVSredirect.dll
c:\windows\system32\cygwin1.dll
c:\windows\system32\cygz.dll
c:\windows\system32\i420vfw.dll
c:\windows\system32\Smab.dll
c:\windows\system32\x.264.exe
c:\windows\system32\yv12vfw.dll

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"=-
"SunJavaUpdateSched"=-
"QuickTime Task"=-
"iTunesHelper"=-
"AdobeAAMUpdater-1.0"=-
"SwitchBoard"=-
"AdobeCS5.5ServiceManager"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"=-
"5900:TCP"=-
"21:TCP"=-

File::
c:\documents and settings\Maťko\Start Menu\Programs\Startup\Adobe Gamma.lnk
c:\windows\Tasks\AdobeAAMUpdater-1.0-MATKO-Maťko.job
c:\windows\Tasks\AppleSoftwareUpdate.job

Driver:
SetupNTGLM7X

ClearJavaCache::

Reboot::

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

Lord_3D · #6 Příspěvek od **Lord_3D** » 16 lis 2012 16:57

Dobrý deň, ospravedlňujem sa za neskorú reakciu.
Tu je log z ComboFixu:

ComboFix 12-11-10.01 - Maťko . 11. 2012 16:38:34.5.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1033.18.1023.537 [GMT 1:00]
Running from: c:\documents and settings\MaŁko\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\MaŁko\Desktop\CFScript.txt.txt
AV: ESET Smart Security 6.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *Enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is active
.
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
.
((((((((((((((((((((((((( Files Created from 2012-10-16 to 2012-11-16 )))))))))))))))))))))))))))))))
.
.
2012-11-11 18:12 . 2012-11-11 18:12 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\ESET
2012-11-11 16:42 . 2012-11-11 16:42 -------- d-----w- c:\documents and settings\Maťko\Application Data\ESET
2012-11-11 16:40 . 2012-11-11 16:40 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 07:21 . 2012-10-08 07:21 62512 ----a-w- c:\windows\system32\drivers\epfwtdi.sys
2012-10-08 07:21 . 2012-10-08 07:21 40376 ----a-w- c:\windows\system32\drivers\epfwndis.sys
2012-10-08 07:21 . 2012-10-08 07:21 149568 ----a-w- c:\windows\system32\drivers\epfw.sys
2012-10-08 07:21 . 2012-10-08 07:21 121216 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2012-10-08 07:21 . 2012-10-08 07:21 159832 ----a-w- c:\windows\system32\drivers\eamon.sys
2012-03-19 18:22 . 2011-10-19 15:31 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2005-05-13 16:12 217073 --sha-r- c:\windows\meta4.exe
2005-10-24 10:13 66560 --sha-r- c:\windows\MOTA113.exe
2005-10-13 20:27 422400 --sha-r- c:\windows\x2.64.exe
2005-10-07 18:14 308224 --sha-r- c:\windows\system32\avisynth.dll
2005-07-14 11:31 27648 --sha-r- c:\windows\system32\AVSredirect.dll
2005-06-26 14:32 616448 --sha-r- c:\windows\system32\cygwin1.dll
2005-06-21 21:37 45568 --sha-r- c:\windows\system32\cygz.dll
2004-01-24 23:00 70656 --sha-r- c:\windows\system32\i420vfw.dll
2006-04-27 09:24 2945024 --sha-r- c:\windows\system32\Smab.dll
2005-02-28 12:16 240128 --sha-r- c:\windows\system32\x.264.exe
2004-01-24 23:00 70656 --sha-r- c:\windows\system32\yv12vfw.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-03-18 630784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-03-27 53248]
"razer"="c:\program files\Razer\razerhid.exe" [2005-05-17 147456]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-29 7573504]
"nwiz"="nwiz.exe" [2006-06-29 1519616]
"SW20"="c:\windows\system32\sw20.exe" [2006-06-29 208896]
"SW24"="c:\windows\system32\sw24.exe" [2006-06-29 69632]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-06-29 86016]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-07-03 499608]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"ScreenManager Pro for LCD (DDCCI)"="c:\program files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe" [2010-02-18 7421952]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2012-10-23 5074384]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 53760]
.
c:\documents and settings\Maťko\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Launchy.lnk - c:\program files\Launchy\Launchy.exe [2008-3-18 274432]
VNC Server.lnk - c:\program files\RealVNC\VNC4\winvnc4.exe [2008-2-16 1484152]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
EIZO ScreenSlicer.lnk - c:\windows\Installer\{292A177D-723F-4537-9985-BC8BFCD8B63D}\ESCSlicer.exe1_87A06423E78E426E924121140A36B659.exe [2012-6-14 61440]
Launchy.lnk - c:\program files\Launchy\Launchy.exe [2008-3-18 274432]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileZilla Server Interface]
2009-12-30 23:25 1208832 ----a-w- c:\program files\FileZilla Server\FileZilla Server Interface.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Install\\Moja Miranda\\M!raNda.Pack-Lord_3D v1\\Miranda IM\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\Skusobna\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"=
"d:\\Install\\Moja Miranda\\M!raNda.Pack-Lord_3D v1 na 7.0\\Miranda IM - ICQ+\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\M!raNda.Pack-Lord_3D v1 na 7.0\\^Zaloha 8.0.0.1 - NS\\Miranda IM - ICQ+\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\L3d.2008\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\SKINTEST\\Miranda IM - ICQ+\\miranda32.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\Miranda 8.0\\miranda32.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"d:\\mIRC\\mirc.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\RatioMaster\\RatioMaster.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\Miranda 0.9 # 1 Alfa\\miranda32.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\RatioMaster\\RatioMaster-vs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"f:\\F -Moje dokumenty\\Miranda 0.9 # 1 Alfa\\miranda32.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\Warcraft III\\war3.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:WAR.3.TFT
"5900:TCP"= 5900:TCP:VNC
"21:TCP"= 21:TCP:21
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [8. 10. 2012 8:21 121216]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [23. 10. 2012 17:38 1329304]
R2 LcdctrlSvc;LcdctrlSvc;c:\program files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlSvc.exe [16. 2. 2010 18:01 90112]
R2 WinI2C-DDC;WinI2C-DDC Kernel Mode Driver;c:\windows\system32\drivers\ddcdrv.sys [10. 12. 2009 9:41 10240]
S2 AdobeAlerter;Adobe LM Service AdobeAlerter;c:\windows\system32\wpv121238436518.exe run --> c:\windows\system32\wpv121238436518.exe run [?]
S3 CnxEtP;Conexant AccessRunner USB ADSL Adapter Filter Driver;c:\windows\system32\DRIVERS\CnxEtP.sys --> c:\windows\system32\DRIVERS\CnxEtP.sys [?]
S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\DRIVERS\CnxEtU.sys --> c:\windows\system32\DRIVERS\CnxEtU.sys [?]
S3 CnxTgNP;Conexant AccessRunner ADSL WAN PPPoE Adapter Driver;c:\windows\system32\DRIVERS\CnxTgNP.sys --> c:\windows\system32\DRIVERS\CnxTgNP.sys [?]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp --> c:\docume~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2. 8. 2005 22:10 32512]
S3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\drivers\Razerlow.sys [14. 3. 2007 14:45 13225]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19. 2. 2010 12:37 517096]
S4 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [23. 11. 2006 23:47 160640]
S4 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [23. 11. 2006 23:47 5248]
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-01 c:\windows\Tasks\AdobeAAMUpdater-1.0-MATKO-Maťko.job
- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-07-03 13:12]
.
2012-10-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.sk/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Locate Spot on Map by GPS - c:\program files\Opanda\IExif 2.3\IExifMap.htm
IE: View Exif/GPS/IPTC with IExif - c:\program files\Opanda\IExif 2.3\IExifCom.htm
FF - ProfilePath - c:\documents and settings\Maťko\Application Data\Mozilla\Firefox\Profiles\tq48cpgt.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/
FF - prefs.js: network.proxy.type - 2
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-16 16:52
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1924)
c:\program files\EIZO\ScreenSlicer\liblatticehook.dll
c:\windows\system32\msi.dll
.
Completion time: 2012-11-16 16:55:57
ComboFix-quarantined-files.txt 2012-11-16 15:55
ComboFix2.txt 2012-11-11 21:33
.
Pre-Run: 12 232 613 888 bytes free
Post-Run: 13 adresárov, 12 243 673 088 voľných bajtov
.
- - End Of File - - 1A586ACCC25E8C42870FD5D3EAC1DBE5

Lord_3D · #7 Příspěvek od **Lord_3D** » 16 lis 2012 16:58

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:28 on 16/11/2012 (Maťko)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
a347bus -> Disabled (Service running -> reboot required)
a347scsi -> Disabled (Service running -> reboot required)
Unable to read atapi.sys

#8 Příspěvek od **vyosek** » 16 lis 2012 18:37

A jeje, zas problemy ComboFixu (diakritika v nazvu uctu)

Dejte CF primo na c:\

Primo na c:\ vytvorte skript a pretahnete jej nad CF

Lord_3D · #9 Příspěvek od **Lord_3D** » 16 lis 2012 19:24

Tak teda pokus číslo 2

ComboFix 12-11-10.01 - Maťko . 11. 2012 19:02:10.6.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1033.18.1023.513 [GMT 1:00]
Running from: C:\ComboFix.exe
Command switches used :: C:\CFScript.txt
AV: ESET Smart Security 6.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *Enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is active
.
.
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
FILE ::
"c:\documents and settings\Maťko\Start Menu\Programs\Startup\Adobe Gamma.lnk"
"c:\windows\Tasks\AdobeAAMUpdater-1.0-MATKO-Maťko.job"
"c:\windows\Tasks\AppleSoftwareUpdate.job"
.
file zipped: c:\windows\meta4.exe
file zipped: c:\windows\MOTA113.exe
file zipped: c:\windows\system32\avisynth.dll
file zipped: c:\windows\system32\AVSredirect.dll
file zipped: c:\windows\system32\cygwin1.dll
file zipped: c:\windows\system32\cygz.dll
file zipped: c:\windows\system32\i420vfw.dll
file zipped: c:\windows\system32\Smab.dll
file zipped: c:\windows\system32\x.264.exe
file zipped: c:\windows\system32\yv12vfw.dll
file zipped: c:\windows\x2.64.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
--------------- FCopy ---------------
.
c:\windows\system32\dllcache\uxtheme.dll --> c:\windows\System32\UxTheme.dll
c:\windows\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys --> c:\windows\system32\dllcache\atapi.sys
.
((((((((((((((((((((((((( Files Created from 2012-10-16 to 2012-11-16 )))))))))))))))))))))))))))))))
.
.
2012-11-11 18:12 . 2012-11-11 18:12 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\ESET
2012-11-11 16:42 . 2012-11-11 16:42 -------- d-----w- c:\documents and settings\Maťko\Application Data\ESET
2012-11-11 16:40 . 2012-11-11 16:40 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-08 07:21 . 2012-10-08 07:21 62512 ----a-w- c:\windows\system32\drivers\epfwtdi.sys
2012-10-08 07:21 . 2012-10-08 07:21 40376 ----a-w- c:\windows\system32\drivers\epfwndis.sys
2012-10-08 07:21 . 2012-10-08 07:21 149568 ----a-w- c:\windows\system32\drivers\epfw.sys
2012-10-08 07:21 . 2012-10-08 07:21 121216 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2012-10-08 07:21 . 2012-10-08 07:21 159832 ----a-w- c:\windows\system32\drivers\eamon.sys
2012-03-19 18:22 . 2011-10-19 15:31 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2005-05-13 16:12 217073 --sha-r- c:\windows\meta4.exe
2005-10-24 10:13 66560 --sha-r- c:\windows\MOTA113.exe
2005-10-13 20:27 422400 --sha-r- c:\windows\x2.64.exe
2005-10-07 18:14 308224 --sha-r- c:\windows\system32\avisynth.dll
2005-07-14 11:31 27648 --sha-r- c:\windows\system32\AVSredirect.dll
2005-06-26 14:32 616448 --sha-r- c:\windows\system32\cygwin1.dll
2005-06-21 21:37 45568 --sha-r- c:\windows\system32\cygz.dll
2004-01-24 23:00 70656 --sha-r- c:\windows\system32\i420vfw.dll
2006-04-27 09:24 2945024 --sha-r- c:\windows\system32\Smab.dll
2005-02-28 12:16 240128 --sha-r- c:\windows\system32\x.264.exe
2004-01-24 23:00 70656 --sha-r- c:\windows\system32\yv12vfw.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-03-18 630784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-03-27 53248]
"razer"="c:\program files\Razer\razerhid.exe" [2005-05-17 147456]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-29 7573504]
"nwiz"="nwiz.exe" [2006-06-29 1519616]
"SW20"="c:\windows\system32\sw20.exe" [2006-06-29 208896]
"SW24"="c:\windows\system32\sw24.exe" [2006-06-29 69632]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-06-29 86016]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 86016]
"ScreenManager Pro for LCD (DDCCI)"="c:\program files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe" [2010-02-18 7421952]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2012-10-23 5074384]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 53760]
.
c:\documents and settings\Maťko\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
Launchy.lnk - c:\program files\Launchy\Launchy.exe [2008-3-18 274432]
VNC Server.lnk - c:\program files\RealVNC\VNC4\winvnc4.exe [2008-2-16 1484152]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
EIZO ScreenSlicer.lnk - c:\windows\Installer\{292A177D-723F-4537-9985-BC8BFCD8B63D}\ESCSlicer.exe1_87A06423E78E426E924121140A36B659.exe [2012-6-14 61440]
Launchy.lnk - c:\program files\Launchy\Launchy.exe [2008-3-18 274432]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileZilla Server Interface]
2009-12-30 23:25 1208832 ----a-w- c:\program files\FileZilla Server\FileZilla Server Interface.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Install\\Moja Miranda\\M!raNda.Pack-Lord_3D v1\\Miranda IM\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\Skusobna\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"=
"d:\\Install\\Moja Miranda\\M!raNda.Pack-Lord_3D v1 na 7.0\\Miranda IM - ICQ+\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\M!raNda.Pack-Lord_3D v1 na 7.0\\^Zaloha 8.0.0.1 - NS\\Miranda IM - ICQ+\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\L3d.2008\\miranda32.exe"=
"d:\\Install\\Moja Miranda\\SKINTEST\\Miranda IM - ICQ+\\miranda32.exe"=
"c:\\Program Files\\Winamp\\winamp.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\Miranda 8.0\\miranda32.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"d:\\mIRC\\mirc.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\RatioMaster\\RatioMaster.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\Miranda 0.9 # 1 Alfa\\miranda32.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\RatioMaster\\RatioMaster-vs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"f:\\F -Moje dokumenty\\Miranda 0.9 # 1 Alfa\\miranda32.exe"=
"f:\\F -Moje dokumenty\\Matúš\\Install\\Warcraft III\\war3.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [8. 10. 2012 8:21 121216]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [23. 10. 2012 17:38 1329304]
R2 LcdctrlSvc;LcdctrlSvc;c:\program files\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlSvc.exe [16. 2. 2010 18:01 90112]
R2 WinI2C-DDC;WinI2C-DDC Kernel Mode Driver;c:\windows\system32\drivers\ddcdrv.sys [10. 12. 2009 9:41 10240]
S2 AdobeAlerter;Adobe LM Service AdobeAlerter;c:\windows\system32\wpv121238436518.exe run --> c:\windows\system32\wpv121238436518.exe run [?]
S3 CnxEtP;Conexant AccessRunner USB ADSL Adapter Filter Driver;c:\windows\system32\DRIVERS\CnxEtP.sys --> c:\windows\system32\DRIVERS\CnxEtP.sys [?]
S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\DRIVERS\CnxEtU.sys --> c:\windows\system32\DRIVERS\CnxEtU.sys [?]
S3 CnxTgNP;Conexant AccessRunner ADSL WAN PPPoE Adapter Driver;c:\windows\system32\DRIVERS\CnxTgNP.sys --> c:\windows\system32\DRIVERS\CnxTgNP.sys [?]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp --> c:\docume~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2. 8. 2005 22:10 32512]
S3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\drivers\Razerlow.sys [14. 3. 2007 14:45 13225]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19. 2. 2010 12:37 517096]
S4 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [23. 11. 2006 23:47 160640]
S4 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [23. 11. 2006 23:47 5248]
.
Contents of the 'Scheduled Tasks' folder
.
2012-11-01 c:\windows\Tasks\AdobeAAMUpdater-1.0-MATKO-Maťko.job
- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-07-03 13:12]
.
2012-10-31 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.sk/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Locate Spot on Map by GPS - c:\program files\Opanda\IExif 2.3\IExifMap.htm
IE: View Exif/GPS/IPTC with IExif - c:\program files\Opanda\IExif 2.3\IExifCom.htm
FF - ProfilePath - c:\documents and settings\Maťko\Application Data\Mozilla\Firefox\Profiles\tq48cpgt.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/
FF - prefs.js: network.proxy.type - 2
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-16 19:16
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\MAKO~1\LOCALS~1\Temp\MVRC35.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1188)
c:\program files\RocketDock\RocketDock.dll
c:\program files\EIZO\ScreenSlicer\liblatticehook.dll
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SOUNDMAN.EXE
c:\program files\EIZO\ScreenSlicer\ESCSlicer.exe
c:\program files\Razer\razerofa.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\FileZilla Server\FileZilla Server.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2012-11-16 19:20:50 - machine was rebooted
ComboFix-quarantined-files.txt 2012-11-16 18:20
ComboFix2.txt 2012-11-16 15:55
ComboFix3.txt 2012-11-11 21:33
.
Pre-Run: 12 754 571 264 bytes free
Post-Run: 13 adresárov, 12 737 986 560 voľných bajtov
.
- - End Of File - - 10D36151889DCD9BF2AC2918679B2053
Upload was successful

#10 Příspěvek od **vyosek** » 16 lis 2012 22:26

Stahnete Avenger http://forum.viry.cz//viewtopic.php?f=11&t=19832

Pokud pouzivate Win Vista ci W7, kliknete na Avenger pravym a dejte Run As Administrator ci Spustit jako spravce
Po spusteni Vas program upozorni, ze vse co delate, delate na vlastni riziko - Dejte OK
Po potvrzeni uz na Vas koukne hlavni okno, kam vlozite skript, ktery mate nize

Kód: Vybrat vše

Files to delete:
c:\windows\meta4.exe
c:\windows\MOTA113.exe
c:\windows\x2.64.exe
c:\windows\system32\avisynth.dll
c:\windows\system32\AVSredirect.dll
c:\windows\system32\cygwin1.dll
c:\windows\system32\cygz.dll
c:\windows\system32\i420vfw.dll
c:\windows\system32\Smab.dll
c:\windows\system32\x.264.exe
c:\windows\system32\yv12vfw.dll

Do ctverecku u Scan for rootkits a Automatically disable any rootkits found dejte fajecku
Nyni uz kliknete na Execute a potvrdte Yes v nasledujicim okne - timto potvrdite spusteni skriptu
Na otazku Reboot now odpovezte opet OK - timto se PC restartuje
Po restartu by se mel otevrit poznamkovy blok s logem a jeho obsah vlozte sem. Pokud se tak nestane, naleznete pozadovany dokument v C:\avenger.txt

Lord_3D · #11 Příspěvek od **Lord_3D** » 17 lis 2012 08:56

nger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "c:\windows\meta4.exe" deleted successfully.
File "c:\windows\MOTA113.exe" deleted successfully.
File "c:\windows\x2.64.exe" deleted successfully.
File "c:\windows\system32\avisynth.dll" deleted successfully.
File "c:\windows\system32\AVSredirect.dll" deleted successfully.
File "c:\windows\system32\cygwin1.dll" deleted successfully.
File "c:\windows\system32\cygz.dll" deleted successfully.
File "c:\windows\system32\i420vfw.dll" deleted successfully.
File "c:\windows\system32\Smab.dll" deleted successfully.
File "c:\windows\system32\x.264.exe" deleted successfully.
File "c:\windows\system32\yv12vfw.dll" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.nger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "c:\windows\meta4.exe" deleted successfully.
File "c:\windows\MOTA113.exe" deleted successfully.
File "c:\windows\x2.64.exe" deleted successfully.
File "c:\windows\system32\avisynth.dll" deleted successfully.
File "c:\windows\system32\AVSredirect.dll" deleted successfully.
File "c:\windows\system32\cygwin1.dll" deleted successfully.
File "c:\windows\system32\cygz.dll" deleted successfully.
File "c:\windows\system32\i420vfw.dll" deleted successfully.
File "c:\windows\system32\Smab.dll" deleted successfully.
File "c:\windows\system32\x.264.exe" deleted successfully.
File "c:\windows\system32\yv12vfw.dll" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

#12 Příspěvek od **vyosek** » 17 lis 2012 21:35

Fajn, jak se chova PC

Lord_3D · #13 Příspěvek od **Lord_3D** » 18 lis 2012 08:42

Už po prvom aplikovaní ComboFixu sa všetko javilo v poriadku, takže hádam je ten bordel preč

Ďakujem za pomoc

#14 Příspěvek od **vyosek** » 18 lis 2012 11:49

Tak jeste uklidime

Odinstalujte Combofix

Prejmenujte ComboFix na Uninstall
Spustte jej
Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

Stahnete a spustte
Pro potvrzeni volby mackejte A, Enter
Po pouziti utilitu smazte
Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

Stahnete a spustte
Kliknete na CleanUp a potvrdte YES
Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

dejte Hledej problémy
nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse

Lord_3D · #15 Příspěvek od **Lord_3D** » 18 lis 2012 15:25

Veľmi pekne ďakujem

VIRY.CZ

Prosím o kontrolu - AdWare

Prosím o kontrolu - AdWare

Re: Prosím o kontrolu - AdWare

Re: Prosím o kontrolu - AdWare

Re: Prosím o kontrolu - AdWare

Re: Prosím o kontrolu - AdWare

Re: Prosím o kontrolu - AdWare

Re: Prosím o kontrolu - AdWare

Re: Prosím o kontrolu - AdWare

Re: Prosím o kontrolu - AdWare

Re: Prosím o kontrolu - AdWare

Re: Prosím o kontrolu - AdWare

Re: Prosím o kontrolu - AdWare

Re: Prosím o kontrolu - AdWare

Re: Prosím o kontrolu - AdWare

Re: Prosím o kontrolu - AdWare