win32/FastSaveApp

Zpráva

#16 Příspěvek od **vyosek** » 14 Ún 2013 21:17

Jde Vam to, uz se blizime snad ke konci mazani

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

KillAll::

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"=-
"Adobe ARM"=-

Driver::
hlivulvy

Collect::
c:\windows\system32\drivers\hlivulvy.sys

Rootkit::
c:\windows\system32\drivers\hlivulvy.sys

File::
c:\windows\Tasks\Adobe Flash Player Updater.job

Firefox::
FF - ProfilePath - c:\documents and settings\hela\Data aplikací\Mozilla\Firefox\Profiles\bp216xxq.default\
FF - prefs.js: browser.search.selectedEngine - Centrum.cz Search
FF - prefs.js: keyword.URL - hxxp://search.centrum.cz/index.php?tool ... m-1.0.0&q=
FF - Ext: LiĹˇta Centrum.cz Toolbar em:version=1.203.023.002 em:displayname=LiĹˇta Centrum.cz Toolbar em:iconURL=chrome://cetrumczp/skin/logo.ico em:creator=iGeared LLC em:description=LiĹˇta Centrum.cz Toolbar em:homepageURL=http://www.igeared.com >: Cetrumcz@igeared - c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

ClearJavaCache::

Reboot::

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

hehelucha · #17 Příspěvek od **hehelucha** » 14 Ún 2013 21:36

ComboFix 13-02-13.02 - hela 14.02.2013 21:30:12.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1791.1069 [GMT 1:00]
Spuštěný z: c:\documents and settings\hela\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\hela\Plocha\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
FILE ::
"c:\windows\Tasks\Adobe Flash Player Updater.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\components\autocomplete.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\components\IGeared_cetrumczp_xputils.xpt
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\components\IGeared_cetrumczp_xputils2.dll
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\components\IGeared_cetrumczp_xputils3.dll
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\components\IGeared_cetrumczp_xputils35.dll
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\components\notifications.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\components\sp.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome.manifest
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\after_install.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\After_uninstall.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\autocomplete-popup.xml
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\config.xml
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\contexthtml.xul
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\custom.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\ex\marquee.xml
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\about.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\bubble_AB.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\bubble_ABSearch.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\bubble_arrow.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\bubble_bottom_shadow.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\bubble_confirm.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\bubble_confirmTbr.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\bubble_logo.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\bubble_search.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\bubble_searchSearchBox.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\bubble_style.css
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\bubble_top_shadow.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\deletehistory_processing.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_config.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifier.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifierBackground.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifierBullet.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifierClose.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifierDown.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifierDownActive.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifierDownDisabled.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifierIco.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifierNext.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifierNextActive.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifierNextDisabled.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifierPrevious.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifierPreviousActive.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifierPreviousDisabled.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifierScrollbar.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifierSettings.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifierUp.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifierUpActive.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\emailchecker_notifierUpDisabled.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\icoUBAccess.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\icoUBCalc.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\icoUBExcel.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\icoUBExplorer.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\icoUBMediaPlayer.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\icoUBNotepad.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\icoUBOutlook.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\icoUBOutlookExpress.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\icoUBPaint.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\icoUBPowerPoint.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\icoUBWord.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_!backgroundFial.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_!backgroundGrey.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_!backgroundRed.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_!bullet.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_!close.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_!icoiDNES.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_!icoRead.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_!icoRSS.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_!icoSimple.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_!icoUnread.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_!logo.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_!logoZena.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_!settings.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_!tabHilighted.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_advanced.css
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_advanced.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_advancedZena.css
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_config.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\rssreader_simple.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\settings_askdialog.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\settings_background.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\settings_closedialog.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\settings_checkboxdialog.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\settings_icohelp.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\settings_loading.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\settings_logo.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\settings_main.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\settings_menu1.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\settings_menu2.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\settings_menu3.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\settings_menu4.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\settings_style.css
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\tabswelcome.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\tabswelcome_button.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\tabswelcome_button_hilight.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\tabswelcome_ie7footer.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\tabswelcome_ie7header.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\tabswelcome_ie8footer.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\tabswelcome_ie8header.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\tbapi.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\ticker_config.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\toolbarprotector_window.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\updater_error.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\updater_ok.gif
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\html\updater_processing.htm
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\htmlwindow.xul
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\imageButton.xml
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\Languages\cs.ini
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\Languages\en.ini
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\Languages\languages.cfg
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\bubbles.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\cache.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\cookie.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\directory.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\dns.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\dom.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\dragdrop.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\file.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\chevron.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\include.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\include_lite.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\loader.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\log.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\mutex.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\newtab.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\pass.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\prefs.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\privacy.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\refreshControl.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\registry.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\resources.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\searches.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\searchplugin.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\searchProvs.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\settings.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\splitter.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\stats.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\tabs.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\translation.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\update.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\updatecontrol.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\updateext.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\updater.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\updates.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\usefulbuttons.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\utils.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\visibility.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\wrapper.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\xml.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\xmlconfig.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libs\xmlitems.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libsex\mail.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libsex\mime.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libsex\pop3.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libsex\rss.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libsex\ticker.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\libsex\xmlitemsex.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\overlay.js
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\overlay.xul
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\content\searchProviders.xml
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\icons\default\IGeared_cetrumczp_htmlwindow.ico
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\contexthtml.css
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\dragdrop.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\emailchecker_icoEmail.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\emailchecker_icoEmailNew.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\gripper.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\chevron.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoAbout.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoAktualne.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoFotoalba.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoGoButtonBG.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoHomepage.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoHoroskopy.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoIcq.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoMagaziny.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoOptions.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoPocasi.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoSport.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoStahuj.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoTelevize.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoTrash.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoUBAccess.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoUBCalc.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoUBExcel.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoUBExplorer.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoUBMediaPlayer.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoUBNotepad.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoUBOutlook.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoUBOutlookExpress.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoUBPaint.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoUBPowerPoint.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoUBWord.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoUpdate.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\icoZena.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\logo.ico
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\logo.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\overlay.css
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\rssreader_!icoRead.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\rssreader_!icoUnread.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\Search_provider_drop.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\searchProvider.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\settings_icon.ico
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\slider.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\spFirma.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\spImages.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\spMapy.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\spSearch.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\spSlovnik.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\spZbozi.png
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\chrome\skin\toolbarprotector_icon.ico
c:\program files\CentrumczToolbar\Firefox\Cetrumcz@igeared\install.rdf
c:\windows\Tasks\Adobe Flash Player Updater.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_hlivulvy
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-01-14 do 2013-02-14 )))))))))))))))))))))))))))))))
.
.
2013-02-14 20:33 . 2013-02-14 20:33 60872 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{FC1BC55C-F40F-4ECF-8ED5-3027BFCE594B}\offreg.dll
2013-02-14 19:37 . 2013-02-14 19:37 29904 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{FC1BC55C-F40F-4ECF-8ED5-3027BFCE594B}\MpKsl7f8dd247.sys
2013-02-14 18:58 . 2013-02-14 18:58 -------- d-----w- c:\program files\trend micro
2013-02-14 18:58 . 2013-02-14 18:58 -------- d-----w- C:\rsit
2013-02-14 13:39 . 2013-01-08 04:57 6991832 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{FC1BC55C-F40F-4ECF-8ED5-3027BFCE594B}\mpengine.dll
2013-02-13 12:42 . 2013-01-08 04:57 6991832 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-08 14:00 . 2012-12-28 14:27 74096 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-02-08 14:00 . 2012-12-28 14:27 697712 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-02-08 14:00 . 2012-12-30 00:00 16365936 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
2013-01-30 10:53 . 2010-12-27 16:24 232336 ------w- c:\windows\system32\MpSigStub.exe
2013-01-26 03:55 . 2008-04-14 12:00 552448 ----a-w- c:\windows\system32\oleaut32.dll
2013-01-20 14:59 . 2010-10-24 20:25 195296 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2013-01-07 07:26 . 2008-04-14 12:00 2150912 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-01-07 07:26 . 2008-04-14 08:06 2029568 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-01-04 10:10 . 2008-04-14 12:00 1867264 ----a-w- c:\windows\system32\win32k.sys
2013-01-02 06:49 . 2008-04-14 12:00 148992 ----a-w- c:\windows\system32\mpg2splt.ax
2013-01-02 06:49 . 2008-04-14 12:00 1294848 ----a-w- c:\windows\system32\quartz.dll
2012-12-27 10:31 . 2008-04-14 12:00 668160 ----a-w- c:\windows\system32\wininet.dll
2012-12-27 10:31 . 2008-04-14 12:00 61952 ----a-w- c:\windows\system32\tdc.ocx
2012-12-27 10:31 . 2008-04-14 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2012-12-27 10:26 . 2008-04-14 12:00 370176 ----a-w- c:\windows\system32\html.iec
2012-12-16 12:23 . 2008-04-14 12:00 290560 ----a-w- c:\windows\system32\atmfd.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 16862720]
"Print2PDF Print Monitor"="c:\program files\Software602\Print2PDF\Print2PDF.exe" [2011-10-04 220992]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\hela\Nabídka Start\Programy\Po spuštění\
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-5 272248]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\ICQ7.5\\ICQ.exe"=
"c:\\Program Files\\Common Files\\soft602\\langserv.exe"=
.
R1 MpKsl7f8dd247;MpKsl7f8dd247;c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{FC1BC55C-F40F-4ECF-8ED5-3027BFCE594B}\MpKsl7f8dd247.sys [14.2.2013 20:37 29904]
R2 602XML Updater;602Updater;c:\program files\Common Files\soft602\602updsvc\602updsvc.exe [10.10.2011 11:55 85344]
R2 HPM1210RcvFaxSrvc;HP LaserJet Professional M1210 MFP Series Receive Fax Service;c:\program files\HP\HP LaserJet M1210 MFP Series\ReceiveFaxUtility.exe [11.5.2010 14:58 247352]
R2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe [2.8.2012 18:15 99896]
S3 HP1210FAX;HP1210MFP FAX;c:\windows\system32\drivers\HPM1210FAX.sys [2.8.2012 18:13 13824]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.318\McCHSvc.exe [5.2.2013 16:48 235216]
S3 mvusbews;USB EWS Device;c:\windows\system32\drivers\mvusbews.sys [2.8.2012 18:13 17408]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
Obsah adresáře 'Naplánované úlohy'
.
2013-02-14 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-01-27 10:11]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
Handler: centrumcztoolbar - {61A97628-7C82-4315-957A-C74C2CDD85DF} - c:\program files\CentrumczToolbar\IEToolbar.dll
FF - ProfilePath - c:\documents and settings\hela\Data aplikací\Mozilla\Firefox\Profiles\bp216xxq.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: SaveByclick: 50ec4e08c2aa5@50ec4e08c2adf.com - %profile%\extensions\50ec4e08c2aa5@50ec4e08c2adf.com
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-14 21:34
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(748)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windows\RTHDCPL.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\windows\system32\wscntfy.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
.
**************************************************************************
.
Celkový čas: 2013-02-14 21:35:32 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-02-14 20:35
ComboFix2.txt 2013-02-14 20:10
.
Před spuštěním: Volných bajtů: 184 668 512 256
Po spuštění: Volných bajtů: 184 582 561 792
.
- - End Of File - - 2D4E4BBB5ADD2F3A613FBA68E2B77B44

#18 Příspěvek od **vyosek** » 14 Ún 2013 21:39

Vyyyborne, jak se chova nas pacient, MSE stale neco mrci a hlasi a krici??

hehelucha · #19 Příspěvek od **hehelucha** » 14 Ún 2013 21:44

ochrana v reálném čase zapnuta a kontrola proběhla bez problémů, MSE mlčí

#20 Příspěvek od **vyosek** » 14 Ún 2013 21:47

Tak jeste uklidime

Odinstalujte Combofix

Prejmenujte ComboFix na Uninstall
Spustte jej
Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

Stahnete a spustte
Pro potvrzeni volby mackejte A, Enter
Po pouziti utilitu smazte
Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

Stahnete a spustte
Kliknete na CleanUp a potvrdte YES
Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

dejte Hledej problémy
nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse

hehelucha · #21 Příspěvek od **hehelucha** » 14 Ún 2013 22:04

vše až na poslední úkol splněno... počítač mi hlásí, že soubor tohoto typu může poškodit počítač, zda chci opravdu ccsetup327.exe stáhnout... pravděpodobně stáhnout, že...

#22 Příspěvek od **vyosek** » 14 Ún 2013 22:06

Aaaano, stahnete, preci bych Vas to nenechal znovu zavirovat abychom to pak lecili znovu

hehelucha · #23 Příspěvek od **hehelucha** » 14 Ún 2013 22:15

já jen pro jistotu...

hotovo - moc děkuji za Váš čas a rady - budu Vás všude chválit a doporučovat...

#24 Příspěvek od **vyosek** » 14 Ún 2013 22:20

Nemate zac, rad jsem pomohl

Byla s vami vyborna spoluprace

Zase nekdy Obrázek

Na rozloucenou vam zahraje nase kapela :guitar:

hehelucha · #25 Příspěvek od **hehelucha** » 14 Ún 2013 22:22

díky a dobrou noc

#26 Příspěvek od **vyosek** » 14 Ún 2013 22:24

Dobrou

A na zaklade Pravidla o zamykani temat

VIRY.CZ

win32/FastSaveApp

Re: win32/FastSaveApp

Re: win32/FastSaveApp

Re: win32/FastSaveApp

Re: win32/FastSaveApp

Re: win32/FastSaveApp

Re: win32/FastSaveApp

Re: win32/FastSaveApp

Re: win32/FastSaveApp

Re: win32/FastSaveApp

Re: win32/FastSaveApp

Re: win32/FastSaveApp