Kontrola logu

[blai]

Zdravím po dlouhé době,
potřeboval bych zkontrolovat log. Neměl by tam být žádný problém.Něco jsem fixnul nebo smazal přes OTM.
Problém je ten, že se nemohu dostat na seznamácké firmy.cz protože jsem údajně podezřelý z rozesílání spamu a žádají mne o emailovou adresu. Tak než jim pošlu ostrou nótu, chtěl bych se ujistit.
Díky

Logfile of random's system information tool 1.09 (written by random/random)
Run by Krotil at 2013-07-15 17:44:10
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 8 GB (43%) free of 19 GB
Total RAM: 1919 MB (75% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:44:16, on 15.7.2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\VIA\RAID\vialogsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\notepad.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Documents and Settings\Krotil\Dokumenty\Downloads\RSIT.exe
C:\Program Files\trend micro\Krotil.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [VIARaidUtl] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O9 - Extra button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files\ICQ7M\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files\ICQ7M\ICQ.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: VRAID Log Service - Unknown owner - C:\Program Files\VIA\RAID\vialogsv.exe

--
End of file - 4129 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\User_Feed_Synchronization-{2D7DFE1B-7F39-4F74-B2FD-3EC953F51445}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"=C:\WINDOWS\SiSUSBrg.exe [2002-07-12 106496]
"Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd []
"VIARaidUtl"=C:\Program Files\VIA\RAID\raid_tool.exe [2013-05-24 2378352]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
C:\Program Files\ICQ7M\ICQ.exe [2013-06-04 127040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2013-05-15 4760816]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2013-05-08 115440]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\!SASCORE]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7M\ICQ.exe"="C:\Program Files\ICQ7M\ICQ.exe:*:Enabled:ICQ7M"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7M\ICQ.exe"="C:\Program Files\ICQ7M\ICQ.exe:*:Enabled:ICQ7M"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv

======List of files/folders created in the last 1 month======

2013-07-15 13:21:31 ----D---- C:\_OTM
2013-07-15 13:14:15 ----D---- C:\Program Files\trend micro
2013-07-15 13:14:14 ----D---- C:\rsit
2013-07-14 18:01:31 ----A---- C:\AdwCleaner[S3].txt
2013-07-14 18:01:06 ----A---- C:\AdwCleaner[R3].txt
2013-07-14 17:54:01 ----D---- C:\JRT
2013-07-14 15:51:23 ----A---- C:\WINDOWS\imsins.BAK
2013-07-14 15:38:01 ----D---- C:\Documents and Settings\All Users\Data aplikací\HitmanPro
2013-07-11 12:39:49 ----HDC---- C:\WINDOWS\$NtUninstallKB2834886$
2013-07-11 12:39:43 ----HDC---- C:\WINDOWS\$NtUninstallKB2850851$
2013-07-11 12:39:18 ----HDC---- C:\WINDOWS\$NtUninstallKB2845187$
2013-07-11 12:39:12 ----HDC---- C:\WINDOWS\$NtUninstallKB2803821_WM9$
2013-07-09 19:27:30 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2013-07-09 13:41:47 ----SHD---- C:\Config.Msi
2013-07-08 12:12:40 ----D---- C:\WINDOWS\system32\XPSViewer
2013-07-08 12:12:34 ----D---- C:\Program Files\MSBuild
2013-07-08 12:12:31 ----D---- C:\WINDOWS\system32\en-US
2013-07-08 12:12:23 ----D---- C:\Program Files\Reference Assemblies
2013-07-08 12:11:51 ----N---- C:\WINDOWS\system32\prntvpt.dll
2013-07-08 12:11:50 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2013-07-08 12:11:50 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2013-07-07 18:03:14 ----D---- C:\Program Files\Yamicsoft
2013-07-07 17:59:20 ----RSD---- C:\WINDOWS\assembly
2013-07-07 17:58:22 ----D---- C:\WINDOWS\Microsoft.NET
2013-07-05 10:37:45 ----A---- C:\sc-cleaner.txt
2013-06-27 19:14:02 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes' Anti-Malware (portable)
2013-06-27 19:12:09 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2013-06-27 17:54:56 ----D---- C:\WINDOWS\ERUNT
2013-06-26 20:32:09 ----D---- C:\Program Files\SUPERAntiSpyware
2013-06-22 12:49:32 ----A---- C:\WINDOWS\system32\msvcr100.dll
2013-06-22 12:49:32 ----A---- C:\WINDOWS\system32\msvcp100.dll
2013-06-22 12:49:07 ----A---- C:\ministub.exe
2013-06-22 12:49:01 ----D---- C:\Program Files\DivX
2013-06-22 12:48:19 ----D---- C:\Documents and Settings\All Users\Data aplikací\DivX

======List of files/folders modified in the last 1 month======

2013-07-15 17:39:58 ----A---- C:\WINDOWS\SchedLgU.Txt
2013-07-15 17:39:23 ----D---- C:\WINDOWS\Prefetch
2013-07-15 17:37:41 ----SD---- C:\WINDOWS\Tasks
2013-07-15 16:28:12 ----D---- C:\WINDOWS\system32\CatRoot2
2013-07-15 13:14:15 ----RD---- C:\Program Files
2013-07-14 16:50:37 ----D---- C:\WINDOWS\system32\drivers
2013-07-14 16:50:37 ----D---- C:\WINDOWS
2013-07-12 17:34:03 ----SHD---- C:\WINDOWS\Installer
2013-07-12 17:34:02 ----D---- C:\WINDOWS\Temp
2013-07-11 20:30:58 ----D---- C:\WINDOWS\Debug
2013-07-11 14:25:07 ----D---- C:\WINDOWS\system32\config
2013-07-11 12:42:52 ----D---- C:\WINDOWS\system32
2013-07-11 12:39:51 ----HD---- C:\WINDOWS\inf
2013-07-11 12:39:50 ----D---- C:\WINDOWS\WinSxS
2013-07-11 12:39:45 ----RSHDC---- C:\WINDOWS\system32\dllcache
2013-07-11 12:38:47 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2013-07-11 12:29:30 ----A---- C:\WINDOWS\system32\MRT.exe
2013-07-11 12:29:11 ----D---- C:\Program Files\Internet Explorer
2013-07-09 19:29:08 ----D---- C:\WINDOWS\system32\CatRoot
2013-07-08 12:12:29 ----RSD---- C:\WINDOWS\Fonts
2013-07-08 12:12:03 ----D---- C:\WINDOWS\system32\spool
2013-07-08 12:09:28 ----D---- C:\WINDOWS\system32\mui
2013-07-07 18:31:15 ----SHD---- C:\System Volume Information
2013-07-07 18:03:21 ----SD---- C:\Documents and Settings\Krotil\Data aplikací\Microsoft
2013-07-07 17:58:48 ----D---- C:\Program Files\Common Files\Microsoft Shared
2013-07-07 17:58:22 ----D---- C:\WINDOWS\pchealth
2013-07-03 13:53:36 ----D---- C:\Program Files\CrystalDiskInfo
2013-06-22 13:28:12 ----D---- C:\Program Files\Common Files
2013-06-22 13:09:56 ----D---- C:\Documents and Settings\All Users\Data aplikací\ICQ

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 uagp35;Filtr Microsoft AGPv3.5; C:\WINDOWS\system32\DRIVERS\uagp35.sys [2008-04-14 44672]
R0 viamraid;viamraid; C:\WINDOWS\system32\DRIVERS\viamraid.sys [2013-05-24 116608]
R1 AmdK7;Ovladač procesoru AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-04-14 41600]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS []
R1 SiSkp;SiSkp; C:\WINDOWS\system32\DRIVERS\srvkp.sys [2006-03-08 12160]
R3 cmuda;C-Media WDM Audio Interface; C:\WINDOWS\system32\drivers\cmuda.sys [2003-10-17 754560]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 SiS315;SiS315; C:\WINDOWS\system32\DRIVERS\sisgrp.sys [2006-03-09 245248]
R3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\system32\DRIVERS\sisnic.sys [2002-07-10 32256]
S3 AsrCDDrv;AsrCDDrv; \??\C:\WINDOWS\system32\Drivers\AsrCDDrv.sys []
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 !SASCORE;SAS Core Service; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [2013-05-23 119056]
R2 VRAID Log Service;VRAID Log Service; C:\Program Files\VIA\RAID\vialogsv.exe [2013-05-24 55920]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2013-05-29 116648]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-11 256904]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2013-05-29 116648]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[Rudy]

Zdravím!
Dvouklikem na soubor C:\Program Files\trend micro\Krotil.exe spusťte HijackThis. Klikněte na "Do a system scan only" a v otevřeném okně vlevo ve čtverečcích zaškrtněte:

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

Klikněte na >FixChecked<. Pak znovu spusťte OTM a klikněte na >CleanUp!<. OTM po sobě uklidí. Nakonec restartujte PC.

[blai]

Hotovo.

Logfile of random's system information tool 1.09 (written by random/random)
Run by Krotil at 2013-07-15 18:05:44
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 8 GB (43%) free of 19 GB
Total RAM: 1919 MB (77% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:05:47, on 15.7.2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\VIA\RAID\vialogsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\system32\sistray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Documents and Settings\Krotil\Plocha\hijackthis.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Krotil\Dokumenty\Downloads\RSIT (1).exe
C:\Program Files\trend micro\Krotil.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [VIARaidUtl] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O9 - Extra button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files\ICQ7M\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files\ICQ7M\ICQ.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: VRAID Log Service - Unknown owner - C:\Program Files\VIA\RAID\vialogsv.exe

--
End of file - 3781 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\User_Feed_Synchronization-{2D7DFE1B-7F39-4F74-B2FD-3EC953F51445}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"=C:\WINDOWS\SiSUSBrg.exe [2002-07-12 106496]
"Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd []
"VIARaidUtl"=C:\Program Files\VIA\RAID\raid_tool.exe [2013-05-24 2378352]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
C:\Program Files\ICQ7M\ICQ.exe [2013-06-04 127040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2013-05-15 4760816]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2013-05-08 115440]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\!SASCORE]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7M\ICQ.exe"="C:\Program Files\ICQ7M\ICQ.exe:*:Enabled:ICQ7M"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7M\ICQ.exe"="C:\Program Files\ICQ7M\ICQ.exe:*:Enabled:ICQ7M"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv

======List of files/folders created in the last 1 month======

2013-07-15 18:05:44 ----D---- C:\rsit
2013-07-15 13:14:15 ----D---- C:\Program Files\trend micro
2013-07-14 18:01:31 ----A---- C:\AdwCleaner[S3].txt
2013-07-14 18:01:06 ----A---- C:\AdwCleaner[R3].txt
2013-07-14 17:54:01 ----D---- C:\JRT
2013-07-14 15:51:23 ----A---- C:\WINDOWS\imsins.BAK
2013-07-14 15:38:01 ----D---- C:\Documents and Settings\All Users\Data aplikací\HitmanPro
2013-07-11 12:39:49 ----HDC---- C:\WINDOWS\$NtUninstallKB2834886$
2013-07-11 12:39:43 ----HDC---- C:\WINDOWS\$NtUninstallKB2850851$
2013-07-11 12:39:18 ----HDC---- C:\WINDOWS\$NtUninstallKB2845187$
2013-07-11 12:39:12 ----HDC---- C:\WINDOWS\$NtUninstallKB2803821_WM9$
2013-07-09 19:27:30 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2013-07-09 13:41:47 ----SHD---- C:\Config.Msi
2013-07-08 12:12:40 ----D---- C:\WINDOWS\system32\XPSViewer
2013-07-08 12:12:34 ----D---- C:\Program Files\MSBuild
2013-07-08 12:12:31 ----D---- C:\WINDOWS\system32\en-US
2013-07-08 12:12:23 ----D---- C:\Program Files\Reference Assemblies
2013-07-08 12:11:51 ----N---- C:\WINDOWS\system32\prntvpt.dll
2013-07-08 12:11:50 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2013-07-08 12:11:50 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2013-07-07 18:03:14 ----D---- C:\Program Files\Yamicsoft
2013-07-07 17:59:20 ----RSD---- C:\WINDOWS\assembly
2013-07-07 17:58:22 ----D---- C:\WINDOWS\Microsoft.NET
2013-07-05 10:37:45 ----A---- C:\sc-cleaner.txt
2013-06-27 19:14:02 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes' Anti-Malware (portable)
2013-06-27 19:12:09 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2013-06-27 17:54:56 ----D---- C:\WINDOWS\ERUNT
2013-06-26 20:32:09 ----D---- C:\Program Files\SUPERAntiSpyware
2013-06-22 12:49:32 ----A---- C:\WINDOWS\system32\msvcr100.dll
2013-06-22 12:49:32 ----A---- C:\WINDOWS\system32\msvcp100.dll
2013-06-22 12:49:07 ----A---- C:\ministub.exe
2013-06-22 12:49:01 ----D---- C:\Program Files\DivX
2013-06-22 12:48:19 ----D---- C:\Documents and Settings\All Users\Data aplikací\DivX

======List of files/folders modified in the last 1 month======

2013-07-15 17:49:57 ----A---- C:\WINDOWS\SchedLgU.Txt
2013-07-15 17:39:23 ----D---- C:\WINDOWS\Prefetch
2013-07-15 17:37:41 ----SD---- C:\WINDOWS\Tasks
2013-07-15 16:28:12 ----D---- C:\WINDOWS\system32\CatRoot2
2013-07-15 13:14:15 ----RD---- C:\Program Files
2013-07-14 16:50:37 ----D---- C:\WINDOWS\system32\drivers
2013-07-14 16:50:37 ----D---- C:\WINDOWS
2013-07-12 17:34:03 ----SHD---- C:\WINDOWS\Installer
2013-07-12 17:34:02 ----D---- C:\WINDOWS\Temp
2013-07-11 20:30:58 ----D---- C:\WINDOWS\Debug
2013-07-11 14:25:07 ----D---- C:\WINDOWS\system32\config
2013-07-11 12:42:52 ----D---- C:\WINDOWS\system32
2013-07-11 12:39:51 ----HD---- C:\WINDOWS\inf
2013-07-11 12:39:50 ----D---- C:\WINDOWS\WinSxS
2013-07-11 12:39:45 ----RSHDC---- C:\WINDOWS\system32\dllcache
2013-07-11 12:38:47 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2013-07-11 12:29:30 ----A---- C:\WINDOWS\system32\MRT.exe
2013-07-11 12:29:11 ----D---- C:\Program Files\Internet Explorer
2013-07-09 19:29:08 ----D---- C:\WINDOWS\system32\CatRoot
2013-07-08 12:12:29 ----RSD---- C:\WINDOWS\Fonts
2013-07-08 12:12:03 ----D---- C:\WINDOWS\system32\spool
2013-07-08 12:09:28 ----D---- C:\WINDOWS\system32\mui
2013-07-07 18:31:15 ----SHD---- C:\System Volume Information
2013-07-07 18:03:21 ----SD---- C:\Documents and Settings\Krotil\Data aplikací\Microsoft
2013-07-07 17:58:48 ----D---- C:\Program Files\Common Files\Microsoft Shared
2013-07-07 17:58:22 ----D---- C:\WINDOWS\pchealth
2013-07-03 13:53:36 ----D---- C:\Program Files\CrystalDiskInfo
2013-06-22 13:28:12 ----D---- C:\Program Files\Common Files
2013-06-22 13:09:56 ----D---- C:\Documents and Settings\All Users\Data aplikací\ICQ

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 uagp35;Filtr Microsoft AGPv3.5; C:\WINDOWS\system32\DRIVERS\uagp35.sys [2008-04-14 44672]
R0 viamraid;viamraid; C:\WINDOWS\system32\DRIVERS\viamraid.sys [2013-05-24 116608]
R1 AmdK7;Ovladač procesoru AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-04-14 41600]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS []
R1 SiSkp;SiSkp; C:\WINDOWS\system32\DRIVERS\srvkp.sys [2006-03-08 12160]
R3 cmuda;C-Media WDM Audio Interface; C:\WINDOWS\system32\drivers\cmuda.sys [2003-10-17 754560]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 SiS315;SiS315; C:\WINDOWS\system32\DRIVERS\sisgrp.sys [2006-03-09 245248]
R3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\system32\DRIVERS\sisnic.sys [2002-07-10 32256]
S3 AsrCDDrv;AsrCDDrv; \??\C:\WINDOWS\system32\Drivers\AsrCDDrv.sys []
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 !SASCORE;SAS Core Service; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [2013-05-23 119056]
R2 VRAID Log Service;VRAID Log Service; C:\Program Files\VIA\RAID\vialogsv.exe [2013-05-24 55920]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2013-05-29 116648]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-11 256904]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2013-05-29 116648]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[Rudy]

Log je již OK.

[blai]

Co s tím varováním od seznamu na firmy.cz ?
Máte s tím nějaké zkušenosti.

[Rudy]

Spsuťte ještě MBAM: http://www.malwarebytes.org/mbam.php . Zadejte kompletní sken a dejte log. Předem nic nemažte.

[blai]

Ten jsem již dělal minulý týden. Log už nemám. Mohu ale znovu. Taky jsem zkoušel rogue killer, MBAR a prostě nic.
Před chvilkou jsem to ještě projel superantispyware a kromě blbostí, co pochytám prohlížení netu, tak taky nic.

Teď mi to jako na potvoru nic nehlásí. Přitom jsem dnes z logu odmazal je zbytečnosti, co se dostanou při instalaci chrome.
Je to dost divný.

[Rudy]

Ještě bychom mohli zkusit ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.

[blai]

Tak vida.
Se ještě asi bude něco čistit, jak koukám.


ComboFix 13-07-15.01 - Krotil 15.07.2013 19:53:29.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1919.1490 [GMT 2:00]
Spuštěný z: c:\documents and settings\Krotil\Dokumenty\Downloads\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Krotil\WINDOWS
c:\windows\IsUn0405.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-06-15 do 2013-07-15 )))))))))))))))))))))))))))))))
.
.
2013-07-15 17:25 . 2013-07-15 17:25 -------- d-----w- c:\documents and settings\Administrator
2013-07-15 17:01 . 2013-07-15 17:01 -------- d-----w- c:\documents and settings\Krotil\Data aplikací\Malwarebytes
2013-07-15 17:01 . 2013-07-15 17:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-07-15 17:01 . 2013-04-04 12:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-07-15 16:05 . 2013-07-15 16:05 -------- d-----w- C:\rsit
2013-07-15 11:14 . 2013-07-15 16:05 -------- d-----w- c:\program files\trend micro
2013-07-14 15:54 . 2013-07-14 15:54 -------- d-----w- C:\JRT
2013-07-14 13:38 . 2013-07-14 13:44 -------- d-----w- c:\documents and settings\All Users\Data aplikací\HitmanPro
2013-07-13 13:42 . 2013-07-13 13:42 512 ----a-w- C:\PhysicalMBR.bin
2013-07-10 07:42 . 2013-07-10 07:42 -------- d-----w- c:\documents and settings\Krotil\Local Settings\Data aplikací\PCHealth
2013-07-08 10:12 . 2013-07-11 10:20 -------- d-----w- c:\windows\system32\XPSViewer
2013-07-08 10:12 . 2013-07-08 10:12 -------- d-----w- c:\program files\MSBuild
2013-07-08 10:12 . 2013-07-08 10:12 -------- d-----w- c:\program files\Reference Assemblies
2013-07-08 10:12 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2013-07-08 10:11 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2013-07-08 10:11 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2013-07-08 10:11 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2013-07-08 10:11 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2013-07-08 10:11 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2013-07-08 10:11 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2013-07-08 10:11 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2013-07-08 10:11 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2013-07-07 16:38 . 2013-07-07 16:38 -------- d-----w- c:\documents and settings\LocalService\Plocha
2013-07-07 16:03 . 2013-07-07 16:03 -------- d-----w- c:\program files\Yamicsoft
2013-07-06 19:24 . 2013-07-06 19:24 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Data aplikací\Google
2013-06-27 17:14 . 2013-07-14 13:35 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes' Anti-Malware (portable)
2013-06-27 17:12 . 2013-06-27 17:12 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2013-06-27 15:54 . 2013-07-14 15:54 -------- d-----w- c:\windows\ERUNT
2013-06-26 18:32 . 2013-06-26 18:32 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-06-22 10:50 . 2013-06-22 10:50 -------- d-----w- c:\documents and settings\Krotil\Local Settings\Data aplikací\Temp
2013-06-22 10:49 . 2013-05-08 06:10 770384 ----a-w- c:\windows\system32\msvcr100.dll
2013-06-22 10:49 . 2013-05-08 06:10 421200 ----a-w- c:\windows\system32\msvcp100.dll
2013-06-22 10:49 . 2013-06-22 10:49 -------- d-----w- c:\documents and settings\Krotil\Local Settings\Data aplikací\CRE
2013-06-22 10:49 . 2013-06-22 10:49 81768 ----a-w- C:\ministub.exe
2013-06-22 10:49 . 2013-06-22 11:28 -------- d-----w- c:\program files\DivX
2013-06-22 10:48 . 2013-06-22 11:28 -------- d-----w- c:\documents and settings\All Users\Data aplikací\DivX
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-11 21:12 . 2013-05-25 13:22 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-06-11 21:12 . 2013-05-25 13:22 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-06-08 01:24 . 2008-04-14 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2013-06-07 21:53 . 2008-04-14 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2013-06-07 21:53 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2013-06-07 18:25 . 2008-04-14 12:00 385024 ------w- c:\windows\system32\html.iec
2013-06-05 09:08 . 2008-04-14 12:00 1876736 ----a-w- c:\windows\system32\win32k.sys
2013-06-04 07:23 . 2008-04-14 12:00 563712 ----a-w- c:\windows\system32\qedit.dll
2013-05-25 14:47 . 2013-05-25 14:48 737280 ----a-w- c:\windows\iun6002.exe
2013-05-24 17:01 . 2010-11-18 12:09 116608 ----a-w- c:\windows\system32\drivers\viamraid.sys
2013-05-24 17:01 . 2013-05-24 17:02 32768 ----a-w- c:\windows\system\VRAIDlog.dll
2013-05-24 17:01 . 2013-05-24 17:02 331184 ------w- c:\windows\system32\difxapi.dll
2013-05-03 05:39 . 2008-04-14 12:00 2195712 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-05-03 05:39 . 2008-04-14 08:06 2072320 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-04-25 15:41 . 2008-04-14 12:00 810496 ----a-w- c:\windows\system32\wmvdmod.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-12 106496]
"VIARaidUtl"="c:\program files\VIA\RAID\raid_tool.exe" [2013-05-24 2378352]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Utility Tray.lnk - c:\windows\system32\sistray.exe [2013-5-24 262144]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2013-05-07 115440]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2013-06-04 15:27 127040 ----a-w- c:\program files\ICQ7M\ICQ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2013-05-15 01:08 4760816 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ7M\\ICQ.exe"=
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [22.7.2011 18:27 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12.7.2011 23:55 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [23.5.2013 22:11 119056]
R2 VRAID Log Service;VRAID Log Service;c:\program files\VIA\RAID\vialogsv.exe [24.5.2013 19:02 55920]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [15.7.2013 19:01 701512]
S3 AsrCDDrv;AsrCDDrv;\??\c:\windows\system32\Drivers\AsrCDDrv.sys --> c:\windows\system32\Drivers\AsrCDDrv.sys [?]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [15.7.2013 19:01 22856]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-13 08:34 1173456 ----a-w- c:\program files\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-07-15 c:\windows\Tasks\User_Feed_Synchronization-{2D7DFE1B-7F39-4F74-B2FD-3EC953F51445}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files\ICQ7M\ICQ.exe
TCP: DhcpNameServer = 10.0.18.234 79.98.156.2
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM-Run-Cmaudio - cmicnfg.cpl
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-07-15 19:59
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
VIARaidUtl = c:\program files\VIA\RAID\raid_tool.exe?ettings\Te
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Celkový čas: 2013-07-15 20:01:37
ComboFix-quarantined-files.txt 2013-07-15 18:01
.
Před spuštěním: 8 463 454 208
Po spuštění: 8 429 596 672
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 906B464168E6697DAFD67B09F41EDF0C
413FC2A0C716421B3158746D63736515

[Rudy]

Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

Reboot::

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

[blai]

ComboFix 13-07-15.01 - Krotil 15.07.2013 21:10:43.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1919.1566 [GMT 2:00]
Spuštěný z: c:\documents and settings\Krotil\Dokumenty\Downloads\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Krotil\Plocha\CFScript.txt
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-06-15 do 2013-07-15 )))))))))))))))))))))))))))))))
.
.
2013-07-15 17:25 . 2013-07-15 17:25 -------- d-----w- c:\documents and settings\Administrator
2013-07-15 17:01 . 2013-07-15 17:01 -------- d-----w- c:\documents and settings\Krotil\Data aplikací\Malwarebytes
2013-07-15 17:01 . 2013-07-15 17:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-07-15 17:01 . 2013-04-04 12:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-07-15 16:05 . 2013-07-15 16:05 -------- d-----w- C:\rsit
2013-07-15 11:14 . 2013-07-15 16:05 -------- d-----w- c:\program files\trend micro
2013-07-14 15:54 . 2013-07-14 15:54 -------- d-----w- C:\JRT
2013-07-14 13:38 . 2013-07-14 13:44 -------- d-----w- c:\documents and settings\All Users\Data aplikací\HitmanPro
2013-07-13 13:42 . 2013-07-13 13:42 512 ----a-w- C:\PhysicalMBR.bin
2013-07-10 07:42 . 2013-07-10 07:42 -------- d-----w- c:\documents and settings\Krotil\Local Settings\Data aplikací\PCHealth
2013-07-08 10:12 . 2013-07-11 10:20 -------- d-----w- c:\windows\system32\XPSViewer
2013-07-08 10:12 . 2013-07-08 10:12 -------- d-----w- c:\program files\MSBuild
2013-07-08 10:12 . 2013-07-08 10:12 -------- d-----w- c:\program files\Reference Assemblies
2013-07-08 10:12 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2013-07-08 10:11 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2013-07-08 10:11 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2013-07-08 10:11 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2013-07-08 10:11 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2013-07-08 10:11 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2013-07-08 10:11 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2013-07-08 10:11 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2013-07-08 10:11 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2013-07-07 16:38 . 2013-07-07 16:38 -------- d-----w- c:\documents and settings\LocalService\Plocha
2013-07-07 16:03 . 2013-07-07 16:03 -------- d-----w- c:\program files\Yamicsoft
2013-07-06 19:24 . 2013-07-06 19:24 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Data aplikací\Google
2013-06-27 17:14 . 2013-07-14 13:35 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes' Anti-Malware (portable)
2013-06-27 17:12 . 2013-06-27 17:12 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2013-06-27 15:54 . 2013-07-14 15:54 -------- d-----w- c:\windows\ERUNT
2013-06-26 18:32 . 2013-06-26 18:32 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-06-22 10:50 . 2013-06-22 10:50 -------- d-----w- c:\documents and settings\Krotil\Local Settings\Data aplikací\Temp
2013-06-22 10:49 . 2013-05-08 06:10 770384 ----a-w- c:\windows\system32\msvcr100.dll
2013-06-22 10:49 . 2013-05-08 06:10 421200 ----a-w- c:\windows\system32\msvcp100.dll
2013-06-22 10:49 . 2013-06-22 10:49 -------- d-----w- c:\documents and settings\Krotil\Local Settings\Data aplikací\CRE
2013-06-22 10:49 . 2013-06-22 10:49 81768 ----a-w- C:\ministub.exe
2013-06-22 10:49 . 2013-06-22 11:28 -------- d-----w- c:\program files\DivX
2013-06-22 10:48 . 2013-06-22 11:28 -------- d-----w- c:\documents and settings\All Users\Data aplikací\DivX
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-11 21:12 . 2013-05-25 13:22 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-06-11 21:12 . 2013-05-25 13:22 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-06-08 01:24 . 2008-04-14 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2013-06-07 21:53 . 2008-04-14 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2013-06-07 21:53 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2013-06-07 18:25 . 2008-04-14 12:00 385024 ------w- c:\windows\system32\html.iec
2013-06-05 09:08 . 2008-04-14 12:00 1876736 ----a-w- c:\windows\system32\win32k.sys
2013-06-04 07:23 . 2008-04-14 12:00 563712 ----a-w- c:\windows\system32\qedit.dll
2013-05-25 14:47 . 2013-05-25 14:48 737280 ----a-w- c:\windows\iun6002.exe
2013-05-24 17:01 . 2010-11-18 12:09 116608 ----a-w- c:\windows\system32\drivers\viamraid.sys
2013-05-24 17:01 . 2013-05-24 17:02 32768 ----a-w- c:\windows\system\VRAIDlog.dll
2013-05-24 17:01 . 2013-05-24 17:02 331184 ------w- c:\windows\system32\difxapi.dll
2013-05-03 05:39 . 2008-04-14 12:00 2195712 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-05-03 05:39 . 2008-04-14 08:06 2072320 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-04-25 15:41 . 2008-04-14 12:00 810496 ----a-w- c:\windows\system32\wmvdmod.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-12 106496]
"VIARaidUtl"="c:\program files\VIA\RAID\raid_tool.exe" [2013-05-24 2378352]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Utility Tray.lnk - c:\windows\system32\sistray.exe [2013-5-24 262144]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2013-05-07 115440]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2013-06-04 15:27 127040 ----a-w- c:\program files\ICQ7M\ICQ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2013-05-15 01:08 4760816 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ7M\\ICQ.exe"=
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [22.7.2011 18:27 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12.7.2011 23:55 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [23.5.2013 22:11 119056]
R2 VRAID Log Service;VRAID Log Service;c:\program files\VIA\RAID\vialogsv.exe [24.5.2013 19:02 55920]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [15.7.2013 19:01 701512]
S3 AsrCDDrv;AsrCDDrv;\??\c:\windows\system32\Drivers\AsrCDDrv.sys --> c:\windows\system32\Drivers\AsrCDDrv.sys [?]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [15.7.2013 19:01 22856]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-13 08:34 1173456 ----a-w- c:\program files\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-07-15 c:\windows\Tasks\User_Feed_Synchronization-{2D7DFE1B-7F39-4F74-B2FD-3EC953F51445}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files\ICQ7M\ICQ.exe
TCP: DhcpNameServer = 10.0.18.234 79.98.156.2
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-07-15 21:19
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
VIARaidUtl = c:\program files\VIA\RAID\raid_tool.exe?ettings\Te
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(1976)
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Google\Update\GoogleUpdate.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2013-07-15 21:22:12 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-07-15 19:22
ComboFix2.txt 2013-07-15 18:01
.
Před spuštěním: 8 416 817 152
Po spuštění: 8 406 413 312
.
- - End Of File - - 9F3D6FDB5D6D1BA1A3880344A5E40F8B
413FC2A0C716421B3158746D63736515

[Rudy]

Log je již OK. Váš PC by měl být zcela bez virů.

[blai]

Rozhodně se zrychlil.
Každopádně si myslím, že něco jsem musel chytnout minulý týden, protože v úterý jsem dělal MBAM a všechno v pohodě a dnes, než se šlo na Combofix, mi nešel MBAM otevřít a musel jsem přejít do nouzáku...
Nejde asi zjistit, co to bylo za mrchu? Včera večer to neodhalil ani onlin eset.

[Rudy]

CF smazal toto:

c:\documents and settings\Krotil\WINDOWS
c:\windows\IsUn0405.exe

Celkem běžné šmejdy a skriptem jsme pouze odemkli několik zamčených reg. klíčů.

[blai]

Jasně. Koukal jsem.

Každopádně díky za pomoc.