BackDoor.Generic18.KWG

Zpráva

jastura · #1 Příspěvek od **jastura** » 31 led 2014 09:49

Dobrý den,
28.1.jsem hloupě otevřela mail od "České pošty" a i když mi to mělo dojít nedošlo a spuštěním odkazu jsem pustila výše uvedeného trojského koně do PC. Hned jsem to projela avg,našlo, vyléčilo, přesto za dva dny (včera) mi začly vyskakovat hlášky o infikovaných položkách v PC. Přeinstalovala jsem avg, projelo se to (odstranilo nebo vyléčilo? před 5tis.položek) a zůstal tam jeden systémový soubor, který to nechtělo odstranit. Jinak to vypadalo, že je už vše ok. Dnes už zase vyskakují zlášky o hrozbách a je jich zase hodně. Jsem v pasti. V PC se moc neorientuji a už fakt nevím co s tím. Moc prosím o radu
Lenka

#2 Příspěvek od **vyosek** » 31 led 2014 10:40

Zdravim, pekne dopoledne preji a vitam Vas u nas na foru

Poprosim o log dle tohoto navodu http://forum.viry.cz/viewtopic.php?f=13&t=130786 a mrkneme se, co tam mate

jastura · #3 Příspěvek od **jastura** » 31 led 2014 11:14

Zdravím, díky moc, jen to zazálohuju a jdu na to. Jste poklad

#4 Příspěvek od **vyosek** » 31 led 2014 11:43

Ou Kej, kdyby neco nejasneho, tak se ptejte

jastura · #5 Příspěvek od **jastura** » 31 led 2014 12:00

No, chci se ujistit, že si mám vybrat jen jeden z těch odkazů a to nainstalovat.. ?

#6 Příspěvek od **vyosek** » 31 led 2014 12:08

Ano, bud 32 nebo 64 bit, zalezi jaky system mate (pripadne se podiveje sem http://support.microsoft.com/kb/827218/cs) a pak dle toho RSIT stahnout z jednoho odkazu (ty dalsi jsou defakto zalozni)

jastura · #7 Příspěvek od **jastura** » 31 led 2014 13:04

Marně se snažím zaslat Vám ten výsledek, ale pokaždé se mi to celé sekne.. Zkoušela jsem to dát do přílohy, ale nechce to příponu txt.. tak zkouším dále...

#8 Příspěvek od **vyosek** » 31 led 2014 13:12

Poslete mi to tedy na mail

jastura · #9 Příspěvek od **jastura** » 31 led 2014 13:23

Máte to v mailu...

#10 Příspěvek od **vyosek** » 31 led 2014 13:28

Mail dobro dosly

Jestli mate rada konicky, tak se na ne vypravte do zoo ale v PC si je nechovejte, zvlaste ti trojsti konici nejsou dobri kamaradi

Mate tam celou zoo i s babkou pokladni

ja tedy AVG moc nemusim, ale to poresime posleze, nejdrive se zkusime zbavit te haveti

Bude vice kroku, ale verim ze to zvladneme, kdyz nebude neco jasneho, tak se ptejte

- - - - -

Odinstalujte pybot - Search & Destroy 2. Ma uz davno nejlepsi za sebou

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
Na plose vznikne log Rkill.txt ten mi sem vlozte
Ted nerestartujte PC - prisli byste o ucinek RKillu

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte, pripadne opet na mail.
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

#11 Příspěvek od **vyosek** » 31 led 2014 14:45

Ja si sem log zaslany mailem vlozim

ComboFix 14-01-29.01 - admin 31.01.2014 14:25:22.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1791.1329 [GMT 1:00]
Spuštěný z: c:\documents and settings\admin\Plocha\ComboFix.exe
AV: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Internet Security 2012 *Enabled* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\admin\WINDOWS
c:\windows\IsUn0405.exe
c:\windows\ssss
c:\windows\system32\Cache
c:\windows\system32\Cache\0eaf150f156f76e4.fb
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\2c53092c95605355.fb
c:\windows\system32\Cache\31a0997e9a5b5eb3.fb
c:\windows\system32\Cache\32c84fe32bb74d60.fb
c:\windows\system32\Cache\32de8bda98a6df01.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\4522bd8710241477.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\6d03dad1035885d3.fb
c:\windows\system32\Cache\8e480dd5579b1643.fb
c:\windows\system32\Cache\a8556537add6dfc5.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\c1fa887b03019701.fb
c:\windows\system32\Cache\c4d28dca2e7648be.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\system32\Cache\dca2ad0ea41989f2.fb
c:\windows\system32\Cache\e0de16f883bea794.fb
c:\windows\system32\Cache\f998975c9cc711ee.fb
c:\windows\system32\msvcrt40.dll.tmp
c:\windows\system32\UNWISE.EXE
c:\windows\wininit.ini
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-12-28 do 2014-01-31 )))))))))))))))))))))))))))))))
.
.
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-03 12:13 . 2012-06-12 08:39 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-01-03 12:13 . 2012-06-12 08:39 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-11-27 20:21 . 2008-04-14 12:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
2013-11-13 03:00 . 2008-04-14 12:00 150528 ----a-w- c:\windows\system32\imagehlp.dll
2013-11-07 05:38 . 2008-04-14 12:00 591360 ----a-w- c:\windows\system32\rpcrt4.dll
2013-11-06 01:36 . 2008-05-05 05:25 7168 ----a-w- c:\windows\system32\xpsp4res.dll
2013-11-05 20:50 . 2013-11-05 20:50 120600 ----a-w- c:\windows\system32\drivers\avgdiskx.sys
2013-11-04 20:57 . 2013-11-04 20:57 209176 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys
2009-06-16 07:48 . 2009-06-16 07:47 16254360 ----a-w- c:\program files\jre-6u14-windows-i586.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-21 13680640]
"nwiz"="nwiz.exe" [2009-01-21 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-21 86016]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2009-02-27 33599488]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-16 148888]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 528384]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"VideoDownloadConverter Search Scope Monitor"="c:\progra~1\VIDEOD~2\bar\1.bin\4zsrchmn.exe" [2014-01-30 55368]
"VideoDownloadConverter_4z Browser Plugin Loader"="c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe" [2014-01-30 61512]
"AVG_UI"="c:\program files\AVG\AVG2014\avgui.exe" [2013-11-07 4956176]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"Start_ShowMyComputer"= 0 (0x0)
"Start_ShowMyDocs"= 0 (0x0)
"NoStrCmpLogical"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe\0c:\progra~1\AVG\AVG2014\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgemcx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"475:TCP"= 475:TCP:HASP LM
"475:UDP"= 475:UDP:HASP LM
"1947:TCP"= 1947:TCP:HASP SRM
"1947:UDP"= 1947:UDP:HASP SRM
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [24.10.2013 22:28 147768]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [31.10.2013 22:30 222520]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [10.9.2013 0:43 27448]
R1 Avgdiskx;AVG Disk Driver;c:\windows\system32\drivers\avgdiskx.sys [5.11.2013 21:50 120600]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [4.11.2013 21:57 209176]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [17.9.2013 0:57 22840]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [31.10.2013 23:00 176952]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [1.8.2013 16:08 193848]
R2 602XML Updater;602Updater;c:\program files\Common Files\soft602\602updsvc\602updsvc.exe [14.4.2010 10:28 84520]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2014\avgwdsvc.exe [24.9.2013 1:33 348008]
R2 hasplms;HASP License Manager;c:\windows\system32\hasplms.exe -run --> c:\windows\system32\hasplms.exe -run [?]
R2 vToolbarUpdater13.2.0;vToolbarUpdater13.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe [9.11.2012 8:04 711112]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [4.6.2009 13:52 1057024]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [4.9.2012 8:01 26984]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2014\avgidsagent.exe [11.11.2013 22:02 3478544]
S2 HASP Loader;HASP Loader;c:\windows\system32\nhsrvice.exe -service --> c:\windows\system32\nhsrvice.exe -service [?]
S2 VideoDownloadConverter_4zService;VideoDownloadConverterService;c:\progra~1\VIDEOD~2\bar\1.bin\4zbarsvc.exe [30.1.2014 11:02 88648]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\80.tmp --> c:\windows\system32\80.tmp [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
Obsah adresáře 'Naplánované úlohy'
.
2014-01-31 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-12 12:13]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/?utm_source=ch-sethp&utm ... paign=home
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Trusted Zone: centrum.cz\www
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\sign
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojeplatba.cz\www
TCP: DhcpNameServer = 5.45.75.11
DPF: {672EE252-D813-4F5E-81BB-5DD163DD4FA5} - hxxps://www.mojedatovaschranka.cz/static/instal ... ctivex.cab
FF - ProfilePath - c:\documents and settings\admin\Data aplikací\Mozilla\Firefox\Profiles\0wlodghi.default\
FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/
FF - prefs.js: keyword.URL - hxxps://isearch.avg.com/search?cid=%7B9dd03b40-a32e-48f5-9407-d0bd1ed4c044%7D&mid=d4dbb81c2eb8f52e9fd785476ca4a527-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&ds=AVG&v=12.2.5.32&lang=cs&pr=fr&d=2012-05-17%2012%3A57%3A14&sap=ku&q=
pref('extensions.shownSelectionUI',true);
pref('extensions.autoDisableScopes',0);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM-Run-ROC_ROC_JULY_P1 - c:\program files\AVG Secure Search\ROC_ROC_JULY_P1.exe
HKLM-Run-VideoDownloadConverter Home Page Guard 32 bit - c:\progra~1\VIDEOD~2\bar\1.bin\AppIntegrator.exe
AddRemove-HASP Device Drivers - c:\windows\system32\UNWISE.EXE
AddRemove-HASP License Manager - c:\windows\system32\UNWISE.EXE
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-01-31 14:29
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\80.tmp"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Celkový čas: 2014-01-31 14:31:42
ComboFix-quarantined-files.txt 2014-01-31 13:31
.
Před spuštěním: Volných bajtů: 222 055 055 360
Po spuštění: Volných bajtů: 222 334 607 360
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - E76AC26723D37568FB7353D65B865D0D
413FC2A0C716421B3158746D63736515

#12 Příspěvek od **vyosek** » 31 led 2014 14:50

CF nam nejak neukazal co RSIT, no uvidime co dale

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

KillAll::

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-
"Sony Ericsson PC Suite"=-
"HP Software Update"=-
"Adobe ARM"=-
"VideoDownloadConverter Search Scope Monitor"=-
"VideoDownloadConverter_4z Browser Plugin Loader"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"475:TCP"=-
"475:UDP"=-
"1947:TCP"=-
"1947:UDP"=-

Folder::
c:\program files\VideoDownloadConverter_4z
c:\progra~1\VIDEOD~2
c:\program files\Common Files\AVG Secure Search
C:\Program Files\Guard-ICQ

Driver::
vToolbarUpdater13.2.0
VideoDownloadConverter_4zService
MEMSWEEP2
Guard.Mail.ru

File::
C:\WINDOWS\tasks\Adobe Flash Player Updater.job
C:\WINDOWS\tasks\Check for updates (Spybot - Search & Destroy).job
C:\WINDOWS\tasks\Refresh immunization (Spybot - Search & Destroy).job
C:\WINDOWS\tasks\Scan the system (Spybot - Search & Destroy).job

Firefox::
FF - ProfilePath - c:\documents and settings\admin\Data aplikací\Mozilla\Firefox\Profiles\0wlodghi.default\
FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/
FF - prefs.js: keyword.URL - hxxps://isearch.avg.com/search?cid=%7B9dd03b40-a32e-48f5-9407-d0bd1ed4c044%7D&mid=d4dbb81c2eb8f52e9fd785476ca4a527-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&ds=AVG&v=12.2.5.32&lang=cs&pr=fr&d=2012-05-17%2012%3A57%3A14&sap=ku&q=
pref('extensions.shownSelectionUI',true);
pref('extensions.autoDisableScopes',0);

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

ClearJavaCache::

Reboot::

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

jastura · #13 Příspěvek od **jastura** » 31 led 2014 15:13

Už se mi to tak neseká, tak vkládám..

ComboFix 14-01-29.01 - admin 31.01.2014 14:58:56.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1791.1240 [GMT 1:00]
Spuštěný z: c:\documents and settings\admin\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\admin\Plocha\CFScript.txt
AV: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Internet Security 2012 *Enabled* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
FILE ::
"c:\windows\tasks\Adobe Flash Player Updater.job"
"c:\windows\tasks\Check for updates (Spybot - Search & Destroy).job"
"c:\windows\tasks\Refresh immunization (Spybot - Search & Destroy).job"
"c:\windows\tasks\Scan the system (Spybot - Search & Destroy).job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\progra~1\VIDEOD~2
c:\progra~1\VIDEOD~2\bar\1.bin\4zauxstb.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zauxstb64.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zbarsvc.exe
c:\progra~1\VIDEOD~2\bar\1.bin\4zbprtct.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zbrmon.exe
c:\progra~1\VIDEOD~2\bar\1.bin\4zbrmon64.exe
c:\progra~1\VIDEOD~2\bar\1.bin\4zbrstub64.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zdatact.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zdlghk.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zdlghk64.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zfeedmg.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zhighin.exe
c:\progra~1\VIDEOD~2\bar\1.bin\4zhtmlmu.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zhttpct.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zidle.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zieovr.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zmedint.exe
c:\progra~1\VIDEOD~2\bar\1.bin\4zmlbtn.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zPlugin.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zradio.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zreghk.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zregiet.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zscript.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zskin.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4zskplay.exe
c:\progra~1\VIDEOD~2\bar\1.bin\4zSrchMn.exe
c:\progra~1\VIDEOD~2\bar\1.bin\4zsrchmr.dll
c:\progra~1\VIDEOD~2\bar\1.bin\4ztpinst.dll
c:\progra~1\VIDEOD~2\bar\1.bin\AppIntegrator64.exe
c:\progra~1\VIDEOD~2\bar\1.bin\AppIntegratorStub64.dll
c:\progra~1\VIDEOD~2\bar\1.bin\BOOTSTRAP.JS
c:\progra~1\VIDEOD~2\bar\1.bin\CREXT.DLL
c:\progra~1\VIDEOD~2\bar\1.bin\CrExtP4z.exe
c:\progra~1\VIDEOD~2\bar\1.bin\DPNMNGR.DLL
c:\progra~1\VIDEOD~2\bar\1.bin\EXEMANAGER.DLL
c:\progra~1\VIDEOD~2\bar\1.bin\FF-NativeMessagingDispatcher.dll
c:\progra~1\VIDEOD~2\bar\1.bin\Hpg64.dll
c:\progra~1\VIDEOD~2\bar\1.bin\installKeys.js
c:\progra~1\VIDEOD~2\bar\1.bin\LOGO.BMP
c:\progra~1\VIDEOD~2\bar\1.bin\NP4zStub.dll
c:\progra~1\VIDEOD~2\bar\1.bin\T8EPMSUP.DLL
c:\progra~1\VIDEOD~2\bar\1.bin\T8EXTEX.DLL
c:\progra~1\VIDEOD~2\bar\1.bin\T8EXTPEX.DLL
c:\progra~1\VIDEOD~2\bar\1.bin\T8HTML.DLL
c:\progra~1\VIDEOD~2\bar\1.bin\T8RES.DLL
c:\progra~1\VIDEOD~2\bar\1.bin\T8TICKER.DLL
c:\progra~1\VIDEOD~2\bar\1.bin\ThirdPartyInstallers\VideoDownloadConverterSetup.exe
c:\progra~1\VIDEOD~2\bar\1.bin\UNIFIEDLOGGING.DLL
c:\progra~1\VIDEOD~2\bar\1.bin\VERIFY.DLL
c:\progra~1\VIDEOD~2\bar\Cache\00AFA3FD
c:\progra~1\VIDEOD~2\bar\Cache\00AFAA56
c:\progra~1\VIDEOD~2\bar\Cache\00AFAB7F.bmp
c:\progra~1\VIDEOD~2\bar\Cache\00AFABCD.bmp
c:\progra~1\VIDEOD~2\bar\Cache\00AFAC59.bmp
c:\progra~1\VIDEOD~2\bar\Cache\00AFAC98.bmp
c:\progra~1\VIDEOD~2\bar\Cache\00AFADB1.bmp
c:\progra~1\VIDEOD~2\bar\Cache\00AFADF0.cab
c:\progra~1\VIDEOD~2\bar\Cache\00AFAF67.bmp
c:\progra~1\VIDEOD~2\bar\Cache\00AFB003.bmp
c:\progra~1\VIDEOD~2\bar\Cache\00AFB051.bmp
c:\progra~1\VIDEOD~2\bar\Cache\00AFB0AF.bmp
c:\progra~1\VIDEOD~2\bar\Cache\00AFB0ED.cab
c:\progra~1\VIDEOD~2\bar\Cache\files.ini
c:\progra~1\VIDEOD~2\bar\gen1\COMMON.T8S
c:\progra~1\VIDEOD~2\bar\History\search3
c:\progra~1\VIDEOD~2\bar\IE9Mesg\COMMON.T8S
c:\progra~1\VIDEOD~2\bar\Message\COMMON.T8S
c:\progra~1\VIDEOD~2\bar\Settings\prevcfg2.htm
c:\progra~1\VIDEOD~2\bar\Settings\s_pid.dat
c:\progra~1\VIDEOD~2\VideoDownloadConverter_4z\Cache\PopupProperties220474653.html
c:\program files\Common Files\AVG Secure Search
c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zauxstb.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zauxstb64.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zbarsvc.exe
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zbprtct.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zbrmon64.exe
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zbrstub64.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zdatact.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zdlghk.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zdlghk64.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zfeedmg.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zhighin.exe
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zhtmlmu.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zhttpct.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zidle.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zieovr.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zmedint.exe
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zmlbtn.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zPlugin.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zradio.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zreghk.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zregiet.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zscript.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zskin.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zskplay.exe
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zSrchMn.exe
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4zsrchmr.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\4ztpinst.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\AppIntegrator64.exe
c:\program files\VideoDownloadConverter_4z\bar\1.bin\AppIntegratorStub64.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\BOOTSTRAP.JS
c:\program files\VideoDownloadConverter_4z\bar\1.bin\CREXT.DLL
c:\program files\VideoDownloadConverter_4z\bar\1.bin\CrExtP4z.exe
c:\program files\VideoDownloadConverter_4z\bar\1.bin\DPNMNGR.DLL
c:\program files\VideoDownloadConverter_4z\bar\1.bin\EXEMANAGER.DLL
c:\program files\VideoDownloadConverter_4z\bar\1.bin\FF-NativeMessagingDispatcher.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\Hpg64.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\installKeys.js
c:\program files\VideoDownloadConverter_4z\bar\1.bin\LOGO.BMP
c:\program files\VideoDownloadConverter_4z\bar\1.bin\NP4zStub.dll
c:\program files\VideoDownloadConverter_4z\bar\1.bin\T8EPMSUP.DLL
c:\program files\VideoDownloadConverter_4z\bar\1.bin\T8EXTEX.DLL
c:\program files\VideoDownloadConverter_4z\bar\1.bin\T8EXTPEX.DLL
c:\program files\VideoDownloadConverter_4z\bar\1.bin\T8HTML.DLL
c:\program files\VideoDownloadConverter_4z\bar\1.bin\T8RES.DLL
c:\program files\VideoDownloadConverter_4z\bar\1.bin\T8TICKER.DLL
c:\program files\VideoDownloadConverter_4z\bar\1.bin\ThirdPartyInstallers\VideoDownloadConverterSetup.exe
c:\program files\VideoDownloadConverter_4z\bar\1.bin\UNIFIEDLOGGING.DLL
c:\program files\VideoDownloadConverter_4z\bar\1.bin\VERIFY.DLL
c:\program files\VideoDownloadConverter_4z\bar\Cache\00AFA3FD
c:\program files\VideoDownloadConverter_4z\bar\Cache\00AFAA56
c:\program files\VideoDownloadConverter_4z\bar\Cache\00AFAB7F.bmp
c:\program files\VideoDownloadConverter_4z\bar\Cache\00AFABCD.bmp
c:\program files\VideoDownloadConverter_4z\bar\Cache\00AFAC59.bmp
c:\program files\VideoDownloadConverter_4z\bar\Cache\00AFAC98.bmp
c:\program files\VideoDownloadConverter_4z\bar\Cache\00AFADB1.bmp
c:\program files\VideoDownloadConverter_4z\bar\Cache\00AFADF0.cab
c:\program files\VideoDownloadConverter_4z\bar\Cache\00AFAF67.bmp
c:\program files\VideoDownloadConverter_4z\bar\Cache\00AFB003.bmp
c:\program files\VideoDownloadConverter_4z\bar\Cache\00AFB051.bmp
c:\program files\VideoDownloadConverter_4z\bar\Cache\00AFB0AF.bmp
c:\program files\VideoDownloadConverter_4z\bar\Cache\00AFB0ED.cab
c:\program files\VideoDownloadConverter_4z\bar\Cache\files.ini
c:\program files\VideoDownloadConverter_4z\bar\gen1\COMMON.T8S
c:\program files\VideoDownloadConverter_4z\bar\History\search3
c:\program files\VideoDownloadConverter_4z\bar\IE9Mesg\COMMON.T8S
c:\program files\VideoDownloadConverter_4z\bar\Message\COMMON.T8S
c:\program files\VideoDownloadConverter_4z\bar\Settings\prevcfg2.htm
c:\program files\VideoDownloadConverter_4z\bar\Settings\s_pid.dat
c:\program files\VideoDownloadConverter_4z\VideoDownloadConverter_4z\Cache\PopupProperties220474653.html
c:\windows\tasks\Adobe Flash Player Updater.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_MEMSWEEP2
-------\Legacy_VIDEODOWNLOADCONVERTER_4ZSERVICE
-------\Legacy_VTOOLBARUPDATER13.2.0
-------\Service_MEMSWEEP2
-------\Service_VideoDownloadConverter_4zService
-------\Service_vToolbarUpdater13.2.0
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-12-28 do 2014-01-31 )))))))))))))))))))))))))))))))
.
.
2014-01-31 11:18 . 2014-01-31 11:20 -------- d-----w- C:\rsit
2014-01-31 11:18 . 2014-01-31 11:18 -------- d-----w- c:\program files\trend micro
2014-01-31 07:43 . 2014-01-31 07:43 -------- d-----w- c:\program files\Sophos
2014-01-30 12:00 . 2014-01-30 12:00 -------- d-----w- c:\documents and settings\admin\Data aplikací\AVG2014
2014-01-30 12:00 . 2014-01-30 12:00 -------- d-----w- c:\windows\system32\config\systemprofile\Data aplikací\AVG2014
2014-01-30 11:59 . 2014-01-30 11:59 -------- d-----w- C:\$AVG
2014-01-30 11:30 . 2014-01-30 12:37 -------- d-----w- c:\documents and settings\All Users\Data aplikací\azkm
2014-01-30 11:30 . 2014-01-30 11:30 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ecov
2014-01-30 11:30 . 2014-01-30 12:41 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ijan
2014-01-30 11:30 . 2014-01-30 13:12 -------- d-----w- c:\windows\epij
2014-01-30 11:30 . 2014-01-30 11:30 -------- d-----w- c:\documents and settings\All Users\Data aplikací\mxal
2014-01-30 11:29 . 2014-01-30 11:29 -------- d-----w- c:\windows\apag
2014-01-30 11:29 . 2014-01-30 11:29 -------- d-----w- c:\windows\efoj
2014-01-30 11:28 . 2014-01-30 12:43 -------- d-----w- c:\documents and settings\All Users\Data aplikací\lsrc
2014-01-30 11:28 . 2014-01-30 11:28 -------- d-----w- c:\documents and settings\All Users\Data aplikací\exqr
2014-01-30 11:28 . 2014-01-30 12:42 -------- d-----w- c:\documents and settings\All Users\Data aplikací\itfr
2014-01-30 11:28 . 2014-01-30 11:28 -------- d-----w- c:\windows\ahid
2014-01-30 11:28 . 2014-01-30 12:34 -------- d-----w- c:\documents and settings\All Users\Data aplikací\agbr
2014-01-30 11:28 . 2014-01-30 12:40 -------- d-----w- c:\documents and settings\All Users\Data aplikací\gqul
2014-01-30 11:27 . 2014-01-30 11:27 -------- d-----w- c:\windows\gwuk
2014-01-30 11:27 . 2014-01-30 13:07 -------- d-----w- c:\windows\axav
2014-01-30 11:27 . 2014-01-30 12:37 -------- d-----w- c:\documents and settings\All Users\Data aplikací\clad
2014-01-30 11:27 . 2014-01-30 11:27 -------- d-----w- c:\windows\dqov
2014-01-30 11:25 . 2014-01-30 13:17 -------- d-----w- c:\windows\iktp
2014-01-30 11:25 . 2014-01-30 13:15 -------- d-----w- c:\windows\icsk
2014-01-30 11:25 . 2014-01-30 11:25 -------- d-----w- c:\documents and settings\All Users\Data aplikací\otof
2014-01-30 11:25 . 2014-01-30 11:25 -------- d-----w- c:\windows\hxyp
2014-01-30 11:25 . 2014-01-30 11:25 -------- d-----w- c:\documents and settings\All Users\Data aplikací\lneg
2014-01-30 11:25 . 2014-01-30 11:25 -------- d-----w- c:\windows\hmat
2014-01-30 11:25 . 2014-01-30 11:25 -------- d-----w- c:\documents and settings\All Users\Data aplikací\dgev
2014-01-30 11:25 . 2014-01-30 13:14 -------- d-----w- c:\windows\gcoh
2014-01-30 11:25 . 2014-01-30 11:25 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ixyd
2014-01-30 11:24 . 2014-01-30 12:59 -------- d-----w- c:\windows\afkc
2014-01-30 11:24 . 2014-01-30 12:34 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ahsb
2014-01-30 11:24 . 2014-01-30 11:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\bzah
2014-01-30 11:24 . 2014-01-30 13:17 -------- d-----w- c:\windows\ikal
2014-01-30 11:24 . 2014-01-30 13:14 -------- d-----w- c:\windows\fnzp
2014-01-30 11:24 . 2014-01-30 11:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\etuv
2014-01-30 11:24 . 2014-01-30 13:05 -------- d-----w- c:\windows\aluz
2014-01-30 11:24 . 2014-01-30 11:24 -------- d-----w- c:\windows\ikbm
2014-01-30 11:24 . 2014-01-30 11:24 -------- d-----w- c:\windows\eqek
2014-01-30 11:24 . 2014-01-30 11:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\azth
2014-01-30 11:22 . 2014-01-30 11:22 -------- d-----w- c:\windows\edjb
2014-01-30 11:22 . 2014-01-30 11:22 -------- d-----w- c:\windows\dzqt
2014-01-30 11:22 . 2014-01-30 13:15 -------- d-----w- c:\windows\hcaz
2014-01-30 11:22 . 2014-01-30 13:08 -------- d-----w- c:\windows\dtew
2014-01-30 11:22 . 2014-01-30 11:22 -------- d-----w- c:\documents and settings\All Users\Data aplikací\eneg
2014-01-30 11:22 . 2014-01-30 11:22 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ftab
2014-01-30 11:22 . 2014-01-30 13:08 -------- d-----w- c:\windows\axyt
2014-01-30 11:22 . 2014-01-30 11:22 -------- d-----w- c:\windows\ajij
2014-01-30 11:22 . 2014-01-30 11:22 -------- d-----w- c:\documents and settings\All Users\Data aplikací\iwyv
2014-01-30 11:22 . 2014-01-30 11:22 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ikab
2014-01-30 11:22 . 2014-01-30 11:22 -------- d-----w- c:\windows\bqfp
2014-01-30 11:22 . 2014-01-30 11:22 -------- d-----w- c:\documents and settings\All Users\Data aplikací\aciv
2014-01-30 11:22 . 2014-01-30 13:17 -------- d-----w- c:\windows\ijmp
2014-01-30 11:20 . 2014-01-30 12:57 -------- d-----w- c:\windows\abyk
2014-01-30 11:20 . 2014-01-30 11:20 -------- d-----w- c:\documents and settings\All Users\Data aplikací\btyr
2014-01-30 11:20 . 2014-01-30 12:46 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ovxz
2014-01-30 11:20 . 2014-01-30 11:20 -------- d-----w- c:\documents and settings\All Users\Data aplikací\grud
2014-01-30 11:20 . 2014-01-30 13:14 -------- d-----w- c:\windows\fghj
2014-01-30 11:20 . 2014-01-30 12:41 -------- d-----w- c:\documents and settings\All Users\Data aplikací\imyj
2014-01-30 11:20 . 2014-01-30 11:20 -------- d-----w- c:\windows\fnyq
2014-01-30 11:20 . 2014-01-30 11:20 -------- d-----w- c:\windows\awwb
2014-01-30 11:20 . 2014-01-30 13:15 -------- d-----w- c:\windows\hhyz
2014-01-30 11:20 . 2014-01-30 11:20 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ktit
2014-01-30 11:20 . 2014-01-30 11:20 -------- d-----w- c:\windows\bvar
2014-01-30 11:20 . 2014-01-30 11:20 -------- d-----w- c:\windows\gtrb
2014-01-30 11:20 . 2014-01-30 13:09 -------- d-----w- c:\windows\ebdk
2014-01-30 11:18 . 2014-01-30 11:18 -------- d-----w- c:\windows\fjav
2014-01-30 11:17 . 2014-01-30 11:17 -------- d-----w- c:\documents and settings\All Users\Data aplikací\atak
2014-01-30 11:16 . 2014-01-30 11:16 -------- d-----w- c:\windows\fhyb
2014-01-30 11:15 . 2014-01-30 13:05 -------- d-----w- c:\windows\amzt
2014-01-30 11:15 . 2014-01-30 11:15 -------- d-----w- c:\documents and settings\All Users\Data aplikací\opul
2014-01-30 11:15 . 2014-01-30 13:08 -------- d-----w- c:\windows\drun
2014-01-30 11:15 . 2014-01-30 11:15 -------- d-----w- c:\documents and settings\All Users\Data aplikací\eqow
2014-01-30 11:15 . 2014-01-30 11:15 -------- d-----w- c:\documents and settings\All Users\Data aplikací\afhf
2014-01-30 11:15 . 2014-01-30 11:15 -------- d-----w- c:\documents and settings\All Users\Data aplikací\adac
2014-01-30 11:15 . 2014-01-30 12:44 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ocet
2014-01-30 11:15 . 2014-01-30 11:15 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ahaz
2014-01-30 11:15 . 2014-01-30 11:15 -------- d-----w- c:\windows\eqok
2014-01-30 11:15 . 2014-01-30 11:15 -------- d-----w- c:\windows\gsum
2014-01-30 11:15 . 2014-01-30 11:15 -------- d-----w- c:\documents and settings\All Users\Data aplikací\hkbm
2014-01-30 11:13 . 2014-01-30 12:36 -------- d-----w- c:\documents and settings\All Users\Data aplikací\asaz
2014-01-30 11:13 . 2014-01-30 11:13 -------- d-----w- c:\documents and settings\All Users\Data aplikací\kkam
2014-01-30 11:13 . 2014-01-30 11:13 -------- d-----w- c:\documents and settings\All Users\Data aplikací\hvfx
2014-01-30 11:13 . 2014-01-30 11:13 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ihms
2014-01-30 11:13 . 2014-01-30 11:13 -------- d-----w- c:\windows\hbyz
2014-01-30 11:13 . 2014-01-30 12:40 -------- d-----w- c:\documents and settings\All Users\Data aplikací\idmg
2014-01-30 11:13 . 2014-01-30 11:13 -------- d-----w- c:\documents and settings\All Users\Data aplikací\oqum
2014-01-30 11:13 . 2014-01-30 11:21 -------- d-----w- c:\documents and settings\All Users\Data aplikací\onox
2014-01-30 11:13 . 2014-01-30 11:13 -------- d-----w- c:\documents and settings\All Users\Data aplikací\efpb
2014-01-30 11:13 . 2014-01-30 13:12 -------- d-----w- c:\windows\esjk
2014-01-30 11:13 . 2014-01-30 12:41 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ihsw
2014-01-30 11:13 . 2014-01-30 11:13 -------- d-----w- c:\documents and settings\All Users\Data aplikací\fttt
2014-01-30 11:11 . 2014-01-30 11:11 -------- d-----w- c:\documents and settings\All Users\Data aplikací\avtt
2014-01-30 11:10 . 2014-01-30 11:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\icad
2014-01-30 11:10 . 2014-01-30 11:10 -------- d-----w- c:\windows\aqaz
2014-01-30 11:10 . 2014-01-30 11:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\jbec
2014-01-30 11:10 . 2014-01-30 12:43 -------- d-----w- c:\documents and settings\All Users\Data aplikací\lpop
2014-01-30 11:10 . 2014-01-30 11:10 -------- d-----w- c:\windows\igbr
2014-01-30 11:10 . 2014-01-30 11:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\nwec
2014-01-30 11:10 . 2014-01-30 12:37 -------- d-----w- c:\documents and settings\All Users\Data aplikací\dprq
2014-01-30 11:10 . 2014-01-30 13:18 -------- d-----w- c:\windows\imbk
2014-01-30 11:10 . 2014-01-30 11:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ivad
2014-01-30 11:10 . 2014-01-30 13:09 -------- d-----w- c:\windows\ebuf
2014-01-30 11:10 . 2014-01-30 11:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\nkow
2014-01-30 11:10 . 2014-01-30 11:10 -------- d-----w- c:\windows\aqfj
2014-01-30 11:08 . 2014-01-30 11:08 -------- d-----w- c:\windows\fkif
2014-01-30 11:07 . 2014-01-30 11:07 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ehek
2014-01-30 11:06 . 2014-01-30 11:09 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ifcm
2014-01-30 11:05 . 2014-01-30 13:10 -------- d-----w- c:\windows\ehnt
2014-01-30 11:04 . 2014-01-30 11:04 -------- d-----w- c:\documents and settings\All Users\Data aplikací\kbyb
2014-01-30 11:04 . 2014-01-30 11:04 -------- d-----w- c:\documents and settings\All Users\Data aplikací\izfb
2014-01-30 11:04 . 2014-01-30 13:15 -------- d-----w- c:\windows\icim
2014-01-30 11:04 . 2014-01-30 11:18 -------- d-----w- c:\documents and settings\All Users\Data aplikací\otoz
2014-01-30 11:04 . 2014-01-30 11:04 -------- d-----w- c:\windows\gpov
2014-01-30 11:04 . 2014-01-30 11:04 -------- d-----w- c:\documents and settings\All Users\Data aplikací\arih
2014-01-30 11:04 . 2014-01-30 11:04 -------- d-----w- c:\windows\cgsn
2014-01-30 11:04 . 2014-01-30 13:08 -------- d-----w- c:\windows\cftc
2014-01-30 11:04 . 2014-01-30 12:43 -------- d-----w- c:\documents and settings\All Users\Data aplikací\kbab
2014-01-30 11:04 . 2014-01-30 11:04 -------- d-----w- c:\documents and settings\All Users\Data aplikací\gwef
2014-01-30 11:04 . 2014-01-30 11:04 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ajif
2014-01-30 11:04 . 2014-01-30 11:04 -------- d-----w- c:\documents and settings\All Users\Data aplikací\gfos
2014-01-30 11:02 . 2014-01-30 11:02 -------- d-----w- c:\documents and settings\All Users\Data aplikací\dded
2014-01-30 11:01 . 2014-01-30 11:01 -------- d-----w- c:\documents and settings\All Users\Data aplikací\eqeq
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-03 12:13 . 2012-06-12 08:39 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-01-03 12:13 . 2012-06-12 08:39 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-11-27 20:21 . 2008-04-14 12:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
2013-11-13 03:00 . 2008-04-14 12:00 150528 ----a-w- c:\windows\system32\imagehlp.dll
2013-11-07 05:38 . 2008-04-14 12:00 591360 ----a-w- c:\windows\system32\rpcrt4.dll
2013-11-06 01:36 . 2008-05-05 05:25 7168 ----a-w- c:\windows\system32\xpsp4res.dll
2013-11-05 20:50 . 2013-11-05 20:50 120600 ----a-w- c:\windows\system32\drivers\avgdiskx.sys
2013-11-04 20:57 . 2013-11-04 20:57 209176 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys
2009-06-16 07:48 . 2009-06-16 07:47 16254360 ----a-w- c:\program files\jre-6u14-windows-i586.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-21 13680640]
"nwiz"="nwiz.exe" [2009-01-21 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-21 86016]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2009-02-27 33599488]
"AVG_UI"="c:\program files\AVG\AVG2014\avgui.exe" [2013-11-07 4956176]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"Start_ShowMyComputer"= 0 (0x0)
"Start_ShowMyDocs"= 0 (0x0)
"NoStrCmpLogical"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe\0c:\progra~1\AVG\AVG2014\avgrsx.exe /sync /restart
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgemcx.exe"=
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [24.10.2013 22:28 147768]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [31.10.2013 22:30 222520]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [10.9.2013 0:43 27448]
R1 Avgdiskx;AVG Disk Driver;c:\windows\system32\drivers\avgdiskx.sys [5.11.2013 21:50 120600]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [4.11.2013 21:57 209176]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [17.9.2013 0:57 22840]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [31.10.2013 23:00 176952]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [1.8.2013 16:08 193848]
R2 602XML Updater;602Updater;c:\program files\Common Files\soft602\602updsvc\602updsvc.exe [14.4.2010 10:28 84520]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2014\avgidsagent.exe [11.11.2013 22:02 3478544]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2014\avgwdsvc.exe [24.9.2013 1:33 348008]
R2 HASP Loader;HASP Loader;c:\windows\system32\nhsrvice.exe -service --> c:\windows\system32\nhsrvice.exe -service [?]
R2 hasplms;HASP License Manager;c:\windows\system32\hasplms.exe -run --> c:\windows\system32\hasplms.exe -run [?]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [4.6.2009 13:52 1057024]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [4.9.2012 8:01 26984]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/?utm_source=ch-sethp&utm ... paign=home
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Trusted Zone: centrum.cz\www
Trusted Zone: mojebanka.cz\etrading
Trusted Zone: mojebanka.cz\sign
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojeplatba.cz\www
TCP: DhcpNameServer = 5.45.75.11
DPF: {672EE252-D813-4F5E-81BB-5DD163DD4FA5} - hxxps://www.mojedatovaschranka.cz/static/instal ... ctivex.cab
FF - ProfilePath - c:\documents and settings\admin\Data aplikací\Mozilla\Firefox\Profiles\0wlodghi.default\
pref('extensions.shownSelectionUI',true);
pref('extensions.autoDisableScopes',0);
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-01-31 15:05
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(3356)
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nhsrvice.exe
c:\windows\system32\hasplms.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
c:\windows\system32\wscntfy.exe
c:\windows\system32\RUNDLL32.EXE
.
**************************************************************************
.
Celkový čas: 2014-01-31 15:11:33 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-01-31 14:11
ComboFix2.txt 2014-01-31 13:31
.
Před spuštěním: Volných bajtů: 222 339 641 344
Po spuštění: Volných bajtů: 222 275 923 968
.
- - End Of File - - 0DA0E8352B515C076BACD0237D72BB2A
413FC2A0C716421B3158746D63736515

#14 Příspěvek od **vyosek** » 31 led 2014 15:24

Parada, uz se nam i bordel zacina ukazovat. Takze jdeme dale

Stahnete OTM http://oldtimer.geekstogo.com/OTM.exe

Spustte OTM
Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

Kód: Vybrat vše

:files
c:\documents and settings\All Users\Data aplikací\ecov
c:\documents and settings\All Users\Data aplikací\ijan
c:\windows\epij
c:\documents and settings\All Users\Data aplikací\mxal
c:\windows\apag
c:\windows\efoj
c:\documents and settings\All Users\Data aplikací\lsrc
c:\documents and settings\All Users\Data aplikací\exqr
c:\documents and settings\All Users\Data aplikací\itfr
c:\windows\ahid
c:\documents and settings\All Users\Data aplikací\agbr
c:\documents and settings\All Users\Data aplikací\gqul
c:\windows\gwuk
c:\windows\axav
c:\documents and settings\All Users\Data aplikací\clad
c:\windows\dqov
c:\windows\iktp
c:\windows\icsk
c:\documents and settings\All Users\Data aplikací\otof
c:\windows\hxyp
c:\documents and settings\All Users\Data aplikací\lneg
c:\windows\hmat
c:\documents and settings\All Users\Data aplikací\dgev
c:\windows\gcoh
c:\documents and settings\All Users\Data aplikací\ixyd
c:\windows\afkc
c:\documents and settings\All Users\Data aplikací\ahsb
c:\documents and settings\All Users\Data aplikací\bzah
c:\windows\ikal
c:\windows\fnzp
c:\documents and settings\All Users\Data aplikací\etuv
c:\windows\aluz
c:\windows\ikbm
c:\windows\eqek
c:\documents and settings\All Users\Data aplikací\azth
c:\windows\edjb
c:\windows\dzqt
c:\windows\hcaz
c:\windows\dtew
c:\documents and settings\All Users\Data aplikací\eneg
c:\documents and settings\All Users\Data aplikací\ftab
c:\windows\axyt
c:\windows\ajij
c:\documents and settings\All Users\Data aplikací\iwyv
c:\documents and settings\All Users\Data aplikací\ikab
c:\windows\bqfp
c:\documents and settings\All Users\Data aplikací\aciv
c:\windows\ijmp
c:\windows\abyk
c:\documents and settings\All Users\Data aplikací\btyr
c:\documents and settings\All Users\Data aplikací\ovxz
c:\documents and settings\All Users\Data aplikací\grud
c:\windows\fghj
c:\documents and settings\All Users\Data aplikací\imyj
c:\windows\fnyq
c:\windows\awwb
c:\windows\hhyz
c:\documents and settings\All Users\Data aplikací\ktit
c:\windows\bvar
c:\windows\gtrb
c:\windows\ebdk
c:\windows\fjav
c:\documents and settings\All Users\Data aplikací\atak
c:\windows\fhyb
c:\windows\amzt
c:\documents and settings\All Users\Data aplikací\opul
c:\windows\drun
c:\documents and settings\All Users\Data aplikací\eqow
c:\documents and settings\All Users\Data aplikací\afhf
c:\documents and settings\All Users\Data aplikací\adac
c:\documents and settings\All Users\Data aplikací\ocet
c:\documents and settings\All Users\Data aplikací\ahaz
c:\windows\eqok
c:\windows\gsum
c:\documents and settings\All Users\Data aplikací\hkbm
c:\documents and settings\All Users\Data aplikací\asaz
c:\documents and settings\All Users\Data aplikací\kkam
c:\documents and settings\All Users\Data aplikací\hvfx
c:\documents and settings\All Users\Data aplikací\ihms
c:\windows\hbyz
c:\documents and settings\All Users\Data aplikací\idmg
c:\documents and settings\All Users\Data aplikací\oqum
c:\documents and settings\All Users\Data aplikací\onox
c:\documents and settings\All Users\Data aplikací\efpb
c:\windows\esjk
c:\documents and settings\All Users\Data aplikací\ihsw
c:\documents and settings\All Users\Data aplikací\fttt
c:\documents and settings\All Users\Data aplikací\avtt
c:\documents and settings\All Users\Data aplikací\icad
c:\windows\aqaz
c:\documents and settings\All Users\Data aplikací\jbec
c:\documents and settings\All Users\Data aplikací\lpop
c:\windows\igbr
c:\documents and settings\All Users\Data aplikací\nwec
c:\documents and settings\All Users\Data aplikací\dprq
c:\windows\imbk
c:\documents and settings\All Users\Data aplikací\ivad
c:\windows\ebuf
c:\documents and settings\All Users\Data aplikací\nkow
c:\windows\aqfj
c:\windows\fkif
c:\documents and settings\All Users\Data aplikací\ehek
c:\documents and settings\All Users\Data aplikací\ifcm
c:\windows\ehnt
c:\documents and settings\All Users\Data aplikací\kbyb
c:\documents and settings\All Users\Data aplikací\izfb
c:\windows\icim
c:\documents and settings\All Users\Data aplikací\otoz
c:\windows\gpov
c:\documents and settings\All Users\Data aplikací\arih
c:\windows\cgsn
c:\windows\cftc
c:\documents and settings\All Users\Data aplikací\kbab
c:\documents and settings\All Users\Data aplikací\gwef
c:\documents and settings\All Users\Data aplikací\ajif
c:\documents and settings\All Users\Data aplikací\gfos
c:\documents and settings\All Users\Data aplikací\dded
c:\documents and settings\All Users\Data aplikací\eqeq
c:\documents and settings\All Users\Data aplikací\azkm
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp

:commands
[RESETHOSTS]
[EMPTYTEMP]
[EMPTYFLASH]
[EMPTYJAVA]

Kliknete na cervene tlacitko MoveIt!
Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte

jastura · #15 Příspěvek od **jastura** » 31 led 2014 15:44

tak tedy vkládám:

All processes killed
========== FILES ==========
c:\documents and settings\All Users\Data aplikací\ecov folder moved successfully.
c:\documents and settings\All Users\Data aplikací\ijan folder moved successfully.
c:\windows\epij folder moved successfully.
c:\documents and settings\All Users\Data aplikací\mxal folder moved successfully.
c:\windows\apag folder moved successfully.
c:\windows\efoj folder moved successfully.
c:\documents and settings\All Users\Data aplikací\lsrc folder moved successfully.
c:\documents and settings\All Users\Data aplikací\exqr folder moved successfully.
c:\documents and settings\All Users\Data aplikací\itfr folder moved successfully.
c:\windows\ahid folder moved successfully.
c:\documents and settings\All Users\Data aplikací\agbr folder moved successfully.
c:\documents and settings\All Users\Data aplikací\gqul folder moved successfully.
c:\windows\gwuk folder moved successfully.
c:\windows\axav folder moved successfully.
c:\documents and settings\All Users\Data aplikací\clad folder moved successfully.
c:\windows\dqov folder moved successfully.
c:\windows\iktp folder moved successfully.
c:\windows\icsk folder moved successfully.
c:\documents and settings\All Users\Data aplikací\otof folder moved successfully.
c:\windows\hxyp folder moved successfully.
c:\documents and settings\All Users\Data aplikací\lneg folder moved successfully.
c:\windows\hmat folder moved successfully.
c:\documents and settings\All Users\Data aplikací\dgev folder moved successfully.
c:\windows\gcoh folder moved successfully.
c:\documents and settings\All Users\Data aplikací\ixyd folder moved successfully.
c:\windows\afkc folder moved successfully.
c:\documents and settings\All Users\Data aplikací\ahsb folder moved successfully.
c:\documents and settings\All Users\Data aplikací\bzah folder moved successfully.
c:\windows\ikal folder moved successfully.
c:\windows\fnzp folder moved successfully.
c:\documents and settings\All Users\Data aplikací\etuv folder moved successfully.
c:\windows\aluz folder moved successfully.
c:\windows\ikbm folder moved successfully.
c:\windows\eqek folder moved successfully.
c:\documents and settings\All Users\Data aplikací\azth folder moved successfully.
c:\windows\edjb folder moved successfully.
c:\windows\dzqt folder moved successfully.
c:\windows\hcaz folder moved successfully.
c:\windows\dtew folder moved successfully.
c:\documents and settings\All Users\Data aplikací\eneg folder moved successfully.
c:\documents and settings\All Users\Data aplikací\ftab folder moved successfully.
c:\windows\axyt folder moved successfully.
c:\windows\ajij folder moved successfully.
c:\documents and settings\All Users\Data aplikací\iwyv folder moved successfully.
c:\documents and settings\All Users\Data aplikací\ikab folder moved successfully.
c:\windows\bqfp folder moved successfully.
c:\documents and settings\All Users\Data aplikací\aciv folder moved successfully.
c:\windows\ijmp folder moved successfully.
c:\windows\abyk folder moved successfully.
c:\documents and settings\All Users\Data aplikací\btyr folder moved successfully.
c:\documents and settings\All Users\Data aplikací\ovxz folder moved successfully.
c:\documents and settings\All Users\Data aplikací\grud folder moved successfully.
c:\windows\fghj folder moved successfully.
c:\documents and settings\All Users\Data aplikací\imyj folder moved successfully.
c:\windows\fnyq folder moved successfully.
c:\windows\awwb folder moved successfully.
c:\windows\hhyz folder moved successfully.
c:\documents and settings\All Users\Data aplikací\ktit folder moved successfully.
c:\windows\bvar folder moved successfully.
c:\windows\gtrb folder moved successfully.
c:\windows\ebdk folder moved successfully.
c:\windows\fjav folder moved successfully.
c:\documents and settings\All Users\Data aplikací\atak folder moved successfully.
c:\windows\fhyb folder moved successfully.
c:\windows\amzt folder moved successfully.
c:\documents and settings\All Users\Data aplikací\opul folder moved successfully.
c:\windows\drun folder moved successfully.
c:\documents and settings\All Users\Data aplikací\eqow folder moved successfully.
c:\documents and settings\All Users\Data aplikací\afhf folder moved successfully.
c:\documents and settings\All Users\Data aplikací\adac folder moved successfully.
c:\documents and settings\All Users\Data aplikací\ocet folder moved successfully.
c:\documents and settings\All Users\Data aplikací\ahaz folder moved successfully.
c:\windows\eqok folder moved successfully.
c:\windows\gsum folder moved successfully.
c:\documents and settings\All Users\Data aplikací\hkbm folder moved successfully.
c:\documents and settings\All Users\Data aplikací\asaz folder moved successfully.
c:\documents and settings\All Users\Data aplikací\kkam folder moved successfully.
c:\documents and settings\All Users\Data aplikací\hvfx folder moved successfully.
c:\documents and settings\All Users\Data aplikací\ihms folder moved successfully.
c:\windows\hbyz folder moved successfully.
c:\documents and settings\All Users\Data aplikací\idmg folder moved successfully.
c:\documents and settings\All Users\Data aplikací\oqum folder moved successfully.
c:\documents and settings\All Users\Data aplikací\onox folder moved successfully.
c:\documents and settings\All Users\Data aplikací\efpb folder moved successfully.
c:\windows\esjk folder moved successfully.
c:\documents and settings\All Users\Data aplikací\ihsw folder moved successfully.
c:\documents and settings\All Users\Data aplikací\fttt folder moved successfully.
c:\documents and settings\All Users\Data aplikací\avtt folder moved successfully.
c:\documents and settings\All Users\Data aplikací\icad folder moved successfully.
c:\windows\aqaz folder moved successfully.
c:\documents and settings\All Users\Data aplikací\jbec folder moved successfully.
c:\documents and settings\All Users\Data aplikací\lpop folder moved successfully.
c:\windows\igbr folder moved successfully.
c:\documents and settings\All Users\Data aplikací\nwec folder moved successfully.
c:\documents and settings\All Users\Data aplikací\dprq folder moved successfully.
c:\windows\imbk folder moved successfully.
c:\documents and settings\All Users\Data aplikací\ivad folder moved successfully.
c:\windows\ebuf folder moved successfully.
c:\documents and settings\All Users\Data aplikací\nkow folder moved successfully.
c:\windows\aqfj folder moved successfully.
c:\windows\fkif folder moved successfully.
c:\documents and settings\All Users\Data aplikací\ehek folder moved successfully.
c:\documents and settings\All Users\Data aplikací\ifcm folder moved successfully.
c:\windows\ehnt folder moved successfully.
c:\documents and settings\All Users\Data aplikací\kbyb folder moved successfully.
c:\documents and settings\All Users\Data aplikací\izfb folder moved successfully.
c:\windows\icim folder moved successfully.
c:\documents and settings\All Users\Data aplikací\otoz folder moved successfully.
c:\windows\gpov folder moved successfully.
c:\documents and settings\All Users\Data aplikací\arih folder moved successfully.
c:\windows\cgsn folder moved successfully.
c:\windows\cftc folder moved successfully.
c:\documents and settings\All Users\Data aplikací\kbab folder moved successfully.
c:\documents and settings\All Users\Data aplikací\gwef folder moved successfully.
c:\documents and settings\All Users\Data aplikací\ajif folder moved successfully.
c:\documents and settings\All Users\Data aplikací\gfos folder moved successfully.
c:\documents and settings\All Users\Data aplikací\dded folder moved successfully.
c:\documents and settings\All Users\Data aplikací\eqeq folder moved successfully.
c:\documents and settings\All Users\Data aplikací\azkm folder moved successfully.
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOWS\system32\SET*.tmp not found.
C:\WINDOWS\msdownld.tmp folder moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: admin
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 5055515 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 430785473 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 1336 bytes

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 5891660 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2504 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 8405015 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 429,00 mb

[EMPTYFLASH]

User: admin
->Flash cache emptied: 0 bytes

User: Administrator

User: All Users

User: Default User

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0,00 mb

[EMPTYJAVA]

User: admin
->Java cache emptied: 0 bytes

User: Administrator

User: All Users

User: Default User

User: LocalService

User: NetworkService

Total Java Files Cleaned = 0,00 mb

OTM by OldTimer - Version 3.1.21.0 log created on 01312014_153415

Files moved on Reboot...
File move failed. C:\WINDOWS\temp\hlktmp scheduled to be moved on reboot.

Registry entries deleted on Reboot...

VIRY.CZ

BackDoor.Generic18.KWG

BackDoor.Generic18.KWG

Re: BackDoor.Generic18.KWG

Re: BackDoor.Generic18.KWG

Re: BackDoor.Generic18.KWG

Re: BackDoor.Generic18.KWG

Re: BackDoor.Generic18.KWG

Re: BackDoor.Generic18.KWG

Re: BackDoor.Generic18.KWG

Re: BackDoor.Generic18.KWG

Re: BackDoor.Generic18.KWG

Re: BackDoor.Generic18.KWG

Re: BackDoor.Generic18.KWG

Re: BackDoor.Generic18.KWG

Re: BackDoor.Generic18.KWG

Re: BackDoor.Generic18.KWG