Prosím o pomoc, virus Policie

[RomanL2]

Dobrý den, prosím o pomoc s virem Policie. Vypadá to, že napadl zatím pouze jeden účet (Václav) a v účtu administrátora se zatím neaktivuje a mohu z něho spustit RSIT. Zde log z RSIT:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2014-03-16 17:41:14
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 568 GB (93%) free of 610 GB
Total RAM: 2047 MB (54% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-527237240-1979792683-725345543-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-527237240-1979792683-725345543-1003UA.job
C:\WINDOWS\tasks\ROC_REG_JAN_DELETE.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{99E15F0F-98D2-45F1-873F-10D0E7FC0E74}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2014-03-12 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-03-12 171944]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2007-03-16 868352]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2007-04-03 839680]
"AVG_UI"=C:\Program Files\AVG\AVG2014\avgui.exe [2014-01-22 4962320]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"AVG-Secure-Search-Update_0214c"=C:\Documents and Settings\Administrator\Data aplikací\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=53261bfe828347d197f5d152ba6c5121-00e66b8a5fb451d2f2d73dfeaaa1b32f08884e5e /CMPID=0214c []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-10-29 143360]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Documents and Settings\Irena\Local Settings\Data aplikací\Skype\Phone\Skype.exe"="C:\Documents and Settings\Irena\Local Settings\Data aplikací\Skype\Phone\Skype.exe:*:Enabled:Skype "
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Disabled:Internet Explorer"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\AVG\AVG10\avgmfapx.exe"="C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:Instalátor AVG"
"C:\Program Files\AVG\AVG2014\avgnsx.exe"="C:\Program Files\AVG\AVG2014\avgnsx.exe:*:Enabled:Webový štít"
"C:\Program Files\AVG\AVG2014\avgdiagex.exe"="C:\Program Files\AVG\AVG2014\avgdiagex.exe:*:Enabled:AVG Diagnostika 2014"
"C:\Program Files\AVG\AVG2014\avgmfapx.exe"="C:\Program Files\AVG\AVG2014\avgmfapx.exe:*:Enabled:Instalátor AVG"
"C:\Program Files\AVG\AVG2014\avgemcx.exe"="C:\Program Files\AVG\AVG2014\avgemcx.exe:*:Enabled:Obecná kontrola pošty"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6a49698-d2a3-11dd-ba20-c2d05c24a6eb}]
shell\AutoRun\command - F:\setupSNK.exe


======List of files/folders created in the last 1 months======

2014-03-16 17:41:15 ----D---- C:\Program Files\trend micro
2014-03-16 17:41:14 ----D---- C:\rsit
2014-03-16 17:27:01 ----A---- C:\WINDOWS\ntbtlog.txt
2014-03-12 19:32:21 ----HDC---- C:\WINDOWS\$NtUninstallKB943232-v2$
2014-03-12 19:32:14 ----HDC---- C:\WINDOWS\$NtUninstallKB2779562$
2014-03-12 19:32:08 ----HDC---- C:\WINDOWS\$NtUninstallKB2756822$
2014-03-12 19:31:59 ----HDC---- C:\WINDOWS\$NtUninstallKB2749655$
2014-03-12 19:31:49 ----HDC---- C:\WINDOWS\$NtUninstallKB2718704$
2014-03-12 19:31:40 ----HDC---- C:\WINDOWS\$NtUninstallKB2698707$
2014-03-12 19:31:34 ----HDC---- C:\WINDOWS\$NtUninstallKB2657025$
2014-03-12 19:31:25 ----HDC---- C:\WINDOWS\$NtUninstallKB2641690$
2014-03-12 19:31:17 ----HDC---- C:\WINDOWS\$NtUninstallKB2633952$
2014-03-12 19:31:09 ----HDC---- C:\WINDOWS\$NtUninstallKB2616676-v2$
2014-03-12 19:31:00 ----HDC---- C:\WINDOWS\$NtUninstallKB2607712$
2014-03-12 19:30:51 ----HDC---- C:\WINDOWS\$NtUninstallKB2570791$
2014-03-12 19:30:44 ----HDC---- C:\WINDOWS\$NtUninstallKB2541763$
2014-03-12 19:30:15 ----HDC---- C:\WINDOWS\$NtUninstallKB2779030$
2014-03-12 19:30:05 ----HDC---- C:\WINDOWS\$NtUninstallKB2770660$
2014-03-12 19:29:55 ----HDC---- C:\WINDOWS\$NtUninstallKB2761226$
2014-03-12 19:29:45 ----HDC---- C:\WINDOWS\$NtUninstallKB2758857$
2014-03-12 19:29:36 ----HDC---- C:\WINDOWS\$NtUninstallKB2753842-v2$
2014-03-12 19:29:28 ----HDC---- C:\WINDOWS\$NtUninstallKB2731847-v2$
2014-03-12 19:29:19 ----HDC---- C:\WINDOWS\$NtUninstallKB2727528$
2014-03-12 19:29:07 ----HDC---- C:\WINDOWS\$NtUninstallKB2724197$
2014-03-12 19:28:57 ----HDC---- C:\WINDOWS\$NtUninstallKB2723135-v2$
2014-03-12 19:28:48 ----HDC---- C:\WINDOWS\$NtUninstallKB2719985$
2014-03-12 19:28:38 ----HDC---- C:\WINDOWS\$NtUninstallKB2718523$
2014-03-12 19:28:28 ----HDC---- C:\WINDOWS\$NtUninstallKB2709162$
2014-03-12 19:28:16 ----HDC---- C:\WINDOWS\$NtUninstallKB2707511$
2014-03-12 19:28:04 ----HDC---- C:\WINDOWS\$NtUninstallKB2705219-v2$
2014-03-12 19:27:54 ----HDC---- C:\WINDOWS\$NtUninstallKB2698365$
2014-03-12 19:27:44 ----HDC---- C:\WINDOWS\$NtUninstallKB2691442$
2014-03-12 19:27:34 ----HDC---- C:\WINDOWS\$NtUninstallKB2686509$
2014-03-12 19:27:22 ----HDC---- C:\WINDOWS\$NtUninstallKB2685939$
2014-03-12 19:27:12 ----HDC---- C:\WINDOWS\$NtUninstallKB2676562$
2014-03-12 19:27:00 ----HDC---- C:\WINDOWS\$NtUninstallKB2661637$
2014-03-12 19:26:58 ----N---- C:\WINDOWS\system32\iacenc.dll
2014-03-12 19:26:52 ----HDC---- C:\WINDOWS\$NtUninstallKB2660649$
2014-03-12 19:26:43 ----HDC---- C:\WINDOWS\$NtUninstallKB2660465$
2014-03-12 19:26:36 ----HDC---- C:\WINDOWS\$NtUninstallKB2659262$
2014-03-12 19:26:27 ----HDC---- C:\WINDOWS\$NtUninstallKB2655992$
2014-03-12 19:26:18 ----HDC---- C:\WINDOWS\$NtUninstallKB2653956$
2014-03-12 19:26:10 ----HDC---- C:\WINDOWS\$NtUninstallKB2646524$
2014-03-12 19:26:02 ----HDC---- C:\WINDOWS\$NtUninstallKB2641653$
2014-03-12 19:25:50 ----HDC---- C:\WINDOWS\$NtUninstallKB2639417$
2014-03-12 19:25:40 ----HDC---- C:\WINDOWS\$NtUninstallKB2633171$
2014-03-12 19:25:22 ----HDC---- C:\WINDOWS\$NtUninstallKB2631813$
2014-03-12 19:25:12 ----HDC---- C:\WINDOWS\$NtUninstallKB2624667$
2014-03-12 19:25:04 ----HDC---- C:\WINDOWS\$NtUninstallKB2621440$
2014-03-12 19:24:56 ----HDC---- C:\WINDOWS\$NtUninstallKB2620712$
2014-03-12 19:24:48 ----HDC---- C:\WINDOWS\$NtUninstallKB2619339$
2014-03-12 19:24:39 ----HDC---- C:\WINDOWS\$NtUninstallKB2603381$
2014-03-12 19:24:30 ----HDC---- C:\WINDOWS\$NtUninstallKB2598479$
2014-03-12 19:24:22 ----HDC---- C:\WINDOWS\$NtUninstallKB2592799$
2014-03-12 19:24:14 ----HDC---- C:\WINDOWS\$NtUninstallKB2585542$
2014-03-12 19:24:06 ----HDC---- C:\WINDOWS\$NtUninstallKB2584146$
2014-03-12 19:23:58 ----HDC---- C:\WINDOWS\$NtUninstallKB2570947$
2014-03-12 19:23:50 ----HDC---- C:\WINDOWS\$NtUninstallKB2570222$
2014-03-12 19:23:40 ----HDC---- C:\WINDOWS\$NtUninstallKB2567680$
2014-03-12 19:23:31 ----HDC---- C:\WINDOWS\$NtUninstallKB2567053$
2014-03-12 19:23:23 ----HDC---- C:\WINDOWS\$NtUninstallKB2566454$
2014-03-12 19:23:15 ----HDC---- C:\WINDOWS\$NtUninstallKB2564958$
2014-03-12 19:23:08 ----HDC---- C:\WINDOWS\$NtUninstallKB2555917$
2014-03-12 19:22:59 ----HDC---- C:\WINDOWS\$NtUninstallKB2544893-v2$
2014-03-12 19:22:52 ----HDC---- C:\WINDOWS\$NtUninstallKB2536276-v2$
2014-03-12 19:22:44 ----HDC---- C:\WINDOWS\$NtUninstallKB2535512$
2014-03-12 19:22:34 ----HDC---- C:\WINDOWS\$NtUninstallKB2507938$
2014-03-12 19:22:26 ----HDC---- C:\WINDOWS\$NtUninstallKB2503665$
2014-03-12 19:22:19 ----HDC---- C:\WINDOWS\$NtUninstallKB2476490$
2014-03-12 19:22:01 ----HDC---- C:\WINDOWS\$NtUninstallKB2661254-v2$
2014-03-12 19:20:37 ----HDC---- C:\WINDOWS\$NtUninstallKB2491683$
2014-03-12 19:16:55 ----HDC---- C:\WINDOWS\$NtUninstallKB2124261$
2014-03-12 19:16:47 ----HDC---- C:\WINDOWS\$NtUninstallKB2290570$
2014-03-12 19:16:23 ----HDC---- C:\WINDOWS\$NtUninstallKB2264107$
2014-03-12 19:16:00 ----HDC---- C:\WINDOWS\$NtUninstallKB982316$
2014-03-12 19:14:06 ----HDC---- C:\WINDOWS\$NtUninstallKB976323$
2014-03-12 19:13:56 ----HDC---- C:\WINDOWS\$NtUninstallKB974841-v2$
2014-03-12 19:13:31 ----HDC---- C:\WINDOWS\$NtUninstallKB977377$
2014-03-12 19:12:12 ----HDC---- C:\WINDOWS\$NtUninstallKB972187_WM9$
2014-03-12 19:10:55 ----D---- C:\WINDOWS\system32\WindowsPowerShell
2014-03-12 19:10:54 ----D---- C:\WINDOWS\system32\winrm
2014-03-12 19:10:54 ----D---- C:\WINDOWS\system32\GroupPolicy
2014-03-12 19:10:50 ----HDC---- C:\WINDOWS\$968930Uinstall_KB968930$
2014-03-12 19:10:49 ----D---- C:\WINDOWS\$NtUninstallKB968930$
2014-03-12 19:10:35 ----HDC---- C:\WINDOWS\$NtUninstallKB971513$
2014-03-12 19:10:20 ----HDC---- C:\WINDOWS\$NtUninstallKB975254$
2014-03-12 19:09:38 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2014-03-12 19:09:31 ----HDC---- C:\WINDOWS\$NtUninstallKB971314$
2014-03-12 19:08:36 ----HDC---- C:\WINDOWS\$NtUninstallKB958911$
2014-03-12 19:08:29 ----HDC---- C:\WINDOWS\$NtUninstallKB961371-v2$
2014-03-12 19:07:42 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2014-03-12 19:06:37 ----HDC---- C:\WINDOWS\$NtUninstallKB969898$
2014-03-12 19:06:22 ----HDC---- C:\WINDOWS\$NtUninstallKB970483$
2014-03-12 19:05:50 ----HDC---- C:\WINDOWS\$NtUninstallKB957579$
2014-03-12 19:04:09 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$
2014-03-12 19:04:03 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2014-03-12 19:03:43 ----HDC---- C:\WINDOWS\$NtUninstallKB959252-v2$
2014-03-12 19:03:35 ----HDC---- C:\WINDOWS\$NtUninstallKB2511455$
2014-03-12 19:03:30 ----HDC---- C:\WINDOWS\$NtUninstallKB955535$
2014-03-12 19:03:23 ----HDC---- C:\WINDOWS\$NtUninstallKB960680-v2$
2014-03-12 19:03:13 ----HDC---- C:\WINDOWS\$NtUninstallKB955704$
2014-03-12 19:03:06 ----N---- C:\WINDOWS\system32\uexfat.dll
2014-03-12 19:02:41 ----HDC---- C:\WINDOWS\$NtUninstallKB958752$
2014-03-12 19:00:47 ----D---- C:\ea51a3e763a1e6dd697aec
2014-03-12 18:59:59 ----A---- C:\WINDOWS\imsins.BAK
2014-03-12 18:59:55 ----HDC---- C:\WINDOWS\$NtUninstallbasecsp$
2014-03-12 18:57:43 ----D---- C:\Program Files\Common Files\Java
2014-03-12 18:57:41 ----A---- C:\WINDOWS\system32\javaws.exe
2014-03-12 18:57:37 ----A---- C:\WINDOWS\system32\WindowsAccessBridge.dll
2014-03-12 18:57:37 ----A---- C:\WINDOWS\system32\javaw.exe
2014-03-12 18:57:36 ----A---- C:\WINDOWS\system32\java.exe
2014-03-12 18:57:26 ----D---- C:\Program Files\Java
2014-03-12 18:53:15 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2014-03-12 18:49:02 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Oracle
2014-03-12 18:45:11 ----D---- C:\Documents and Settings\Administrator\Data aplikací\AVG2014
2014-03-12 18:42:57 ----D---- C:\Documents and Settings\Administrator\Data aplikací\TuneUp Software
2014-03-12 18:41:37 ----D---- C:\Documents and Settings\All Users\Data aplikací\AVG2014
2014-03-12 18:25:51 ----A---- C:\WINDOWS\SchedLgU.Txt
2014-03-12 17:07:54 ----D---- C:\AdwCleaner

======List of files/folders modified in the last 1 months======

2014-03-16 17:41:15 ----RD---- C:\Program Files
2014-03-16 17:40:52 ----D---- C:\WINDOWS\Temp
2014-03-16 17:40:45 ----SD---- C:\WINDOWS\Tasks
2014-03-16 17:40:06 ----D---- C:\Documents and Settings\All Users\Data aplikací\MFAData
2014-03-16 17:36:14 ----D---- C:\WINDOWS\system32\CatRoot2
2014-03-16 17:27:09 ----HD---- C:\WINDOWS\inf
2014-03-16 17:27:01 ----D---- C:\WINDOWS
2014-03-12 19:53:33 ----A---- C:\WINDOWS\wincmd.ini
2014-03-12 19:34:34 ----D---- C:\WINDOWS\system32
2014-03-12 19:34:07 ----D---- C:\WINDOWS\system32\config
2014-03-12 19:34:01 ----RSHDC---- C:\WINDOWS\system32\dllcache
2014-03-12 19:33:08 ----D---- C:\WINDOWS\security
2014-03-12 19:31:58 ----HD---- C:\WINDOWS\$hf_mig$
2014-03-12 19:30:40 ----D---- C:\WINDOWS\system32\CatRoot
2014-03-12 19:30:25 ----D---- C:\WINDOWS\ie8updates
2014-03-12 19:29:02 ----D---- C:\WINDOWS\system32\drivers
2014-03-12 19:26:39 ----D---- C:\WINDOWS\WinSxS
2014-03-12 19:12:44 ----RSD---- C:\WINDOWS\assembly
2014-03-12 19:11:20 ----D---- C:\WINDOWS\Microsoft.NET
2014-03-12 19:11:02 ----D---- C:\WINDOWS\Help
2014-03-12 19:10:54 ----D---- C:\WINDOWS\system32\wbem
2014-03-12 18:59:00 ----D---- C:\Work
2014-03-12 18:57:43 ----SHD---- C:\WINDOWS\Installer
2014-03-12 18:57:43 ----D---- C:\Program Files\Common Files
2014-03-12 18:46:18 ----D---- C:\Program Files\AVG
2014-03-12 18:44:29 ----D---- C:\WINDOWS\Prefetch
2014-03-12 18:42:12 ----HD---- C:\$AVG
2014-03-12 18:39:06 ----RD---- C:\Dokumenty
2014-03-12 18:35:56 ----D---- C:\Program Files\Google
2014-03-12 18:26:38 ----D---- C:\WINDOWS\SoftwareDistribution
2014-03-12 18:26:17 ----SHD---- C:\RECYCLER
2014-03-12 17:30:31 ----D---- C:\WINDOWS\Debug
2014-03-12 17:30:30 ----D---- C:\WINDOWS\Minidump
2014-03-12 17:30:07 ----D---- C:\Program Files\CCleaner
2014-03-12 17:06:51 ----SD---- C:\Documents and Settings\Administrator\Data aplikací\Microsoft
2014-03-11 06:41:22 ----SHD---- C:\WINDOWS\CSC
2014-03-10 14:32:35 ----A---- C:\WINDOWS\NeroDigital.ini
2014-03-10 13:54:48 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 atitray;atitray; \??\C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys []
R1 Avgdiskx;AVG Disk Driver; C:\WINDOWS\system32\DRIVERS\avgdiskx.sys [2013-11-25 120600]
R1 AVGIDSDriver;AVGIDSDriver; C:\WINDOWS\system32\DRIVERS\avgidsdriverx.sys [2013-11-25 210712]
R1 AVGIDSShim;AVGIDSShim; C:\WINDOWS\system32\DRIVERS\avgidsshimx.sys [2014-01-19 22808]
R1 Avgldx86;AVG AVI Loader Driver; C:\WINDOWS\system32\DRIVERS\avgldx86.sys [2013-10-31 176952]
R1 Avgtdix;AVG TDI Driver; C:\WINDOWS\system32\DRIVERS\avgtdix.sys [2013-08-01 193848]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R2 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2002-11-29 16320]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2007-05-18 304640]
R3 AEAudio;AE Audio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2007-05-18 94848]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-10-29 3341824]
R3 AtiHdmiService;ATI Function Driver for HDMI Service; C:\WINDOWS\system32\drivers\AtiHdmi.sys [2008-07-02 89600]
R3 ElbyCDFL;ElbyCDFL; C:\WINDOWS\System32\Drivers\ElbyCDFL.sys [2002-11-28 15360]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2006-02-26 5810]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2006-06-28 81920]
R3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2006-03-17 392960]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S4 atapi;atapi; C:\WINDOWS\system32\drivers\atapi.sys [2008-04-14 96512]
S4 exFat;exFat; C:\WINDOWS\system32\drivers\exFat.sys [2008-09-29 133632]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-10-29 585728]
R2 avgwd;AVG WatchDog; C:\Program Files\AVG\AVG2014\avgwdsvc.exe [2013-09-24 348008]
R2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-03-12 116648]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre7\bin\jqs.exe [2014-03-12 182696]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2008-10-28 593920]
S2 AVGIDSAgent;AVGIDSAgent; C:\Program Files\AVG\AVG2014\avgidsagent.exe [2014-01-22 3788816]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-03-12 116648]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 WinRM;Windows Remote Management (WS-Management); C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[Rudy]

Zdravím!
Dejte log Combofix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.

[RomanL2]

Zde výpis z Combofix:

ComboFix 14-03-13.01 - Administrator 16.03.2014 18:43:31.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1586 [GMT 1:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
AV: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Data aplikací\0jzfl9ex.cpp
c:\windows\msmqinst.log
c:\windows\system32\TZLog.log
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-02-16 do 2014-03-16 )))))))))))))))))))))))))))))))
.
.
2014-03-16 16:41 . 2014-03-16 16:41 -------- d-----w- c:\program files\trend micro
2014-03-16 16:41 . 2014-03-16 16:41 -------- d-----w- C:\rsit
2014-03-12 18:34 . 2014-03-12 18:35 -------- d-----w- c:\documents and settings\Václav\Data aplikací\AVG2014
2014-03-12 18:34 . 2014-03-12 18:34 -------- d-----w- c:\documents and settings\Václav\Local Settings\Data aplikací\Avg2014
2014-03-12 18:32 . 2008-10-23 13:40 713728 -c----w- c:\windows\system32\dllcache\sxs.dll
2014-03-12 18:30 . 2012-11-02 02:03 375296 -c----w- c:\windows\system32\dllcache\dpnet.dll
2014-03-12 18:29 . 2012-10-02 18:04 58368 -c----w- c:\windows\system32\dllcache\synceng.dll
2014-03-12 18:28 . 2012-07-06 13:58 78336 -c----w- c:\windows\system32\dllcache\browser.dll
2014-03-12 18:25 . 2011-11-03 15:29 386560 -c----w- c:\windows\system32\dllcache\qdvd.dll
2014-03-12 18:24 . 2011-10-14 14:47 23040 -c----w- c:\windows\system32\dllcache\mciseq.dll
2014-03-12 18:24 . 2011-10-14 14:47 174592 -c----w- c:\windows\system32\dllcache\winmm.dll
2014-03-12 18:24 . 2011-11-20 06:12 60416 -c----w- c:\windows\system32\dllcache\packager.exe
2014-03-12 18:23 . 2012-07-04 14:05 139784 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2014-03-12 18:23 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2014-03-12 18:22 . 2011-04-21 13:37 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2014-03-12 18:22 . 2010-12-20 17:32 551936 -c----w- c:\windows\system32\dllcache\oleaut32.dll
2014-03-12 18:21 . 2012-06-01 16:50 604160 -c----w- c:\windows\system32\dllcache\crypt32.dll
2014-03-12 18:20 . 2011-02-11 14:44 232448 -c----w- c:\windows\system32\dllcache\fxscover.exe
2014-03-12 18:16 . 2010-06-30 20:39 372736 -c----w- c:\windows\system32\dllcache\asp51.dll
2014-03-12 18:16 . 2010-07-27 06:38 257024 -c----w- c:\windows\system32\dllcache\infocomm.dll
2014-03-12 18:16 . 2010-06-30 13:16 179712 -c----w- c:\windows\system32\dllcache\mrxdav.sys
2014-03-12 18:14 . 2010-03-05 18:50 460800 -c----w- c:\windows\system32\dllcache\smtpsvc.dll
2014-03-12 18:10 . 2014-03-12 18:10 -------- d-----w- c:\windows\system32\winrm
2014-03-12 18:10 . 2014-03-12 18:10 -------- d-----w- c:\windows\system32\GroupPolicy
2014-03-12 18:10 . 2014-03-12 18:11 -------- dc-h--w- c:\windows\$968930Uinstall_KB968930$
2014-03-12 18:10 . 2009-09-06 07:11 128000 -c----w- c:\windows\system32\dllcache\ftpsvc2.dll
2014-03-12 18:09 . 2009-05-18 15:55 91648 -c----w- c:\windows\system32\dllcache\ntprint.dll
2014-03-12 18:06 . 2009-05-21 18:49 268288 -c----w- c:\windows\system32\dllcache\httpext.dll
2014-03-12 18:03 . 2008-09-30 06:21 290304 -c----w- c:\windows\system32\dllcache\ulib.dll
2014-03-12 18:03 . 2008-09-30 06:21 57344 -c----w- c:\windows\system32\dllcache\uexfat.dll
2014-03-12 18:03 . 2008-09-30 06:21 57344 ------w- c:\windows\system32\uexfat.dll
2014-03-12 18:03 . 2008-09-29 10:21 133632 -c----w- c:\windows\system32\dllcache\exfat.sys
2014-03-12 18:03 . 2008-09-29 10:21 133632 ------w- c:\windows\system32\drivers\exfat.sys
2014-03-12 18:00 . 2014-03-12 18:00 -------- d-----w- C:\ea51a3e763a1e6dd697aec
2014-03-12 17:57 . 2014-03-12 17:57 -------- d-----w- c:\program files\Common Files\Java
2014-03-12 17:57 . 2014-03-12 17:57 145408 ----a-w- c:\windows\system32\javacpl.cpl
2014-03-12 17:57 . 2014-03-12 17:57 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2014-03-12 17:57 . 2014-03-12 17:57 -------- d-----w- c:\program files\Java
2014-03-12 17:53 . 2014-03-12 17:53 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-03-12 17:49 . 2014-03-12 17:49 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Oracle
2014-03-12 17:48 . 2014-03-12 17:48 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Sun
2014-03-12 17:45 . 2014-03-12 17:45 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\AVG2014
2014-03-12 17:42 . 2014-03-12 17:42 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\TuneUp Software
2014-03-12 17:41 . 2014-03-12 17:44 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVG2014
2014-03-12 17:41 . 2014-03-12 17:46 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Data aplikací\Avg2014
2014-03-12 17:39 . 2014-03-12 17:45 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Avg2014
2014-03-12 17:39 . 2014-03-12 17:39 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\MFAData
2014-03-12 17:35 . 2014-03-12 17:36 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Google
2014-03-12 17:35 . 2014-03-12 17:35 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Deployment
2014-03-12 17:29 . 2014-03-12 17:29 -------- d-----w- c:\documents and settings\Václav\Local Settings\Data aplikací\Deployment
2014-03-12 16:07 . 2014-03-12 17:34 -------- d-----w- C:\AdwCleaner
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-12 17:53 . 2011-06-01 18:52 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-01-19 20:46 . 2014-01-19 20:46 22808 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-03-16 868352]
"AVG_UI"="c:\program files\AVG\AVG2014\avgui.exe" [2014-01-22 4962320]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Václav\Nabídka Start\Programy\Po spuštění\
xe9lfzj0.lnk - c:\windows\system32\rundll32.exe c:\docume~1\ALLUSE~1\DATAAP~1\0jzfl9ex.cpp,XXS1 [2004-8-17 33280]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2014\avgrsx.exe /sync /restart
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgemcx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [25.11.2013 21:56 149272]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [31.10.2013 22:30 222520]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [16.3.2011 15:03 27448]
R1 atitray;atitray;c:\program files\Ray Adams\ATI Tray Tools\atitray.sys [22.5.2007 10:04 18088]
R1 Avgdiskx;AVG Disk Driver;c:\windows\system32\drivers\avgdiskx.sys [25.11.2013 21:49 120600]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [25.11.2013 21:56 210712]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [19.1.2014 21:46 22808]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [7.1.2011 5:41 176952]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [4.4.2011 23:59 193848]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2014\avgwdsvc.exe [24.9.2013 1:33 348008]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2014\avgidsagent.exe [22.1.2014 12:19 3788816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-03-16 16:41 1150280 ----a-w- c:\program files\Google\Chrome\Application\33.0.1750.154\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-03-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-03-12 17:35]
.
2014-03-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-03-12 17:35]
.
2014-03-16 c:\windows\Tasks\User_Feed_Synchronization-{99E15F0F-98D2-45F1-873F-10D0E7FC0E74}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.idnes.cz/
uInternet Connection Wizard,ShellNext = hxxp://www.skype.com/go/help.guides.ieaddon?lang=en
TCP: DhcpNameServer = 10.133.0.37 10.133.37.37
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKCU-Run-AVG-Secure-Search-Update_0214c - c:\documents and settings\Administrator\Data aplikací\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-03-16 19:44
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-527237240-1979792683-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,df,3b,1b,a7,08,58,11,41,9b,87,e5,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,65,24,e4,b3,a0,bd,91,4b,92,49,44,\
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(924)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2014-03-16 19:45:24
ComboFix-quarantined-files.txt 2014-03-16 18:45
.
Před spuštěním: Volných bajtů: 595 128 254 464
Po spuštění: Volných bajtů: 597 697 933 312
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 0B53A52FDA22DD4DC7CCFFC4B04F49F2
413FC2A0C716421B3158746D63736515

[Rudy]

Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

File::
c:\documents and settings\Václav\Nabídka Start\Programy\Po spuštění\xe9lfzj0.lnk
c:\docume~1\ALLUSE~1\DATAAP~1\0jzfl9ex.cpp
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

RegLock::
[HKEY_USERS\S-1-5-21-527237240-1979792683-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

Reboot::

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu Combofix a pusťte. CF se spustí a vykoná příkazy ze skiptu.

[RomanL2]

Zde log z Combofixu po provedení scriptu:

ComboFix 14-03-13.01 - Administrator 16.03.2014 20:57:50.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1515 [GMT 1:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
FILE ::
"c:\docume~1\ALLUSE~1\DATAAP~1\0jzfl9ex.cpp"
"c:\documents and settings\Václav\Nabídka Start\Programy\Po spuštění\xe9lfzj0.lnk"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-02-16 do 2014-03-16 )))))))))))))))))))))))))))))))
.
.
2014-03-16 16:41 . 2014-03-16 16:41 -------- d-----w- c:\program files\trend micro
2014-03-16 16:41 . 2014-03-16 16:41 -------- d-----w- C:\rsit
2014-03-12 18:34 . 2014-03-12 18:35 -------- d-----w- c:\documents and settings\Václav\Data aplikací\AVG2014
2014-03-12 18:34 . 2014-03-12 18:34 -------- d-----w- c:\documents and settings\Václav\Local Settings\Data aplikací\Avg2014
2014-03-12 18:32 . 2008-10-23 13:40 713728 -c----w- c:\windows\system32\dllcache\sxs.dll
2014-03-12 18:30 . 2012-11-02 02:03 375296 -c----w- c:\windows\system32\dllcache\dpnet.dll
2014-03-12 18:29 . 2012-10-02 18:04 58368 -c----w- c:\windows\system32\dllcache\synceng.dll
2014-03-12 18:28 . 2012-07-06 13:58 78336 -c----w- c:\windows\system32\dllcache\browser.dll
2014-03-12 18:25 . 2011-11-03 15:29 386560 -c----w- c:\windows\system32\dllcache\qdvd.dll
2014-03-12 18:24 . 2011-10-14 14:47 23040 -c----w- c:\windows\system32\dllcache\mciseq.dll
2014-03-12 18:24 . 2011-10-14 14:47 174592 -c----w- c:\windows\system32\dllcache\winmm.dll
2014-03-12 18:24 . 2011-11-20 06:12 60416 -c----w- c:\windows\system32\dllcache\packager.exe
2014-03-12 18:23 . 2012-07-04 14:05 139784 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2014-03-12 18:23 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2014-03-12 18:22 . 2011-04-21 13:37 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2014-03-12 18:22 . 2010-12-20 17:32 551936 -c----w- c:\windows\system32\dllcache\oleaut32.dll
2014-03-12 18:21 . 2012-06-01 16:50 604160 -c----w- c:\windows\system32\dllcache\crypt32.dll
2014-03-12 18:20 . 2011-02-11 14:44 232448 -c----w- c:\windows\system32\dllcache\fxscover.exe
2014-03-12 18:16 . 2010-06-30 20:39 372736 -c----w- c:\windows\system32\dllcache\asp51.dll
2014-03-12 18:16 . 2010-07-27 06:38 257024 -c----w- c:\windows\system32\dllcache\infocomm.dll
2014-03-12 18:16 . 2010-06-30 13:16 179712 -c----w- c:\windows\system32\dllcache\mrxdav.sys
2014-03-12 18:14 . 2010-03-05 18:50 460800 -c----w- c:\windows\system32\dllcache\smtpsvc.dll
2014-03-12 18:10 . 2014-03-12 18:10 -------- d-----w- c:\windows\system32\winrm
2014-03-12 18:10 . 2014-03-12 18:10 -------- d-----w- c:\windows\system32\GroupPolicy
2014-03-12 18:10 . 2014-03-12 18:11 -------- dc-h--w- c:\windows\$968930Uinstall_KB968930$
2014-03-12 18:10 . 2009-09-06 07:11 128000 -c----w- c:\windows\system32\dllcache\ftpsvc2.dll
2014-03-12 18:09 . 2009-05-18 15:55 91648 -c----w- c:\windows\system32\dllcache\ntprint.dll
2014-03-12 18:06 . 2009-05-21 18:49 268288 -c----w- c:\windows\system32\dllcache\httpext.dll
2014-03-12 18:03 . 2008-09-30 06:21 290304 -c----w- c:\windows\system32\dllcache\ulib.dll
2014-03-12 18:03 . 2008-09-30 06:21 57344 -c----w- c:\windows\system32\dllcache\uexfat.dll
2014-03-12 18:03 . 2008-09-30 06:21 57344 ------w- c:\windows\system32\uexfat.dll
2014-03-12 18:03 . 2008-09-29 10:21 133632 -c----w- c:\windows\system32\dllcache\exfat.sys
2014-03-12 18:03 . 2008-09-29 10:21 133632 ------w- c:\windows\system32\drivers\exfat.sys
2014-03-12 18:00 . 2014-03-12 18:00 -------- d-----w- C:\ea51a3e763a1e6dd697aec
2014-03-12 17:57 . 2014-03-12 17:57 -------- d-----w- c:\program files\Common Files\Java
2014-03-12 17:57 . 2014-03-12 17:57 145408 ----a-w- c:\windows\system32\javacpl.cpl
2014-03-12 17:57 . 2014-03-12 17:57 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2014-03-12 17:57 . 2014-03-12 17:57 -------- d-----w- c:\program files\Java
2014-03-12 17:53 . 2014-03-12 17:53 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-03-12 17:49 . 2014-03-12 17:49 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Oracle
2014-03-12 17:48 . 2014-03-12 17:48 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Sun
2014-03-12 17:45 . 2014-03-12 17:45 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\AVG2014
2014-03-12 17:42 . 2014-03-12 17:42 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\TuneUp Software
2014-03-12 17:41 . 2014-03-12 17:44 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVG2014
2014-03-12 17:41 . 2014-03-12 17:46 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Data aplikací\Avg2014
2014-03-12 17:39 . 2014-03-12 17:45 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Avg2014
2014-03-12 17:39 . 2014-03-12 17:39 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\MFAData
2014-03-12 17:35 . 2014-03-12 17:36 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Google
2014-03-12 17:35 . 2014-03-12 17:35 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Deployment
2014-03-12 17:29 . 2014-03-12 17:29 -------- d-----w- c:\documents and settings\Václav\Local Settings\Data aplikací\Deployment
2014-03-12 16:07 . 2014-03-12 17:34 -------- d-----w- C:\AdwCleaner
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-12 17:53 . 2011-06-01 18:52 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-01-19 20:46 . 2014-01-19 20:46 22808 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-03-16 868352]
"AVG_UI"="c:\program files\AVG\AVG2014\avgui.exe" [2014-01-22 4962320]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Václav\Nabídka Start\Programy\Po spuštění\
xe9lfzj0.lnk - c:\windows\system32\rundll32.exe c:\docume~1\ALLUSE~1\DATAAP~1\0jzfl9ex.cpp,XXS1 [2004-8-17 33280]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2014\avgrsx.exe /sync /restart
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgemcx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [25.11.2013 21:56 149272]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [31.10.2013 22:30 222520]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [16.3.2011 15:03 27448]
R1 atitray;atitray;c:\program files\Ray Adams\ATI Tray Tools\atitray.sys [22.5.2007 10:04 18088]
R1 Avgdiskx;AVG Disk Driver;c:\windows\system32\drivers\avgdiskx.sys [25.11.2013 21:49 120600]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [25.11.2013 21:56 210712]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [19.1.2014 21:46 22808]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [7.1.2011 5:41 176952]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [4.4.2011 23:59 193848]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2014\avgidsagent.exe [22.1.2014 12:19 3788816]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2014\avgwdsvc.exe [24.9.2013 1:33 348008]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-03-16 16:41 1150280 ----a-w- c:\program files\Google\Chrome\Application\33.0.1750.154\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-03-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-03-12 17:35]
.
2014-03-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-03-12 17:35]
.
2014-03-16 c:\windows\Tasks\User_Feed_Synchronization-{99E15F0F-98D2-45F1-873F-10D0E7FC0E74}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.idnes.cz/
uInternet Connection Wizard,ShellNext = hxxp://www.skype.com/go/help.guides.ieaddon?lang=en
TCP: DhcpNameServer = 10.133.0.37 10.133.37.37
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-03-16 21:07
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(924)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(368)
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Celkový čas: 2014-03-16 21:08:41 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-03-16 20:08
ComboFix2.txt 2014-03-16 18:45
.
Před spuštěním: Volných bajtů: 597 698 072 576
Po spuštění: Volných bajtů: 597 684 744 192
.
- - End Of File - - AED694E47086812250DF86D5E92485D4
413FC2A0C716421B3158746D63736515

[Rudy]

CF z nějakého důvodu nemazal. Zkuste to znovu se stejným skriptem, ale v nouz. režimu.

[RomanL2]

Hm, mám obavu, že to nevyšlo ani v nouzovém režimu. Nemám něco zkusit smazat ručně?
Zde log:

ComboFix 14-03-13.01 - Administrator 17.03.2014 9:48.3.2 - x86 MINIMAL
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1680 [GMT 1:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
FILE ::
"c:\docume~1\ALLUSE~1\DATAAP~1\0jzfl9ex.cpp"
"c:\documents and settings\Václav\Nabídka Start\Programy\Po spuštění\xe9lfzj0.lnk"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-02-17 do 2014-03-17 )))))))))))))))))))))))))))))))
.
.
2014-03-16 16:41 . 2014-03-16 16:41 -------- d-----w- c:\program files\trend micro
2014-03-16 16:41 . 2014-03-16 16:41 -------- d-----w- C:\rsit
2014-03-12 18:34 . 2014-03-12 18:35 -------- d-----w- c:\documents and settings\Václav\Data aplikací\AVG2014
2014-03-12 18:34 . 2014-03-12 18:34 -------- d-----w- c:\documents and settings\Václav\Local Settings\Data aplikací\Avg2014
2014-03-12 18:32 . 2008-10-23 13:40 713728 -c----w- c:\windows\system32\dllcache\sxs.dll
2014-03-12 18:30 . 2012-11-02 02:03 375296 -c----w- c:\windows\system32\dllcache\dpnet.dll
2014-03-12 18:29 . 2012-10-02 18:04 58368 -c----w- c:\windows\system32\dllcache\synceng.dll
2014-03-12 18:28 . 2012-07-06 13:58 78336 -c----w- c:\windows\system32\dllcache\browser.dll
2014-03-12 18:25 . 2011-11-03 15:29 386560 -c----w- c:\windows\system32\dllcache\qdvd.dll
2014-03-12 18:24 . 2011-10-14 14:47 23040 -c----w- c:\windows\system32\dllcache\mciseq.dll
2014-03-12 18:24 . 2011-10-14 14:47 174592 -c----w- c:\windows\system32\dllcache\winmm.dll
2014-03-12 18:24 . 2011-11-20 06:12 60416 -c----w- c:\windows\system32\dllcache\packager.exe
2014-03-12 18:23 . 2012-07-04 14:05 139784 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2014-03-12 18:23 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2014-03-12 18:22 . 2011-04-21 13:37 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2014-03-12 18:22 . 2010-12-20 17:32 551936 -c----w- c:\windows\system32\dllcache\oleaut32.dll
2014-03-12 18:21 . 2012-06-01 16:50 604160 -c----w- c:\windows\system32\dllcache\crypt32.dll
2014-03-12 18:20 . 2011-02-11 14:44 232448 -c----w- c:\windows\system32\dllcache\fxscover.exe
2014-03-12 18:16 . 2010-06-30 20:39 372736 -c----w- c:\windows\system32\dllcache\asp51.dll
2014-03-12 18:16 . 2010-07-27 06:38 257024 -c----w- c:\windows\system32\dllcache\infocomm.dll
2014-03-12 18:16 . 2010-06-30 13:16 179712 -c----w- c:\windows\system32\dllcache\mrxdav.sys
2014-03-12 18:14 . 2010-03-05 18:50 460800 -c----w- c:\windows\system32\dllcache\smtpsvc.dll
2014-03-12 18:10 . 2014-03-12 18:10 -------- d-----w- c:\windows\system32\winrm
2014-03-12 18:10 . 2014-03-12 18:10 -------- d-----w- c:\windows\system32\GroupPolicy
2014-03-12 18:10 . 2014-03-12 18:11 -------- dc-h--w- c:\windows\$968930Uinstall_KB968930$
2014-03-12 18:10 . 2009-09-06 07:11 128000 -c----w- c:\windows\system32\dllcache\ftpsvc2.dll
2014-03-12 18:09 . 2009-05-18 15:55 91648 -c----w- c:\windows\system32\dllcache\ntprint.dll
2014-03-12 18:06 . 2009-05-21 18:49 268288 -c----w- c:\windows\system32\dllcache\httpext.dll
2014-03-12 18:03 . 2008-09-30 06:21 290304 -c----w- c:\windows\system32\dllcache\ulib.dll
2014-03-12 18:03 . 2008-09-30 06:21 57344 -c----w- c:\windows\system32\dllcache\uexfat.dll
2014-03-12 18:03 . 2008-09-30 06:21 57344 ------w- c:\windows\system32\uexfat.dll
2014-03-12 18:03 . 2008-09-29 10:21 133632 -c----w- c:\windows\system32\dllcache\exfat.sys
2014-03-12 18:03 . 2008-09-29 10:21 133632 ------w- c:\windows\system32\drivers\exfat.sys
2014-03-12 18:00 . 2014-03-12 18:00 -------- d-----w- C:\ea51a3e763a1e6dd697aec
2014-03-12 17:57 . 2014-03-12 17:57 -------- d-----w- c:\program files\Common Files\Java
2014-03-12 17:57 . 2014-03-12 17:57 145408 ----a-w- c:\windows\system32\javacpl.cpl
2014-03-12 17:57 . 2014-03-12 17:57 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2014-03-12 17:57 . 2014-03-12 17:57 -------- d-----w- c:\program files\Java
2014-03-12 17:53 . 2014-03-12 17:53 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-03-12 17:49 . 2014-03-12 17:49 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Oracle
2014-03-12 17:48 . 2014-03-12 17:48 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Sun
2014-03-12 17:45 . 2014-03-12 17:45 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\AVG2014
2014-03-12 17:42 . 2014-03-12 17:42 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\TuneUp Software
2014-03-12 17:41 . 2014-03-12 17:44 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVG2014
2014-03-12 17:41 . 2014-03-12 17:46 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Data aplikací\Avg2014
2014-03-12 17:39 . 2014-03-12 17:45 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Avg2014
2014-03-12 17:39 . 2014-03-12 17:39 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\MFAData
2014-03-12 17:35 . 2014-03-12 17:36 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Google
2014-03-12 17:35 . 2014-03-12 17:35 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Deployment
2014-03-12 17:29 . 2014-03-12 17:29 -------- d-----w- c:\documents and settings\Václav\Local Settings\Data aplikací\Deployment
2014-03-12 16:07 . 2014-03-12 17:34 -------- d-----w- C:\AdwCleaner
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-12 17:53 . 2011-06-01 18:52 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-01-19 20:46 . 2014-01-19 20:46 22808 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-03-16 868352]
"AVG_UI"="c:\program files\AVG\AVG2014\avgui.exe" [2014-01-22 4962320]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Václav\Nabídka Start\Programy\Po spuštění\
xe9lfzj0.lnk - c:\windows\system32\rundll32.exe c:\docume~1\ALLUSE~1\DATAAP~1\0jzfl9ex.cpp,XXS1 [2004-8-17 33280]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2014\avgrsx.exe /sync /restart
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgemcx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [25.11.2013 21:56 149272]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [31.10.2013 22:30 222520]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [16.3.2011 15:03 27448]
R1 atitray;atitray;c:\program files\Ray Adams\ATI Tray Tools\atitray.sys [22.5.2007 10:04 18088]
R1 Avgdiskx;AVG Disk Driver;c:\windows\system32\drivers\avgdiskx.sys [25.11.2013 21:49 120600]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [25.11.2013 21:56 210712]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [19.1.2014 21:46 22808]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [7.1.2011 5:41 176952]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [4.4.2011 23:59 193848]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2014\avgidsagent.exe [22.1.2014 12:19 3788816]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2014\avgwdsvc.exe [24.9.2013 1:33 348008]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-03-16 16:41 1150280 ----a-w- c:\program files\Google\Chrome\Application\33.0.1750.154\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-03-16 c:\windows\Tasks\User_Feed_Synchronization-{99E15F0F-98D2-45F1-873F-10D0E7FC0E74}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.idnes.cz/
uInternet Connection Wizard,ShellNext = hxxp://www.skype.com/go/help.guides.ieaddon?lang=en
TCP: DhcpNameServer = 10.133.0.37 10.133.37.37
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-03-17 09:56
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(924)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(3008)
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\program files\Google\Update\GoogleUpdate.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2014-03-17 09:57:59 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-03-17 08:57
ComboFix2.txt 2014-03-16 20:08
ComboFix3.txt 2014-03-16 18:45
.
Před spuštěním: Volných bajtů: 597 782 945 792
Po spuštění: Volných bajtů: 597 767 557 120
.
- - End Of File - - 7F89367FC8CA62EC19D2BF5E5FB2BF53
413FC2A0C716421B3158746D63736515

[Rudy]

Zkuste odmazat tato soubory:

c:\documents and settings\Václav\Nabídka Start\Programy\Po spuštění\xe9lfzj0.lnk
c:\docume~1\ALLUSE~1\DATAAP~1\0jzfl9ex.cpp

[RomanL2]

Chová se to jaksi divně. V uvedených lokacích jsem soubory smazal, ale místo souboru 0jzfl9ex.cpp byl soubor 0jzfl9ex.fee. Potom jsem pustil znovu script do Combofixu, a tady je výsledek, nevypadá to ale, že se něco změnilo:

ComboFix 14-03-16.01 - Administrator 18.03.2014 18:19:33.5.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1406 [GMT 1:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: AVG AntiVirus Free Edition 2014 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
FILE ::
"c:\docume~1\ALLUSE~1\DATAAP~1\0jzfl9ex.cpp"
"c:\documents and settings\Václav\Nabídka Start\Programy\Po spuštění\xe9lfzj0.lnk"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-02-18 do 2014-03-18 )))))))))))))))))))))))))))))))
.
.
2014-03-16 16:41 . 2014-03-16 16:41 -------- d-----w- c:\program files\trend micro
2014-03-16 16:41 . 2014-03-16 16:41 -------- d-----w- C:\rsit
2014-03-12 18:34 . 2014-03-12 18:35 -------- d-----w- c:\documents and settings\Václav\Data aplikací\AVG2014
2014-03-12 18:34 . 2014-03-12 18:34 -------- d-----w- c:\documents and settings\Václav\Local Settings\Data aplikací\Avg2014
2014-03-12 18:32 . 2008-10-23 13:40 713728 -c----w- c:\windows\system32\dllcache\sxs.dll
2014-03-12 18:30 . 2012-11-02 02:03 375296 -c----w- c:\windows\system32\dllcache\dpnet.dll
2014-03-12 18:29 . 2012-10-02 18:04 58368 -c----w- c:\windows\system32\dllcache\synceng.dll
2014-03-12 18:28 . 2012-07-06 13:58 78336 -c----w- c:\windows\system32\dllcache\browser.dll
2014-03-12 18:25 . 2011-11-03 15:29 386560 -c----w- c:\windows\system32\dllcache\qdvd.dll
2014-03-12 18:24 . 2011-10-14 14:47 23040 -c----w- c:\windows\system32\dllcache\mciseq.dll
2014-03-12 18:24 . 2011-10-14 14:47 174592 -c----w- c:\windows\system32\dllcache\winmm.dll
2014-03-12 18:24 . 2011-11-20 06:12 60416 -c----w- c:\windows\system32\dllcache\packager.exe
2014-03-12 18:23 . 2012-07-04 14:05 139784 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2014-03-12 18:23 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2014-03-12 18:22 . 2011-04-21 13:37 105472 -c----w- c:\windows\system32\dllcache\mup.sys
2014-03-12 18:22 . 2010-12-20 17:32 551936 -c----w- c:\windows\system32\dllcache\oleaut32.dll
2014-03-12 18:21 . 2012-06-01 16:50 604160 -c----w- c:\windows\system32\dllcache\crypt32.dll
2014-03-12 18:20 . 2011-02-11 14:44 232448 -c----w- c:\windows\system32\dllcache\fxscover.exe
2014-03-12 18:16 . 2010-06-30 20:39 372736 -c----w- c:\windows\system32\dllcache\asp51.dll
2014-03-12 18:16 . 2010-07-27 06:38 257024 -c----w- c:\windows\system32\dllcache\infocomm.dll
2014-03-12 18:16 . 2010-06-30 13:16 179712 -c----w- c:\windows\system32\dllcache\mrxdav.sys
2014-03-12 18:14 . 2010-03-05 18:50 460800 -c----w- c:\windows\system32\dllcache\smtpsvc.dll
2014-03-12 18:10 . 2014-03-12 18:10 -------- d-----w- c:\windows\system32\winrm
2014-03-12 18:10 . 2014-03-12 18:10 -------- d-----w- c:\windows\system32\GroupPolicy
2014-03-12 18:10 . 2014-03-12 18:11 -------- dc-h--w- c:\windows\$968930Uinstall_KB968930$
2014-03-12 18:10 . 2009-09-06 07:11 128000 -c----w- c:\windows\system32\dllcache\ftpsvc2.dll
2014-03-12 18:09 . 2009-05-18 15:55 91648 -c----w- c:\windows\system32\dllcache\ntprint.dll
2014-03-12 18:06 . 2009-05-21 18:49 268288 -c----w- c:\windows\system32\dllcache\httpext.dll
2014-03-12 18:03 . 2008-09-30 06:21 290304 -c----w- c:\windows\system32\dllcache\ulib.dll
2014-03-12 18:03 . 2008-09-30 06:21 57344 -c----w- c:\windows\system32\dllcache\uexfat.dll
2014-03-12 18:03 . 2008-09-30 06:21 57344 ------w- c:\windows\system32\uexfat.dll
2014-03-12 18:03 . 2008-09-29 10:21 133632 -c----w- c:\windows\system32\dllcache\exfat.sys
2014-03-12 18:03 . 2008-09-29 10:21 133632 ------w- c:\windows\system32\drivers\exfat.sys
2014-03-12 17:57 . 2014-03-12 17:57 -------- d-----w- c:\program files\Common Files\Java
2014-03-12 17:57 . 2014-03-12 17:57 145408 ----a-w- c:\windows\system32\javacpl.cpl
2014-03-12 17:57 . 2014-03-12 17:57 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2014-03-12 17:57 . 2014-03-12 17:57 -------- d-----w- c:\program files\Java
2014-03-12 17:53 . 2014-03-12 17:53 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-03-12 17:49 . 2014-03-12 17:49 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Oracle
2014-03-12 17:48 . 2014-03-12 17:48 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Sun
2014-03-12 17:45 . 2014-03-12 17:45 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\AVG2014
2014-03-12 17:42 . 2014-03-12 17:42 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\TuneUp Software
2014-03-12 17:41 . 2014-03-12 17:44 -------- d-----w- c:\documents and settings\All Users\Data aplikací\AVG2014
2014-03-12 17:41 . 2014-03-12 17:46 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Data aplikací\Avg2014
2014-03-12 17:39 . 2014-03-12 17:45 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Avg2014
2014-03-12 17:39 . 2014-03-12 17:39 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\MFAData
2014-03-12 17:35 . 2014-03-12 17:36 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Google
2014-03-12 17:35 . 2014-03-12 17:35 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Deployment
2014-03-12 17:29 . 2014-03-12 17:29 -------- d-----w- c:\documents and settings\Václav\Local Settings\Data aplikací\Deployment
2014-03-12 16:07 . 2014-03-12 17:34 -------- d-----w- C:\AdwCleaner
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-12 17:53 . 2011-06-01 18:52 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-01-19 20:46 . 2014-01-19 20:46 22808 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-03-16 868352]
"AVG_UI"="c:\program files\AVG\AVG2014\avgui.exe" [2014-01-22 4962320]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2014\avgrsx.exe /sync /restart
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2014\\avgemcx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [25.11.2013 21:56 149272]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [31.10.2013 22:30 222520]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [16.3.2011 15:03 27448]
R1 atitray;atitray;c:\program files\Ray Adams\ATI Tray Tools\atitray.sys [22.5.2007 10:04 18088]
R1 Avgdiskx;AVG Disk Driver;c:\windows\system32\drivers\avgdiskx.sys [25.11.2013 21:49 120600]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [25.11.2013 21:56 210712]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [19.1.2014 21:46 22808]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [7.1.2011 5:41 176952]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [4.4.2011 23:59 193848]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2014\avgidsagent.exe [22.1.2014 12:19 3788816]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2014\avgwdsvc.exe [24.9.2013 1:33 348008]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-03-16 16:41 1150280 ----a-w- c:\program files\Google\Chrome\Application\33.0.1750.154\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-03-18 c:\windows\Tasks\User_Feed_Synchronization-{99E15F0F-98D2-45F1-873F-10D0E7FC0E74}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.idnes.cz/
uInternet Connection Wizard,ShellNext = hxxp://www.skype.com/go/help.guides.ieaddon?lang=en
TCP: DhcpNameServer = 10.133.0.37 10.133.37.37
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2014-03-18 18:28
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(924)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(3060)
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Google\Update\GoogleUpdate.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2014-03-18 18:29:39 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-03-18 17:29
ComboFix2.txt 2014-03-17 08:58
ComboFix3.txt 2014-03-16 20:08
ComboFix4.txt 2014-03-16 18:45
.
Před spuštěním: Volných bajtů: 597 834 240 000
Po spuštění: Volných bajtů: 597 821 472 768
.
- - End Of File - - 18ADAC5C57F72C75D75AE55331CFB9EA
413FC2A0C716421B3158746D63736515

[Rudy]

Tenhle log je OK. Zkuste ještě kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

[RomanL2]

Tak to je dobře, že je to v pořádku. Zde log z MBAM:

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Verze: v2014.03.19.06

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Administrator :: VACLAV-DOMA [administrátor]

19.3.2014 18:08:04
MBAM-log-2014-03-19 (19-15-54).txt

Typ: Kompletní kontrola (C:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 316113
Uplynulý čas: 52 minut, 11 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 1
HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Špatný: (1) Dobrý: (0) -> Nebyla provedena žádná instrukce.

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 2
C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Data aplikací\0jzfl9ex.cpp.vir (Trojan.FakeMS) -> Nebyla provedena žádná instrukce.
C:\Documents and Settings\Václav\Data aplikací\Sun\Java\Deployment\cache\6.0\59\6afdc83b-6796c429 (Trojan.FakeAlert.RO) -> Nebyla provedena žádná instrukce.

(konec)

[Rudy]

Vše, co MBAM nalezl, smažte.

[RomanL2]

Smazáno, restartováno.

[Rudy]

Pokud není jiný problém, je to vše. CF odinstalujte pomocí T-Cleaneru: http://vyosek.tym.cz/pro_usery/T-Cleaner.exe .

[RomanL2]

Provedeno, děkuji za pomoc!