ICQ posílá samo viry do CL

[poly-filip]

Virus Total :

Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.5.0.48 2010.01.09 Trojan-PWS.Legmir!IK
AhnLab-V3 5.0.0.2 2010.01.09 -
AntiVir 7.9.1.130 2010.01.08 -
Antiy-AVL 2.0.3.7 2010.01.08 -
Authentium 5.2.0.5 2010.01.09 W32/Trojan.BWKV
Avast 4.8.1351.0 2010.01.08 -
AVG 8.5.0.430 2010.01.04 -
BitDefender 7.2 2010.01.09 Trojan.Generic.2843771
CAT-QuickHeal 10.00 2010.01.09 Trojan.Agent.ATV
ClamAV 0.94.1 2010.01.09 Trojan.Agent-17889
Comodo 3514 2010.01.08 TrojWare.Win32.PWS.Agent.AAA
DrWeb 5.0.1.12222 2010.01.09 -
eSafe 7.0.17.0 2010.01.07 Win32.Backdoor.EggDr
eTrust-Vet 35.2.7226 2010.01.08 Win32/Kolsevs.A
F-Prot 4.5.1.85 2010.01.08 W32/Trojan.BWKV
F-Secure 9.0.15370.0 2010.01.09 Trojan.Generic.2843771
Fortinet 4.0.14.0 2010.01.09 W32/Small.K!tr
GData 19 2010.01.09 Trojan.Generic.2843771
Ikarus T3.1.1.80.0 2010.01.09 Trojan-PWS.Legmir
Jiangmin 13.0.900 2010.01.09 -
K7AntiVirus 7.10.942 2010.01.08 Trojan-Spy.Win32.BZub
Kaspersky 7.0.0.125 2010.01.09 -
McAfee 5855 2010.01.08 -
McAfee+Artemis 5855 2010.01.08 -
McAfee-GW-Edition 6.8.5 2010.01.09 -
Microsoft 1.5302 2010.01.09 Worm:Win32/Autorun.MH
NOD32 4755 2010.01.08 -
Norman 6.04.03 2010.01.08 OnlineGames.LDSI
nProtect 2009.1.8.0 2010.01.09 -
Panda 10.0.2.2 2010.01.08 -
PCTools 7.0.3.5 2010.01.09 Trojan.Agent.EAPN
Rising 22.29.05.04 2010.01.09 -
Sophos 4.49.0 2010.01.09 -
Sunbelt 3.2.1858.2 2010.01.09 Trojan.Win32.Generic!BT
Symantec 20091.2.0.41 2010.01.09 Backdoor.EggDrop
TheHacker 6.5.0.3.143 2010.01.09 Trojan/Legmir.gen
TrendMicro 9.120.0.1004 2010.01.09 -
VBA32 3.12.12.1 2010.01.09 Trojan.PWS.Legmir
ViRobot 2010.1.8.2128 2010.01.08 Trojan.Win32.PSWLmir.61440.C
VirusBuster 5.0.21.0 2010.01.08 Trojan.Agent.EAPN
Rozšiřující informace
File size: 61440 bytes
MD5...: 3a9bcde21a8d27f0c4b7f43615e0e821
SHA1..: ab56a0f2a9791ca37c56d13527e79f2189d595a9
SHA256: 03a1f5b024787a4f8c3a3056ec2c571b1bd1420a86b48d556a1edba272bfe653
ssdeep: 768:rsj44SFkaaLPP+GizfclAzfvy1NQ/zY09OiJos/yQ:g44xeGYnzfvy1NQGio
s7
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x5977
timedatestamp.....: 0x3bda2297 (Sat Oct 27 02:57:27 2001)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x89ca 0x9000 6.45 1994abea7221718b1ed1aee41e68769a
.rdata 0xa000 0xf2e 0x1000 5.25 9a4d1718837cf54bcc0c918cf18c43fe
.data 0xb000 0x52d68 0x1000 3.64 f994ddaadb3a047f851f7a6e4cc30275
Shared 0x5e000 0xb 0x1000 0.03 e0fa2593540ef8832a6f919d6e2f77ec
.rsrc 0x5f000 0x1010 0x2000 1.62 df298f4f1e5f36d542e657f5268c2239

( 5 imports )
> KERNEL32.dll: InterlockedIncrement, DeleteFileA, CloseHandle, FindFirstFileA, OutputDebugStringA, GetCurrentDirectoryA, SetStdHandle, ReadFile, FlushFileBuffers, GetProcAddress, LoadLibraryA, VirtualAlloc, HeapAlloc, HeapReAlloc, LCMapStringW, LCMapStringA, SetFilePointer, GetACP, GetCPInfo, GetOEMCP, GetStringTypeA, MultiByteToWideChar, GetStringTypeW, RtlUnwind, HeapFree, WriteFile, HeapCreate, HeapDestroy, VirtualFree, GetStdHandle, SetHandleCount, GetPrivateProfileStringA, GetFileType, WritePrivateProfileStringA, GetEnvironmentStrings, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsA, GetLastError, GetModuleHandleA, GetPrivateProfileIntA, GlobalAlloc, GetSystemDefaultLangID, GetVersionExA, GetWindowsDirectoryA, GetSystemDirectoryA, GetModuleFileNameA, SetCurrentDirectoryA, UnhandledExceptionFilter, FreeEnvironmentStringsW, GetCommandLineA, SetEnvironmentVariableA, GetCurrentProcess, GetStartupInfoA, ExitProcess, GetVersion, TerminateProcess
> USER32.dll: LoadCursorA, ReleaseDC, wsprintfA, MessageBoxA, SetCursor, GetDC, GetDesktopWindow, InvalidateRect, PtInRect, UpdateWindow, SetRect, DialogBoxParamA, PostQuitMessage, GetClientRect, GetSystemMetrics, DestroyWindow, DefWindowProcA, GetMessageA, CreateWindowExA, RegisterClassExA, GetDlgItem, TranslateMessage, DispatchMessageA, SendMessageA, SetWindowTextA, ShowWindow, IsDlgButtonChecked, BeginPaint, EndPaint, LoadImageA, EndDialog
> GDI32.dll: CreateCompatibleDC, GetStockObject, SetBkMode, GetDeviceCaps, GetObjectA, DeleteObject, DeleteDC, TextOutA, BitBlt, SetTextColor, CreateFontIndirectA, SelectObject
> ADVAPI32.dll: RegOpenKeyExA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA
> SHELL32.dll: ShellExecuteA

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx ... 3615e0e821' target='_blank'>http://www.threatexpert.com/report.aspx ... 5e0e821</a>

[Unlimited_Killer]

Nějak se skript neprovedl správně. Ještě jednou a vkopírujte CELÝ text v zeleném rámečku.
A poté proveďte ty ostatní kroky.

~~~

Stáhněte OTM na Plochu. Spusťte ho dvojklikem na OTM.exe, pokud máte Vistu, pravým tlačítkem na soubor -> Run as Administrator [spustit jako administrátor].
Do levého okna 'Paste Instructions for Items to be Moved' vkopírujte následující skript:

Kód: Vybrat vše

:processes
explorer.exe

:reg
[HKLM\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://google.cz"
"Default_Search_URL"=-
[HKLM\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{855F3B16-6D32-4fe6-8A56-BBB695989046}"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22FC6CE8-7D47-479F-B74A-BFBB04ADB9AF}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{855F3B16-6D32-4fe6-8A56-BBB695989046}"=-

:commands
[emptytemp]
[reboot]

Poté klikněte na červené tlačítko 'MoveIt!'.
V zeleném okně vpravo by se měl zobrazit log, ten vkopírujete sem do fóra. Pokud se zobrazí hláška k restartování, klikněte na Yes. Po restartu log najdete v C:\_OTM\MovedFiles

[Unlimited_Killer]

A na ten VirusTotal mi dejte pouze link (odkaz) z adresního řádku prohlížeče.

[poly-filip]

OTM 2 pokus po restartování mi to hodí poznámkový blok ten sem kopíruji:

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== REGISTRY ==========
HKLM\Software\Microsoft\Internet Explorer\Main\\"Start Page"|"http://google.cz" /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Default_Search_URL deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\\SearchAssistant deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22FC6CE8-7D47-479F-B74A-BFBB04ADB9AF}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22FC6CE8-7D47-479F-B74A-BFBB04ADB9AF}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: All Users.WINDOWS.0

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User.WINDOWS.0
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService.NT AUTHORITY
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService.NT AUTHORITY
->Temp folder emptied: 16384 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Polly
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes

User: POLLY.POLY
->Temp folder emptied: 7944 bytes
->Temporary Internet Files folder emptied: 3734448 bytes
->FireFox cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 34450 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 4,00 mb


OTM by OldTimer - Version 3.1.4.0 log created on 01092010_115949

Files moved on Reboot...
File C:\Documents and Settings\NetworkService.NT AUTHORITY\Local Settings\Temp\Perflib_Perfdata_448.dat not found!
File C:\WINDOWS.0\temp\_avast4_\Webshlock.txt not found!
File move failed. C:\WINDOWS.0\temp\Perflib_Perfdata_5ac.dat scheduled to be moved on reboot.

Registry entries deleted on Reboot...

[poly-filip]

http://www.virustotal.com/cs/analisis/0 ... 1263033177

[Unlimited_Killer]

Super, už se provedl správně. Ten VirusTotal udělejte znovu - ale po dokončení testu mi vkopírujte pouze odkaz z adresního řádku prohlížeče.

[poly-filip]

A ten MBAM mi napsal že nemyl nalezen žádný infikovaný soubor .

[Unlimited_Killer]

Dobře, poprosím o nový RSIT log.
Jinak
O4 - HKLM\..\Run: [Soltek] C:\WINDOWS.0\System32\autorun.exe
To znáte?

[poly-filip]

nové VirusTotal : http://www.virustotal.com/cs/analisis/0 ... 1263035315

[poly-filip]

Logfile of random's system information tool 1.06 (written by random/random)
Run by POLLY at 2010-01-09 12:11:22
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 9 GB (17%) free of 55 GB
Total RAM: 767 MB (37% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:11:27, on 9.1.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\System32\Ati2evxx.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\WINDOWS.0\system32\Ati2evxx.exe
C:\WINDOWS.0\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Autodesk\Data Management Server 2009\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS.0\System32\svchost.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\wscntfy.exe
C:\Documents and Settings\POLLY.POLY\Plocha\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\POLLY.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = start.qip.ru
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.cz
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Soltek] C:\WINDOWS.0\System32\autorun.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [combofix] "C:\ComboFix\CF32113.cfxxe" /c "C:\ComboFix\C.bat"
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AdobeBridge] "C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe" -stealth
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6.5\ICQ.exe" silent
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS.0\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS.0\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PC Confidential - {925DAB62-F9AC-4221-806A-057BFB1014AA} - C:\Program Files\Winferno\PC Confidential\PCConfidential.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: HP Chytrý výběr - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS.0\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS.0\system32\ati2sgag.exe
O23 - Service: Autodesk Data Management Job Dispatch - Autodesk - C:\Program Files\Autodesk\Data Management Server 2009\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
O23 - Service: Autodesk EDM Server - Autodesk - C:\Program Files\Autodesk\Data Management Server 2009\Server\Webserver\Connectivity.EDMWS.Server.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

--
End of file - 7162 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
HP Print Enhancer - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2007-11-06 322880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}]
HP Smart BHO Class - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2007-11-06 542016]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2004-08-12 339968]
"Soltek"=C:\WINDOWS.0\System32\autorun.exe [2001-10-29 61440]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-26 31016]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-08-17 81000]
"VirtualCloneDrive"=C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [2009-05-26 85160]
"hpqSRMon"=C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [2007-08-22 80896]
"AdobeCS4ServiceManager"=C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]
"combofix"=C:\ComboFix\CF32113.cfxxe /c C:\ComboFix\C.bat []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe [2007-09-18 171464]
"Skype"=C:\Program Files\Skype\\Phone\Skype.exe [2009-10-09 25623336]
"AdobeBridge"=C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe [2008-08-28 13145448]
"ICQ"=C:\Program Files\ICQ6.5\ICQ.exe [2009-11-16 172792]

C:\Documents and Settings\All Users.WINDOWS.0\Nabídka Start\Programy\Po spuštění
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Documents and Settings\POLLY.POLY\Nabídka Start\Programy\Po spuštění
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS.0\system32\Ati2evxx.dll [2004-08-12 86016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.scr - open - c:\WINDOWS.0\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2010-01-09 11:49:39 ----D---- C:\Documents and Settings\POLLY.POLY\Data aplikací\Malwarebytes
2010-01-09 11:49:32 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-01-09 11:49:32 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Data aplikací\Malwarebytes
2010-01-09 11:28:15 ----SHD---- C:\RECYCLER
2010-01-09 11:28:02 ----D---- C:\_OTM
2010-01-07 16:03:27 ----A---- C:\ComboFix.txt
2010-01-05 17:53:21 ----A---- C:\Boot.bak
2010-01-05 17:53:08 ----RASHD---- C:\cmdcons
2010-01-05 17:47:48 ----D---- C:\WINDOWS.0\ERDNT
2010-01-05 16:30:46 ----A---- C:\avenger.txt
2010-01-03 17:58:22 ----D---- C:\rsit
2010-01-03 17:48:25 ----D---- C:\Program Files\Trend Micro
2009-12-23 16:02:05 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Data aplikací\FLEXnet
2009-12-23 15:56:21 ----D---- C:\Program Files\Adobe Media Player
2009-12-23 15:53:24 ----D---- C:\Program Files\Common Files\Adobe AIR
2009-12-23 15:48:28 ----D---- C:\Program Files\Common Files\Macrovision Shared
2009-12-21 20:32:16 ----D---- C:\Documents and Settings\POLLY.POLY\Data aplikací\BitZipper
2009-12-21 20:32:12 ----D---- C:\Program Files\BitZipper
2009-12-21 20:29:00 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Data aplikací\Winferno
2009-12-21 20:24:26 ----A---- C:\WINDOWS.0\system32\WINUTIL5.DLL
2009-12-21 20:24:26 ----A---- C:\WINDOWS.0\system32\WINLCTL5.DLL
2009-12-21 20:24:24 ----A---- C:\WINDOWS.0\system32\CapiCom.dll
2009-12-21 18:29:52 ----D---- C:\Documents and Settings\POLLY.POLY\Data aplikací\HPAppData
2009-12-17 21:42:00 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Data aplikací\Canon
2009-12-17 21:33:10 ----D---- C:\Program Files\Canon
2009-12-17 21:18:57 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Data aplikací\HP Product Assistant
2009-12-17 21:18:57 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Data aplikací\HP
2009-12-17 21:18:39 ----D---- C:\Program Files\Hewlett-Packard
2009-12-17 21:18:34 ----D---- C:\Program Files\Common Files\Hewlett-Packard
2009-12-17 21:18:14 ----D---- C:\Program Files\Common Files\HP
2009-12-17 21:17:24 ----DC---- C:\WINDOWS.0\system32\DRVSTORE
2009-12-17 21:17:09 ----D---- C:\Program Files\HP
2009-12-11 15:29:01 ----A---- C:\WINDOWS.0\system32\ptpusb.dll
2009-12-11 15:28:59 ----A---- C:\WINDOWS.0\system32\ptpusd.dll
2009-12-10 17:49:41 ----HDC---- C:\WINDOWS.0\$NtUninstallKB970430$
2009-12-10 17:49:35 ----HDC---- C:\WINDOWS.0\$NtUninstallKB974318$
2009-12-10 17:49:21 ----HDC---- C:\WINDOWS.0\$NtUninstallKB976325$
2009-12-10 17:49:12 ----HDC---- C:\WINDOWS.0\$NtUninstallKB973904$
2009-12-10 17:49:07 ----HDC---- C:\WINDOWS.0\$NtUninstallKB974392$
2009-12-10 17:48:56 ----HDC---- C:\WINDOWS.0\$NtUninstallKB971737$

======List of files/folders modified in the last 1 months======

2010-01-09 12:05:02 ----D---- C:\WINDOWS.0\Temp
2010-01-09 12:01:50 ----A---- C:\WINDOWS.0\system32\auto.ini
2010-01-09 12:00:31 ----A---- C:\WINDOWS.0\SchedLgU.Txt
2010-01-09 11:50:45 ----D---- C:\Documents and Settings\POLLY.POLY\Data aplikací\Skype
2010-01-09 11:49:39 ----D---- C:\WINDOWS.0\Prefetch
2010-01-09 11:49:34 ----D---- C:\WINDOWS.0\system32\drivers
2010-01-09 11:49:32 ----RD---- C:\Program Files
2010-01-09 11:44:56 ----D---- C:\WINDOWS.0
2010-01-09 11:30:58 ----D---- C:\Documents and Settings\POLLY.POLY\Data aplikací\skypePM
2010-01-09 11:28:13 ----D---- C:\WINDOWS.0\system32
2010-01-07 19:29:26 ----D---- C:\WINDOWS.0\system32\CatRoot2
2010-01-07 15:58:09 ----A---- C:\WINDOWS.0\system.ini
2010-01-07 15:55:49 ----SD---- C:\WINDOWS.0\Tasks
2010-01-07 15:54:04 ----D---- C:\WINDOWS.0\AppPatch
2010-01-07 15:54:00 ----D---- C:\Program Files\Common Files
2010-01-05 18:48:06 ----D---- C:\Program Files\Mozilla Firefox
2010-01-05 18:01:46 ----SD---- C:\WINDOWS.0\Downloaded Program Files
2010-01-05 18:01:46 ----D---- C:\Program Files\ICQ6.5
2010-01-05 17:53:21 ----RASH---- C:\boot.ini
2010-01-03 17:40:03 ----D---- C:\Documents and Settings\POLLY.POLY\Data aplikací\ICQ
2009-12-25 14:05:29 ----D---- C:\Documents and Settings\POLLY.POLY\Data aplikací\Adobe
2009-12-23 16:38:58 ----D---- C:\Documents and Settings\All Users.WINDOWS.0\Data aplikací\Adobe
2009-12-23 16:38:57 ----D---- C:\Program Files\Adobe
2009-12-23 16:06:29 ----SD---- C:\Documents and Settings\All Users.WINDOWS.0\Data aplikací\Microsoft
2009-12-23 16:00:09 ----SHD---- C:\WINDOWS.0\Installer
2009-12-23 16:00:08 ----D---- C:\Config.Msi
2009-12-23 15:57:40 ----D---- C:\Program Files\Common Files\Adobe
2009-12-23 15:55:36 ----RSD---- C:\WINDOWS.0\Fonts
2009-12-17 21:59:36 ----SD---- C:\Documents and Settings\POLLY.POLY\Data aplikací\Microsoft
2009-12-17 21:58:52 ----HD---- C:\WINDOWS.0\inf
2009-12-17 21:19:57 ----D---- C:\WINDOWS.0\WinSxS
2009-12-17 21:18:42 ----D---- C:\WINDOWS.0\twain_32
2009-12-17 21:04:52 ----RSHDC---- C:\WINDOWS.0\system32\dllcache
2009-12-10 18:35:14 ----A---- C:\WINDOWS.0\system32\PerfStringBackup.INI
2009-12-10 17:49:38 ----A---- C:\WINDOWS.0\imsins.BAK
2009-12-10 17:49:11 ----HD---- C:\WINDOWS.0\$hf_mig$

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS.0\system32\drivers\Aavmker4.sys [2009-08-17 26944]
R1 aswSP;avast! Self Protection; C:\WINDOWS.0\system32\drivers\aswSP.sys [2009-08-17 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS.0\system32\drivers\aswTdi.sys [2009-08-17 51376]
R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS.0\System32\Drivers\ElbyCDIO.sys [2009-02-17 24232]
R1 ISODisk;ISODisk; C:\WINDOWS.0\system32\drivers\ISODisk.sys [2006-04-26 9600]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS.0\System32\DRIVERS\kbdhid.sys [2004-08-17 14848]
R2 adfs;adfs; C:\WINDOWS.0\system32\drivers\adfs.sys [2008-08-14 74720]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS.0\system32\DRIVERS\aswFsBlk.sys [2009-08-17 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS.0\system32\drivers\aswMon2.sys [2009-08-17 94160]
R2 EIO;EIO; \??\C:\WINDOWS.0\system32\drivers\EIO.sys []
R3 aswRdr;aswRdr; C:\WINDOWS.0\system32\drivers\aswRdr.sys [2009-08-17 23152]
R3 ati2mtag;ati2mtag; C:\WINDOWS.0\System32\DRIVERS\ati2mtag.sys [2004-08-12 786944]
R3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS.0\System32\DRIVERS\fetnd5.sys [2001-08-17 27165]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS.0\System32\DRIVERS\hidusb.sys [2001-10-25 9600]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS.0\System32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS.0\system32\drivers\msmpu401.sys [2001-08-17 2944]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS.0\System32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS.0\System32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS.0\System32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS.0\System32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 VIAudio;Vinyl AC'97 Audio Controller (WDM); C:\WINDOWS.0\system32\drivers\viaudios.sys [2004-06-18 152192]
R3 vulfntrs;VIA USB Roothub Lower Filter; C:\WINDOWS.0\System32\Drivers\vulfntr.sys [2002-10-30 10240]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 usbprint;Třída USB Printer; C:\WINDOWS.0\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS.0\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS.0\System32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 vulfnths;VIA USB Host Controller Lower Filter; C:\WINDOWS.0\System32\Drivers\vulfnth.sys [2002-10-23 6912]
S4 IntelIde;IntelIde; C:\WINDOWS.0\system32\drivers\IntelIde.sys []
S4 sptd;sptd; C:\WINDOWS.0\System32\Drivers\sptd.sys [2009-09-27 685816]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-08-17 18752]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS.0\System32\Ati2evxx.exe [2004-08-12 389120]
R2 Autodesk Data Management Job Dispatch;Autodesk Data Management Job Dispatch; C:\Program Files\Autodesk\Data Management Server 2009\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe [2008-02-18 32768]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-08-17 138680]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\WINDOWS.0\system32\svchost.exe [2004-08-17 14336]
R2 MSSQL$AUTODESKVAULT;SQL Server (AUTODESKVAULT); C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-01-22 29178224]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS.0\System32\svchost.exe [2004-08-17 14336]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS.0\System32\svchost.exe [2004-08-17 14336]
R2 SQLWriter;SQL Server VSS Writer; C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2007-02-10 89968]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-08-17 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-08-17 352920]
R3 hpqcxs08;hpqcxs08; C:\WINDOWS.0\system32\svchost.exe [2004-08-17 14336]
S2 ATI Smart;ATI Smart; C:\WINDOWS.0\system32\ati2sgag.exe [2004-08-12 516096]
S2 Autodesk EDM Server;Autodesk EDM Server; C:\Program Files\Autodesk\Data Management Server 2009\Server\Webserver\Connectivity.EDMWS.Server.exe [2008-02-18 57344]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS.0\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2009-10-16 79360]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; c:\WINDOWS.0\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-12-23 655624]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS.0\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; c:\WINDOWS.0\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-26 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2008-01-22 45272]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; c:\WINDOWS.0\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 SQLBrowser;SQL Server Browser; C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2008-01-22 242544]

-----------------EOF-----------------

[poly-filip]

O4 - HKLM\..\Run: [Soltek] C:\WINDOWS.0\System32\autorun.exe : neznám ale myslím si že to je něco v registrech nebo tak něco podle adresy bych to našel ale abych věděl co to umí to ne.

[Unlimited_Killer]

No, podle VT je to celkem velká havěť, raději odmažu.

[Unlimited_Killer]

A ještě dodejte ten MBAM až doskenuje.

[poly-filip]

Malwarebytes' Anti-Malware 1.44
Verze databáze: 3526
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

9.1.2010 14:44:17
mbam-log-2010-01-09 (14-44-17).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 154171
Uplynulý čas: 6 minute(s), 22 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
(Nebyly nalezeny žádné škodlivé položky)

[Unlimited_Killer]

Dobře, smažeme toho zmetka z VT.

~~~

Stáhněte OTM na Plochu. Spusťte ho dvojklikem na OTM.exe, pokud máte Vistu, pravým tlačítkem na soubor -> Run as Administrator [spustit jako administrátor].
Do levého okna 'Paste Instructions for Items to be Moved' vkopírujte následující skript:

Kód: Vybrat vše

:processes
Explorer.EXE

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Soltek"=-
"combofix"=-


:files
C:\WINDOWS.0\System32\autorun.exe
C:\Documents and Settings\All Users.WINDOWS.0\Data aplikací\Winferno

:commands
[emptytemp]
[reboot]

Poté klikněte na červené tlačítko 'MoveIt!'.
V zeleném okně vpravo by se měl zobrazit log, ten vkopírujete sem do fóra. Pokud se zobrazí hláška k restartování, klikněte na Yes. Po restartu log najdete v C:\_OTM\MovedFiles

~~~

Spusťte přejmenované HiJackThis - C:\Program Files\Trend Micro\HijackThis\POLLY.exe
Klikněte na 'Do a system scan only'.
U níže uvedených položek udělejte fajfku do čtverečku a poté klikněte na 'Fix Checked'.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = start.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

Pokud by tam nějaká položka nebyla, vynechte ji.

~~~

Poté nový RSIT log.