Problem so Security tool, desifrovanie logu

[pitimir]

Ahoj, prepac za zdrzanie...
Otestuj subor(y) na >>VIRUSTOTALe<<:

Kód: Vybrat vše

c:\windows\System32\es.dll

Ak vypise, ze subor uz bol testovany, daj ho otestovat znovu. Vysledok posli ako LINK.


+novy log z ComboFixu. Dakujem

[mirto]

Tu to je vsetko.

http://www.virustotal.com/cs/analisis/5 ... 1263186946


ComboFix 10-01-13.04 - Miro . 01. 2010 18:43:08.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1033.18.2047.1650 [GMT 1:00]
Running from: c:\documents and settings\All Users\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Miro\Desktop\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
--------------- FCopy ---------------

c:\windows\system32\dllcache\tcpip.sys --> c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((( Files Created from 2009-12-15 to 2010-01-15 )))))))))))))))))))))))))))))))
.

2010-01-15 08:59 . 2010-01-15 08:59 -------- d-----w- c:\program files\ESET
2010-01-13 16:44 . 2010-01-13 16:44 -------- d-----w- c:\documents and settings\Miro\Application Data\Malwarebytes
2010-01-13 16:44 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-13 16:44 . 2010-01-13 16:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-13 16:44 . 2010-01-13 16:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-13 16:44 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-13 15:04 . 2010-01-13 15:58 -------- d-----w- c:\program files\trend micro
2010-01-13 15:03 . 2010-01-13 15:58 -------- d-----w- C:\rsit
2010-01-06 21:24 . 2010-01-06 21:24 -------- d-----w- c:\documents and settings\Miro\Application Data\Winamp
2010-01-06 14:48 . 2010-01-06 14:48 -------- d-----w- c:\program files\MP3 Cutter
2010-01-06 14:48 . 2004-11-14 04:27 212992 ----a-w- c:\windows\system32\sql.dll
2010-01-04 08:19 . 2010-01-13 19:14 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-01-01 20:06 . 2010-01-01 20:53 -------- d-----w- c:\documents and settings\Miro\Application Data\GanymedeNet
2010-01-01 20:05 . 2010-01-01 20:05 -------- d-----w- c:\program files\Ganymede
2009-12-29 00:21 . 2009-12-29 00:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-12-28 15:10 . 2009-12-28 15:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
2009-12-24 10:31 . 2009-12-24 10:31 -------- d-----w- c:\program files\123 DVD Clone
2009-12-24 10:17 . 2009-12-24 10:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Canneverbe Limited
2009-12-24 10:16 . 2009-09-28 19:57 7168 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2009-12-24 10:16 . 2009-12-24 17:51 -------- d-----w- c:\program files\CDBurnerXP
2009-12-23 16:04 . 2009-12-23 16:04 -------- d-----w- c:\program files\Common Files\DirectX
2009-12-20 09:28 . 2009-12-20 10:12 -------- d-----w- c:\program files\Free YouTube Downloader Converter
2009-12-20 09:26 . 2009-12-20 09:26 -------- d-----w- c:\program files\YouTube Downloader
2009-12-18 23:33 . 2009-12-18 23:33 -------- d-----w- c:\documents and settings\Miro\Local Settings\Application Data\Adobe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-15 17:49 . 2009-10-15 07:45 140577 ----a-w- c:\windows\hpoins14.dat
2010-01-15 12:25 . 2009-11-04 12:24 -------- d-----w- c:\documents and settings\Miro\Application Data\HP
2010-01-15 12:25 . 2009-11-04 12:14 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
2010-01-14 19:02 . 2009-09-28 18:22 -------- d-----w- c:\program files\ICQ6.5
2010-01-06 21:16 . 2009-10-08 07:44 -------- d-----w- c:\program files\BitComet
2010-01-06 15:17 . 2010-01-06 15:16 -------- d-----w- c:\program files\Winamp
2010-01-05 16:21 . 2009-10-06 12:46 -------- d-----w- c:\documents and settings\Miro\Application Data\ICQ
2009-12-29 00:25 . 2009-12-29 00:25 56 ---ha-w- c:\documents and settings\All Users\Application Data\ezsidmv.dat
2009-12-22 13:04 . 2009-09-26 13:20 -------- d-----w- c:\program files\Google
2009-12-15 12:45 . 2009-12-15 12:45 -------- d-----w- c:\program files\Common Files\Adobe
2009-12-13 13:37 . 2009-12-13 13:37 -------- d-----w- c:\program files\ShrinkTo5
2009-12-08 21:40 . 2009-09-27 11:06 24736 ----a-w- c:\documents and settings\Miro\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-08 20:53 . 2009-09-26 12:41 24736 ----a-w- c:\documents and settings\Peto\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-08 17:20 . 2009-10-07 19:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-08 15:06 . 2009-09-26 20:40 25128 ----a-w- c:\documents and settings\Mammi\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-08 13:47 . 2009-12-08 13:47 -------- d-----w- c:\documents and settings\Mammi\Application Data\HPAppData
2009-12-07 16:39 . 2009-12-07 16:39 -------- d-----w- c:\documents and settings\Miro\Application Data\Apple Computer
2009-12-03 20:59 . 2009-12-02 17:29 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-11-30 23:03 . 2009-11-30 23:03 79488 ----a-w- c:\documents and settings\Peto\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-11-29 11:10 . 2009-11-28 16:27 -------- d-----w- c:\program files\Any Video Converter
2009-11-29 11:09 . 2009-11-24 14:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-11-29 11:09 . 2009-11-24 14:58 -------- d-----w- c:\program files\Common Files\Nero
2009-11-29 11:09 . 2009-11-24 14:58 -------- d-----w- c:\program files\Nero
2009-11-28 20:23 . 2009-11-28 20:13 -------- d-----w- c:\documents and settings\Miro\Application Data\DeepBurner
2009-11-28 19:45 . 2009-11-28 19:45 -------- d-----w- c:\program files\Astonsoft
2009-11-28 16:51 . 2009-11-28 16:51 -------- d-----w- c:\program files\Digiarty
2009-11-28 16:35 . 2009-11-28 16:33 -------- d-----w- c:\program files\Next Video Converter
2009-11-26 19:25 . 2009-09-27 14:48 -------- d-----w- c:\program files\rFactor
2009-11-25 12:03 . 2009-11-25 12:03 -------- d-----w- c:\documents and settings\Miro\Application Data\Nero
2009-11-24 17:42 . 2009-11-24 17:42 -------- d-----w- c:\documents and settings\Peto\Application Data\Nero
2009-11-24 15:08 . 2009-11-24 15:08 -------- d-----w- c:\program files\Windows Sidebar
2009-11-07 22:49 . 2009-11-07 22:49 86016 ----a-w- c:\windows\system32\frapsvid.dll
2009-10-26 12:53 . 2001-08-23 13:00 14336 ------w- c:\windows\system32\svchost.exe
2009-10-26 10:35 . 2009-10-26 10:28 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-10-26 10:24 . 2009-10-26 10:24 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-10-26 10:24 . 2009-10-26 10:24 107832 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-10-26 10:24 . 2009-10-26 10:24 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-10-26 10:24 . 2009-10-26 10:24 2250024 ----a-w- c:\windows\system32\pbsvc.exe
2009-10-22 19:42 . 2009-10-22 19:42 411368 ----a-w- c:\windows\system32\deploytk.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-01-14_19.04.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-15 17:48 . 2010-01-15 17:48 16384 c:\windows\temp\Perflib_Perfdata_79c.dat
+ 2009-09-26 06:21 . 2010-01-15 16:51 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-09-26 06:21 . 2010-01-14 12:47 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-01-15 16:51 . 2010-01-15 16:51 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-09-26 06:21 . 2010-01-14 12:47 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2002-08-29 02:58 . 2008-06-20 11:51 361600 c:\windows\system32\dllcache\tcpip.sys
- 2008-06-20 11:51 . 2008-06-20 11:51 361600 c:\windows\system32\dllcache\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-26 39408]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-25 13680640]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

S2 FAH@C:+Program Files+Ubisoft+Far Cry 2+bin+FAH.exe;FAH@C:+Program Files+Ubisoft+Far Cry 2+bin+FAH.exe;c:\program files\Ubisoft\Far Cry 2\bin\FAH.exe -svcstart --> c:\program files\Ubisoft\Far Cry 2\bin\FAH.exe -svcstart [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [8. 10. 2009 8:18 133104]
S3 k510bus;Sony Ericsson K510 Driver driver (WDM);c:\windows\system32\drivers\k510bus.sys [16. 10. 2009 15:02 58288]
S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;c:\windows\system32\drivers\k510mdfl.sys [16. 10. 2009 15:02 8336]
S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;c:\windows\system32\drivers\k510mdm.sys [16. 10. 2009 15:02 94064]
S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\k510mgmt.sys [16. 10. 2009 15:12 85408]
S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;c:\windows\system32\drivers\k510obex.sys [16. 10. 2009 15:12 83344]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\i:\ntglm7x.sys --> i:\NTGLM7X.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2010-01-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-08 07:18]

2010-01-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-08 07:18]

2010-01-15 c:\windows\Tasks\WebReg Deskjet F2100 series.job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2007-03-11 20:27]

2010-01-15 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-09-27 20:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.atcomet.com/b/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: Stiahnuť &všetky odkazy pomocou BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Stiahnuť odkaz &pomocou BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Stiahnuť všetky v&ideá pomocou BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Miro\Application Data\Mozilla\Firefox\Profiles\y9bwhm8r.default\
FF - component: c:\documents and settings\Miro\Application Data\Mozilla\Firefox\Profiles\y9bwhm8r.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}\components\IBitCometExtension.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".sk");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-15 18:49
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
"ServiceDll"="c:\windows\System32\es.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\FAH@C:+Program Files+Ubisoft+Far Cry 2+bin+FAH.exe]
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\System32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\msiexec.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
.
**************************************************************************
.
Completion time: 2010-01-15 18:51:55 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-15 17:51
ComboFix2.txt 2010-01-14 19:07

Pre-Run: 99 785 818 112 bytes free
Post-Run: 99 740 651 520 bytes free

- - End Of File - - 122D488F6063798FE0D7EE6027E57DA3

[pitimir]

Ako sa sprava pocitac teraz?

Stiahni na plochu CureIt. Zatial ho nespustat. Restart do nudoveho rezimu (>>klik<<) a v nom spravis nasledovne:

• Spust program dvojklikom, zrus pripadne vyzvy na stiahnutie novsej verzie a klikni na "Start".
• Potvrd okna a automaticky zacne expresny scan. Ak sa pri tomto kratkom scane najdu infikovane subory, klikni na "Vyber vsetky" -> "Liecit" -> "Odstran neliecitelne".
• Vo vrchnom menu klikni na "Volby" -> "Zmenit Nastavenia" a vyfajkni Heuristicka analyza a Vyzva na akciu -> "OK". Vrat sa naspat do hlavneho menu, v nom zvol komplet scan a klikni na zelenu sipku naprvo pod logom Dr. Web.
• Ked bude scan hotovy, vo vrchnom menu klik na "File" a zvol "Uloz...". Uloz log na plochu, otvor v poznamkovom bloku a vloz ho sem. Nezabudni restartovat PC.

[mirto]

Pocitac sa zda byt v poriadku. V polovici scanu sa vzdy restartuje pc. Pri spusteni windowsu naskoci upozornenie o chybe, "system windows spusteny po vaznej chybe". Vytvoril sa aj log zo scanu, ale je extremne dlhy.

=============================================================================
Dr.Web Scanner for Windows v5.00.10 (5.00.10.11260)
© Doctor Web, Ltd., 1992-2009
Protokolový súbor generovaný: 2010-01-18, 12:23:47 [Miro]
Príkazový riadok: "C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\h7423XP.exe" /lng:sk-scan /ini:setup_XP.ini /fast
Operačný systém: Windows XP Professional x86 (Build 2600), Service Pack 3
=============================================================================
DwShield spustený
Verzia jadra: 5.00 (5.00.1.12222)
API verzia jadra: 2.02
[Databáza vírusov] C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\7eb163f8 - 516 vírusových vzoriek
[Databáza vírusov] C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\66d3645d - 13618 vírusových vzoriek
[Databáza vírusov] C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\8b1c7331 - 17748 vírusových vzoriek
[Databáza vírusov] C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\788480d6 - 18725 vírusových vzoriek
[Databáza vírusov] C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\9e94ce8b - 18429 vírusových vzoriek
[Databáza vírusov] C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\db34e9f7 - 872 vírusových vzoriek
[Databáza vírusov] C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\9a7d7068 - 142240 vírusových vzoriek
[Databáza vírusov] C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\b4058803 - 66726 vírusových vzoriek
[Databáza vírusov] C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\02f30b24 - 24512 vírusových vzoriek
[Databáza vírusov] C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\18bf12c6 - 82762 vírusových vzoriek
[Databáza vírusov] C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\6aeedb64 - 514157 vírusových vzoriek
[Databáza vírusov] C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\c0223e5b - 1825 vírusových vzoriek
[Databáza vírusov] C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\f6ca01c3 - 941 vírusových vzoriek
[Databáza vírusov] C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\f20edcbd - 2545 vírusových vzoriek
[Databáza vírusov] C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\016a6156 - 2801 vírusových vzoriek
[Databáza vírusov] C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\cd843d39 - 6197 vírusových vzoriek
[Databáza vírusov] C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\6f97cbbe - 28348 vírusových vzoriek
Celkovo vírusových vzoriek: 942962
[Samokontrola] C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\h7423XP.exe
Kľúčový súbor: C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\setup.key
Číslo licenčného kľúča: 0011097003
Registrované na meno: An unauthorized User
Licenčný kľúč aktivovaný: 2009-09-14
Licenčný kľúč vypršaný: 2010-03-17
Procesy v pamäti: System:4 - OK
Procesy v pamäti: \SystemRoot\System32\smss.exe:144 - OK
Procesy v pamäti: \??\C:\WINDOWS\system32\csrss.exe:196 - OK
Procesy v pamäti: \??\C:\WINDOWS\system32\winlogon.exe:220 - OK
Procesy v pamäti: C:\WINDOWS\system32\services.exe:264 - OK
Procesy v pamäti: C:\WINDOWS\system32\lsass.exe:276 - OK
Procesy v pamäti: C:\WINDOWS\system32\svchost.exe:428 - OK
Procesy v pamäti: C:\WINDOWS\system32\svchost.exe:472 - OK
Procesy v pamäti: C:\WINDOWS\system32\svchost.exe:540 - OK
Procesy v pamäti: C:\WINDOWS\Explorer.EXE:1100 - OK
Procesy v pamäti: C:\Documents and Settings\Miro\Desktop\drweb-cureit.exe:1200 - OK
Procesy v pamäti: C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\257k4c.exe:1208 - OK
Procesy v pamäti: C:\DOCUME~1\Miro\LOCALS~1\Temp\RarSFX0\h7423XP.exe:1224 - OK
[Test pamäte] Žiadne vírusy sa nenašli
Master Boot Record HDD1 - OK
Active OS/2 or WinNT Boot Sector HDD1 - OK

[Kontrolovať cestu] C:\WINDOWS\system32
C:\WINDOWS\system32\$winnt$.inf - OK
C:\WINDOWS\system32\12520437.cpx - OK
C:\WINDOWS\system32\12520850.cpx - OK
C:\WINDOWS\system32\6to4svc.dll - OK
C:\WINDOWS\system32\aaaamon.dll - OK
C:\WINDOWS\system32\aaclient.dll - OK
C:\WINDOWS\system32\AbaleZip.dll - OK
C:\WINDOWS\system32\ac3acm.acm - OK
C:\WINDOWS\system32\access.cpl - OK
C:\WINDOWS\system32\acctres.dll - OK
C:\WINDOWS\system32\accwiz.exe - OK
C:\WINDOWS\system32\acelpdec.ax - OK
C:\WINDOWS\system32\acledit.dll - OK
C:\WINDOWS\system32\aclui.dll - OK
C:\WINDOWS\system32\activeds.dll komprimované s FLY-CODE
>C:\WINDOWS\system32\activeds.dll - OK
C:\WINDOWS\system32\activeds.tlb - OK
C:\WINDOWS\system32\actmovie.exe - OK
C:\WINDOWS\system32\actxprxy.dll - OK
C:\WINDOWS\system32\admparse.dll - OK
C:\WINDOWS\system32\adptif.dll - OK
C:\WINDOWS\system32\adsldp.dll komprimované s FLY-CODE
>C:\WINDOWS\system32\adsldp.dll - OK
C:\WINDOWS\system32\adsldpc.dll - OK
C:\WINDOWS\system32\adsmsext.dll - OK
C:\WINDOWS\system32\adsnds.dll - OK
C:\WINDOWS\system32\adsnt.dll - OK
C:\WINDOWS\system32\adsnw.dll - OK
C:\WINDOWS\system32\advapi32.dll - OK
C:\WINDOWS\system32\advpack.dll - OK
C:\WINDOWS\system32\ahui.exe - OK
C:\WINDOWS\system32\alg.exe - OK
C:\WINDOWS\system32\alrsvc.dll - OK
C:\WINDOWS\system32\ALSndMgr.cpl - OK
C:\WINDOWS\system32\amcompat.tlb - OK
C:\WINDOWS\system32\amstream.dll - OK
C:\WINDOWS\system32\ansi.sys - OK
C:\WINDOWS\system32\apcups.dll - OK
C:\WINDOWS\system32\append.exe - OK
C:\WINDOWS\system32\apphelp.dll - OK
C:\WINDOWS\system32\appmgmts.dll - OK
C:\WINDOWS\system32\appmgr.dll - OK
C:\WINDOWS\system32\appwiz.cpl - archív BINARYRES
>C:\WINDOWS\system32\appwiz.cpl/data001 - OK
>C:\WINDOWS\system32\appwiz.cpl/data002 - OK
>C:\WINDOWS\system32\appwiz.cpl/data003 - archív HTML
>>C:\WINDOWS\system32\appwiz.cpl/data003/JavaScript.0 - OK
>C:\WINDOWS\system32\appwiz.cpl/data003 - OK
>C:\WINDOWS\system32\appwiz.cpl/data004 - archív HTML
>>C:\WINDOWS\system32\appwiz.cpl/data004/JavaScript.0 - OK
>C:\WINDOWS\system32\appwiz.cpl/data004 - OK
>C:\WINDOWS\system32\appwiz.cpl/data005 - OK
>C:\WINDOWS\system32\appwiz.cpl/data006 - archív HTML
>>C:\WINDOWS\system32\appwiz.cpl/data006/JavaScript.0 - OK
>C:\WINDOWS\system32\appwiz.cpl/data006 - OK
>C:\WINDOWS\system32\appwiz.cpl/data007 - OK
>C:\WINDOWS\system32\appwiz.cpl/data008 - archív HTML
>>C:\WINDOWS\system32\appwiz.cpl/data008/JavaScript.0 - OK
>C:\WINDOWS\system32\appwiz.cpl/data008 - OK
>C:\WINDOWS\system32\appwiz.cpl/data009 - archív HTML
>>C:\WINDOWS\system32\appwiz.cpl/data009/JavaScript.0 - OK
>C:\WINDOWS\system32\appwiz.cpl/data009 - OK
>C:\WINDOWS\system32\appwiz.cpl/data010 - OK
>C:\WINDOWS\system32\appwiz.cpl/data011 - archív HTML
>>C:\WINDOWS\system32\appwiz.cpl/data011/JavaScript.0 - OK
>C:\WINDOWS\system32\appwiz.cpl/data011 - OK
>C:\WINDOWS\system32\appwiz.cpl/data012 - archív HTML
>>C:\WINDOWS\system32\appwiz.cpl/data012/JavaScript.0 - OK
>C:\WINDOWS\system32\appwiz.cpl/data012 - OK
>C:\WINDOWS\system32\appwiz.cpl/data013 - OK
>C:\WINDOWS\system32\appwiz.cpl/data014 - archív HTML
>>C:\WINDOWS\system32\appwiz.cpl/data014/javascript.0 - OK
>C:\WINDOWS\system32\appwiz.cpl/data014 - OK
>C:\WINDOWS\system32\appwiz.cpl/data015 - archív HTML
>>C:\WINDOWS\system32\appwiz.cpl/data015/javascript.0 - OK
>C:\WINDOWS\system32\appwiz.cpl/data015 - OK
>C:\WINDOWS\system32\appwiz.cpl/data016 - archív HTML
>>C:\WINDOWS\system32\appwiz.cpl/data016/javascript.0 - OK
>C:\WINDOWS\system32\appwiz.cpl/data016 - OK
C:\WINDOWS\system32\appwiz.cpl - OK
C:\WINDOWS\system32\arp.exe - OK
C:\WINDOWS\system32\asctrls.ocx - OK
C:\WINDOWS\system32\asferror.dll - OK
C:\WINDOWS\system32\asr_fmt.exe - OK
C:\WINDOWS\system32\asr_ldm.exe - OK
C:\WINDOWS\system32\asr_pfu.exe - OK
C:\WINDOWS\system32\asycfilt.dll - OK
C:\WINDOWS\system32\at.exe - OK
C:\WINDOWS\system32\ATHPRXY.DLL - OK
C:\WINDOWS\system32\ati2cqag.dll - OK
C:\WINDOWS\system32\ati2dvaa.dll - OK
C:\WINDOWS\system32\ati2dvag.dll - OK
C:\WINDOWS\system32\ati3d1ag.dll - OK
C:\WINDOWS\system32\ati3duag.dll - OK
C:\WINDOWS\system32\ativdaxx.ax - OK
C:\WINDOWS\system32\ativmvxx.ax - OK
C:\WINDOWS\system32\ativtmxx.dll - OK
C:\WINDOWS\system32\ativvaxx.dll - OK
C:\WINDOWS\system32\atkctrs.dll - OK
C:\WINDOWS\system32\atl.dll - OK
C:\WINDOWS\system32\atl71.dll - OK
C:\WINDOWS\system32\atmadm.exe - OK
C:\WINDOWS\system32\atmfd.dll - OK
C:\WINDOWS\system32\atmlib.dll - OK
C:\WINDOWS\system32\atmpvcno.dll - OK
C:\WINDOWS\system32\atrace.dll - OK
C:\WINDOWS\system32\attrib.exe - OK
C:\WINDOWS\system32\audiosrv.dll - OK
C:\WINDOWS\system32\auditusr.exe - OK
C:\WINDOWS\system32\authz.dll - OK
C:\WINDOWS\system32\autochk.exe - OK
C:\WINDOWS\system32\autoconv.exe - OK
C:\WINDOWS\system32\autodisc.dll - OK
C:\WINDOWS\system32\AUTOEXEC.NT - OK
C:\WINDOWS\system32\autofmt.exe - OK
C:\WINDOWS\system32\autolfn.exe komprimované s FLY-CODE
>C:\WINDOWS\system32\autolfn.exe - OK
C:\WINDOWS\system32\autorun.inf - OK
C:\WINDOWS\system32\avicap.dll - OK
C:\WINDOWS\system32\avicap32.dll - OK
C:\WINDOWS\system32\avifil32.dll - OK
C:\WINDOWS\system32\avifile.dll - OK
C:\WINDOWS\system32\avmeter.dll - OK
C:\WINDOWS\system32\avtapi.dll - OK
C:\WINDOWS\system32\avwav.dll - OK
C:\WINDOWS\system32\azroles.dll - OK
C:\WINDOWS\system32\basesrv.dll - OK
C:\WINDOWS\system32\batmeter.dll - OK
C:\WINDOWS\system32\batt.dll - OK
C:\WINDOWS\system32\bidispl.dll - OK
C:\WINDOWS\system32\binkw32.dll - OK
C:\WINDOWS\system32\bios1.rom - OK
C:\WINDOWS\system32\bios4.rom - OK
C:\WINDOWS\system32\bitsprx2.dll - OK
C:\WINDOWS\system32\bitsprx3.dll - OK
C:\WINDOWS\system32\bitsprx4.dll - OK
C:\WINDOWS\system32\blackbox.dll - OK
C:\WINDOWS\system32\blastcln.exe - OK
C:\WINDOWS\system32\bootcfg.exe - OK
C:\WINDOWS\system32\bootok.exe - OK
C:\WINDOWS\system32\bootvid.dll - OK
C:\WINDOWS\system32\bootvrfy.exe - OK
C:\WINDOWS\system32\bopomofo.uce - OK
C:\WINDOWS\system32\browselc.dll - archív BINARYRES
>C:\WINDOWS\system32\browselc.dll/data001 - OK
>C:\WINDOWS\system32\browselc.dll/data002 - OK
>C:\WINDOWS\system32\browselc.dll/data003 - OK
>C:\WINDOWS\system32\browselc.dll/data004 - archív HTML
>>C:\WINDOWS\system32\browselc.dll/data004/Script.0 - OK
>C:\WINDOWS\system32\browselc.dll/data004 - OK
>C:\WINDOWS\system32\browselc.dll/data005 - OK
>C:\WINDOWS\system32\browselc.dll/data006 - OK
>C:\WINDOWS\system32\browselc.dll/data007 - OK
>C:\WINDOWS\system32\browselc.dll/data008 - archív HTML
>>C:\WINDOWS\system32\browselc.dll/data008/Script.0 - OK
>C:\WINDOWS\system32\browselc.dll/data008 - OK
>C:\WINDOWS\system32\browselc.dll/data009 - OK
>C:\WINDOWS\system32\browselc.dll/data010 - OK
>C:\WINDOWS\system32\browselc.dll/data011 - OK
>C:\WINDOWS\system32\browselc.dll/data012 - archív HTML
>>C:\WINDOWS\system32\browselc.dll/data012/Script.0 - OK
>C:\WINDOWS\system32\browselc.dll/data012 - OK
>C:\WINDOWS\system32\browselc.dll/data013 komprimované s ZLIB
>>C:\WINDOWS\system32\browselc.dll/data013 - archív BINARYRES
>>>C:\WINDOWS\system32\browselc.dll/data013/data001 - OK
>>C:\WINDOWS\system32\browselc.dll/data013 - OK
C:\WINDOWS\system32\browselc.dll - OK
C:\WINDOWS\system32\browser.dll - OK
C:\WINDOWS\system32\browseui.dll - OK
C:\WINDOWS\system32\browsewm.dll - OK
C:\WINDOWS\system32\bthci.dll - OK
C:\WINDOWS\system32\bthprops.cpl - OK
C:\WINDOWS\system32\bthserv.dll - OK
C:\WINDOWS\system32\btpanui.dll - OK
C:\WINDOWS\system32\BuzzingBee.wav - OK
C:\WINDOWS\system32\cabinet.dll - OK
C:\WINDOWS\system32\cabview.dll - OK
C:\WINDOWS\system32\cacls.exe - OK
C:\WINDOWS\system32\calc.exe - OK
C:\WINDOWS\system32\camocx.dll - OK
C:\WINDOWS\system32\capesnpn.dll - OK
C:\WINDOWS\system32\cards.dll - OK
C:\WINDOWS\system32\catsrv.dll - OK
C:\WINDOWS\system32\catsrvps.dll - OK
C:\WINDOWS\system32\catsrvut.dll - OK
C:\WINDOWS\system32\ccfgnt.dll - OK
C:\WINDOWS\system32\cdfview.dll - archív BINARYRES
>C:\WINDOWS\system32\cdfview.dll/data001 - archív HTML
>>C:\WINDOWS\system32\cdfview.dll/data001/JavaScript.0 - OK
>>C:\WINDOWS\system32\cdfview.dll/data001/JavaScript.1 - OK
>C:\WINDOWS\system32\cdfview.dll/data001 - OK
>C:\WINDOWS\system32\cdfview.dll/data002 - archív HTML
>>C:\WINDOWS\system32\cdfview.dll/data002/JavaScript.0 - OK
>>C:\WINDOWS\system32\cdfview.dll/data002/JavaScript.1 - OK
>C:\WINDOWS\system32\cdfview.dll/data002 - OK
>C:\WINDOWS\system32\cdfview.dll/data003 - OK
C:\WINDOWS\system32\cdfview.dll - OK
C:\WINDOWS\system32\cdm.dll - OK
C:\WINDOWS\system32\cdmodem.dll - OK
C:\WINDOWS\system32\cdosys.dll - archív BINARYRES
>C:\WINDOWS\system32\cdosys.dll/data001 - OK
>C:\WINDOWS\system32\cdosys.dll/data002 - OK
C:\WINDOWS\system32\cdosys.dll - OK
C:\WINDOWS\system32\cdplayer.exe.manifest - OK
C:\WINDOWS\system32\certcli.dll - OK
C:\WINDOWS\system32\certmgr.dll - OK
C:\WINDOWS\system32\certmgr.msc - OK
C:\WINDOWS\system32\cewmdm.dll - OK
C:\WINDOWS\system32\cfgbkend.dll - OK
C:\WINDOWS\system32\cfgmgr32.dll - OK
C:\WINDOWS\system32\charmap.exe - OK
C:\WINDOWS\system32\ChCfg.exe - OK
C:\WINDOWS\system32\chcp.com - OK
C:\WINDOWS\system32\chkdsk.exe - OK
C:\WINDOWS\system32\chkntfs.exe - OK
C:\WINDOWS\system32\ciadmin.dll - OK
C:\WINDOWS\system32\ciadv.msc - OK
C:\WINDOWS\system32\cic.dll - OK
C:\WINDOWS\system32\cidaemon.exe - OK
C:\WINDOWS\system32\ciodm.dll - OK
C:\WINDOWS\system32\cipher.exe - OK
C:\WINDOWS\system32\cisvc.exe - OK
C:\WINDOWS\system32\ckcnv.exe - OK
C:\WINDOWS\system32\clb.dll - OK
C:\WINDOWS\system32\clbcatex.dll - OK
C:\WINDOWS\system32\clbcatq.dll - OK
C:\WINDOWS\system32\cleanmgr.exe - OK
C:\WINDOWS\system32\cliconf.chm - archív CHM
>C:\WINDOWS\system32\cliconf.chm/#IDXHDR - OK
>C:\WINDOWS\system32\cliconf.chm/#ITBITS - OK
>C:\WINDOWS\system32\cliconf.chm/#IVB - OK
>C:\WINDOWS\system32\cliconf.chm/#STRINGS - OK
>C:\WINDOWS\system32\cliconf.chm/#SYSTEM - OK
>C:\WINDOWS\system32\cliconf.chm/#TOCIDX - OK
>C:\WINDOWS\system32\cliconf.chm/#TOPICS - OK
>C:\WINDOWS\system32\cliconf.chm/#URLSTR - OK
>C:\WINDOWS\system32\cliconf.chm/#URLTBL - OK
>C:\WINDOWS\system32\cliconf.chm/#WINDOWS - OK
>C:\WINDOWS\system32\cliconf.chm/$FIftiMain - OK
>C:\WINDOWS\system32\cliconf.chm/$OBJINST - OK
>C:\WINDOWS\system32\cliconf.chm/$WWAssociativeLinks/Property - OK
>C:\WINDOWS\system32\cliconf.chm/$WWKeywordLinks/Property - OK
>C:\WINDOWS\system32\cliconf.chm/_add_(or_edit)_via_library_configuration.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_appletalk_protocol_default_value_setup.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_banyan_vines_protocol_default_value_setup.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_helphow_to_alias_a_client_to_an_alternate_pipe.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_helphow_to_check_the_library_version_numbers.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_helphow_to_use_the_windows_sockets_net.2d.library_.28.windows.2d_.or_windows_nt.2d.based_clients.29.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_helphow_to_verify_that_sql_server_is_listening_on_appletalk_and_can_accept_a_client_connection.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_how_to_add_a_network_protocol_configuration_.28.client_configuration_utility.29.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_how_to_check_the_odbc_sql_server_driver_version_.28.windows_95.2d.based_clients.29.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_how_to_configure_a_client_to_a_nonstandard_network_protocol.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_how_to_configure_a_client_to_use_the_appletalk_network_protocol.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_how_to_configure_a_client_to_use_the_banyan_vines_network_protocol.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_how_to_configure_a_client_to_use_the_nwlink_ipx.2f.spx_network_protocol.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_how_to_configure_a_client_to_use_the_via_network_library_(client_network_utility).htm - OK
>C:\WINDOWS\system32\cliconf.chm/_how_to_create_an_alias_for_a_specific_server_name_to_use_the_multi.2d.protocol_net.2d.library.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_how_to_delete_a_network_protocol_configuration_.28.client_configuration_utility.29.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_how_to_edit_a_network_protocol_configuration_.28.client_configuration_utility.29.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_how_to_set_db.2d.library_conversion_preference.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_how_to_start_the_sql_client_configuration_utility_.28.windows_nt.2d_.or_windows_95.2d_.based_client.29.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_managing_clients.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_multiprotocol_protocol_default_value_setup.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_named_pipes_protocol_default_value_setup.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_nwlink_ipx!spx_protocol_default_value_setup.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_sql_server_2000_copyright_and_disclaimer.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_tcp!ip_protocol_default_value_setup.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_topic_unavailable_in_help.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_via_protocol_default_value_setup.htm - OK
>C:\WINDOWS\system32\cliconf.chm/_what_is_microsoft_sql_server_client_configurationy.htm - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/banner.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/banner2.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/banner_.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/banner_2.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/caution.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/coC.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/coCb.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/coE.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/coEb.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/coUA.css - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/coUA_Ex.css - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/coUA_Print.css - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/elle.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/important.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/keybrd.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/keybrd_.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/keybrd_c.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/mailto.css - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/mailto.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/mailto.js - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/mailto_.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/mailto_c.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/note.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/relglyph.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/relglyph_.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/relglyph_c.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/shared.js - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/shortcutclick.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/shortcutcold.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/shortcuthot.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/spacer.gif - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/vs70.js - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/vs70_5.css - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/vs70link.js - OK
>C:\WINDOWS\system32\cliconf.chm/Basics/warning.gif - OK
>C:\WINDOWS\system32\cliconf.chm/cliconf.hhc - OK
>C:\WINDOWS\system32\cliconf.chm/idh_add_apple.htm - OK
>C:\WINDOWS\system32\cliconf.chm/idh_add_ipxspx1.htm - OK
>C:\WINDOWS\system32\cliconf.chm/idh_add_ipxspx2.htm - OK
>C:\WINDOWS\system32\cliconf.chm/idh_add_multi.htm - OK
>C:\WINDOWS\system32\cliconf.chm/idh_add_namedpipes.htm - OK
>C:\WINDOWS\system32\cliconf.chm/idh_add_others.htm - OK
>C:\WINDOWS\system32\cliconf.chm/idh_add_tcpip.htm - OK
>C:\WINDOWS\system32\cliconf.chm/idh_add_vines.htm - OK
>C:\WINDOWS\system32\cliconf.chm/idh_alias.htm - OK
>C:\WINDOWS\system32\cliconf.chm/idh_dblib.htm - OK
>C:\WINDOWS\system32\cliconf.chm/idh_general.htm - OK
>C:\WINDOWS\system32\cliconf.chm/idh_netlib.htm - OK
C:\WINDOWS\system32\cliconf.chm - OK
C:\WINDOWS\system32\cliconfg.dll - OK
C:\WINDOWS\system32\cliconfg.exe - OK
C:\WINDOWS\system32\cliconfg.rll - OK
C:\WINDOWS\system32\clipbrd.exe - OK
C:\WINDOWS\system32\clipsrv.exe - OK
C:\WINDOWS\system32\clspack.exe - OK
C:\WINDOWS\system32\clusapi.dll - OK
C:\WINDOWS\system32\cmcfg32.dll - OK
C:\WINDOWS\system32\cmd.exe - OK
C:\WINDOWS\system32\cmdial32.dll - OK
C:\WINDOWS\system32\cmdl32.exe - OK
C:\WINDOWS\system32\cmdlib.wsc - OK
C:\WINDOWS\system32\CmdLineExt.dll - OK
C:\WINDOWS\system32\cmmgr32.hlp - OK
C:\WINDOWS\system32\cmmon32.exe - OK
C:\WINDOWS\system32\cmos.ram - OK
C:\WINDOWS\system32\cmpbk32.dll - OK
C:\WINDOWS\system32\cmprops.dll - OK
C:\WINDOWS\system32\cmsetacl.dll - OK
C:\WINDOWS\system32\cmstp.exe - OK
C:\WINDOWS\system32\cmutil.dll - OK
C:\WINDOWS\system32\cnbjmon.dll - OK
C:\WINDOWS\system32\cnetcfg.dll - OK
C:\WINDOWS\system32\cnvfat.dll - OK
C:\WINDOWS\system32\colbact.dll - OK
C:\WINDOWS\system32\comaddin.dll - OK
C:\WINDOWS\system32\comcat.dll - OK
C:\WINDOWS\system32\comctl32.dll - OK
C:\WINDOWS\system32\comctl32.ocx - OK
C:\WINDOWS\system32\comdlg32.dll - OK
C:\WINDOWS\system32\comdlg32.ocx - OK
C:\WINDOWS\system32\comm.drv - OK
C:\WINDOWS\system32\command.com - OK
C:\WINDOWS\system32\commdlg.dll - OK
C:\WINDOWS\system32\comp.exe - OK
C:\WINDOWS\system32\compact.exe - OK
C:\WINDOWS\system32\compatui.dll - archív BINARYRES
>C:\WINDOWS\system32\compatui.dll/data001 - OK
>C:\WINDOWS\system32\compatui.dll/data002 - archív HTML
>>C:\WINDOWS\system32\compatui.dll/data002/javascript.0 - OK
>C:\WINDOWS\system32\compatui.dll/data002 - OK
C:\WINDOWS\system32\compatui.dll - OK
C:\WINDOWS\system32\compmgmt.msc - OK
C:\WINDOWS\system32\compobj.dll - OK
C:\WINDOWS\system32\compstui.dll - OK
C:\WINDOWS\system32\comrepl.dll - OK
C:\WINDOWS\system32\comres.dll - OK
C:\WINDOWS\system32\comsdupd.exe - OK
C:\WINDOWS\system32\comsnap.dll - OK
C:\WINDOWS\system32\comsvcs.dll - OK
C:\WINDOWS\system32\comuid.dll - OK
C:\WINDOWS\system32\CONFIG.NT - OK
C:\WINDOWS\system32\CONFIG.TMP - OK
C:\WINDOWS\system32\confmsp.dll - OK
C:\WINDOWS\system32\conime.exe - OK
C:\WINDOWS\system32\console.dll - OK
C:\WINDOWS\system32\control.exe - OK
C:\WINDOWS\system32\convert.exe - OK
C:\WINDOWS\system32\corpol.dll - OK
C:\WINDOWS\system32\country.sys - OK
C:\WINDOWS\system32\credssp.dll - OK
C:\WINDOWS\system32\credui.dll - OK
C:\WINDOWS\system32\crtdll.dll - OK
C:\WINDOWS\system32\crypt32.dll - OK
C:\WINDOWS\system32\cryptdlg.dll - OK
C:\WINDOWS\system32\cryptdll.dll - OK
C:\WINDOWS\system32\cryptext.dll - OK
C:\WINDOWS\system32\cryptnet.dll - OK
C:\WINDOWS\system32\cryptsvc.dll - OK
C:\WINDOWS\system32\cryptui.dll - OK
C:\WINDOWS\system32\cscdll.dll - OK
C:\WINDOWS\system32\cscript.exe - OK
C:\WINDOWS\system32\cscui.dll - OK
C:\WINDOWS\system32\csrsrv.dll - OK
C:\WINDOWS\system32\csrss.exe - OK
C:\WINDOWS\system32\csseqchk.dll - OK
C:\WINDOWS\system32\ctfmon.exe - OK
C:\WINDOWS\system32\ctl3d32.dll - OK
C:\WINDOWS\system32\ctl3dv2.dll - OK
C:\WINDOWS\system32\ctype.nls - OK
C:\WINDOWS\system32\c_037.nls - OK
C:\WINDOWS\system32\c_10000.nls - OK
C:\WINDOWS\system32\c_10006.nls - OK
C:\WINDOWS\system32\c_10007.nls - OK
C:\WINDOWS\system32\c_10010.nls - OK
C:\WINDOWS\system32\c_10017.nls - OK
C:\WINDOWS\system32\c_10029.nls - OK
C:\WINDOWS\system32\c_10079.nls - OK
C:\WINDOWS\system32\c_10081.nls - OK
C:\WINDOWS\system32\c_10082.nls - OK
C:\WINDOWS\system32\c_1026.nls - OK
C:\WINDOWS\system32\c_1250.nls - OK
C:\WINDOWS\system32\c_1251.nls - OK
C:\WINDOWS\system32\c_1252.nls - OK
C:\WINDOWS\system32\c_1253.nls - OK
C:\WINDOWS\system32\c_1254.nls - OK
C:\WINDOWS\system32\c_1255.nls - OK
C:\WINDOWS\system32\c_1256.nls - OK
C:\WINDOWS\system32\c_1257.nls - OK
C:\WINDOWS\system32\c_1258.nls - OK
C:\WINDOWS\system32\c_20127.nls - OK
C:\WINDOWS\system32\c_20261.nls - OK
C:\WINDOWS\system32\c_20866.nls - OK
C:\WINDOWS\system32\c_20905.nls - OK
C:\WINDOWS\system32\c_21866.nls - OK
C:\WINDOWS\system32\c_28591.nls - OK
C:\WINDOWS\system32\c_28592.nls - OK
C:\WINDOWS\system32\c_28593.nls - OK
C:\WINDOWS\system32\C_28594.NLS - OK
C:\WINDOWS\system32\C_28595.NLS - OK
C:\WINDOWS\system32\C_28597.NLS - OK
C:\WINDOWS\system32\c_28598.nls - OK
C:\WINDOWS\system32\c_28599.nls - OK
C:\WINDOWS\system32\c_28603.nls - OK
C:\WINDOWS\system32\c_28605.nls - OK
C:\WINDOWS\system32\c_437.nls - OK
C:\WINDOWS\system32\c_500.nls - OK
C:\WINDOWS\system32\c_737.nls - OK
C:\WINDOWS\system32\c_775.nls - OK
C:\WINDOWS\system32\c_850.nls - OK
C:\WINDOWS\system32\c_852.nls - OK
C:\WINDOWS\system32\c_855.nls - OK
C:\WINDOWS\system32\c_857.nls - OK
C:\WINDOWS\system32\c_860.nls - OK
C:\WINDOWS\system32\c_861.nls - OK
C:\WINDOWS\system32\c_863.nls - OK
C:\WINDOWS\system32\c_865.nls - OK
C:\WINDOWS\system32\c_866.nls - OK
C:\WINDOWS\system32\c_869.nls - OK
C:\WINDOWS\system32\c_874.nls - OK
C:\WINDOWS\system32\c_875.nls - OK
C:\WINDOWS\system32\c_932.nls - OK
C:\WINDOWS\system32\c_936.nls - OK
C:\WINDOWS\system32\c_949.nls - OK
C:\WINDOWS\system32\c_950.nls - OK
C:\WINDOWS\system32\d3d8.dll - OK
C:\WINDOWS\system32\d3d8thk.dll - OK
C:\WINDOWS\system32\d3d9.dll - OK
C:\WINDOWS\system32\d3d9caps.dat - OK
C:\WINDOWS\system32\D3DCompiler_33.dll komprimované s PESTUB
>C:\WINDOWS\system32\D3DCompiler_33.dll - OK
C:\WINDOWS\system32\D3DCompiler_34.dll komprimované s PESTUB
>C:\WINDOWS\system32\D3DCompiler_34.dll - OK
C:\WINDOWS\system32\D3DCompiler_35.dll komprimované s PESTUB
>C:\WINDOWS\system32\D3DCompiler_35.dll - OK
C:\WINDOWS\system32\D3DCompiler_36.dll komprimované s PESTUB
>C:\WINDOWS\system32\D3DCompiler_36.dll - OK
C:\WINDOWS\system32\D3DCompiler_37.dll komprimované s PESTUB
>C:\WINDOWS\system32\D3DCompiler_37.dll - OK
C:\WINDOWS\system32\D3DCompiler_38.dll komprimované s PESTUB
>C:\WINDOWS\system32\D3DCompiler_38.dll - OK
C:\WINDOWS\system32\D3DCompiler_39.dll komprimované s PESTUB
>C:\WINDOWS\system32\D3DCompiler_39.dll - OK
C:\WINDOWS\system32\D3DCompiler_40.dll komprimované s PESTUB
>C:\WINDOWS\system32\D3DCompiler_40.dll - OK
C:\WINDOWS\system32\D3DCompiler_41.dll komprimované s PESTUB
>C:\WINDOWS\system32\D3DCompiler_41.dll - OK
C:\WINDOWS\system32\D3DCompiler_42.dll - OK
C:\WINDOWS\system32\d3dcsx_42.dll - OK
C:\WINDOWS\system32\d3dim.dll - OK
C:\WINDOWS\system32\d3dim700.dll - OK
C:\WINDOWS\system32\d3dpmesh.dll - OK
C:\WINDOWS\system32\d3dramp.dll - OK
C:\WINDOWS\system32\d3drm.dll - OK
C:\WINDOWS\system32\d3dx10_33.dll komprimované s PESTUB
>C:\WINDOWS\system32\d3dx10_33.dll - OK
C:\WINDOWS\system32\d3dx10_34.dll komprimované s PESTUB
>C:\WINDOWS\system32\d3dx10_34.dll - OK
C:\WINDOWS\system32\d3dx10_35.dll komprimované s PESTUB
>C:\WINDOWS\system32\d3dx10_35.dll - OK
C:\WINDOWS\system32\d3dx10_36.dll komprimované s PESTUB
>C:\WINDOWS\system32\d3dx10_36.dll - OK
C:\WINDOWS\system32\d3dx10_37.dll komprimované s PESTUB
>C:\WINDOWS\system32\d3dx10_37.dll - OK
C:\WINDOWS\system32\d3dx10_38.dll komprimované s PESTUB
>C:\WINDOWS\system32\d3dx10_38.dll - OK
C:\WINDOWS\system32\d3dx10_39.dll komprimované s PESTUB
>C:\WINDOWS\system32\d3dx10_39.dll - OK
C:\WINDOWS\system32\d3dx10_40.dll komprimované s PESTUB
>C:\WINDOWS\system32\d3dx10_40.dll - OK
C:\WINDOWS\system32\d3dx10_41.dll komprimované s PESTUB
>C:\WINDOWS\system32\d3dx10_41.dll - OK
C:\WINDOWS\system32\d3dx10_42.dll - OK

a takto to ide dalej, za kazdym suborom ok, iba zopar ich ma komprimovane...

[pitimir]

Pouzi AVPTool:

Stiahni a spust AVPTool. Vypracuj log podla navodu a vloz ho.

[mirto]

Autoscan: stopped 8 minutes ago (events: 5, objects: 79, time: 00:10:45)
19. 1. 2010 20:14:22 Task started
19. 1. 2010 20:17:07 Detected: Trojan.Win32.VBKrypt.cc C:\Documents and Settings\Juro\Application Data\sdra64.exe
19. 1. 2010 20:24:39 Disinfected: Trojan.Win32.VBKrypt.cc HKEY_USERS\S-1-5-21-602162358-682003330-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Run\userinit
19. 1. 2010 20:24:39 Disinfected: Trojan.Win32.VBKrypt.cc HKEY_USERS\S-1-5-21-602162358-682003330-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Run\userinit
19. 1. 2010 20:25:07 Task stopped
Disinfect active threats: completed 4 minutes ago (events: 4, objects: 2565, time: 00:04:34)
19. 1. 2010 20:25:07 Task started
19. 1. 2010 20:25:08 Detected: Trojan.Win32.VBKrypt.cc C:\Documents and Settings\Juro\Application Data\sdra64.exe
19. 1. 2010 20:25:45 Deleted: Trojan.Win32.VBKrypt.cc C:\Documents and Settings\Juro\Application Data\sdra64.exe
19. 1. 2010 20:29:41 Task completed

[pitimir]

Ako sa sprava pocitac teraz?

[mirto]

Urcite funguje lepsie. Predtym bol dost vytazeny procesor uz pri malych ulohach a vo windowse bolo vela malych chyb. Teraz je uz vsetko v poriadku. Dakujem ti za pomoc. Vobec som necakal, ze je v PC tolko virusov. Ak si uz myslis, ze netraba robyt dalsie testy, poradil by si mi nejaky free antivirus, ktory sa ti zda dobry?

[pitimir]

1) Docistime to:

• Odinstaluj Combofix:
  Start -> Spustit -> (napis) combofix /uninstall

• Pouzi T-Cleaner (ak by ho antivirus hlasil ako smejda, nic sa netreba bat, ide len o paranoju AV programu).

• Precisti PC CCleanerom (vratane registrov).

• Pouzi TFC (spust program a klikni na "Start". Pozor, PC moze byt restartovane).

2) Vloz log z HJT.

V pripade nezrovnalosti sa >>tu<< nachadza navod.

Ad AV: Avast alebo Avira.

[mirto]

Tak tu je ten log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:17:03, on 21. 1. 2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\trend micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O8 - Extra context menu item: Stiahnuť &všetky odkazy pomocou BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Stiahnuť odkaz &pomocou BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Stiahnuť všetky v&ideá pomocou BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FAH@C:+Program Files+Ubisoft+Far Cry 2+bin+FAH.exe - Unknown owner - C:\Program Files\Ubisoft\Far Cry 2\bin\FAH.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 6299 bytes

[pitimir]

Fixni v HJT (zasrktni stvorcek pri danom riadku a stlac "Fix Checked"):

Kód: Vybrat vše

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll
O8 - Extra context menu item: Stiahnuť &všetky odkazy pomocou BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Stiahnuť odkaz &pomocou BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Stiahnuť všetky v&ideá pomocou BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll/206 (file missing)

2) Skopiruj do poznamkoveho bloku:

Kód: Vybrat vše

@echo off
sc stop "FAH@C:+Program Files+Ubisoft+Far Cry 2+bin+FAH.exe"
sc delete "FAH@C:+Program Files+Ubisoft+Far Cry 2+bin+FAH.exe"
sc stop "Nero BackItUp Scheduler 4.0"
sc delete "Nero BackItUp Scheduler 4.0"
rd /s /q "C:\Program Files\BitComet"
del %0
exit

Uloz ako del.bat (typ vsetky subory) na plochu a spust.


3) Okamzite doinstaluj zakladne zabezpecenie pocitaca (antivirus, antispyware a firewall).


4) Pouzi JavaRa, mas staru Javu.