Security Tool

[nolibu]

Dobrý den!
Do PC se mi dostal vir Security Tool.
Připojuji log z RSIT, který jsem po delší době z PC vyzískal.
Log z ComboFix mě Security Tool nenechá vytvořit. Okna viru jsou umístěna uprostřed obrazovky,
nejdou přesunout a překrývají okna ComboFixu.

Děkuji za pomoc.




Logfile of random's system information tool 1.06 (written by random/random)
Run by Libor at 2010-02-17 17:59:27
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 130 GB (65%) free of 200 GB
Total RAM: 3326 MB (64% free)


======Scheduled tasks folder======

C:\Windows\tasks\User_Feed_Synchronization-{005E0631-13D1-496D-91C0-F4C68B07B2FA}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EA837F48-5AD1-443E-AE34-FFE03CBF3099}]
Lištička - C:\Program Files\Seznam.cz\listicka.dll [2010-02-02 1119896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2009-08-16 962808]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2009-01-20 6711840]
"Skytel"=C:\Program Files\Realtek\Audio\HDA\Skytel.exe [2009-01-20 1833504]
"JMB36X IDE Setup"=C:\Windows\RaidTool\xInsIDE.exe [2007-03-20 36864]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-08-01 61440]
"WinFastDTV"=C:\Program Files\WinFast\WFDTV\DTVSchdl.exe [2009-03-09 90112]
"ArcSoft Connection Service"=C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [2009-10-10 203264]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-12-10 49152]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920]
"WinFast Schedule"=C:\Program Files\WinFast\WFDTV\WFWIZ.exe [2009-01-12 2908160]
"bluebirds"=C:\Users\Libor\Bluebirds\BlueBirds.exe [2009-04-29 270336]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952]
"PC Suite Tray"=C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2009-06-25 1414144]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]
"81823123"=C:\ProgramData\81823123\81823123.exe [2010-02-16 1035776]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95d4e9ab-9a3a-11de-afc8-806e6f6e6963}]
shell\AutoRun\command - F:\BlueBirds.exe


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-02-17 17:59:28 ----D---- C:\Program Files\trend micro
2010-02-17 17:59:27 ----D---- C:\rsit
2010-02-16 16:14:02 ----D---- C:\ProgramData\81823123
2010-02-15 18:41:59 ----D---- C:\Program Files\Seznam.cz
2010-02-10 22:11:22 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-02-10 22:11:22 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-02-10 22:11:14 ----A---- C:\Windows\system32\tsbyuv.dll
2010-02-10 22:11:14 ----A---- C:\Windows\system32\quartz.dll
2010-02-10 22:11:14 ----A---- C:\Windows\system32\msyuv.dll
2010-02-10 22:11:14 ----A---- C:\Windows\system32\msvidc32.dll
2010-02-10 22:11:13 ----A---- C:\Windows\system32\msvfw32.dll
2010-02-10 22:11:13 ----A---- C:\Windows\system32\msrle32.dll
2010-02-10 22:11:13 ----A---- C:\Windows\system32\mciavi32.dll
2010-02-10 22:11:13 ----A---- C:\Windows\system32\iyuv_32.dll
2010-02-10 22:11:13 ----A---- C:\Windows\system32\avifil32.dll
2010-01-22 10:25:20 ----A---- C:\Windows\system32\mshtml.dll
2010-01-22 10:25:19 ----A---- C:\Windows\system32\ieframe.dll
2010-01-22 10:25:17 ----A---- C:\Windows\system32\wininet.dll
2010-01-22 10:25:17 ----A---- C:\Windows\system32\urlmon.dll
2010-01-22 10:25:17 ----A---- C:\Windows\system32\occache.dll
2010-01-22 10:25:17 ----A---- C:\Windows\system32\msfeeds.dll
2010-01-22 10:25:17 ----A---- C:\Windows\system32\iertutil.dll
2010-01-22 10:25:17 ----A---- C:\Windows\system32\iedkcs32.dll
2010-01-22 10:25:16 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-01-22 10:25:16 ----A---- C:\Windows\system32\jsproxy.dll
2010-01-22 10:25:16 ----A---- C:\Windows\system32\ieUnatt.exe
2010-01-22 10:25:16 ----A---- C:\Windows\system32\ieui.dll
2010-01-22 10:25:16 ----A---- C:\Windows\system32\iesysprep.dll
2010-01-22 10:25:16 ----A---- C:\Windows\system32\iepeers.dll
2010-01-22 10:25:15 ----A---- C:\Windows\system32\msfeedssync.exe
2010-01-22 10:25:15 ----A---- C:\Windows\system32\iesetup.dll
2010-01-22 10:25:15 ----A---- C:\Windows\system32\iernonce.dll
2010-01-22 10:25:15 ----A---- C:\Windows\system32\ie4uinit.exe

======List of files/folders modified in the last 1 months======

2010-02-17 17:59:28 ----RD---- C:\Program Files
2010-02-17 17:59:25 ----D---- C:\Windows\Temp
2010-02-17 17:55:44 ----D---- C:\Windows\System32
2010-02-17 17:55:44 ----D---- C:\Windows\inf
2010-02-17 17:55:44 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-02-17 17:41:02 ----D---- C:\Windows\Prefetch
2010-02-16 20:04:33 ----SHD---- C:\System Volume Information
2010-02-16 16:17:23 ----D---- C:\Users\Libor\AppData\Roaming\ICQ
2010-02-16 16:14:02 ----HD---- C:\ProgramData
2010-02-15 21:14:55 ----D---- C:\Windows
2010-02-12 16:01:09 ----D---- C:\Windows\winsxs
2010-02-12 15:50:55 ----D---- C:\Windows\system32\catroot
2010-02-12 15:50:54 ----D---- C:\Windows\system32\catroot2
2010-02-11 12:41:35 ----D---- C:\Windows\system32\drivers
2010-02-11 12:41:35 ----D---- C:\Program Files\Windows Mail
2010-02-03 21:08:20 ----SHD---- C:\Windows\Installer
2010-02-03 21:08:19 ----HD---- C:\Config.Msi
2010-02-01 20:26:20 ----A---- C:\Windows\system32\mrt.exe
2010-01-28 11:09:48 ----D---- C:\Program Files\Internet Explorer
2010-01-26 19:13:29 ----HD---- C:\Program Files\InstallShield Installation Information
2010-01-26 18:39:26 ----D---- C:\WinFast WorkArea
2010-01-24 11:18:49 ----D---- C:\Windows\system32\migration

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [2009-02-13 11608]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2009-12-07 56816]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-09-06 3929600]
R3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2010-02-17 16608]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2009-01-20 2317536]
R3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
R3 RTHDMIAzAudService;Service for HDMI; C:\Windows\system32\drivers\RtHDMIV.sys [2008-12-25 155808]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-11-10 135680]
R3 WFLR6654;WinFast DTV1800 H (XC4000); C:\Windows\system32\drivers\wfeaglxt.sys [2008-12-25 433792]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-21 11264]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
S3 Dot4;Ovladač MS IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-21 131584]
S3 Dot4Print;Ovladač třídy tiskárny standardu IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-21 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-21 36864]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 nmwcd;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmb.sys [2009-02-09 17664]
S3 nmwcdc;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbo.sys [2009-02-09 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2009-02-09 7808]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2009-04-11 27648]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2009-02-09 7808]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2009-09-28 109056]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2008-09-06 704512]
R2 ES lite Service;ES lite Service for program management.; C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE [2009-02-05 68136]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2009-08-16 222968]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-21 21504]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-21 21504]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2004-12-13 49152]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2009-06-02 637952]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]

-----------------EOF-----------------

[stell]

Zdravim
1:Restart do nudzoveho rezimu s pracou vsieti.

Stiahnite si prosím Rkill z jedného z týchto štyroch odkazov:

Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe

Rkill COM:
http://download.bleepingcomputer.com/grinler/rkill.com

Rkill SCR:
http://download.bleepingcomputer.com/grinler/rkill.scr
Rkill PIF:
http://download.bleepingcomputer.com/grinler/rkill.pif

Uložiť jeden z tých 4 na plochu a spustite ho. Ak ho infekcia blokuje, potom skúste použiť niektorý z ďalších. Po spustení prosím, skúste spustiť Malwarebytes 'Anti-Malware, spustite aktualizáciu, spustite Rychly Scan a odstrániť všetko, čo nájde.

2:V nudzovom rezime spustis Malwarebytes Rychly skan
http://download.bleepingcomputer.com/ma ... -setup.exe
Stiahnes>>Malwarebytes' Anti-Malware
log vloz sem,

[nolibu]

log z rkill :
This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Ran as Libor on 18.02.2010 at 11:24:07.
Processes terminated by Rkill or while it was running:
C:\Users\Libor\Desktop\rkill.exe
Rkill completed on 18.02.2010 at 11:24:07.

log z Malwarebytes :
Malwarebytes' Anti-Malware 1.44
Verze databáze: 3754
Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 8.0.6001.18882

18.2.2010 11:38:09
mbam-log-2010-02-18 (11-38-09).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 101692
Uplynulý čas: 3 minute(s), 0 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 1
Infikované datové položky registru: 0
Infikované adresáře: 1
Infikované soubory: 4

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\81823123 (Rogue.Multiple.H) -> Quarantined and deleted successfully.

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
C:\ProgramData\81823123 (Rogue.Multiple.H) -> Quarantined and deleted successfully.

Infikované soubory:
C:\ProgramData\81823123\81823123.exe (Rogue.Multiple.H) -> Quarantined and deleted successfully.
C:\Windows\Temp\_ex-68.exe (Rogue.Security.Tool) -> Quarantined and deleted successfully.
C:\Users\Libor\Desktop\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Users\Libor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.

[stell]

ok,
spust este raz Malwarebytes a sprav komplet skan co najde zmaz a log vloz sem,potom vypni obnovu systemu a restart do normalneho windowsu a spust combofix,log vloz sem,

[nolibu]

log z Malwarebytes :

Malwarebytes' Anti-Malware 1.44
Verze databáze: 3754
Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 8.0.6001.18882
18.2.2010 12:38:24
mbam-log-2010-02-18 (12-38-24).txt

Typ kontroly: Kompletní kontrola (C:\|D:\|S:\|)
Zkontrolované objekty: 203476
Uplynulý čas: 17 minute(s), 54 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
(Nebyly nalezeny žádné škodlivé položky)



log z ComboFix :
ComboFix 10-02-17.01 - Libor 18.02.2010 13:01:35.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1250.420.1029.18.3326.2407 [GMT 1:00]
Spuštěný z: c:\users\Libor\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\temp

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-01-18 do 2010-02-18 )))))))))))))))))))))))))))))))
.

2010-02-18 12:09 . 2010-02-18 12:09 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-02-18 10:29 . 2010-02-18 10:29 5115824 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-02-18 10:29 . 2010-02-18 10:29 -------- d-----w- c:\users\Libor\AppData\Roaming\Malwarebytes
2010-02-18 10:29 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-18 10:29 . 2010-02-18 10:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-18 10:29 . 2010-02-18 10:29 -------- d-----w- c:\programdata\Malwarebytes
2010-02-18 10:29 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-17 16:59 . 2010-02-17 16:59 -------- d-----w- c:\program files\trend micro
2010-02-17 16:59 . 2010-02-17 16:59 -------- d-----w- C:\rsit
2010-02-15 17:41 . 2010-02-15 17:42 -------- d-----w- c:\program files\Seznam.cz

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-18 11:57 . 2008-01-21 06:46 598594 ----a-w- c:\windows\system32\perfh005.dat
2010-02-18 11:57 . 2008-01-21 06:46 114786 ----a-w- c:\windows\system32\perfc005.dat
2010-02-18 11:51 . 2009-09-05 17:28 16608 ----a-w- c:\windows\gdrv.sys
2010-02-18 11:42 . 2009-09-05 17:22 680 ----a-w- c:\users\Libor\AppData\Local\d3d9caps.dat
2010-02-16 15:17 . 2009-09-10 19:22 -------- d-----w- c:\users\Libor\AppData\Roaming\ICQ
2010-02-11 11:41 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-01-26 18:13 . 2009-09-05 17:29 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-14 10:12 . 2009-10-04 21:14 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-01-02 06:38 . 2010-01-22 09:25 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-22 09:25 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 06:32 . 2010-01-22 09:25 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 04:57 . 2010-01-22 09:25 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-12-29 08:58 . 2009-09-10 19:22 -------- d-----w- c:\program files\ICQ6.5
2009-12-11 11:43 . 2010-02-10 21:11 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-11 11:43 . 2010-02-10 21:11 98816 ----a-w- c:\windows\system32\drivers\srvnet.sys
2009-12-08 20:01 . 2010-02-10 21:11 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-12-08 20:01 . 2010-02-10 21:11 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-08 20:01 . 2010-02-10 21:11 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 17:26 . 2010-02-10 21:11 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-12-07 20:13 . 2009-09-05 13:42 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-04 18:30 . 2010-02-10 21:11 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2009-12-04 18:29 . 2010-02-10 21:11 1314816 ----a-w- c:\windows\system32\quartz.dll
2009-12-04 18:28 . 2010-02-10 21:11 22528 ----a-w- c:\windows\system32\msyuv.dll
2009-12-04 18:28 . 2010-02-10 21:11 31744 ----a-w- c:\windows\system32\msvidc32.dll
2009-12-04 18:28 . 2010-02-10 21:11 123904 ----a-w- c:\windows\system32\msvfw32.dll
2009-12-04 18:28 . 2010-02-10 21:11 13312 ----a-w- c:\windows\system32\msrle32.dll
2009-12-04 18:28 . 2010-02-10 21:11 82944 ----a-w- c:\windows\system32\mciavi32.dll
2009-12-04 18:28 . 2010-02-10 21:11 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2009-12-04 18:27 . 2010-02-10 21:11 91136 ----a-w- c:\windows\system32\avifil32.dll
2009-12-04 15:56 . 2010-02-10 21:11 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2009-12-04 15:56 . 2010-02-10 21:11 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WinFast Schedule"="c:\program files\WinFast\WFDTV\WFWIZ.exe" [2009-01-12 2908160]
"bluebirds"="c:\users\Libor\Bluebirds\BlueBirds.exe" [2009-04-29 270336]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-01-20 6711840]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-01-20 1833504]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440]
"WinFastDTV"="c:\program files\WinFast\WFDTV\DTVSchdl.exe" [2009-03-09 90112]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2009-10-10 203264]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-01-07 1394000]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):e0,34,85,d9,86,38,ca,01

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [5.9.2009 14:42 108289]
R2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [5.9.2009 18:29 68136]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [10.9.2009 20:23 222968]
R3 WFLR6654;WinFast DTV1800 H (XC4000);c:\windows\System32\drivers\wfeaglxt.sys [5.9.2009 19:17 433792]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Obsah adresáře 'Naplánované úlohy'

2010-02-17 c:\windows\Tasks\User_Feed_Synchronization-{005E0631-13D1-496D-91C0-F4C68B07B2FA}.job
- c:\windows\system32\msfeedssync.exe [2010-01-22 04:56]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: {{0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - {0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - c:\program files\Seznam.cz\listicka.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-18 13:09
Windows 6.0.6002 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2010-02-18 13:12:13
ComboFix-quarantined-files.txt 2010-02-18 12:12

Před spuštěním: Volných bajtů: 166 056 468 480
Po spuštění: Volných bajtů: 167 319 625 728

- - End Of File - - A0E5A6ECEFB71B6E3FDD548063E5BBCD

[stell]

Dobre vyzera to ok,este sprav toto:log z combofixu uz nemusis sem davat,po skane odinstaluj combofix--do start spustit vloz prikaz combofix /uninstall
precisti pc CCleanerom a ak nebudu uz problemy tot vse
Pri tejto akcii je nutné mať ComboFix na ploche.

Vypni>FIREWALL>Antivir>Antispyware>vsetko rezidentne.

Otvor Notepad (Poznámkový blok) a zkopíruj do neho celý zeleny tex:

Kód: Vybrat vše

KILLALL::

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

Potom klik na Subor -> Uložiť ako.. .. -> Ako je Názov souboru tak do toho riadku napiš:CFScript.txt
Typ súboru tak tam vyberies *všetky súbory
A ulož ho na plochu.> Pozor CFScript.txt>Neotvarat a nemoze byt ani>CFScript.txt.txt A Urobis Toto :

[nolibu]

Vypadá to , že vše je OK.
Díky moc.

[stell]

nemas zaco,