Problem s internetom

Zpráva

H1Tm4N · #1 Příspěvek od **H1Tm4N** » 02 bře 2010 21:15

Dobry vecer!
Nejdu mi nacitat rozne stranky antivirusov, Microsoftu. Pocitac bezi dobre, len obcas mam problem s prilis velkym vyuzitim CPU.
Prikladam log z RSIT

Logfile of random's system information tool 1.06 (written by random/random)
Run by Pc at 2010-03-02 21:12:02
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 7 GB (17%) free of 38 GB
Total RAM: 767 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:12:16, on 2. 3. 2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\PROGRA~1\MYSECR~1\MSFMON.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Documents and Settings\Pc\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Pc\Plocha\RSIT.exe
C:\Program Files\trend micro\Pc.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.fesicomp.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: QIPBHO Class - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\Pc\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: QIPBHO - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Documents and Settings\Pc\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [MSF_Monitor] C:\PROGRA~1\MYSECR~1\MSFMON.exe /Start
O4 - HKLM\..\Run: [MP10_EnsureFileVer] C:\WINDOWS\inf\unregmp2.exe /EnsureFileVersions
O4 - HKLM\..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe /WAITSERVICE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Pc\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odoslať do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&oslať do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP\qip.exe (HKCU)
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe

--
End of file - 7663 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2000478354-507921405-1417001333-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2000478354-507921405-1417001333-1003UA.job
C:\WINDOWS\tasks\WGASetup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}]
QIPBHO Class - C:\Documents and Settings\Pc\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll [2009-07-14 150768]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-07-16 61440]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2006-11-17 577536]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2009-12-21 39424]
"PWRISOVM.EXE"=C:\Program Files\PowerISO\PWRISOVM.EXE [2009-03-15 180224]
"MSF_Monitor"=C:\PROGRA~1\MYSECR~1\MSFMON.exe [2007-02-28 99920]
"MP10_EnsureFileVer"=C:\WINDOWS\inf\unregmp2.exe [2008-04-14 208896]
"nod32kui"=C:\Program Files\Eset\nod32kui.exe [2010-02-28 778240]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Google Update"=C:\Documents and Settings\Pc\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2009-12-21 135664]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-08-08 143360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14b60923-1a34-11df-ac9b-00e04c71cc4b}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14b60924-1a34-11df-ac9b-00e04c71cc4b}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57851ac5-f136-11de-ac49-00e04c71cc4b}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{837b3974-220a-11df-acb7-00e04c71cc4b}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{97284ad4-ec9a-11de-977d-00e04c71cc4b}]
shell\AutoRun\command - F:\a2g21.exe
shell\open\command - F:\a2g21.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c0002c04-ef2b-11de-ac46-00e04c71cc4b}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn

======List of files/folders created in the last 1 months======

2010-03-02 21:12:03 ----D---- C:\Program Files\trend micro
2010-03-02 21:12:02 ----D---- C:\rsit
2010-03-02 21:08:44 ----D---- C:\WINDOWS\CSC
2010-03-02 21:08:37 ----A---- C:\WINDOWS\ntbtlog.txt
2010-02-28 21:53:00 ----D---- C:\Program Files\Eset
2010-02-28 21:53:00 ----A---- C:\WINDOWS\system32\nms32.dll
2010-02-28 21:53:00 ----A---- C:\WINDOWS\system32\imon.dll
2010-02-28 20:47:58 ----SHD---- C:\Config.Msi
2010-02-28 20:46:36 ----D---- C:\WINDOWS\system32\appmgmt
2010-02-28 20:44:09 ----D---- C:\Program Files\Common Files\ParetoLogic
2010-02-21 19:38:31 ----D---- C:\Documents and Settings\Pc\Data aplikací\Audacity
2010-02-21 19:38:13 ----D---- C:\Program Files\Audacity 1.3 Beta (Unicode)
2010-02-19 23:53:44 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2010-02-19 23:52:41 ----D---- C:\WINDOWS\system32\LogFiles
2010-02-19 23:52:29 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2010-02-19 23:51:20 ----A---- C:\Documents and Settings\All Users\Data aplikací\hpe2454.dll
2010-02-18 07:46:28 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-18 07:46:23 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-02-18 07:42:37 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-02-18 07:42:32 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-02-18 07:42:27 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-02-18 07:42:21 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-02-18 07:42:12 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-02-18 07:42:01 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-02-17 15:38:58 ----A---- C:\WINDOWS\unvise32.exe
2010-02-17 15:33:39 ----D---- C:\Program Files\SCi Games
2010-02-17 15:33:31 ----A---- C:\WINDOWS\system32\UAService7.exe
2010-02-17 15:00:42 ----A---- C:\WINDOWS\xobglu32.dll
2010-02-17 15:00:41 ----A---- C:\WINDOWS\xobglu16.dll
2010-02-17 12:26:28 ----D---- C:\Program Files\MySecretFolder XP
2010-02-15 09:56:36 ----A---- C:\WINDOWS\system32\MRT.INI
2010-02-15 09:53:57 ----A---- C:\WINDOWS\system32\MRT.exe
2010-02-10 22:30:55 ----D---- C:\bwinPoker
2010-02-09 16:18:49 ----D---- C:\Documents and Settings\Pc\Data aplikací\Zoner
2010-02-09 16:18:04 ----D---- C:\Program Files\Zoner
2010-02-07 14:09:23 ----RHD---- C:\Documents and Settings\Pc\Data aplikací\SecuROM
2010-02-07 14:09:21 ----A---- C:\WINDOWS\system32\CmdLineExt.dll
2010-02-07 14:09:03 ----D---- C:\Program Files\Hasbro
2010-02-04 18:14:50 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2010-02-04 18:14:38 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$

======List of files/folders modified in the last 1 months======

2010-03-02 21:12:03 ----RD---- C:\Program Files
2010-03-02 21:11:25 ----D---- C:\WINDOWS\Temp
2010-03-02 21:11:25 ----D---- C:\Program Files\Mozilla Firefox
2010-03-02 21:11:24 ----D---- C:\WINDOWS\system32
2010-03-02 21:08:44 ----D---- C:\WINDOWS
2010-03-02 21:07:41 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-03-02 20:36:37 ----D---- C:\Documents and Settings\Pc\Data aplikací\Skype
2010-03-02 15:28:13 ----D---- C:\WINDOWS\Prefetch
2010-03-01 09:22:07 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-03-01 09:21:16 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-28 21:53:00 ----D---- C:\WINDOWS\system32\drivers
2010-02-28 21:50:18 ----D---- C:\Documents and Settings\Pc\Data aplikací\DC++
2010-02-28 21:49:47 ----SHD---- C:\WINDOWS\Installer
2010-02-28 20:47:08 ----SD---- C:\WINDOWS\Tasks
2010-02-28 20:44:09 ----D---- C:\Program Files\Common Files
2010-02-28 13:33:50 ----D---- C:\WINDOWS\Debug
2010-02-25 13:56:10 ----SD---- C:\Documents and Settings\Pc\Data aplikací\Microsoft
2010-02-25 09:04:00 ----D---- C:\WINDOWS\Microsoft.NET
2010-02-25 08:35:21 ----RSD---- C:\WINDOWS\assembly
2010-02-25 08:35:05 ----D---- C:\WINDOWS\WinSxS
2010-02-25 08:34:56 ----D---- C:\WINDOWS\system32\mui
2010-02-25 08:34:56 ----D---- C:\Program Files\Internet Explorer
2010-02-19 23:57:11 ----HD---- C:\WINDOWS\inf
2010-02-19 23:54:00 ----D---- C:\Program Files\Windows Media Player
2010-02-19 23:52:00 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-02-19 23:51:48 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-02-19 23:50:51 ----HD---- C:\Program Files\InstallShield Installation Information
2010-02-19 23:50:46 ----D---- C:\Program Files\Sony Ericsson
2010-02-19 10:58:52 ----SHD---- C:\System Volume Information
2010-02-19 10:58:52 ----D---- C:\WINDOWS\system32\Restore
2010-02-18 07:46:28 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-13 21:19:30 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2010-02-12 23:54:10 ----A---- C:\WINDOWS\wincmd.ini
2010-02-10 16:10:18 ----D---- C:\Program Files\Common Files\Adobe
2010-02-05 17:53:21 ----D---- C:\WINDOWS\Minidump
2010-02-04 18:15:57 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2009-03-15 56268]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
R2 AMON;AMON; \??\C:\WINDOWS\system32\drivers\amon.sys []
R2 MSF32;MSF32; \??\C:\Program Files\MySecretFolder XP\MSF32.SYS []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2007-03-08 4027840]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-08-08 3266560]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-13 20992]
R3 seehcri;Sony Ericsson seehcri Device Driver; C:\WINDOWS\system32\DRIVERS\seehcri.sys [2008-01-09 27632]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\WINDOWS\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\WINDOWS\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\WINDOWS\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM); C:\WINDOWS\system32\DRIVERS\s1018bus.sys [2008-11-04 86696]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s1018mdfl.sys [2008-11-04 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s1018mdm.sys [2008-11-04 114472]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s1018mgmt.sys [2008-11-04 108200]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS); C:\WINDOWS\system32\DRIVERS\s1018nd5.sys [2008-11-04 26024]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s1018obex.sys [2008-11-04 104616]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM); C:\WINDOWS\system32\DRIVERS\s1018unic.sys [2008-11-04 109736]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-08-08 573440]
R2 NOD32krn;NOD32 Kernel Service; C:\Program Files\Eset\nod32krn.exe [2010-02-28 331776]
R2 OMSI download service;Sony Ericsson OMSI download service; C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112]
R2 UserAccess7;SecuROM User Access Service (V7); C:\WINDOWS\system32\UAService7.exe [2010-02-17 126976]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

#2 Příspěvek od **Caroprd111** » 02 bře 2010 21:19

Zdravím

Na logu se pracuje, prosím o strpení.

#3 Příspěvek od **Caroprd111** » 02 bře 2010 21:23

Stáhněte a uložte, nejlépe na plochu http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Obrázek

Vypněte všechny rezidentní bezpečnostní programy - firewally, antiviry, antispywary

Obrázek

Vložte do PC všechny flash disky, které používáte.

Obrázek

Spusťte aplikaci pod účtem s oprávněním Administrátora (Správce), ihned po startu se zobrází stránka s licenčnímy podmínkami, pokračujte stisknutím tlačítka "Ano"

Obrázek

Dále postupujte dle pokynů, během scanu nespouštějte jiné aplikace a neklikejte do zobrazujícího se okna

Scan by měl trvat okolo 5 - 10 minut, po dokončení Combofix zobrazí log C:\ComboFix.txt , který sem vložte.

Obrázek

Během skenování může být počítač restartován.

H1Tm4N · #4 Příspěvek od **H1Tm4N** » 03 bře 2010 15:37

ComboFix 10-03-02.08 - Pc . 03. 2010 15:25:07.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1029.18.767.481 [GMT 1:00]
Running from: c:\documents and settings\Pc\Plocha\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Data aplikací\hpe2454.dll
c:\windows\system32\vbzlib1.dll
c:\windows\xobglu16.dll
D:\khq

.
((((((((((((((((((((((((( Files Created from 2010-02-03 to 2010-03-03 )))))))))))))))))))))))))))))))
.

2010-03-02 20:12 . 2010-03-02 20:12 -------- d-----w- c:\program files\trend micro
2010-03-02 20:12 . 2010-03-02 20:12 -------- d-----w- C:\rsit
2010-02-28 20:53 . 2010-02-28 20:53 -------- d-----w- c:\program files\Eset
2010-02-28 20:53 . 2010-02-28 20:51 208896 ----a-w- c:\windows\system32\imon.dll
2010-02-28 20:53 . 2010-02-28 20:51 114688 ----a-w- c:\windows\system32\nms32.dll
2010-02-28 20:53 . 2010-02-28 20:51 225808 ----a-w- c:\windows\system32\drivers\amon.sys
2010-02-28 19:44 . 2010-02-28 19:48 -------- d-----w- c:\program files\Common Files\ParetoLogic
2010-02-21 18:38 . 2010-02-21 18:38 -------- d-----w- c:\program files\Audacity 1.3 Beta (Unicode)
2010-02-19 22:52 . 2010-02-19 22:57 -------- d-----w- c:\windows\system32\drivers\UMDF
2010-02-19 22:52 . 2010-02-19 22:52 -------- d-----w- c:\windows\system32\LogFiles
2010-02-19 22:51 . 2008-01-09 11:28 27632 ----a-w- c:\windows\system32\drivers\seehcri.sys
2010-02-17 14:38 . 2004-03-29 15:23 90112 ----a-w- c:\windows\unvise32.exe
2010-02-17 14:33 . 2010-02-17 14:33 -------- d-----w- c:\program files\SCi Games
2010-02-17 14:33 . 2010-02-17 14:33 126976 ----a-w- c:\windows\system32\UAService7.exe
2010-02-17 14:00 . 2010-02-17 14:00 1968126 ----a-w- c:\windows\xobglu32.dll
2010-02-17 11:26 . 2010-02-17 11:26 -------- d-----w- c:\program files\MySecretFolder XP
2010-02-10 21:30 . 2010-02-10 21:31 -------- d-----w- C:\bwinPoker
2010-02-09 15:18 . 2010-02-09 15:18 -------- d-----w- c:\program files\Zoner
2010-02-07 13:09 . 2010-02-07 13:09 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-02-07 13:09 . 2010-02-07 13:09 -------- d-----w- c:\program files\Hasbro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-19 22:50 . 2009-12-19 12:40 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-19 22:50 . 2009-12-24 22:04 -------- d-----w- c:\program files\Sony Ericsson
2010-02-10 15:10 . 2009-12-19 12:36 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-04 17:15 . 2001-10-25 13:00 69584 ----a-w- c:\windows\system32\perfc005.dat
2010-02-04 17:15 . 2001-10-25 13:00 392548 ----a-w- c:\windows\system32\perfh005.dat
2010-01-23 15:38 . 2010-01-23 15:38 -------- d-----w- c:\program files\PowerISO
2010-01-16 08:26 . 2010-01-16 08:26 -------- d-----w- c:\program files\Play+Smile
2010-01-10 13:26 . 2009-12-21 17:22 -------- d-----w- c:\program files\ICQ6.5
2010-01-09 16:02 . 2010-01-09 16:02 -------- d-----w- c:\program files\Ashampoo
2010-01-05 09:58 . 2008-12-01 11:19 832512 ----a-w- c:\windows\system32\wininet.dll
2010-01-05 09:57 . 2008-12-01 11:19 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 09:57 . 2008-12-01 11:19 17408 ----a-w- c:\windows\system32\corpol.dll
2010-01-04 13:34 . 2010-01-04 13:34 -------- d-----w- c:\program files\DsNET Corp
2009-12-31 16:50 . 2008-04-13 22:45 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-22 19:21 . 2009-12-19 08:04 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-12-22 19:21 . 2009-12-19 08:04 2426 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2009-12-22 19:20 . 2009-12-19 08:04 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2009-12-22 19:07 . 2009-12-22 19:07 60416 ----a-w- c:\windows\ALCFDRTM.EXE
2009-12-21 17:53 . 2009-12-21 17:15 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-12-19 12:51 . 2009-12-19 12:51 0 -c--a-w- c:\windows\ativpsrm.bin
2009-12-19 12:35 . 2009-12-19 12:35 0 -c--a-w- c:\windows\nsreg.dat
2009-12-19 08:01 . 2009-12-19 08:01 21812 -c--a-w- c:\windows\system32\emptyregdb.dat
2009-12-17 07:42 . 2009-12-19 08:00 343552 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:10 . 2008-04-14 06:51 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-04 18:22 . 2008-04-13 22:47 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-03-21 14:09 . 2008-04-14 06:51 164746 --sha-r- c:\windows\system32\etbgxe.dll
.

------- Sigcheck -------

[-] 2008-12-01 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Pc\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2009-12-21 135664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-07-16 61440]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 577536]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-12-21 39424]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2009-03-15 180224]
"MSF_Monitor"="c:\progra~1\MYSECR~1\MSFMON.exe" [2007-02-27 99920]
"MP10_EnsureFileVer"="c:\windows\inf\unregmp2.exe" [2008-04-14 208896]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2010-02-28 778240]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_2"="shell32" [X]
"_nltide_3"="advpack.dll" [2010-01-05 124928]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5909:TCP"= 5909:TCP:rmalxtap

R2 MSF32;MSF32;c:\program files\MySecretFolder XP\MSF32.SYS [17. 2. 2010 12:26 39424]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [19. 2. 2010 23:51 27632]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [21. 12. 2009 18:15 721904]
S2 jeovc;wlkfs;c:\windows\system32\svchost.exe -k netsvcs [14. 4. 2008 7:52 14336]
S2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [19. 2. 2010 23:50 90112]
S2 pixbyzwjk;Task Time;c:\windows\system32\svchost.exe -k netsvcs [14. 4. 2008 7:52 14336]
S2 xdkodlyku;Monitor Boot;c:\windows\system32\svchost.exe -k netsvcs [14. 4. 2008 7:52 14336]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [24. 12. 2009 23:05 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [24. 12. 2009 23:05 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [24. 12. 2009 23:05 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [24. 12. 2009 23:05 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [24. 12. 2009 23:05 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [24. 12. 2009 23:05 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [24. 12. 2009 23:05 115752]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [24. 12. 2009 23:05 86696]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [24. 12. 2009 23:05 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [24. 12. 2009 23:05 114472]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [24. 12. 2009 23:05 108200]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [24. 12. 2009 23:05 26024]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [24. 12. 2009 23:05 104616]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [24. 12. 2009 23:05 109736]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
jeovc
.
Contents of the 'Scheduled Tasks' folder

2010-03-03 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-02-01 21:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.fesicomp.sk/
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: imon.dll
FF - ProfilePath - c:\documents and settings\Pc\Data aplikací\Mozilla\Firefox\Profiles\3jqhh5gs.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-03 15:34
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\jeovc]
"ServiceDll"="c:\windows\system32\etbgxe.dll"
--

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pixbyzwjk]
"ServiceDll"="c:\windows\system32\etbgxe.dll"
--

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\xdkodlyku]
"ServiceDll"="c:\windows\system32\etbgxe.dll"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2000478354-507921405-1417001333-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:35,b3,ad,36,7c,06,96,e2,4d,99,14,93,06,8b,45,b5,06,df,76,79,e4,81,68,
8a,30,b3,37,90,d5,f3,50,c6,ce,99,1e,f2,71,77,e0,de,14,f9,33,e9,61,00,a8,9f,\
"??"=hex:ff,32,26,d7,8c,c4,03,c0,8b,d6,e2,23,a6,f7,68,1c
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(652)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(716)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll
.
Completion time: 2010-03-03 15:36:23
ComboFix-quarantined-files.txt 2010-03-03 14:36

Pre-Run: 6 714 585 088
Post-Run: 6 689 357 824

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 8174D8BB892D943FE012F45AEE1D0555

#5 Příspěvek od **Caroprd111** » 03 bře 2010 15:42

Pokud nemáte, přesuňte Combofix na plochu

otevřete si Poznámkový blok a zkopírujte do něj text z bílého okénka.

Kód: Vybrat vše

Driver::
pixbyzwjk
xdkodlyku
jeovc

uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
po uložení uchopte vámi vytvořený skript levým myšítkem a přesuňte ho nad ikonu Combofixu, kde ho upustíte:
po aplikaci na Vás vypadne další log,vložte ho sem

Může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

H1Tm4N · #6 Příspěvek od **H1Tm4N** » 03 bře 2010 16:05

ComboFix 10-03-02.08 - Pc . 03. 2010 15:48:43.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1029.18.767.439 [GMT 1:00]
Running from: c:\documents and settings\Pc\Plocha\ComboFix.exe
Command switches used :: c:\documents and settings\Pc\Plocha\CFScript.txt.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Pc\LOCALS~1\Temp\wjaqxf.dat
c:\documents and settings\Pc\Local Settings\Temp\wjaqxf.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_JEOVC
-------\Legacy_PIXBYZWJK
-------\Legacy_XDKODLYKU
-------\Service_jeovc
-------\Service_pixbyzwjk
-------\Service_xdkodlyku

((((((((((((((((((((((((( Files Created from 2010-02-03 to 2010-03-03 )))))))))))))))))))))))))))))))
.

2010-03-02 20:12 . 2010-03-02 20:12 -------- d-----w- c:\program files\trend micro
2010-03-02 20:12 . 2010-03-02 20:12 -------- d-----w- C:\rsit
2010-02-28 20:53 . 2010-02-28 20:53 -------- d-----w- c:\program files\Eset
2010-02-28 20:53 . 2010-02-28 20:51 208896 ----a-w- c:\windows\system32\imon.dll
2010-02-28 20:53 . 2010-02-28 20:51 114688 ----a-w- c:\windows\system32\nms32.dll
2010-02-28 20:53 . 2010-02-28 20:51 225808 ----a-w- c:\windows\system32\drivers\amon.sys
2010-02-28 19:44 . 2010-02-28 19:48 -------- d-----w- c:\program files\Common Files\ParetoLogic
2010-02-21 18:38 . 2010-02-21 18:38 -------- d-----w- c:\program files\Audacity 1.3 Beta (Unicode)
2010-02-19 22:52 . 2010-02-19 22:57 -------- d-----w- c:\windows\system32\drivers\UMDF
2010-02-19 22:52 . 2010-02-19 22:52 -------- d-----w- c:\windows\system32\LogFiles
2010-02-19 22:51 . 2008-01-09 11:28 27632 ----a-w- c:\windows\system32\drivers\seehcri.sys
2010-02-17 14:38 . 2004-03-29 15:23 90112 ----a-w- c:\windows\unvise32.exe
2010-02-17 14:33 . 2010-02-17 14:33 -------- d-----w- c:\program files\SCi Games
2010-02-17 14:33 . 2010-02-17 14:33 126976 ----a-w- c:\windows\system32\UAService7.exe
2010-02-17 14:00 . 2010-02-17 14:00 1968126 ----a-w- c:\windows\xobglu32.dll
2010-02-17 11:26 . 2010-02-17 11:26 -------- d-----w- c:\program files\MySecretFolder XP
2010-02-10 21:30 . 2010-02-10 21:31 -------- d-----w- C:\bwinPoker
2010-02-09 15:18 . 2010-02-09 15:18 -------- d-----w- c:\program files\Zoner
2010-02-07 13:09 . 2010-02-07 13:09 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-02-07 13:09 . 2010-02-07 13:09 -------- d-----w- c:\program files\Hasbro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-19 22:50 . 2009-12-19 12:40 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-19 22:50 . 2009-12-24 22:04 -------- d-----w- c:\program files\Sony Ericsson
2010-02-10 15:10 . 2009-12-19 12:36 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-04 17:15 . 2001-10-25 13:00 69584 ----a-w- c:\windows\system32\perfc005.dat
2010-02-04 17:15 . 2001-10-25 13:00 392548 ----a-w- c:\windows\system32\perfh005.dat
2010-01-23 15:38 . 2010-01-23 15:38 -------- d-----w- c:\program files\PowerISO
2010-01-16 08:26 . 2010-01-16 08:26 -------- d-----w- c:\program files\Play+Smile
2010-01-10 13:26 . 2009-12-21 17:22 -------- d-----w- c:\program files\ICQ6.5
2010-01-09 16:02 . 2010-01-09 16:02 -------- d-----w- c:\program files\Ashampoo
2010-01-05 09:58 . 2008-12-01 11:19 832512 ------w- c:\windows\system32\wininet.dll
2010-01-05 09:57 . 2008-12-01 11:19 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 09:57 . 2008-12-01 11:19 17408 ----a-w- c:\windows\system32\corpol.dll
2010-01-04 13:34 . 2010-01-04 13:34 -------- d-----w- c:\program files\DsNET Corp
2009-12-31 16:50 . 2008-04-13 22:45 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-22 19:21 . 2009-12-19 08:04 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-12-22 19:21 . 2009-12-19 08:04 2426 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2009-12-22 19:20 . 2009-12-19 08:04 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2009-12-22 19:07 . 2009-12-22 19:07 60416 ----a-w- c:\windows\ALCFDRTM.EXE
2009-12-21 17:53 . 2009-12-21 17:15 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-12-19 12:51 . 2009-12-19 12:51 0 -c--a-w- c:\windows\ativpsrm.bin
2009-12-19 12:35 . 2009-12-19 12:35 0 -c--a-w- c:\windows\nsreg.dat
2009-12-19 08:01 . 2009-12-19 08:01 21812 -c--a-w- c:\windows\system32\emptyregdb.dat
2009-12-17 07:42 . 2009-12-19 08:00 343552 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:10 . 2008-04-14 06:51 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-04 18:22 . 2008-04-13 22:47 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-03-21 14:09 . 2008-04-14 06:51 164746 --sha-r- c:\windows\system32\etbgxe.dll
.

------- Sigcheck -------

[-] 2008-12-01 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Pc\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2009-12-21 135664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-07-16 61440]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 577536]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-12-21 39424]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2009-03-15 180224]
"MSF_Monitor"="c:\progra~1\MYSECR~1\MSFMON.exe" [2007-02-27 99920]
"MP10_EnsureFileVer"="c:\windows\inf\unregmp2.exe" [2008-04-14 208896]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2010-02-28 778240]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_2"="shell32" [X]
"_nltide_3"="advpack.dll" [2010-01-05 124928]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi9"=c:\docume~1\Pc\LOCALS~1\Temp\wjaqxf.dat 2nHAPKGEHD

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5909:TCP"= 5909:TCP:rmalxtap

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [21. 12. 2009 18:15 721904]
R2 MSF32;MSF32;c:\program files\MySecretFolder XP\MSF32.SYS [17. 2. 2010 12:26 39424]
R2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [19. 2. 2010 23:50 90112]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [19. 2. 2010 23:51 27632]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [24. 12. 2009 23:05 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [24. 12. 2009 23:05 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [24. 12. 2009 23:05 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [24. 12. 2009 23:05 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [24. 12. 2009 23:05 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [24. 12. 2009 23:05 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [24. 12. 2009 23:05 115752]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [24. 12. 2009 23:05 86696]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [24. 12. 2009 23:05 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [24. 12. 2009 23:05 114472]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [24. 12. 2009 23:05 108200]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [24. 12. 2009 23:05 26024]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [24. 12. 2009 23:05 104616]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [24. 12. 2009 23:05 109736]
.
Contents of the 'Scheduled Tasks' folder

2010-03-03 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-02-01 21:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.fesicomp.sk/
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: imon.dll
FF - ProfilePath - c:\documents and settings\Pc\Data aplikací\Mozilla\Firefox\Profiles\3jqhh5gs.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-03 15:59
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spuq.sys >>UNKNOWN [0x82F90938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf75c0f28
\Driver\ACPI -> ACPI.sys @ 0xf731acb8
\Driver\atapi -> atapi.sys @ 0xf72afb40
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
NDIS: Realtek RTL8139 Family PCI Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xf71a6bd4
PacketIndicateHandler -> NDIS.sys @ 0xf71b2a21
SendHandler -> NDIS.sys @ 0xf71a6d44
user & kernel MBR OK

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2000478354-507921405-1417001333-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:35,b3,ad,36,7c,06,96,e2,4d,99,14,93,06,8b,45,b5,06,df,76,79,e4,81,68,
8a,30,b3,37,90,d5,f3,50,c6,ce,99,1e,f2,71,77,e0,de,14,f9,33,e9,61,00,a8,9f,\
"??"=hex:ff,32,26,d7,8c,c4,03,c0,8b,d6,e2,23,a6,f7,68,1c
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(668)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(724)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll

- - - - - - - > 'explorer.exe'(2216)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windows\SOUNDMAN.EXE
c:\program files\Eset\nod32krn.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\windows\system32\UAService7.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-03-03 16:04:10 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-03 15:04
ComboFix2.txt 2010-03-03 14:36

Pre-Run: 6 677 467 136
Post-Run: 6 539 386 880

- - End Of File - - 6A12C4AA7D45D8D2FC67605B5D44DC16

#7 Příspěvek od **Caroprd111** » 03 bře 2010 16:08

Tohle otestujte na http://www.virustotal.com/cs/
c:\windows\system32\sfcfiles.dll

(Soubor nehledejte, jenom vložíte tučně označenou cestu, v případě hlášky "Soubor již byl testován" dejte otestovat znovu. Výsledek analýzy sem vložte.)

Obrázek

Odinstalujte všechny emulátory virtuálních mechanik.

Obrázek

Stáhněte SPTD http://www.duplexsecure.com/en/downloads

Vyberte verzi podle svého operačního systému (64 & 32b). Uložte na plochu a spusťte.
zvolte možnost Uninstall a restartujte PC.

Stáhněte MBR na plochu http://www2.gmer.net/mbr/mbr.exe

Obrázek

Start > Spustit (Win + R)

Vyskočí okénko, zkopírujte do něj:

Kód: Vybrat vše

"%userprofile%\plocha\mbr" -t

Klikněte na OK

Vytvoří se log s názvem mbr.log, vložte ho sem.

Dejte log z Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878

H1Tm4N · #8 Příspěvek od **H1Tm4N** » 03 bře 2010 17:00

Dufam, ze som to dobre spravil...

http://www.virustotal.com/cs/analisis/7 ... 1267297810

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-03-03 16:57:43
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Pc\LOCALS~1\Temp\kxtdipow.sys

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs amon.sys (Amon monitor/Eset)
AttachedDevice \FileSystem\Fastfat \Fat amon.sys (Amon monitor/Eset)

---- EOF - GMER 1.0.15 ----

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-03 16:56:40
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Pc\LOCALS~1\Temp\kxtdipow.sys

---- Kernel code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xF68ED000, 0x1A0E00, 0xE8000020]
? C:\DOCUME~1\Pc\LOCALS~1\Temp\mbr.sys Systém nemůže nalézt uvedený soubor. !

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs amon.sys (Amon monitor/Eset)
AttachedDevice \FileSystem\Fastfat \Fat amon.sys (Amon monitor/Eset)

---- Files - GMER 1.0.15 ----

File C:\Documents and Settings\Pc\Local Settings\Data aplikací\Mozilla\Firefox\Profiles\3jqhh5gs.default\urlclassifier3.sqlite-journal

---- EOF - GMER 1.0.15 ----

#9 Příspěvek od **Caroprd111** » 03 bře 2010 17:02

Příště nedávejte logy do "Quote".

Obrázek

Jak to vypadá s PC

H1Tm4N · #10 Příspěvek od **H1Tm4N** » 03 bře 2010 21:26

Caroprd111 píše: Příště nedávejte logy do "Quote".

V poriadku.

Caroprd111 píše: Jak to vypadá s PC

Vyzera to dobre, nevidim uz ziadny problem...
Dakujem za pomoc.

#11 Příspěvek od **Caroprd111** » 03 bře 2010 21:32

Odinstalujte ComboFix přes:
Start >> Spustit, zkopírujte do okénka:

ComboFix /Uninstall

stiskněte Enter

Obrázek

Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

Spusťte, pro potvrzení volby mačkejte klávesu A, Enter
Po použití program vymažte. Pozor,antiviry ho mohou falešně označit za vir.

Stáhněte OTC http://oldtimer.geekstogo.com/OTC.exe

Spusťte.
Klikněte na "CleanUp!". Potvrďte hlášky stiskem "Yes" (Bude následovat restart)

Stáhněte Ccleaner http://viry.cz/forum/viewtopic.php?t=7478

Nainstalujte a v průběhu instalace odškrtněte, že chcete instalovat yahoo toolbar.

Záložka Čistič
Dejte analyzovat, po dokončení dejte Spustit Ccleaner.

Záložka Registry
Klikněte na Hledej problémy, po dokončení klikněte na Opravit problémy, zálohu dělat nemusíte, potom dejte Opravit všechny problémy.
OK Zavřít

Dejte nový log z RSIT.

H1Tm4N · #12 Příspěvek od **H1Tm4N** » 04 bře 2010 14:22

Logfile of random's system information tool 1.06 (written by random/random)
Run by Pc at 2010-03-04 14:20:57
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 7 GB (18%) free of 38 GB
Total RAM: 767 MB (59% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:21:07, on 4. 3. 2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\PROGRA~1\MYSECR~1\MSFMON.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Documents and Settings\Pc\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Pc\Plocha\RSIT.exe
C:\Program Files\trend micro\Pc.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.fesicomp.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [MSF_Monitor] C:\PROGRA~1\MYSECR~1\MSFMON.exe /Start
O4 - HKLM\..\Run: [MP10_EnsureFileVer] C:\WINDOWS\inf\unregmp2.exe /EnsureFileVersions
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Pc\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odoslať do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&oslať do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP\qip.exe (HKCU)
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe

--
End of file - 6613 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\WGASetup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-07-16 61440]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2006-11-17 577536]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2009-12-21 39424]
"MSF_Monitor"=C:\PROGRA~1\MYSECR~1\MSFMON.exe [2007-02-28 99920]
"MP10_EnsureFileVer"=C:\WINDOWS\inf\unregmp2.exe [2008-04-14 208896]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2009-11-16 2054360]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Documents and Settings\Pc\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2009-12-21 135664]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-08-08 143360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{837b3974-220a-11df-acb7-00e04c71cc4b}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn

======List of files/folders created in the last 1 months======

2010-03-04 14:20:57 ----D---- C:\rsit
2010-03-04 14:20:57 ----D---- C:\Program Files\trend micro
2010-03-04 14:13:14 ----SHD---- C:\RECYCLER
2010-03-04 12:32:39 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2010-03-04 12:31:47 ----HDC---- C:\WINDOWS\$NtUninstallKB979306$
2010-03-03 16:04:13 ----D---- C:\WINDOWS\temp
2010-03-03 16:02:22 ----N---- C:\WINDOWS\system32\spmsg.dll
2010-03-03 15:23:52 ----A---- C:\Boot.bak
2010-03-03 15:23:46 ----RASHD---- C:\cmdcons
2010-03-02 21:08:44 ----D---- C:\WINDOWS\CSC
2010-02-28 21:53:00 ----D---- C:\Program Files\Eset
2010-02-28 20:46:36 ----D---- C:\WINDOWS\system32\appmgmt
2010-02-28 20:44:09 ----D---- C:\Program Files\Common Files\ParetoLogic
2010-02-21 19:38:31 ----D---- C:\Documents and Settings\Pc\Data aplikací\Audacity
2010-02-21 19:38:13 ----D---- C:\Program Files\Audacity 1.3 Beta (Unicode)
2010-02-19 23:53:44 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2010-02-19 23:52:41 ----D---- C:\WINDOWS\system32\LogFiles
2010-02-19 23:52:29 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2010-02-18 07:46:28 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-18 07:46:23 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-02-18 07:42:37 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-02-18 07:42:32 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-02-18 07:42:27 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-02-18 07:42:21 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-02-18 07:42:12 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-02-18 07:42:01 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-02-17 15:38:58 ----A---- C:\WINDOWS\unvise32.exe
2010-02-17 15:33:39 ----D---- C:\Program Files\SCi Games
2010-02-17 15:33:31 ----A---- C:\WINDOWS\system32\UAService7.exe
2010-02-17 15:00:42 ----A---- C:\WINDOWS\xobglu32.dll
2010-02-17 12:26:28 ----D---- C:\Program Files\MySecretFolder XP
2010-02-15 09:56:36 ----A---- C:\WINDOWS\system32\MRT.INI
2010-02-15 09:53:57 ----A---- C:\WINDOWS\system32\MRT.exe
2010-02-10 22:30:55 ----D---- C:\bwinPoker
2010-02-09 16:18:49 ----D---- C:\Documents and Settings\Pc\Data aplikací\Zoner
2010-02-09 16:18:04 ----D---- C:\Program Files\Zoner
2010-02-07 14:09:23 ----RHD---- C:\Documents and Settings\Pc\Data aplikací\SecuROM
2010-02-07 14:09:21 ----A---- C:\WINDOWS\system32\CmdLineExt.dll
2010-02-07 14:09:03 ----D---- C:\Program Files\Hasbro

======List of files/folders modified in the last 1 months======

2010-03-04 14:21:06 ----D---- C:\WINDOWS\Prefetch
2010-03-04 14:20:57 ----RD---- C:\Program Files
2010-03-04 14:19:30 ----D---- C:\Program Files\Mozilla Firefox
2010-03-04 14:18:40 ----D---- C:\WINDOWS
2010-03-04 14:18:02 ----D---- C:\WINDOWS\system32
2010-03-04 14:16:50 ----SHD---- C:\WINDOWS\Installer
2010-03-04 14:16:43 ----HD---- C:\WINDOWS\inf
2010-03-04 14:16:43 ----D---- C:\WINDOWS\system32\drivers
2010-03-04 14:16:37 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-04 14:07:21 ----SHD---- C:\System Volume Information
2010-03-04 14:07:21 ----D---- C:\WINDOWS\system32\Restore
2010-03-04 12:33:46 ----D---- C:\WINDOWS\system32\CatRoot
2010-03-04 12:32:47 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-03-03 22:12:16 ----D---- C:\Documents and Settings\Pc\Data aplikací\Skype
2010-03-03 15:59:35 ----A---- C:\WINDOWS\system.ini
2010-03-03 15:58:02 ----D---- C:\WINDOWS\system32\config
2010-03-03 15:54:10 ----D---- C:\WINDOWS\AppPatch
2010-03-03 15:54:07 ----D---- C:\Program Files\Common Files
2010-03-03 15:47:25 ----N---- C:\WINDOWS\SchedLgU.Txt
2010-03-03 15:35:41 ----SD---- C:\WINDOWS\Tasks
2010-03-03 15:23:52 ----RASH---- C:\boot.ini
2010-02-28 21:50:18 ----D---- C:\Documents and Settings\Pc\Data aplikací\DC++
2010-02-28 13:33:50 ----D---- C:\WINDOWS\Debug
2010-02-25 13:56:10 ----SD---- C:\Documents and Settings\Pc\Data aplikací\Microsoft
2010-02-25 09:04:00 ----D---- C:\WINDOWS\Microsoft.NET
2010-02-25 08:35:21 ----RSD---- C:\WINDOWS\assembly
2010-02-25 08:35:05 ----D---- C:\WINDOWS\WinSxS
2010-02-25 08:34:56 ----D---- C:\WINDOWS\system32\mui
2010-02-25 08:34:56 ----D---- C:\Program Files\Internet Explorer
2010-02-19 23:54:00 ----D---- C:\Program Files\Windows Media Player
2010-02-19 23:52:00 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-02-19 23:51:48 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-02-19 23:50:51 ----HD---- C:\Program Files\InstallShield Installation Information
2010-02-19 23:50:46 ----D---- C:\Program Files\Sony Ericsson
2010-02-18 07:46:28 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-13 21:19:30 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2010-02-12 23:54:10 ----A---- C:\WINDOWS\wincmd.ini
2010-02-10 16:10:18 ----D---- C:\Program Files\Common Files\Adobe
2010-02-05 17:53:21 ----D---- C:\WINDOWS\Minidump

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-11-16 108792]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2009-11-16 96408]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-11-16 116520]
R2 MSF32;MSF32; \??\C:\Program Files\MySecretFolder XP\MSF32.SYS []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2007-03-08 4027840]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-08-08 3266560]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-13 20992]
R3 seehcri;Sony Ericsson seehcri Device Driver; C:\WINDOWS\system32\DRIVERS\seehcri.sys [2008-01-09 27632]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\WINDOWS\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\WINDOWS\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\WINDOWS\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM); C:\WINDOWS\system32\DRIVERS\s1018bus.sys [2008-11-04 86696]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s1018mdfl.sys [2008-11-04 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s1018mdm.sys [2008-11-04 114472]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s1018mgmt.sys [2008-11-04 108200]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS); C:\WINDOWS\system32\DRIVERS\s1018nd5.sys [2008-11-04 26024]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s1018obex.sys [2008-11-04 104616]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM); C:\WINDOWS\system32\DRIVERS\s1018unic.sys [2008-11-04 109736]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys []
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-08-08 573440]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-11-16 735960]
R2 OMSI download service;Sony Ericsson OMSI download service; C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112]
R2 UserAccess7;SecuROM User Access Service (V7); C:\WINDOWS\system32\UAService7.exe [2010-02-17 126976]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2009-11-16 20680]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

#13 Příspěvek od **Caroprd111** » 04 bře 2010 14:27

Vložte do PC všechny flash disky, které používáte.

Obrázek

Podle návodu http://www.viry.cz/forum/viewtopic.php?f=15&t=72743 aplikujte tento skript.

Kód: Vybrat vše

:reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{837b3974-220a-11df-acb7-00e04c71cc4b}]

:files
c:\Autorun.inf
D:\Autorun.inf
E:\Autorun.inf
F:\Autorun.inf
G:\Autorun.inf
H:\Autorun.inf
I:\Autorun.inf
K:\Autorun.inf
L:\Autorun.inf
C:\recycler
D:\recycler
e:\recycler
f:\recycler
g:\recycler
h:\recycler
I:\recycler
C:\resycled
D:\resycled
e:\resycled
f:\resycled
g:\resycled
h:\resycled
I:\resycled
c:\$recycle.bin
d:\$recycle.bin
e:\$recycle.bin
f:\$recycle.bin
g:\$recycle.bin
h:\$recycle.bin
I:\$recycle.bin

:commands
[EmptyTemp]
[Reboot]

H1Tm4N · #14 Příspěvek od **H1Tm4N** » 04 bře 2010 14:34

All processes killed
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{837b3974-220a-11df-acb7-00e04c71cc4b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{837b3974-220a-11df-acb7-00e04c71cc4b}\ not found.
========== FILES ==========
File/Folder c:\Autorun.inf not found.
File/Folder D:\Autorun.inf not found.
File/Folder E:\Autorun.inf not found.
File/Folder F:\Autorun.inf not found.
File/Folder G:\Autorun.inf not found.
File/Folder H:\Autorun.inf not found.
File/Folder I:\Autorun.inf not found.
File/Folder K:\Autorun.inf not found.
File/Folder L:\Autorun.inf not found.
C:\RECYCLER\S-1-5-21-2000478354-507921405-1417001333-1003 folder moved successfully.
C:\RECYCLER folder moved successfully.
File/Folder D:\recycler not found.
File/Folder e:\recycler not found.
File/Folder f:\recycler not found.
File/Folder g:\recycler not found.
File/Folder h:\recycler not found.
File/Folder I:\recycler not found.
File/Folder C:\resycled not found.
File/Folder D:\resycled not found.
File/Folder e:\resycled not found.
File/Folder f:\resycled not found.
File/Folder g:\resycled not found.
File/Folder h:\resycled not found.
File/Folder I:\resycled not found.
File/Folder c:\$recycle.bin not found.
File/Folder d:\$recycle.bin not found.
File/Folder e:\$recycle.bin not found.
File/Folder f:\$recycle.bin not found.
File/Folder g:\$recycle.bin not found.
File/Folder h:\$recycle.bin not found.
File/Folder I:\$recycle.bin not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Pc
->Temp folder emptied: 1501832 bytes
->Temporary Internet Files folder emptied: 434890 bytes
->FireFox cache emptied: 48943889 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 3953 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2351732 bytes
%systemroot%\System32 .tmp files removed: 2504 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 51,00 mb

OTM by OldTimer - Version 3.1.10.0 log created on 03042010_143036

Files moved on Reboot...

Registry entries deleted on Reboot...

#15 Příspěvek od **Caroprd111** » 04 bře 2010 14:45

Stáhněte OTC http://oldtimer.geekstogo.com/OTC.exe

Spusťte.
Klikněte na "CleanUp!". Potvrďte hlášky stiskem "Yes" (Bude následovat restart)

Doporučuji aktualizovat Adobe Reader http://www.stahuj.centrum.cz/podnikani_ ... batreader/

Obrázek

V logu nevidím firewall, doinstalujte

Přehled: http://www.viry.cz/forum/viewtopic.php?f=41&t=6523

VIRY.CZ

Problem s internetom

Problem s internetom

Re: Problem s internetom

Re: Problem s internetom

Re: Problem s internetom

Re: Problem s internetom

Re: Problem s internetom

Re: Problem s internetom

Re: Problem s internetom

Re: Problem s internetom

Re: Problem s internetom

Re: Problem s internetom

Re: Problem s internetom

Re: Problem s internetom

Re: Problem s internetom

Re: Problem s internetom