win32:rootkit-gen [rtk] + pomalý start win XP

[miki333]

Zdravím,

dnes jsem někde chytl nějaký rootkit. Avast mi zahlásil pár souborů ze složky windows/system32/drivers, které jsem hodil do karantény. Poté jsem trochu googlil a hledal i na tomto fóru a zkusil projet pc Ccleanerem. Nyní po restartu mi PC po naběhnutí do windows (naběhne komplet systém, vše vypadá ok) asi na 3-5 minut zamrzne. Tedy nic nereaguje. Můžu poklepat na ikony na ploše a spustit nějaký program, nicméně PC nereaguje. Stejně tak nereaguje na ctrl-alt-del a lišta Start je úplně neaktivní.

Po těch pár minutách ale všechno naskočí a dokonce se ozve startovací zvuk woken. Stejně tak se spustí všechny programy, které jsem se pokusil na ploše spustit. Po chvíli mi také vyskočí hláška Avastu "Byl nalezen rootkit" v souboru "J:\WINDOWS\System32\Drivers\PCIDump.sys"...

Přikládám log z pravidel tohoto fóra...



Logfile of random's system information tool 1.06 (written by random/random)
Run by Kamil at 2010-04-10 16:54:14
WIN_XP Service Pack 2
System drive J: has 14 GB (9%) free of 153 GB
Total RAM: 2046 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:54:26, on 10.4.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
J:\WINDOWS\System32\smss.exe
J:\WINDOWS\system32\winlogon.exe
J:\WINDOWS\system32\services.exe
J:\WINDOWS\system32\lsass.exe
J:\WINDOWS\system32\svchost.exe
J:\WINDOWS\System32\svchost.exe
J:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
J:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
J:\Program Files\Alwil Software\Avast4\ashServ.exe
J:\WINDOWS\Explorer.EXE
J:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
J:\Program Files\TortoiseSVN\bin\TSVNCache.exe
J:\WINDOWS\RTHDCPL.EXE
J:\Program Files\HP\HP Software Update\HPWuSchd2.exe
J:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
J:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
J:\Program Files\Common Files\Java\Java Update\jusched.exe
J:\Program Files\Ad Muncher\AdMunch.exe
J:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WinFast\WFDTV\WFWIZ.exe
J:\Program Files\DAEMON Tools Lite\daemon.exe
J:\Program Files\Logitech\SetPoint\SetPoint.exe
J:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
J:\WINDOWS\system32\spoolsv.exe
J:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
J:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
J:\WINDOWS\system32\svchost.exe
J:\Program Files\Java\jre6\bin\jqs.exe
J:\Program Files\Common Files\LightScribe\LSSrvc.exe
J:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
J:\WINDOWS\System32\svchost.exe
J:\WINDOWS\system32\nvsvc32.exe
J:\WINDOWS\System32\svchost.exe
J:\WINDOWS\system32\svchost.exe
J:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
J:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
J:\Program Files\Alwil Software\Avast4\ashWebSv.exe
J:\Program Files\Mozilla Firefox\firefox.exe
J:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
J:\Program Files\Common Files\Java\Java Update\jucheck.exe
J:\Documents and Settings\Kamil\Plocha\RSIT.exe
J:\Program Files\trend micro\Kamil.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O1 - Hosts: 77.93.209.79 abhdesign.cz
O1 - Hosts: 77.93.209.79 ftp.abhdesign.cz
O1 - Hosts: 95.168.205.187 ftp.gothicz.net
O1 - Hosts: 95.168.205.187 forum.gothicz.net
O1 - Hosts: 95.168.205.187 munin.gothicz.net
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - J:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - J:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - J:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - J:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - J:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - J:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE J:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE J:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GEST] m‘|\ü
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "J:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinFastDTV] C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] J:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [HP Software Update] J:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avast!] J:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "J:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [NeroFilterCheck] J:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "J:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "J:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SunJavaUpdateSched] "J:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Ad Muncher] J:\Program Files\Ad Muncher\AdMunch.exe /bt
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFDTV\WFWIZ.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "J:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-1547161642-492894223-839522115-1003\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-1547161642-492894223-839522115-1003\..\Run: [DAEMON Tools Lite] "J:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://J:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Kniha klipů HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - J:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Chytrý výběr - {700259D7-1666-479a-93B1-3250410481E8} - J:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - J:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - J:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - J:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - J:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - J:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - J:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - J:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - J:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - J:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - J:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - J:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - J:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - J:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - J:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - J:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - J:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - J:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 9083 bytes

======Scheduled tasks folder======

J:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
J:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
J:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
J:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
J:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
HP Print Enhancer - J:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll [2007-03-02 1298024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{053F9267-DC04-4294-A72C-58F732D338C0}]
HP Print Clips - J:\Program Files\HP\Smart Web Printing\hpswp_framework.dll [2007-03-02 177768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - J:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - J:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - J:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-02-19 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - J:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-02-19 79648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=J:\WINDOWS\system32\NvCpl.dll [2008-10-07 13574144]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=J:\WINDOWS\system32\NvMcTray.dll [2008-10-07 86016]
"GEST"=m‘|\ü []
"Adobe Reader Speed Launcher"=J:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"WinFastDTV"=C:\Program Files\WinFast\WFDTV\DTVSchdl.exe [2009-01-16 90112]
"ArcSoft Connection Service"=J:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [2010-03-18 207360]
"RTHDCPL"=J:\WINDOWS\RTHDCPL.EXE [2009-03-24 17567744]
"HP Software Update"=J:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-03-11 49152]
"avast!"=J:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-25 81000]
"AdobeCS4ServiceManager"=J:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]
"NeroFilterCheck"=J:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2007-03-01 153136]
"GrooveMonitor"=J:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"Logitech Hardware Abstraction Layer"=J:\WINDOWS\KHALMNPR.EXE [2007-01-23 101136]
"Malwarebytes Anti-Malware (reboot)"=J:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]
"SunJavaUpdateSched"=J:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"Ad Muncher"=J:\Program Files\Ad Muncher\AdMunch.exe [2010-03-06 7168]
"KernelFaultCheck"=J:\WINDOWS\system32\dumprep 0 -k []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=J:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]
"WinFast Schedule"=C:\Program Files\WinFast\WFDTV\WFWIZ.exe [2009-01-12 2908160]
"AdobeBridge"= []
"DAEMON Tools Lite"=J:\Program Files\DAEMON Tools Lite\daemon.exe [2009-04-23 691656]

J:\Documents and Settings\All Users\Nabídka Start\Programy\Po spu±tění
Logitech SetPoint.lnk - J:\Program Files\Logitech\SetPoint\SetPoint.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=J:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"J:\wincmd\WINCMD32.EXE"="J:\wincmd\WINCMD32.EXE:*:Enabled:Windows Commander 32 bit international version, file manager replacement for Windows"
"J:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="J:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"J:\Program Files\Mozilla Firefox\firefox.exe"="J:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"J:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="J:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"J:\Program Files\VideoLAN\VLC\vlc.exe"="J:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"J:\Program Files\Java\jre6\bin\java.exe"="J:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"J:\Program Files\Java\jdk1.6.0_17\bin\java.exe"="J:\Program Files\Java\jdk1.6.0_17\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"J:\Program Files\Java\jre6\launch4j-tmp\frd.exe"="J:\Program Files\Java\jre6\launch4j-tmp\frd.exe:*:Enabled:Java(TM) Platform SE binary"
"J:\Program Files\Java\jre6\bin\javaw.exe"="J:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"J:\Program Files\Skype\Plugin Manager\skypePM.exe"="J:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"J:\Program Files\Skype\Phone\Skype.exe"="J:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"J:\Program Files\Ad Muncher\AdMunch.exe"="J:\Program Files\Ad Muncher\AdMunch.exe:*:Enabled:AdMunch"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{150a6712-2357-11de-8351-001fd02554db}]
shell\AutoRun\command - L:\AUTOSTARTER.EXE


======File associations======

.txt - open - "J:\Program Files\PSPad editor\PSPad.exe" "%1"

======List of files/folders created in the last 1 months======

2010-04-10 16:54:14 ----D---- J:\rsit
2010-04-10 16:54:14 ----D---- J:\Program Files\trend micro
2010-04-10 15:42:57 ----D---- J:\Program Files\CCleaner
2010-04-10 14:35:30 ----D---- J:\WINDOWS\pss
2010-03-27 13:08:02 ----D---- J:\Program Files\WinHugs
2010-03-23 21:16:52 ----D---- J:\jason
2010-03-23 14:29:48 ----D---- J:\Program Files\Sun
2010-03-23 14:23:28 ----D---- J:\Program Files\Common Files\Java
2010-03-23 14:23:28 ----D---- J:\Documents and Settings\All Users\Data aplikací\Sun
2010-03-23 14:23:15 ----A---- J:\WINDOWS\system32\javaws.exe
2010-03-23 14:23:15 ----A---- J:\WINDOWS\system32\javaw.exe
2010-03-23 14:23:15 ----A---- J:\WINDOWS\system32\java.exe
2010-03-19 18:12:41 ----A---- J:\WINDOWS\setup.INI
2010-03-19 18:10:11 ----D---- J:\Program Files\OUP
2010-03-15 10:16:43 ----A---- J:\WINDOWS\system32\wmpns.dll
2010-03-14 14:41:33 ----D---- J:\Documents and Settings\All Users\Data aplikací\FarmFrenzy3_Arctica
2010-03-14 11:50:31 ----D---- J:\Program Files\QuickTime
2010-03-14 11:50:28 ----D---- J:\Program Files\Xilisoft
2010-03-14 11:40:29 ----D---- J:\Program Files\AVI WMV MPEG Converter
2010-03-13 12:26:23 ----D---- J:\Program Files\Vitware

======List of files/folders modified in the last 1 months======

2010-04-10 16:54:14 ----RD---- J:\Program Files
2010-04-10 16:54:13 ----D---- J:\WINDOWS\system32\CatRoot2
2010-04-10 16:54:12 ----D---- J:\WINDOWS\Temp
2010-04-10 16:53:57 ----D---- J:\WINDOWS\Prefetch
2010-04-10 16:47:26 ----SD---- J:\WINDOWS\Tasks
2010-04-10 16:46:24 ----D---- J:\WINDOWS
2010-04-10 16:18:39 ----D---- J:\WINDOWS\system32
2010-04-10 16:15:40 ----D---- J:\WINDOWS\system32\drivers
2010-04-10 16:08:01 ----D---- J:\Program Files\Mozilla Thunderbird
2010-04-10 15:48:47 ----N---- J:\WINDOWS\SchedLgU.Txt
2010-04-10 15:46:49 ----D---- J:\WINDOWS\Minidump
2010-04-10 15:46:49 ----D---- J:\WINDOWS\Debug
2010-04-10 15:41:21 ----RSHDC---- J:\WINDOWS\system32\dllcache
2010-04-10 14:52:50 ----SHD---- J:\System Volume Information
2010-04-10 14:52:50 ----D---- J:\WINDOWS\system32\Restore
2010-04-10 14:42:58 ----D---- J:\Program Files\Internet Explorer
2010-04-10 13:48:04 ----AD---- J:\Documents and Settings\All Users\Data aplikací\TEMP
2010-04-10 00:06:09 ----A---- J:\WINDOWS\winamp.ini
2010-04-09 09:26:43 ----A---- J:\WINDOWS\NeroDigital.ini
2010-04-07 22:26:11 ----A---- J:\WINDOWS\wincmd.ini
2010-04-07 18:41:49 ----AD---- J:\JDownloader 0.9.310
2010-04-07 13:54:20 ----SHD---- J:\WINDOWS\Installer
2010-04-07 13:54:19 ----HD---- J:\Config.Msi
2010-04-07 13:44:48 ----HD---- J:\WINDOWS\inf
2010-04-07 13:44:48 ----D---- J:\WINDOWS\system32\DirectX
2010-04-07 13:44:40 ----RSD---- J:\WINDOWS\assembly
2010-04-07 13:44:15 ----D---- J:\Program Files\EA Sports
2010-04-07 13:10:46 ----A---- J:\WINDOWS\wcx_ftp.ini
2010-04-06 12:27:14 ----D---- J:\Documents and Settings\Kamil\Data aplikací\OpenOffice.org2
2010-04-06 12:01:19 ----D---- J:\Documents and Settings\Kamil\Data aplikací\vlc
2010-04-05 20:02:59 ----D---- J:\Program Files\Mozilla Firefox
2010-03-28 12:44:24 ----HD---- J:\Program Files\InstallShield Installation Information
2010-03-27 11:46:08 ----RSD---- J:\WINDOWS\Fonts
2010-03-23 14:28:28 ----D---- J:\Program Files\Java
2010-03-23 14:23:28 ----D---- J:\Program Files\Common Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; J:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 aswSP;avast! Self Protection; J:\WINDOWS\system32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; J:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 intelppm;Řadič procesoru Intel; J:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-17 39936]
R1 oreans32;oreans32; \??\J:\WINDOWS\system32\drivers\oreans32.sys []
R2 adfs;adfs; J:\WINDOWS\system32\drivers\adfs.sys [2008-08-14 74720]
R2 aswFsBlk;aswFsBlk; J:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
R2 aswMon2;avast! Standard Shield Support; J:\WINDOWS\system32\drivers\aswMon2.sys [2009-11-25 94160]
R2 atksgt;atksgt; J:\WINDOWS\system32\DRIVERS\atksgt.sys [2009-09-30 281760]
R2 giveio;giveio; \??\J:\WINDOWS\giveio.sys []
R2 lirsgt;lirsgt; J:\WINDOWS\system32\DRIVERS\lirsgt.sys [2009-09-30 25888]
R2 XilinxPC4Driver;XilinxPC4Driver; J:\WINDOWS\System32\drivers\xpc4drvr.sys [2009-04-02 16000]
R3 aswRdr;aswRdr; J:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
R3 gdrv;gdrv; \??\J:\WINDOWS\gdrv.sys []
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; J:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); J:\WINDOWS\system32\drivers\RtkHDAud.sys [2009-03-24 5056000]
R3 L8042Kbd;Logitech SetPoint Keyboard Driver; J:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2007-01-23 20496]
R3 L8042mou;SetPoint PS/2 Mouse Filter Driver; J:\WINDOWS\system32\DRIVERS\L8042mou.Sys [2007-01-23 62992]
R3 LMouKE;SetPoint Mouse Filter Driver; J:\WINDOWS\system32\DRIVERS\LMouKE.Sys [2007-01-23 78864]
R3 nv;nv; J:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-10-07 6133856]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; J:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-01-03 105856]
R3 usbehci;Ovladač miniportu roz±ířeného radiče hostitele Microsoft USB 2.0; J:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Rozbočovač umo·nující USB2; J:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbstor;Ovladač velkokapacitního pamě¶ového zařízení USB; J:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; J:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 WFLR6654;WinFast DTV1800 H (XC4000); J:\WINDOWS\system32\drivers\wfeaglxt.sys [2008-12-25 433792]
R3 WinDriver6;WinDriver6; J:\WINDOWS\system32\drivers\windrvr6.sys [2009-04-02 194362]
S3 aqvbe61m;aqvbe61m; J:\WINDOWS\system32\drivers\aqvbe61m.sys []
S3 MPE;Filtr MPE BDA; J:\WINDOWS\system32\DRIVERS\MPE.sys [2004-08-03 15360]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; J:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; J:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; J:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 NIC1394;1394 Net Driver; J:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-17 61824]
S3 SLIP;BDA Slip De-Framer; J:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; J:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; J:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Třída USB Printer; J:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbscan;Ovladač skeneru USB; J:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 WpdUsb;WpdUsb; J:\WINDOWS\System32\Drivers\wpdusb.sys [2004-08-11 18944]
S3 WSTCODEC;Dálnopisný kodek světového standardu; J:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S4 IntelIde;IntelIde; J:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACDaemon;ArcSoft Connect Daemon; J:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2010-03-18 113152]
R2 aswUpdSv;avast! iAVS4 Control Service; J:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 avast! Antivirus;avast! Antivirus; J:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-25 138680]
R2 GEST Service;GEST Service for program management.; J:\Program Files\GIGABYTE\EnergySaver\GSvr.exe [2008-05-13 80392]
R2 hpqddsvc;Slu·ba HP CUE DeviceDiscovery; J:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
R2 JavaQuickStarterService;Java Quick Starter; J:\Program Files\Java\jre6\bin\jqs.exe [2009-12-17 153376]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; J:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2010-02-04 1181328]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; J:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-02-26 73728]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; J:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2007-09-20 853288]
R2 Net Driver HPZ12;Net Driver HPZ12; J:\WINDOWS\System32\svchost.exe [2004-08-17 14336]
R2 NVSvc;NVIDIA Display Driver Service; J:\WINDOWS\system32\nvsvc32.exe [2008-10-07 163908]
R2 Pml Driver HPZ12;Pml Driver HPZ12; J:\WINDOWS\System32\svchost.exe [2004-08-17 14336]
R2 UleadBurningHelper;Ulead Burning Helper; J:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2004-12-13 49152]
R2 UMWdf;Windows User Mode Driver Framework; J:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
R3 avast! Mail Scanner;avast! Mail Scanner; J:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; J:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-25 352920]
R3 hpqcxs08;hpqcxs08; J:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
S3 aspnet_state;ASP.NET State Service; J:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; J:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; J:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-04-07 655624]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; J:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 NMIndexingService;NMIndexingService; J:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2007-11-15 382248]
S3 odserv;Microsoft Office Diagnostics Service; J:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; J:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------

[Rudy]

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[miki333]

Zdravím, zde je log z ComboFixu...

ComboFix 10-04-10.02 - Kamil 11.04.2010 10:40:41.1.2 - x86
Spuštěný z: j:\documents and settings\Kamil\Plocha\ComboFix.exe
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

j:\windows\system32\AutoRun.inf
j:\windows\system32\drivers\pcidump.sys

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-03-11 do 2010-04-11 )))))))))))))))))))))))))))))))
.

2010-04-11 08:01 . 2010-04-11 08:01 -------- d-----w- j:\program files\RisenMDS
2010-04-10 14:54 . 2010-04-10 14:54 -------- d-----w- J:\rsit
2010-04-10 14:54 . 2010-04-10 14:54 -------- d-----w- j:\program files\trend micro
2010-04-10 13:42 . 2010-04-10 13:42 -------- d-----w- j:\program files\CCleaner
2010-04-10 12:32 . 2004-08-03 20:59 34688 -c--a-w- j:\windows\system32\dllcache\lbrtfdc.sys
2010-04-10 12:32 . 2004-08-03 20:59 34688 ----a-w- j:\windows\system32\drivers\lbrtfdc.sys
2010-04-10 12:32 . 2004-08-03 21:00 8192 -c--a-w- j:\windows\system32\dllcache\i2omgmt.sys
2010-04-10 12:32 . 2004-08-03 21:00 8192 ----a-w- j:\windows\system32\drivers\i2omgmt.sys
2010-04-10 12:31 . 2004-08-03 21:00 8192 -c--a-w- j:\windows\system32\dllcache\changer.sys
2010-04-10 12:31 . 2004-08-03 21:00 8192 ----a-w- j:\windows\system32\drivers\changer.sys
2010-03-27 11:08 . 2010-03-27 11:14 -------- d-----w- j:\program files\WinHugs
2010-03-23 19:16 . 2010-03-23 19:20 -------- d-----w- J:\jason
2010-03-23 12:29 . 2010-03-23 12:29 -------- d-----w- j:\program files\Sun
2010-03-23 12:23 . 2010-03-23 12:23 -------- d-----w- j:\program files\Common Files\Java
2010-03-23 12:19 . 2010-03-23 12:19 -------- d-----w- j:\documents and settings\Kamil\.jason
2010-03-23 12:19 . 2010-04-06 07:00 -------- d-----w- j:\documents and settings\Kamil\.jedit
2010-03-19 16:10 . 2010-03-19 16:10 -------- d-----w- j:\program files\OUP
2010-03-15 08:16 . 2004-08-17 14:49 221184 ----a-w- j:\windows\system32\wmpns.dll
2010-03-14 09:50 . 2010-03-14 09:50 -------- d-----w- j:\program files\QuickTime
2010-03-14 09:50 . 2010-03-14 09:50 -------- d-----w- j:\program files\Xilisoft
2010-03-14 09:40 . 2010-03-14 09:41 -------- d-----w- j:\program files\AVI WMV MPEG Converter
2010-03-13 10:26 . 2010-03-13 10:26 -------- d-----w- j:\program files\Vitware

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-11 08:49 . 2009-04-02 18:29 16608 ----a-w- j:\windows\gdrv.sys
2010-04-11 07:57 . 2009-04-02 17:40 -------- d-----w- j:\program files\Mozilla Thunderbird
2010-04-07 11:44 . 2009-09-07 16:16 -------- d-----w- j:\program files\EA Sports
2010-03-28 10:44 . 2009-04-02 18:30 -------- d--h--w- j:\program files\InstallShield Installation Information
2010-03-23 12:28 . 2009-07-19 14:46 -------- d-----w- j:\program files\Java
2010-03-10 16:12 . 2009-08-12 15:45 -------- d-----w- j:\program files\Gothic III
2010-03-09 19:13 . 2010-03-09 19:13 -------- d-----w- j:\program files\Font Xplorer
2010-03-06 12:11 . 2010-03-06 11:46 -------- d-----w- j:\program files\Ad Muncher
2010-02-24 15:33 . 2010-02-24 15:33 -------- d-----w- j:\program files\Farm Frenzy 2
2010-02-23 19:56 . 2010-02-23 19:56 -------- d-----w- j:\program files\Microsoft Silverlight
2010-02-19 12:53 . 2010-02-19 12:53 -------- d-----w- j:\program files\Ventrilo
2010-02-19 12:52 . 2009-04-02 18:28 -------- d-----w- j:\program files\Common Files\Wise Installation Wizard
2010-02-13 21:32 . 2010-02-13 21:32 -------- d-----w- j:\program files\URUSoft
2010-02-13 14:09 . 2010-02-13 13:21 -------- d-----w- j:\program files\Tomb Raider - Legend
2010-02-08 17:28 . 2010-02-08 17:28 56 ---ha-w- j:\windows\system32\ezsidmv.dat
2010-01-28 20:40 . 2010-01-28 20:40 108144 ----a-w- j:\windows\system32\CmdLineExt.dll
2010-01-27 09:18 . 2010-01-25 11:01 15880 ----a-w- j:\windows\system32\lsdelete.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 17:55 85768 ----a-w- j:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 17:55 85768 ----a-w- j:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 17:55 85768 ----a-w- j:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 17:55 85768 ----a-w- j:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 17:55 85768 ----a-w- j:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 17:55 85768 ----a-w- j:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 17:55 85768 ----a-w- j:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 17:55 85768 ----a-w- j:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2009-08-13 17:55 85768 ----a-w- j:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinFast Schedule"="c:\program files\WinFast\WFDTV\WFWIZ.exe" [2009-01-12 2908160]
"DAEMON Tools Lite"="j:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="m‘|\ü" [X]
"NvCplDaemon"="j:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"nwiz"="nwiz.exe" [2008-10-07 1630208]
"NvMediaCenter"="j:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"Adobe Reader Speed Launcher"="j:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"WinFastDTV"="c:\program files\WinFast\WFDTV\DTVSchdl.exe" [2009-01-16 90112]
"ArcSoft Connection Service"="j:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]
"RTHDCPL"="RTHDCPL.EXE" [2009-03-24 17567744]
"HP Software Update"="j:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"avast!"="j:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"AdobeCS4ServiceManager"="j:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"NeroFilterCheck"="j:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"GrooveMonitor"="j:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 101136]
"Malwarebytes Anti-Malware (reboot)"="j:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SunJavaUpdateSched"="j:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Ad Muncher"="j:\program files\Ad Muncher\AdMunch.exe" [2010-03-06 7168]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="j:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

j:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Logitech SetPoint.lnk - j:\program files\Logitech\SetPoint\SetPoint.exe [2009-10-2 688128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"j:\\wincmd\\WINCMD32.EXE"=
"j:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"j:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"j:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"j:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"j:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"j:\\Program Files\\Java\\jdk1.6.0_17\\bin\\java.exe"=
"j:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
"j:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"j:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"j:\\Program Files\\Skype\\Phone\\Skype.exe"=
"j:\\Program Files\\Ad Muncher\\AdMunch.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"4444:UDP"= 4444:UDP:stream

S0 Lbd;Lbd;j:\windows\system32\DRIVERS\Lbd.sys [2009-12-02 64288]
S0 sptd;sptd;j:\windows\System32\Drivers\sptd.sys [2009-09-30 722416]
S1 aswSP;avast! Self Protection; [x]
S1 oreans32;oreans32;j:\windows\system32\drivers\oreans32.sys [2009-04-02 33824]
S2 aswFsBlk;aswFsBlk;j:\windows\system32\DRIVERS\aswFsBlk.sys [2009-11-24 20560]
S2 GEST Service;GEST Service for program management.;j:\program files\GIGABYTE\EnergySaver\GSvr.exe [2008-05-13 80392]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;j:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-02-04 1181328]
S3 WFLR6654;WinFast DTV1800 H (XC4000);j:\windows\system32\drivers\wfeaglxt.sys [2008-12-25 433792]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-02-26 12:06 451872 ----a-w- j:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'

2010-04-11 j:\windows\Tasks\Ad-Aware Update (Daily 1).job
- j:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 15:07]

2010-04-11 j:\windows\Tasks\Ad-Aware Update (Daily 2).job
- j:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 15:07]

2010-04-11 j:\windows\Tasks\Ad-Aware Update (Daily 3).job
- j:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 15:07]

2010-04-11 j:\windows\Tasks\Ad-Aware Update (Daily 4).job
- j:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 15:07]

2010-04-11 j:\windows\Tasks\Ad-Aware Update (Weekly).job
- j:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 15:07]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.daemon-search.com/startpage
uInternet Settings,ProxyOverride = local
IE: E&xportovat do aplikace Microsoft Excel - j:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - j:\documents and settings\Kamil\Data aplikací\Mozilla\Firefox\Profiles\blhmg4zl.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll

---- NASTAVENÍ FIREFOXU ----
j:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
j:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
j:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
j:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
j:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
j:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
j:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
j:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
j:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
j:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
j:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
j:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
j:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
j:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
j:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
j:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
j:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
j:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
j:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
j:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
j:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
j:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
j:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
j:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
j:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
j:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
j:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
j:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
j:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
j:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
j:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
j:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
j:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
j:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
j:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
j:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
j:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
.
------- Asociace souborů -------
.
txtfile="j:\program files\PSPad editor\PSPad.exe" "%1"
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-AdobeBridge - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-11 10:49
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A8E11F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba90cfc3
\Driver\ACPI -> ACPI.sys @ 0xba666cb8
\Driver\atapi -> 0x8a8e11f8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058236c
ParseProcedure -> ntkrnlpa.exe @ 0x8058146a
NDIS: Realtek RTL8168C(P)/8111C(P) PCI-E Gigabit Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xba505ba0
PacketIndicateHandler -> NDIS.sys @ 0xba512b21
SendHandler -> NDIS.sys @ 0xba4f087b
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1547161642-492894223-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:e9,55,c9,2e,f0,da,85,f5,7b,61,03,97,61,69,18,f9,d4,4c,16,99,cb,ff,aa,
bd,76,d2,9b,c4,2b,ce,a8,fd,43,15,0d,b8,0c,1c,3a,1a,d0,33,97,3b,6d,21,6f,ee,\
"??"=hex:6c,2e,b7,a3,77,a5,cb,3a,7d,73,00,fd,4a,05,9d,68
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(940)
j:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(4368)
j:\program files\Ad Muncher\AdMunch.dll
j:\program files\Logitech\SetPoint\lgscroll.dll
j:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
j:\program files\TortoiseSVN\bin\TortoiseStub.dll
j:\program files\TortoiseSVN\bin\TortoiseSVN.dll
j:\program files\TortoiseSVN\bin\intl3_tsvn.dll
j:\windows\system32\msi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
j:\program files\Alwil Software\Avast4\aswUpdSv.exe
j:\program files\Alwil Software\Avast4\ashServ.exe
j:\program files\TortoiseSVN\bin\TSVNCache.exe
j:\windows\system32\RUNDLL32.EXE
j:\windows\RTHDCPL.EXE
j:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
j:\program files\Common Files\Logitech\khalshared\KHALMNPR.EXE
j:\program files\Java\jre6\bin\jqs.exe
j:\program files\Common Files\LightScribe\LSSrvc.exe
j:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
j:\windows\system32\nvsvc32.exe
j:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
j:\windows\system32\wdfmgr.exe
j:\program files\Alwil Software\Avast4\ashMaiSv.exe
j:\program files\Alwil Software\Avast4\ashWebSv.exe
j:\windows\system32\wscntfy.exe
j:\program files\Lavasoft\Ad-Aware\AAWTray.exe
j:\program files\Common Files\Java\Java Update\jucheck.exe
.
**************************************************************************
.
Celkový čas: 2010-04-11 10:54:50 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-04-11 08:54

Před spuštěním: Volných bajtů: 14 468 034 560
Po spuštění: Volných bajtů: 14 422 548 480

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(1)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

Current=3 Default=3 Failed=2 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - B2B982A1154627A8F6CD40CC51E55D55

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

Collect::
j:\windows\system32\drivers\oreans32.sys

Driver::
oreans32

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.