PC rozesílá spam

[baapee]

Dobrý den,
pomohl by někdo s počítačem, který odesílá neustále spam. Připojuji log z RSIT
předem moc děkuji


Microsoft® Windows Vista™ Business Service Pack 2
System drive C: has 18 GB (29%) free of 62 GB
Total RAM: 1015 MB (16% free)

HijackThis download failed

======Scheduled tasks folder======

C:\windows\tasks\User_Feed_Synchronization-{5491C056-4170-4FC1-8B7C-248A2EECF16D}.job
C:\windows\tasks\User_Feed_Synchronization-{B3177933-2829-4A4E-9D67-18FE13A2701E}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0\bin\ssv.dll [2007-07-18 501384]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"RtHDVCpl"=C:\windows\RtHDVCpl.exe [2006-11-09 3784704]
"PDF Complete"=C:\Program Files\PDF Complete\pdfsty.exe [2007-04-13 331552]
"SetRefresh"=C:\Program Files\HP\SetRefresh\SetRefresh.exe [2003-11-20 525824]
"IgfxTray"=C:\windows\system32\igfxtray.exe [2008-01-02 141848]
"HotKeysCmds"=C:\windows\system32\hkcmd.exe [2008-01-02 166424]
"Persistence"=C:\windows\system32\igfxpers.exe [2008-01-02 133656]
"Windows Mobile Device Center"=C:\windows\WindowsMobile\wmdc.exe [2007-05-31 648072]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-05-27 413696]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2010-04-07 2145000]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ST Recovery Launcher"=C:\windows\SMINST\launcher.exe [2007-03-07 44168]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]

C:\Users\Valek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
OpenOffice.org 2.2.lnk - C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2008-01-02 200704]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4b01bca-95c4-11dd-a7c5-001b783e8400}]
shell\AutoRun\command - G:\WD_Windows_Tools\Setup.exe


======File associations======

.js - edit - C:\windows\System32\Notepad.exe %1
.js - open - C:\windows\System32\WScript.exe "%1" %*
.reg - open - "regedit.exe" "%1"

======List of files/folders created in the last 1 months======

2010-05-26 07:55:47 ----D---- C:\Program Files\trend micro
2010-05-26 07:55:46 ----D---- C:\rsit
2010-05-26 07:54:20 ----D---- C:\ven
2010-05-25 15:26:52 ----D---- C:\Program Files\FileHippo.com
2010-05-25 15:19:14 ----D---- C:\Program Files\CCleaner
2010-05-24 13:52:14 ----D---- C:\Program Files\Windows Portable Devices
2010-05-24 13:24:10 ----A---- C:\windows\system32\UIRibbonRes.dll
2010-05-24 13:24:10 ----A---- C:\windows\system32\UIAnimation.dll
2010-05-24 13:24:09 ----A---- C:\windows\system32\UIRibbon.dll
2010-05-24 13:23:37 ----A---- C:\windows\system32\WMPhoto.dll
2010-05-24 13:23:35 ----A---- C:\windows\system32\cdd.dll
2010-05-24 13:23:34 ----A---- C:\windows\system32\XpsRasterService.dll
2010-05-24 13:23:34 ----A---- C:\windows\system32\XpsGdiConverter.dll
2010-05-24 13:23:34 ----A---- C:\windows\system32\printfilterpipelineprxy.dll
2010-05-24 13:23:34 ----A---- C:\windows\system32\d3d10warp.dll
2010-05-24 13:23:33 ----A---- C:\windows\system32\xpsservices.dll
2010-05-24 13:23:33 ----A---- C:\windows\system32\XpsPrint.dll
2010-05-24 13:23:33 ----A---- C:\windows\system32\WindowsCodecsExt.dll
2010-05-24 13:23:33 ----A---- C:\windows\system32\WindowsCodecs.dll
2010-05-24 13:23:33 ----A---- C:\windows\system32\printfilterpipelinesvc.exe
2010-05-24 13:23:33 ----A---- C:\windows\system32\PhotoMetadataHandler.dll
2010-05-24 13:23:33 ----A---- C:\windows\system32\OpcServices.dll
2010-05-24 13:23:33 ----A---- C:\windows\system32\FntCache.dll
2010-05-24 13:23:33 ----A---- C:\windows\system32\dxgi.dll
2010-05-24 13:23:33 ----A---- C:\windows\system32\dxdiagn.dll
2010-05-24 13:23:33 ----A---- C:\windows\system32\dxdiag.exe
2010-05-24 13:23:33 ----A---- C:\windows\system32\DWrite.dll
2010-05-24 13:23:33 ----A---- C:\windows\system32\d3d11.dll
2010-05-24 13:23:33 ----A---- C:\windows\system32\d3d10level9.dll
2010-05-24 13:23:33 ----A---- C:\windows\system32\d3d10core.dll
2010-05-24 13:23:33 ----A---- C:\windows\system32\d3d10_1core.dll
2010-05-24 13:23:33 ----A---- C:\windows\system32\d3d10_1.dll
2010-05-24 13:23:33 ----A---- C:\windows\system32\d2d1.dll
2010-05-24 13:23:32 ----A---- C:\windows\system32\d3d10.dll
2010-05-24 13:23:04 ----A---- C:\windows\system32\WPDShextAutoplay.exe
2010-05-24 13:23:04 ----A---- C:\windows\system32\wpdbusenum.dll
2010-05-24 13:23:04 ----A---- C:\windows\system32\BthMtpContextHandler.dll
2010-05-24 13:23:01 ----A---- C:\windows\system32\PortableDeviceConnectApi.dll
2010-05-24 13:22:58 ----A---- C:\windows\system32\WpdMtpUS.dll
2010-05-24 13:22:58 ----A---- C:\windows\system32\WpdConns.dll
2010-05-24 13:22:57 ----A---- C:\windows\system32\WPDSp.dll
2010-05-24 13:22:57 ----A---- C:\windows\system32\WPDShServiceObj.dll
2010-05-24 13:22:57 ----A---- C:\windows\system32\wpdshext.dll
2010-05-24 13:22:57 ----A---- C:\windows\system32\WpdMtp.dll
2010-05-24 13:22:57 ----A---- C:\windows\system32\wpd_ci.dll
2010-05-24 13:22:57 ----A---- C:\windows\system32\PortableDeviceWMDRM.dll
2010-05-24 13:22:57 ----A---- C:\windows\system32\PortableDeviceTypes.dll
2010-05-24 13:22:57 ----A---- C:\windows\system32\PortableDeviceClassExtension.dll
2010-05-24 13:22:57 ----A---- C:\windows\system32\PortableDeviceApi.dll
2010-05-24 13:21:47 ----A---- C:\windows\system32\oleaccrc.dll
2010-05-24 13:21:42 ----A---- C:\windows\system32\UIAutomationCore.dll
2010-05-24 13:21:42 ----A---- C:\windows\system32\oleacc.dll
2010-05-24 13:17:28 ----A---- C:\windows\system32\gameux.dll
2010-05-24 13:17:25 ----A---- C:\windows\system32\Apphlpdm.dll
2010-05-24 13:17:24 ----A---- C:\windows\system32\GameUXLegacyGDFs.dll
2010-05-24 12:55:24 ----A---- C:\windows\system32\vbscript.dll
2010-05-24 12:55:18 ----A---- C:\windows\system32\jscript.dll
2010-05-24 12:34:58 ----D---- C:\windows\system32\eu-ES
2010-05-24 12:34:58 ----D---- C:\windows\system32\ca-ES
2010-05-24 12:34:53 ----D---- C:\windows\system32\vi-VN
2010-05-24 11:39:42 ----D---- C:\windows\system32\EventProviders
2010-05-24 11:33:23 ----D---- C:\ProgramData\Spybot - Search & Destroy
2010-05-24 11:33:23 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-05-24 11:11:10 ----SHD---- C:\Config.Msi
2010-05-24 11:08:09 ----A---- C:\windows\system32\mstime.dll
2010-05-24 11:08:08 ----A---- C:\windows\system32\occache.dll
2010-05-24 11:08:08 ----A---- C:\windows\system32\jsproxy.dll
2010-05-24 11:08:08 ----A---- C:\windows\system32\iepeers.dll
2010-05-24 11:08:07 ----A---- C:\windows\system32\msfeedsbs.dll
2010-05-24 11:08:07 ----A---- C:\windows\system32\msfeeds.dll
2010-05-24 11:08:07 ----A---- C:\windows\system32\ieui.dll
2010-05-24 11:08:06 ----A---- C:\windows\system32\wininet.dll
2010-05-24 11:08:06 ----A---- C:\windows\system32\iesetup.dll
2010-05-24 11:08:06 ----A---- C:\windows\system32\iernonce.dll
2010-05-24 11:08:05 ----A---- C:\windows\system32\msfeedssync.exe
2010-05-24 11:08:05 ----A---- C:\windows\system32\ie4uinit.exe
2010-05-24 11:08:04 ----A---- C:\windows\system32\iertutil.dll
2010-05-24 11:08:04 ----A---- C:\windows\system32\iedkcs32.dll
2010-05-24 11:08:02 ----A---- C:\windows\system32\urlmon.dll
2010-05-24 11:08:02 ----A---- C:\windows\system32\ieUnatt.exe
2010-05-24 11:08:02 ----A---- C:\windows\system32\iesysprep.dll
2010-05-24 11:08:01 ----A---- C:\windows\system32\ieframe.dll
2010-05-24 11:08:00 ----A---- C:\windows\system32\mshtml.dll
2010-05-24 11:04:46 ----A---- C:\windows\system32\mshtmler.dll
2010-05-24 11:04:46 ----A---- C:\windows\system32\mshtmled.dll
2010-05-24 11:04:46 ----A---- C:\windows\system32\icardie.dll
2010-05-24 11:04:46 ----A---- C:\windows\system32\admparse.dll
2010-05-24 11:04:45 ----A---- C:\windows\system32\msls31.dll
2010-05-24 11:04:45 ----A---- C:\windows\system32\corpol.dll
2010-05-24 11:04:44 ----A---- C:\windows\system32\imgutil.dll
2010-05-24 11:04:44 ----A---- C:\windows\system32\ieakeng.dll
2010-05-24 11:04:44 ----A---- C:\windows\system32\dxtrans.dll
2010-05-24 11:04:44 ----A---- C:\windows\system32\dxtmsft.dll
2010-05-24 11:04:43 ----A---- C:\windows\system32\WinFXDocObj.exe
2010-05-24 11:04:43 ----A---- C:\windows\system32\wextract.exe
2010-05-24 11:04:43 ----A---- C:\windows\system32\webcheck.dll
2010-05-24 11:04:43 ----A---- C:\windows\system32\msrating.dll
2010-05-24 11:04:43 ----A---- C:\windows\system32\licmgr10.dll
2010-05-24 11:04:43 ----A---- C:\windows\system32\inseng.dll
2010-05-24 11:04:43 ----A---- C:\windows\system32\ieakui.dll
2010-05-24 11:04:43 ----A---- C:\windows\system32\ieaksie.dll
2010-05-24 11:04:42 ----A---- C:\windows\system32\pngfilt.dll
2010-05-24 11:04:42 ----A---- C:\windows\system32\ieapfltr.dll
2010-05-24 11:04:42 ----A---- C:\windows\system32\advpack.dll
2010-05-24 11:04:41 ----A---- C:\windows\system32\url.dll
2010-05-24 11:04:38 ----A---- C:\windows\system32\mshta.exe
2010-05-24 11:04:38 ----A---- C:\windows\system32\iexpress.exe
2010-05-24 11:04:37 ----A---- C:\windows\system32\SetIEInstalledDate.exe
2010-05-24 11:04:37 ----A---- C:\windows\system32\SetDepNx.exe
2010-05-24 11:04:37 ----A---- C:\windows\system32\RegisterIEPKEYs.exe
2010-05-24 11:04:37 ----A---- C:\windows\system32\PDMSetup.exe
2010-05-24 10:49:39 ----D---- C:\ProgramData\ESET
2010-05-12 01:34:02 ----A---- C:\windows\system32\inetcomm.dll

======List of files/folders modified in the last 1 months======

2010-05-26 07:55:47 ----RD---- C:\Program Files
2010-05-26 07:55:47 ----D---- C:\windows\Prefetch
2010-05-26 07:55:43 ----D---- C:\windows\Temp
2010-05-26 02:16:55 ----SHD---- C:\System Volume Information
2010-05-25 15:36:00 ----D---- C:\windows\Debug
2010-05-25 15:36:00 ----D---- C:\Windows
2010-05-25 15:21:01 ----D---- C:\windows\System32
2010-05-25 15:21:01 ----A---- C:\windows\system32\PerfStringBackup.INI
2010-05-25 15:21:00 ----D---- C:\windows\inf
2010-05-25 15:17:20 ----D---- C:\Users\Valek\AppData\Roaming\OpenOffice.org2
2010-05-25 15:16:53 ----D---- C:\windows\SMINST
2010-05-24 14:48:24 ----D---- C:\windows\system32\drivers
2010-05-24 14:30:06 ----D---- C:\windows\rescache
2010-05-24 14:14:15 ----SD---- C:\windows\Downloaded Program Files
2010-05-24 13:59:09 ----D---- C:\windows\Microsoft.NET
2010-05-24 13:59:08 ----RSD---- C:\windows\assembly
2010-05-24 13:56:11 ----D---- C:\windows\system32\Tasks
2010-05-24 13:52:16 ----D---- C:\windows\system32\cs-CZ
2010-05-24 13:52:14 ----D---- C:\windows\system32\wbem
2010-05-24 13:52:10 ----D---- C:\windows\system32\uk-UA
2010-05-24 13:52:10 ----D---- C:\windows\system32\pt-PT
2010-05-24 13:52:10 ----D---- C:\windows\system32\pt-BR
2010-05-24 13:52:10 ----D---- C:\windows\system32\pl-PL
2010-05-24 13:52:10 ----D---- C:\windows\system32\ko-KR
2010-05-24 13:52:10 ----D---- C:\windows\system32\it-IT
2010-05-24 13:52:10 ----D---- C:\windows\system32\hu-HU
2010-05-24 13:52:10 ----D---- C:\windows\system32\hr-HR
2010-05-24 13:52:10 ----D---- C:\windows\system32\he-IL
2010-05-24 13:52:10 ----D---- C:\windows\system32\bg-BG
2010-05-24 13:52:09 ----D---- C:\windows\system32\zh-TW
2010-05-24 13:52:09 ----D---- C:\windows\system32\zh-HK
2010-05-24 13:52:09 ----D---- C:\windows\system32\zh-CN
2010-05-24 13:52:09 ----D---- C:\windows\system32\tr-TR
2010-05-24 13:52:09 ----D---- C:\windows\system32\th-TH
2010-05-24 13:52:09 ----D---- C:\windows\system32\sv-SE
2010-05-24 13:52:09 ----D---- C:\windows\system32\sr-Latn-CS
2010-05-24 13:52:09 ----D---- C:\windows\system32\sl-SI
2010-05-24 13:52:09 ----D---- C:\windows\system32\sk-SK
2010-05-24 13:52:09 ----D---- C:\windows\system32\ru-RU
2010-05-24 13:52:09 ----D---- C:\windows\system32\ro-RO
2010-05-24 13:52:09 ----D---- C:\windows\system32\nl-NL
2010-05-24 13:52:09 ----D---- C:\windows\system32\nb-NO
2010-05-24 13:52:09 ----D---- C:\windows\system32\lv-LV
2010-05-24 13:52:09 ----D---- C:\windows\system32\lt-LT
2010-05-24 13:52:09 ----D---- C:\windows\system32\ja-JP
2010-05-24 13:52:09 ----D---- C:\windows\system32\fr-FR
2010-05-24 13:52:09 ----D---- C:\windows\system32\fi-FI
2010-05-24 13:52:09 ----D---- C:\windows\system32\et-EE
2010-05-24 13:52:09 ----D---- C:\windows\system32\es-ES
2010-05-24 13:52:09 ----D---- C:\windows\system32\en-US
2010-05-24 13:52:09 ----D---- C:\windows\system32\el-GR
2010-05-24 13:52:09 ----D---- C:\windows\system32\de-DE
2010-05-24 13:52:09 ----D---- C:\windows\system32\da-DK
2010-05-24 13:52:09 ----D---- C:\windows\system32\ar-SA
2010-05-24 13:52:06 ----D---- C:\windows\AppPatch
2010-05-24 13:24:21 ----D---- C:\windows\winsxs
2010-05-24 13:24:20 ----D---- C:\windows\system32\catroot
2010-05-24 13:23:22 ----D---- C:\windows\system32\catroot2
2010-05-24 12:59:01 ----HD---- C:\ProgramData
2010-05-24 12:45:27 ----SHD---- C:\boot
2010-05-24 12:37:31 ----D---- C:\Program Files\Windows Calendar
2010-05-24 12:37:30 ----D---- C:\Program Files\Windows Sidebar
2010-05-24 12:37:30 ----D---- C:\Program Files\Windows Mail
2010-05-24 12:37:30 ----D---- C:\Program Files\Movie Maker
2010-05-24 12:37:29 ----D---- C:\Program Files\Windows Media Player
2010-05-24 12:37:29 ----D---- C:\Program Files\Windows Collaboration
2010-05-24 12:37:29 ----D---- C:\Program Files\Internet Explorer
2010-05-24 12:37:28 ----D---- C:\Program Files\Windows Journal
2010-05-24 12:37:27 ----D---- C:\Program Files\Windows Photo Gallery
2010-05-24 12:37:27 ----D---- C:\Program Files\Common Files\System
2010-05-24 12:37:22 ----D---- C:\windows\servicing
2010-05-24 12:37:22 ----D---- C:\Program Files\Windows Defender
2010-05-24 12:36:59 ----D---- C:\windows\PolicyDefinitions
2010-05-24 12:36:59 ----D---- C:\windows\IME
2010-05-24 12:36:57 ----D---- C:\windows\system32\XPSViewer
2010-05-24 12:36:55 ----D---- C:\windows\system32\oobe
2010-05-24 12:36:55 ----D---- C:\windows\system32\migration
2010-05-24 12:36:50 ----D---- C:\windows\system32\AdvancedInstallers
2010-05-24 12:36:49 ----D---- C:\windows\system32\setup
2010-05-24 12:36:49 ----D---- C:\windows\system32\cs
2010-05-24 12:36:38 ----D---- C:\windows\system32\SLUI
2010-05-24 12:36:37 ----D---- C:\windows\system32\manifeststore
2010-05-24 12:36:26 ----D---- C:\windows\system32\migwiz
2010-05-24 12:35:11 ----RSD---- C:\windows\Fonts
2010-05-24 12:34:53 ----D---- C:\windows\system32\Boot
2010-05-24 11:14:17 ----D---- C:\windows\system32\appmgmt
2010-05-24 11:11:45 ----SHD---- C:\windows\Installer
2010-05-24 11:11:36 ----D---- C:\Program Files\Common Files
2010-05-24 11:11:29 ----D---- C:\ProgramData\Skype
2010-05-24 11:09:19 ----D---- C:\Program Files\Valve
2010-05-24 10:52:41 ----D---- C:\Program Files\ESET
2010-05-21 11:55:01 ----SD---- C:\Users\Valek\AppData\Roaming\Microsoft
2010-05-12 11:21:16 ----N---- C:\windows\system32\MpSigStub.exe
2010-04-30 20:51:06 ----A---- C:\windows\system32\mrt.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 CSC;Offline Files Driver; C:\windows\system32\drivers\csc.sys [2009-04-11 351744]
R1 ehdrv;ehdrv; C:\windows\system32\DRIVERS\ehdrv.sys [2010-04-07 114984]
R2 eamonm;eamonm; C:\windows\system32\DRIVERS\eamonm.sys [2010-04-07 133512]
R2 epfwwfpr;epfwwfpr; C:\windows\system32\DRIVERS\epfwwfpr.sys [2010-04-07 96896]
R3 b57nd60x;%SvcDispName%; C:\windows\system32\DRIVERS\b57nd60x.sys [2008-01-19 179712]
R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd32.sys [2008-01-02 2016256]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHDA.sys [2006-11-08 1647976]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\windows\system32\DRIVERS\wmiacpi.sys [2008-01-19 11264]
R3 WUDFRd;WUDFRd; C:\windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S3 BthEnum;Služba Bluetooth Enumerator; C:\windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\windows\system32\DRIVERS\bthpan.sys [2008-01-19 92160]
S3 BTHPORT;Ovladač portu Bluetooth; C:\windows\System32\Drivers\BTHport.sys [2009-04-11 507904]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\windows\System32\Drivers\BTHUSB.sys [2009-04-11 29696]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 PSSDK42;PSSDK42; \??\C:\windows\system32\Drivers\pssdk42.sys [2010-05-24 38976]
S3 PSSDKLBF;PSSDKLBF; \??\C:\windows\system32\Drivers\pssdklbf.sys [2010-05-24 53312]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\windows\system32\DRIVERS\rfcomm.sys [2009-04-11 148992]
S3 usb_rndisx;Adaptér USB RNDIS; C:\windows\system32\DRIVERS\usb8023x.sys [2008-01-19 15872]
S3 WimFltr;WimFltr; C:\windows\system32\DRIVERS\wimfltr.sys [2006-11-02 128104]
S3 WINUSB;Ovladač WinUsb; C:\windows\system32\DRIVERS\WinUSB.SYS [2008-01-19 31616]
S3 WpdUsb;WpdUsb; C:\windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\windows\system32\svchost.exe [2008-01-19 21504]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\windows\System32\svchost.exe [2008-01-19 21504]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-04-07 810120]
R2 iprip;@%Systemroot%\system32\iprip.dll,-200; C:\windows\System32\svchost.exe [2008-01-19 21504]
R2 IviRegMgr;IviRegMgr; C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe [2007-01-04 112152]
R2 LPDSVC;@%systemroot%\system32\lpdsvc.dll,-500; C:\windows\System32\svchost.exe [2008-01-19 21504]
R2 pdfcDispatcher;PDF Document Manager; C:\Program Files\PDF Complete\pdfsvc.exe [2007-04-13 540448]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\windows\system32\svchost.exe [2008-01-19 21504]
R2 simptcp;@%SystemRoot%\system32\simptcp.dll,-200; C:\windows\System32\tcpsvcs.exe [2009-08-14 9728]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\windows\system32\svchost.exe [2008-01-19 21504]
S3 AppMgmt;@appmgmts.dll,-3250; C:\windows\system32\svchost.exe [2008-01-19 21504]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2010-04-07 33560]
S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\windows\system32\fxssvc.exe [2008-01-19 523776]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\windows\system32\svchost.exe [2008-01-19 21504]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\windows\System32\svchost.exe [2008-01-19 21504]
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\windows\system32\wbengine.exe [2009-04-11 918528]

-----------------EOF-----------------

[JaRon]

prescanuj PC s MBAM

[baapee]

posílám dva logy - poprvé jsem pustil sken bez aktualizace

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4052

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18904

26.5.2010 9:32:30
mbam-log-2010-05-26 (09-32-30).txt

Typ skenu: Rychlý sken
Skenované objekty: 9987
Uplynulý čas: 1 minuta(y), 59 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 1
Infikované hodnoty registru: 0
Infikované datové položky registru: 1
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken.

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> No action taken.

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

____________________________________________________________________________________________-

a následný sken

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4144

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18904

26.5.2010 9:41:47
mbam-log-2010-05-26 (09-41-47).txt

Typ skenu: Rychlý sken
Skenované objekty: 132824
Uplynulý čas: 5 minuta(y), 32 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\windows\system32\Drivers\ctgioxf.sys (Rootkit.Agent) -> No action taken.

[JaRon]

nuz rootkit zmaz - restart - zopakuj kontrolu s MBAM - daj uplnu kontrolu a napis ci este spamuje

[baapee]

SPam vypadá že to už nerozesílá, ale snaží se pořád přistupovat na 96.0.203.122 a 66.79.162.138 na port 80.
MBAM pořád běží zatím nic nenašel

[JaRon]

potom pre istotu:
stiahni a uloz na plochu ComboFix

potom spust pod uctom s administratorskym opravnenim


akcia trva cca. 5-10 minut, niekedy i dlhsie -, Pocas scanu nespustaj ziadne ine aplikacie

Nie je dovod na paniku ak stroj bude restartovany
upozornenie: ak pouzivas antispyware s rezidentnim stitem, ten pred scanom vypni.

po restarte aplikacie vytvori log, ulozeny na C:\Combofix.txt (jeho obsah vloz sem)

[baapee]

projel jsem znova ten MBAM a našel zase jeden rootkit .. docela dlouho to trvalo

níže potom ten log s combofixu


Malwarebytes' Anti-Malware 1.46
http://www.malwarebytes.org

Verze databáze: 4144

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18904

26.5.2010 12:08:27
mbam-log-2010-05-26 (12-08-27).txt

Typ skenu: Úplný sken (C:\|D:\|E:\|)
Skenované objekty: 342819
Uplynulý čas: 2 hodina(y), 15 minuta(y), 26 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\Windows\System32\drivers\ctgioxf.sys (Rootkit.Agent) -> No action taken.

__________________________________________________________________________________________


tady ten log z combofixu


ComboFix 10-05-25.03 - Valek 26.05.2010 12:20:09.1.2 - x86
Microsoft® Windows Vista™ Business 6.0.6002.2.1250.420.1029.18.1015.293 [GMT 2:00]
Spuštěný z: c:\users\Valek\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Valek\AppData\Roaming\Microsoft\Windows\Recent\. Řeznictví a občerstvení Červ Horoměřice . - Aktuální nabídka občerstvení.url
c:\users\Valek\AppData\Roaming\Microsoft\Windows\Recent\Diaporadna Andresová.url
c:\users\Valek\AppData\Roaming\Microsoft\Windows\Recent\Obec Brandýsek Všeobecné informace Výstavba.url
c:\users\Valek\AppData\Roaming\Microsoft\Windows\Recent\TV Barrandov odvysílá seriál Třicet případů majora Zemana – Novinky.cz.url
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_iprip


((((((((((((((((((((((((( Soubory vytvořené od 2010-04-26 do 2010-05-26 )))))))))))))))))))))))))))))))
.

2010-05-26 10:31 . 2010-05-26 10:31 -------- d-----w- c:\users\sochra\AppData\Local\temp
2010-05-26 10:31 . 2010-05-26 10:31 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-05-26 10:31 . 2010-05-26 10:31 -------- d-----w- c:\users\admin\AppData\Local\temp
2010-05-26 08:10 . 2010-05-26 08:10 -------- d-----w- c:\users\Valek\AppData\Roaming\Wireshark
2010-05-26 08:08 . 2010-05-26 08:08 -------- d-----w- c:\program files\WinPcap
2010-05-26 08:08 . 2010-05-26 08:09 -------- d-----w- c:\program files\Wireshark
2010-05-26 07:29 . 2010-05-26 07:29 -------- d-----w- c:\users\Valek\AppData\Roaming\Malwarebytes
2010-05-26 07:28 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-26 07:28 . 2010-05-26 07:28 -------- d-----w- c:\programdata\Malwarebytes
2010-05-26 07:28 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-26 07:28 . 2010-05-26 07:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-26 05:55 . 2010-05-26 05:55 -------- d-----w- c:\program files\trend micro
2010-05-26 05:55 . 2010-05-26 05:55 -------- d-----w- C:\rsit
2010-05-26 05:54 . 2010-05-26 05:54 -------- d-----w- C:\ven
2010-05-25 13:26 . 2010-05-25 13:26 -------- d-----w- c:\program files\FileHippo.com
2010-05-25 13:19 . 2010-05-25 13:19 -------- d-----w- c:\program files\CCleaner
2010-05-24 12:48 . 2010-05-24 12:48 53312 ----a-w- c:\windows\system32\drivers\pssdklbf.sys
2010-05-24 12:48 . 2010-05-24 12:48 38976 ----a-w- c:\windows\system32\drivers\pssdk42.sys
2010-05-24 11:52 . 2010-05-24 11:52 -------- d-----w- c:\program files\Windows Portable Devices
2010-05-24 11:24 . 2009-09-10 02:00 1164800 ----a-w- c:\windows\system32\UIRibbonRes.dll
2010-05-24 11:24 . 2009-09-10 02:00 92672 ----a-w- c:\windows\system32\UIAnimation.dll
2010-05-24 11:24 . 2009-09-10 02:01 3023360 ----a-w- c:\windows\system32\UIRibbon.dll
2010-05-24 11:22 . 2009-10-01 01:01 40448 ----a-w- c:\windows\system32\drivers\WpdUsb.sys
2010-05-24 11:22 . 2009-10-01 01:01 61952 ----a-w- c:\windows\system32\WpdMtpUS.dll
2010-05-24 11:22 . 2009-10-01 01:01 33280 ----a-w- c:\windows\system32\WpdConns.dll
2010-05-24 11:22 . 2009-10-01 01:02 2537472 ----a-w- c:\windows\system32\wpdshext.dll
2010-05-24 11:22 . 2009-10-01 01:02 334848 ----a-w- c:\windows\system32\PortableDeviceApi.dll
2010-05-24 11:22 . 2009-10-01 01:02 87552 ----a-w- c:\windows\system32\WPDShServiceObj.dll
2010-05-24 11:22 . 2009-10-01 01:01 546816 ----a-w- c:\windows\system32\wpd_ci.dll
2010-05-24 11:22 . 2009-10-01 01:01 160256 ----a-w- c:\windows\system32\PortableDeviceTypes.dll
2010-05-24 11:22 . 2009-10-01 01:01 350208 ----a-w- c:\windows\system32\WPDSp.dll
2010-05-24 11:22 . 2009-10-01 01:01 196608 ----a-w- c:\windows\system32\PortableDeviceWMDRM.dll
2010-05-24 11:22 . 2009-10-01 01:01 100864 ----a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2010-05-24 11:22 . 2009-10-01 01:01 226816 ----a-w- c:\windows\system32\WpdMtp.dll
2010-05-24 11:21 . 2009-10-08 21:07 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2010-05-24 11:21 . 2009-10-08 21:08 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2010-05-24 11:21 . 2009-10-08 21:08 234496 ----a-w- c:\windows\system32\oleacc.dll
2010-05-24 11:17 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll
2010-05-24 11:17 . 2010-01-06 15:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-05-24 11:17 . 2010-01-06 13:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-05-24 10:55 . 2010-03-05 14:01 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-05-24 10:34 . 2010-05-24 10:36 -------- d-----w- c:\windows\system32\ca-ES
2010-05-24 10:34 . 2010-05-24 10:36 -------- d-----w- c:\windows\system32\eu-ES
2010-05-24 10:34 . 2010-05-24 10:36 -------- d-----w- c:\windows\system32\vi-VN
2010-05-24 09:39 . 2010-05-24 09:39 -------- d-----w- c:\windows\system32\EventProviders
2010-05-24 09:33 . 2010-05-25 13:36 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-05-24 09:33 . 2010-05-24 09:35 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-05-24 09:04 . 2009-03-08 11:32 72704 ----a-w- c:\windows\system32\admparse.dll
2010-05-11 23:34 . 2010-01-29 15:40 738816 ----a-w- c:\windows\system32\inetcomm.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-26 10:40 . 2008-09-11 09:48 -------- d-----w- c:\users\Valek\AppData\Roaming\OpenOffice.org2
2010-05-26 10:37 . 2008-05-21 10:33 12 ----a-w- c:\windows\bthservsdp.dat
2010-05-26 10:16 . 2007-01-08 21:12 598600 ----a-w- c:\windows\system32\perfh005.dat
2010-05-26 10:16 . 2007-01-08 21:12 114808 ----a-w- c:\windows\system32\perfc005.dat
2010-05-24 11:51 . 2010-05-24 11:51 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-05-24 11:51 . 2010-05-24 11:51 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2010-05-24 10:37 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2010-05-24 10:37 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2010-05-24 10:37 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-05-24 10:37 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2010-05-24 10:37 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2010-05-24 10:37 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2010-05-24 10:37 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2010-05-24 09:11 . 2008-03-11 08:51 -------- d-----w- c:\programdata\Skype
2010-05-24 09:09 . 2009-02-18 07:21 -------- d-----w- c:\program files\Valve
2010-05-24 08:52 . 2007-08-17 06:15 -------- d-----w- c:\program files\ESET
2010-05-12 09:21 . 2009-10-02 22:27 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-04-09 13:33 . 2010-04-09 13:33 8 ----a-w- c:\users\Valek\AppData\Roaming\jnryao.dat
2010-04-07 19:08 . 2010-04-07 19:08 96896 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys
2010-04-07 19:07 . 2010-04-07 19:07 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-04-07 19:03 . 2010-04-07 19:03 133512 ----a-w- c:\windows\system32\drivers\eamonm.sys
2010-04-07 09:13 . 2010-04-07 09:13 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2007-07-18 13:06 . 2007-07-18 13:06 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2006-11-09 3784704]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2007-04-13 331552]
"SetRefresh"="c:\program files\HP\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-02 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-04-07 2145000]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"ST Recovery Launcher"="c:\windows\SMINST\launcher.exe" [2007-03-07 44168]

c:\users\Valek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 2.2.lnk - c:\program files\OpenOffice.org 2.2\program\quickstart.exe [2007-6-8 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):82,8c,6c,28,2e,fb,ca,01

R3 PSSDK42;PSSDK42;c:\windows\system32\Drivers\pssdk42.sys [2010-05-24 38976]
R3 PSSDKLBF;PSSDKLBF;c:\windows\system32\Drivers\pssdklbf.sys [2010-05-24 53312]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-04-07 114984]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-04-07 133512]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-04-07 810120]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2010-04-07 96896]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-10-20 50704]
S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2007-04-13 540448]
S3 b57nd60x;%SvcDispName%;c:\windows\system32\DRIVERS\b57nd60x.sys [2008-01-19 179712]


--- Ostatní služby/ovladače v paměti ---

*Deregistered* - ctgioxf

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
bthsvcs REG_MULTI_SZ BthServ
LPDService REG_MULTI_SZ LPDSVC
ipripsvc REG_MULTI_SZ iprip
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Obsah adresáře 'Naplánované úlohy'

2010-05-26 c:\windows\Tasks\User_Feed_Synchronization-{5491C056-4170-4FC1-8B7C-248A2EECF16D}.job
- c:\windows\system32\msfeedssync.exe [2010-05-24 04:54]

2010-05-26 c:\windows\Tasks\User_Feed_Synchronization-{B3177933-2829-4A4E-9D67-18FE13A2701E}.job
- c:\windows\system32\msfeedssync.exe [2010-05-24 04:54]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
TCP: {96F933CD-B026-492E-B581-34ADDF958176} = 194.228.2.1,194.228.2.61
FF - ProfilePath -
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-26 12:38
Windows 6.0.6002 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ctgioxf]

.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\windows\System32\tcpsvcs.exe
c:\windows\system32\conime.exe
c:\windows\SMINST\scheduler.exe
c:\windows\RtHDVCpl.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\OpenOffice.org 2.2\program\soffice.exe
c:\program files\OpenOffice.org 2.2\program\soffice.BIN
.
**************************************************************************
.
Celkový čas: 2010-05-26 12:49:05 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-05-26 10:49

Před spuštěním: Volných bajtů: 18 144 444 416
Po spuštění: Volných bajtů: 18 052 997 120

- - End Of File - - 25D9F19249EF90A2332F3D5759637762

[JaRon]

Presun ComboFix
na plochu (ak tam este nie je)

otvor si Poznamkovy blok - notepad

do neho zkopiruj skript z nasledujiceho okna:

Kód: Vybrat vše

Driver::
ctgioxf

File::
C:\Windows\System32\drivers\ctgioxf.sys 

uloz vytvoreny textovy soubor ako CFScript.txt na plochu

po ulozeni uchop vytvoreny skript lavym tlacitkom mysi a presun ho nad ikonu Combofixu, nad nim skript upust:



po aplikacii by mal vzniknut dalsi log, ten vloz sem

[baapee]

tu je

ComboFix 10-05-25.03 - Valek 26.05.2010 13:45:26.3.2 - x86
Microsoft® Windows Vista™ Business 6.0.6002.2.1250.420.1029.18.1015.283 [GMT 2:00]
Spuštěný z: c:\users\Valek\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Valek\Desktop\CFScript.TXT
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Rezidentní štít AV je zapnutý


FILE ::
"c:\windows\System32\drivers\ctgioxf.sys"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\System32\drivers\ctgioxf.sys

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CTGIOXF
-------\Service_ctgioxf


((((((((((((((((((((((((( Soubory vytvořené od 2010-04-26 do 2010-05-26 )))))))))))))))))))))))))))))))
.

2010-05-26 11:56 . 2010-05-26 11:56 -------- d-----w- c:\users\sochra\AppData\Local\temp
2010-05-26 11:56 . 2010-05-26 11:56 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-05-26 11:56 . 2010-05-26 11:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-05-26 11:56 . 2010-05-26 11:56 -------- d-----w- c:\users\admin\AppData\Local\temp
2010-05-26 11:24 . 2010-05-26 11:24 -------- d-----w- c:\users\Valek\AppData\Local\ESET
2010-05-26 08:10 . 2010-05-26 08:10 -------- d-----w- c:\users\Valek\AppData\Roaming\Wireshark
2010-05-26 08:08 . 2010-05-26 08:08 -------- d-----w- c:\program files\WinPcap
2010-05-26 08:08 . 2010-05-26 08:09 -------- d-----w- c:\program files\Wireshark
2010-05-26 07:29 . 2010-05-26 07:29 -------- d-----w- c:\users\Valek\AppData\Roaming\Malwarebytes
2010-05-26 07:28 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-26 07:28 . 2010-05-26 07:28 -------- d-----w- c:\programdata\Malwarebytes
2010-05-26 07:28 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-26 07:28 . 2010-05-26 07:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-26 05:55 . 2010-05-26 05:55 -------- d-----w- c:\program files\trend micro
2010-05-26 05:55 . 2010-05-26 05:55 -------- d-----w- C:\rsit
2010-05-26 05:54 . 2010-05-26 05:54 -------- d-----w- C:\ven
2010-05-25 13:26 . 2010-05-25 13:26 -------- d-----w- c:\program files\FileHippo.com
2010-05-25 13:19 . 2010-05-25 13:19 -------- d-----w- c:\program files\CCleaner
2010-05-24 12:48 . 2010-05-24 12:48 53312 ----a-w- c:\windows\system32\drivers\pssdklbf.sys
2010-05-24 12:48 . 2010-05-24 12:48 38976 ----a-w- c:\windows\system32\drivers\pssdk42.sys
2010-05-24 11:52 . 2010-05-24 11:52 -------- d-----w- c:\program files\Windows Portable Devices
2010-05-24 11:24 . 2009-09-10 02:00 1164800 ----a-w- c:\windows\system32\UIRibbonRes.dll
2010-05-24 11:24 . 2009-09-10 02:00 92672 ----a-w- c:\windows\system32\UIAnimation.dll
2010-05-24 11:24 . 2009-09-10 02:01 3023360 ----a-w- c:\windows\system32\UIRibbon.dll
2010-05-24 11:22 . 2009-10-01 01:01 40448 ----a-w- c:\windows\system32\drivers\WpdUsb.sys
2010-05-24 11:22 . 2009-10-01 01:01 61952 ----a-w- c:\windows\system32\WpdMtpUS.dll
2010-05-24 11:22 . 2009-10-01 01:01 33280 ----a-w- c:\windows\system32\WpdConns.dll
2010-05-24 11:22 . 2009-10-01 01:02 2537472 ----a-w- c:\windows\system32\wpdshext.dll
2010-05-24 11:22 . 2009-10-01 01:02 334848 ----a-w- c:\windows\system32\PortableDeviceApi.dll
2010-05-24 11:22 . 2009-10-01 01:02 87552 ----a-w- c:\windows\system32\WPDShServiceObj.dll
2010-05-24 11:22 . 2009-10-01 01:01 546816 ----a-w- c:\windows\system32\wpd_ci.dll
2010-05-24 11:22 . 2009-10-01 01:01 160256 ----a-w- c:\windows\system32\PortableDeviceTypes.dll
2010-05-24 11:22 . 2009-10-01 01:01 350208 ----a-w- c:\windows\system32\WPDSp.dll
2010-05-24 11:22 . 2009-10-01 01:01 196608 ----a-w- c:\windows\system32\PortableDeviceWMDRM.dll
2010-05-24 11:22 . 2009-10-01 01:01 100864 ----a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2010-05-24 11:22 . 2009-10-01 01:01 226816 ----a-w- c:\windows\system32\WpdMtp.dll
2010-05-24 11:21 . 2009-10-08 21:07 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2010-05-24 11:21 . 2009-10-08 21:08 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2010-05-24 11:21 . 2009-10-08 21:08 234496 ----a-w- c:\windows\system32\oleacc.dll
2010-05-24 11:17 . 2010-01-06 15:39 1696256 ----a-w- c:\windows\system32\gameux.dll
2010-05-24 11:17 . 2010-01-06 15:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2010-05-24 11:17 . 2010-01-06 13:30 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2010-05-24 10:55 . 2010-03-05 14:01 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-05-24 10:34 . 2010-05-24 10:36 -------- d-----w- c:\windows\system32\ca-ES
2010-05-24 10:34 . 2010-05-24 10:36 -------- d-----w- c:\windows\system32\eu-ES
2010-05-24 10:34 . 2010-05-24 10:36 -------- d-----w- c:\windows\system32\vi-VN
2010-05-24 09:39 . 2010-05-24 09:39 -------- d-----w- c:\windows\system32\EventProviders
2010-05-24 09:33 . 2010-05-25 13:36 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-05-24 09:33 . 2010-05-24 09:35 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-05-24 09:04 . 2009-03-08 11:32 72704 ----a-w- c:\windows\system32\admparse.dll
2010-05-11 23:34 . 2010-01-29 15:40 738816 ----a-w- c:\windows\system32\inetcomm.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-26 12:01 . 2008-09-11 09:48 -------- d-----w- c:\users\Valek\AppData\Roaming\OpenOffice.org2
2010-05-26 11:57 . 2008-05-21 10:33 12 ----a-w- c:\windows\bthservsdp.dat
2010-05-26 11:23 . 2007-01-08 21:12 598600 ----a-w- c:\windows\system32\perfh005.dat
2010-05-26 11:23 . 2007-01-08 21:12 114808 ----a-w- c:\windows\system32\perfc005.dat
2010-05-24 11:51 . 2010-05-24 11:51 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-05-24 11:51 . 2010-05-24 11:51 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2010-05-24 10:37 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2010-05-24 10:37 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2010-05-24 10:37 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-05-24 10:37 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2010-05-24 10:37 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2010-05-24 10:37 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2010-05-24 10:37 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2010-05-24 09:11 . 2008-03-11 08:51 -------- d-----w- c:\programdata\Skype
2010-05-24 09:09 . 2009-02-18 07:21 -------- d-----w- c:\program files\Valve
2010-05-24 08:52 . 2007-08-17 06:15 -------- d-----w- c:\program files\ESET
2010-05-12 09:21 . 2009-10-02 22:27 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-04-09 13:33 . 2010-04-09 13:33 8 ----a-w- c:\users\Valek\AppData\Roaming\jnryao.dat
2010-04-07 19:08 . 2010-04-07 19:08 96896 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys
2010-04-07 19:07 . 2010-04-07 19:07 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-04-07 19:03 . 2010-04-07 19:03 133512 ----a-w- c:\windows\system32\drivers\eamonm.sys
2010-04-07 09:13 . 2010-04-07 09:13 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2007-07-18 13:06 . 2007-07-18 13:06 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2006-11-09 3784704]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2007-04-13 331552]
"SetRefresh"="c:\program files\HP\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-02 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-04-07 2145000]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"ST Recovery Launcher"="c:\windows\SMINST\launcher.exe" [2007-03-07 44168]

c:\users\Valek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 2.2.lnk - c:\program files\OpenOffice.org 2.2\program\quickstart.exe [2007-6-8 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):82,8c,6c,28,2e,fb,ca,01

S3 b57nd60x;%SvcDispName%;c:\windows\system32\DRIVERS\b57nd60x.sys [2008-01-19 179712]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
bthsvcs REG_MULTI_SZ BthServ
LPDService REG_MULTI_SZ LPDSVC
ipripsvc REG_MULTI_SZ iprip
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Obsah adresáře 'Naplánované úlohy'

2010-05-26 c:\windows\Tasks\User_Feed_Synchronization-{5491C056-4170-4FC1-8B7C-248A2EECF16D}.job
- c:\windows\system32\msfeedssync.exe [2010-05-24 04:54]

2010-05-26 c:\windows\Tasks\User_Feed_Synchronization-{B3177933-2829-4A4E-9D67-18FE13A2701E}.job
- c:\windows\system32\msfeedssync.exe [2010-05-24 04:54]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
TCP: {96F933CD-B026-492E-B581-34ADDF958176} = 194.228.2.1,194.228.2.61
FF - ProfilePath -
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-26 13:59
Windows 6.0.6002 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\PDF Complete\pdfsvc.exe
c:\windows\System32\tcpsvcs.exe
c:\windows\system32\conime.exe
c:\windows\SMINST\scheduler.exe
c:\windows\RtHDVCpl.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\OpenOffice.org 2.2\program\soffice.exe
c:\program files\OpenOffice.org 2.2\program\soffice.BIN
.
**************************************************************************
.
Celkový čas: 2010-05-26 14:08:56 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-05-26 12:08
ComboFix2.txt 2010-05-26 10:49

Před spuštěním: Volných bajtů: 18 095 075 328
Po spuštění: Volných bajtů: 18 064 654 336

- - End Of File - - 4A61ACC967D7DF33D64E37AA36B03BDD

[JaRon]

uz to vypada OK

[baapee]

Díky moc

[JaRon]

rado sa stalo