Kontrola logu - hirin.exe

Zpráva

hazik · #1 Příspěvek od **hazik** » 28 Zář 2010 12:22

Zdravím mám problém s virem hirin.exe po vlozeni flashky se nahraje a nelze smazat (skrytý soubor) Děkuji moc

Logfile of random's system information tool 1.08 (written by random/random)
Run by Nelgio at 2010-09-28 13:14:58
Microsoft Windows 7 Ultimate
System drive C: has 85 GB (35%) free of 238 GB
Total RAM: 2022 MB (40% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:15:09, on 28.9.2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Programy\DAEMON Tools Lite\DTLite.exe
C:\Programy\Advanced SystemCare 3\AWC.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Jwojua.exe
C:\Users\Nelgio\hirin.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Programy\Mozilla Firefox\firefox.exe
C:\Programy\Mozilla Firefox\plugin-container.exe
C:\Programy\QIP\qip.exe
C:\Programy\totalcmd\TOTALCMD.EXE
C:\Users\Nelgio\AppData\Local\Temp\Jf2.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Nelgio\Downloads\RSIT.exe
C:\Program Files\trend micro\Nelgio.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Mobile Connectivity Suite] "C:\Programy\HTC SYNC\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Programy\Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Programy\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Google Update] "C:\Users\Nelgio\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Steam] "c:\games\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Metropolis] rundll32.exe C:\Windows\system32\sshnas21.dll,GetHandle
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [hirin] C:\Users\Nelgio\hirin.exe /o
O4 - HKCU\..\Run: [3FWHZQA3LT] C:\Users\Nelgio\AppData\Local\Temp\Jf2.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/f ... wflash.cab
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Programy\Hamachi\hamachi-2.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_ef7356bc77a65e9e\STacSV.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 5673 bytes

======Scheduled tasks folder======

C:\Windows\tasks\CreateChoiceProcessTask.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-733698393-836852717-2586388751-1001Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-733698393-836852717-2586388751-1001UA.job
C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-11-24 953800]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-09-07 2838912]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2009-03-12 483422]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-09-23 173592]
"Persistence"=C:\Windows\system32\igfxpers.exe [2009-09-23 150552]
"Mobile Connectivity Suite"=C:\Programy\HTC SYNC\Application Launcher\Application Launcher.exe [2009-11-19 598016]
"LogMeIn Hamachi Ui"=C:\Programy\Hamachi\hamachi-2-ui.exe [2010-03-30 1820040]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1173504]
"DAEMON Tools Lite"=C:\Programy\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]
"Google Update"=C:\Users\Nelgio\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-16 136176]
"Steam"=c:\games\steam\steam.exe [2010-09-06 1242448]
"Metropolis"=C:\Windows\system32\sshnas21.dll [2010-09-27 275456]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-01-26 2144088]
"hirin"=C:\Users\Nelgio\hirin.exe [2010-09-28 188416]
"3FWHZQA3LT"=C:\Users\Nelgio\AppData\Local\Temp\Jf2.exe [2010-09-28 238080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-09-23 218112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoResolveSearch"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-09-28 13:14:59 ----D---- C:\Program Files\trend micro
2010-09-28 13:14:58 ----D---- C:\rsit
2010-09-28 12:55:06 ----D---- C:\ProgramData\Spybot - Search & Destroy
2010-09-28 12:55:06 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-09-27 21:08:00 ----A---- C:\Windows\d3dx9_35.dll
2010-09-27 19:16:27 ----A---- C:\Windows\system32\NOTICE.TXT.lnk
2010-09-27 19:16:20 ----RSH---- C:\Windows\system32\gaolu.exe
2010-09-27 10:45:41 ----A---- C:\Windows\Jwojua.exe
2010-09-27 10:45:17 ----N---- C:\Windows\system32\sshnas21.dll
2010-09-26 07:11:51 ----RSH---- C:\Windows\system32\gaolux.exe
2010-09-21 17:56:28 ----D---- C:\ProgramData\HTC
2010-09-21 17:55:48 ----D---- C:\ProgramData\Teleca
2010-09-21 17:55:48 ----D---- C:\Program Files\Common Files\Teleca Shared
2010-09-21 17:53:56 ----D---- C:\Program Files\HTC
2010-09-21 17:22:22 ----A---- C:\Windows\game.ini
2010-09-21 17:10:12 ----SHD---- C:\Windows\ftpcache
2010-09-15 17:12:07 ----A---- C:\Windows\system32\iertutil.dll
2010-09-15 16:22:40 ----A---- C:\Windows\system32\spoolsv.exe
2010-09-06 17:35:10 ----D---- C:\ProgramData\LAG
2010-09-06 17:26:42 ----D---- C:\Program Files\Common Files\Steam
2010-08-31 14:38:47 ----D---- C:\ProgramData\PopCap Games

======List of files/folders modified in the last 1 months======

2010-09-28 19:35:55 ----SHD---- C:\Windows\system32\drivers
2010-09-28 19:26:46 ----SHD---- C:\System Volume Information
2010-09-28 13:15:07 ----D---- C:\Windows\Temp
2010-09-28 13:14:59 ----RD---- C:\Program Files
2010-09-28 13:07:59 ----D---- C:\Windows\Tasks
2010-09-28 12:55:06 ----HD---- C:\ProgramData
2010-09-28 12:10:15 ----SHD---- C:\Windows\System32
2010-09-28 12:10:15 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-09-28 12:10:14 ----D---- C:\Windows\inf
2010-09-28 10:05:22 ----D---- C:\_Moje_
2010-09-28 09:45:00 ----SHD---- C:\Windows\system32\Tasks
2010-09-27 21:08:47 ----SHD---- C:\Windows
2010-09-27 21:03:28 ----D---- C:\Hudba
2010-09-27 21:03:18 ----D---- C:\Games
2010-09-27 20:56:52 ----D---- C:\Download
2010-09-27 20:31:24 ----SHD---- C:\Windows\Installer
2010-09-27 20:31:23 ----SHD---- C:\Config.Msi
2010-09-27 20:30:34 ----D---- C:\Programy
2010-09-26 21:03:21 ----SHD---- C:\Windows\system32\config
2010-09-26 15:17:42 ----D---- C:\Users\Nelgio\AppData\Roaming\uTorrent
2010-09-24 12:21:06 ----SHD---- C:\Windows\system32\catroot2
2010-09-21 17:58:46 ----D---- C:\Users\Nelgio\AppData\Roaming\Teleca
2010-09-21 17:55:48 ----D---- C:\Program Files\Common Files
2010-09-21 17:22:21 ----HD---- C:\Program Files\InstallShield Installation Information
2010-09-16 06:33:12 ----D---- C:\Windows\winsxs
2010-09-15 17:12:11 ----SHD---- C:\Windows\system32\catroot
2010-09-07 17:11:54 ----N---- C:\Windows\system32\aswBoot.exe
2010-09-06 17:33:53 ----RSD---- C:\Windows\assembly
2010-09-06 17:22:35 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-09-05 10:53:13 ----D---- C:\Program Files\Common Files\InstallShield
2010-08-29 10:54:37 ----D---- C:\Users\Nelgio\AppData\Roaming\App Launcher Gadget

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-03-25 691696]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-09-07 23376]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-09-07 46672]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
R2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys [2010-04-28 25416]
R2 npf;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2009-11-16 50704]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 e1express;Intel(R) PRO/1000 – ovladač PCI Express síťového připojení; C:\Windows\system32\DRIVERS\e1e6032.sys [2009-07-14 211456]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2010-02-03 26176]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-09-23 4808192]
R3 STHDA;IDT High Definition Audio CODEC; C:\Windows\system32\DRIVERS\stwrt.sys [2009-03-12 398336]
S2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys [2010-04-28 278984]
S3 abvf8yx9;abvf8yx9; C:\Windows\system32\drivers\abvf8yx9.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Programy\Hamachi\hamachi-2.exe [2010-03-30 1107336]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-09-27 215656]
R2 STacSV;Audio Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_ef7356bc77a65e9e\STacSV.exe [2009-03-12 254036]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2006-12-23 262144]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2009-07-16 316664]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-22 1343400]

-----------------EOF-----------------

#2 Příspěvek od **vyosek** » 28 Zář 2010 12:28

Zdravim a pekny den preji

Ono je tam toho podstatne vic

Doporucuji odinstalovat (pokud nepouzivate) toolbary (listy prohlizecu) v Přidat nebo odebrat programy

Doporucuji odinstalovat Spybot - Search & Destroy - program ma uz nejlepsi leta davno za sebou a posledni cca 3 roky neni schopen celit aktualnim hrozbam

Nahrady za Spybota:
- Spyware Terminator - info o nem http://www.viry.cz/forum/viewtopic.php?f=29&t=44730
- SuperAntiSpyare - info o nem http://www.viry.cz/forum/viewtopic.php?f=29&t=51359
Samozrejme pouzivejte jen jeden z nich
Osobne doporucuji SuperAntiSpyware
Instalaci noveho antispy provedte az po ukonceni leceni

Zapojte do PC vsechny USB klice (flashky, ext. disky apod.)

Stahne a ulozte na plochu UsbFix http://www.viry.cz/forum/viewtopic.php?f=24&t=102308
Spustte a kliknete na Deletion
Po dokonceni sem vlozte log, pokud na Vas nevyskoci, najdete jej zde C:\UsbFix.txt

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Vložte do PC vsechny USB klice (flash disky, ext.disky apod.)
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

hazik · #3 Příspěvek od **hazik** » 28 Zář 2010 12:38

zde je log:

############################## | UsbFix 7.027 | [Deletion]

User: Nelgio (Administrator) # NELGIO-PC [ ]
Updated 28/09/10 by El Desaparecido / C_XX
Started at 13:33:50 | 28/09/2010
Website: http://www.teamxscript.org
Contact: FindyKill.Contact@gmail.com

CPU: Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz
CPU 2: Intel(R) Core(TM)2 CPU 6400 @ 2.13GHz
Microsoft Windows 7 Ultimate (6.1.7600 32-Bit) #
Internet Explorer 8.0.7600.16385

Windows Firewall: Enabled
RAM -> 2022 Mb
C:\ (%systemdrive%) -> Fixed drive # 233 Gb (83 Mb free - 35%) [] # NTFS
D:\ -> CD-ROM
E:\ -> CD-ROM
J:\ -> Fixed drive # 233 Gb (87 Mb free - 37%) [APOLLO] # FAT32
K:\ -> Removable drive # 15 Gb (15 Mb free - 100%) [] # FAT32

################## | Files # Infected Folders |

Deleted ! C:\Users\Nelgio\hirin.exe
Deleted ! C:\Users\Nelgio\impro.exe
Deleted ! C:\Users\Nelgio\sbrpx.exe
Deleted ! C:\Users\Nelgio\vapro.exe
Deleted ! C:\Users\Nelgio\varxp.exe
Deleted ! C:\Users\Nelgio\vodaf.exe
Deleted ! C:\Users\Nelgio\weidu.exe
Deleted ! J:\Windows.lnk
Deleted ! J:\System Volume Information.lnk
Deleted ! J:\FOUND.000.lnk
Deleted ! J:\Recycled.lnk
Deleted ! J:\_Moje_.lnk
Deleted ! J:\Mac.lnk
Deleted ! J:\_Filmy_.lnk
Deleted ! J:\$RECYCLE.BIN.lnk
Deleted ! J:\Katalogy.lnk
Deleted ! J:\_Sound_.lnk
Deleted ! J:\NELGIO PC.lnk
Deleted ! J:\hirin.exe
Deleted ! J:\hirinx.exe
Deleted ! K:\hirin.exe
Deleted ! K:\hirinx.exe
Deleted ! C:\Windows\system32\autorun.inf
Deleted ! C:\Users\Nelgio\AppData\Local\Temp\a.dat
Deleted ! C:\Users\Nelgio\AppData\Local\Temp\Jf0.exe
Deleted ! C:\Users\Nelgio\AppData\Local\Temp\Jf1.exe
Deleted ! C:\Users\Nelgio\AppData\Local\Temp\Jf2.exe
Deleted ! C:\Users\Nelgio\AppData\Local\Temp\Jf3.exe
Deleted ! C:\Users\Nelgio\AppData\Local\Temp\Jf4.exe
Deleted ! C:\Users\Nelgio\AppData\Local\Temp\Jf5.exe
Deleted ! C:\Users\Nelgio\AppData\Local\Temp\Jf6.exe
Deleted ! C:\Users\Nelgio\AppData\Local\Temp\Jf7.exe
Deleted ! C:\Users\Nelgio\AppData\Local\Temp\Jf8.exe
Deleted ! C:\Users\Nelgio\AppData\Local\Temp\Jfz.exe
Deleted ! C:\Users\Nelgio\yiq.exe
Deleted ! C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
Not deleted ! J:\Autorun.inf
Not deleted ! K:\Autorun.inf
Deleted ! J:\Documents.lnk
Deleted ! J:\Music.lnk
Deleted ! J:\New Folder.lnk
Deleted ! J:\Passwords.lnk
Deleted ! J:\Pictures.lnk
Deleted ! J:\Video.lnk
Deleted ! K:\Documents.lnk
Deleted ! K:\Music.lnk
Deleted ! K:\New Folder.lnk
Deleted ! K:\Passwords.lnk
Deleted ! K:\Pictures.lnk
Deleted ! K:\Video.lnk

################## | Registry |

Deleted ! HKCU\Software\3FWHZQA3LT
Deleted ! HKCU\Software\Microsoft\Handle
Deleted ! HKCU\Software\XML
Deleted ! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|hirin
Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoResolveSearch
Deleted ! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|3FWHZQA3LT
Deleted ! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Metropolis

################## | Mountpoints2 |

################## | Listing |

[25/03/2010 - 17:43:02 | SHD ] C:\$Recycle.Bin
[26/03/2010 - 02:32:48 | SHD ] C:\Boot
[14/07/2009 - 03:38:58 | RASH | 383562] C:\bootmgr
[26/03/2010 - 02:32:49 | RASH | 8192] C:\BOOTSECT.BAK
[27/09/2010 - 20:31:23 | SHD ] C:\Config.Msi
[14/07/2009 - 06:53:55 | SHD ] C:\Documents and Settings
[27/09/2010 - 20:56:52 | D ] C:\Download
[27/09/2010 - 21:03:18 | D ] C:\Games
[02/08/2009 - 10:59:51 | RASH | 171136] C:\grldr
[28/09/2010 - 09:42:43 | ASH | 1590132736] C:\hiberfil.sys
[27/09/2010 - 21:03:28 | D ] C:\Hudba
[25/03/2010 - 17:54:39 | D ] C:\Intel
[21/05/2010 - 11:47:06 | RASH | 0] C:\IO.SYS
[07/09/2010 - 19:32:22 | A | 7292926] C:\Linkin Park_The Messenger.mp3
[21/05/2010 - 11:47:06 | RASH | 0] C:\MSDOS.SYS
[25/03/2010 - 17:51:59 | D ] C:\NVIDIA
[28/09/2010 - 09:42:51 | ASH | 2120179712] C:\pagefile.sys
[14/07/2009 - 04:37:05 | D ] C:\PerfLogs
[28/09/2010 - 13:14:59 | RD ] C:\Program Files
[28/09/2010 - 12:55:06 | HD ] C:\ProgramData
[27/09/2010 - 20:30:34 | D ] C:\Programy
[25/03/2010 - 17:41:01 | SHD ] C:\Recovery
[28/09/2010 - 13:15:13 | D ] C:\rsit
[28/09/2010 - 19:26:46 | SHD ] C:\System Volume Information
[28/09/2010 - 13:38:06 | D ] C:\UsbFix
[28/09/2010 - 13:33:59 | A | 4318] C:\UsbFix.txt
[25/03/2010 - 17:42:49 | RD ] C:\Users
[28/09/2010 - 13:33:24 | SHD ] C:\Windows
[28/09/2010 - 13:37:17 | D ] C:\zaloha
[28/09/2010 - 10:05:22 | D ] C:\_Moje_
[10/05/2008 - 23:58:42 | D ] J:\Windows
[31/05/2008 - 12:42:50 | D ] J:\System Volume Information
[06/07/2010 - 15:09:28 | D ] J:\FOUND.000
[31/10/2008 - 18:29:54 | ASH | 20] J:\ArcDeviceInfo
[31/10/2008 - 18:39:26 | D ] J:\Recycled
[31/10/2008 - 19:38:16 | D ] J:\_Moje_
[02/11/2008 - 11:54:14 | D ] J:\Mac
[11/11/2008 - 17:22:02 | D ] J:\_Filmy_
[22/11/2008 - 16:38:22 | SHD ] J:\$RECYCLE.BIN
[10/06/2009 - 07:26:44 | D ] J:\Katalogy
[13/10/2009 - 18:39:48 | SH | 963410] J:\Zákon o zbraních.pdf
[23/10/2009 - 18:08:48 | A | 10030] J:\Hotelovka Login.docx
[26/12/2009 - 15:53:34 | SH | 1603696640] J:\Hokej OH 1998 Nagano.avi
[07/03/2010 - 16:44:48 | D ] J:\_Sound_
[23/03/2010 - 08:03:28 | D ] J:\NELGIO PC
[28/09/2010 - 13:31:40 | N | 0] J:\autorun.inf
[28/09/2010 - 13:31:42 | A | 399] J:\Zákon o zbraních.pdf.lnk
[28/09/2010 - 13:31:42 | A | 399] J:\Hokej OH 1998 Nagano.avi.lnk
[28/09/2010 - 13:04:40 | N | 0] K:\autorun.inf

################## | Vaccin |

C:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_NELGIO-PC.zip
http://chiquitine.changelog.fr/Sample/Upload.php
Thank you for your contribution.

################## | E.O.F |

#4 Příspěvek od **vyosek** » 28 Zář 2010 12:41

A to se da nakoupit kde prosim

Vzhuru na ComboFix - fleshky nechce zapojene...

hazik · #5 Příspěvek od **hazik** » 28 Zář 2010 12:47

nechce nebo nechte ? Dekuji

#6 Příspěvek od **vyosek** » 28 Zář 2010 12:49

Omlouvam se

NECHTE zapojene, je to pak i v navodu na CF...Hodne toho USBFix smazal, ale zaliskane to mate jak jetel

hazik · #7 Příspěvek od **hazik** » 28 Zář 2010 13:17

zde je log

ComboFix 10-09-27.05 - Nelgio 28.09.2010 14:00:18.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.2022.1566 [GMT 2:00]
Spuštěný z: c:\users\Nelgio\Downloads\ComboFix.exe
SP: SUPERAntiSpyware *enabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Nelgio\palap.exe
c:\users\Nelgio\soeruk.exe
c:\users\Nelgio\xooah.exe
J:\Autorun.inf

Nakažená kopie c:\windows\system32\drivers\rdprefmp.sys byla nalezena a vyléčena.
Obnovena kopie z - Kitty had a snack :p
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-08-28 do 2010-09-28 )))))))))))))))))))))))))))))))
.

2010-09-28 12:07 . 2010-09-28 12:10 -------- d-----w- c:\users\Nelgio\AppData\Local\temp
2010-09-28 12:07 . 2010-09-28 12:07 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-09-28 11:57 . 2009-07-14 00:01 7168 ----a-w- c:\windows\system32\drivers\rdprefmp.sys
2010-09-28 11:46 . 2010-09-28 11:51 -------- d-----w- C:\32788R22FWJFW
2010-09-28 11:39 . 2010-09-28 11:39 -------- d-----w- c:\users\Nelgio\AppData\Roaming\SUPERAntiSpyware.com
2010-09-28 11:39 . 2010-09-28 11:39 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2010-09-28 11:39 . 2010-09-28 11:39 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-09-28 11:38 . 2010-09-28 11:38 3359801 ----a-w- C:\UsbFix_Upload_Me_NELGIO-PC.zip
2010-09-28 11:35 . 2010-09-28 11:37 -------- d-----w- C:\zaloha
2010-09-28 11:33 . 2010-09-28 11:38 -------- d-----w- C:\UsbFix
2010-09-28 11:14 . 2010-09-28 11:15 -------- d-----w- c:\program files\trend micro
2010-09-28 11:14 . 2010-09-28 11:15 -------- d-----w- C:\rsit
2010-09-28 10:55 . 2010-09-28 11:53 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-09-28 10:55 . 2010-09-28 11:34 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-09-27 19:08 . 2010-09-27 19:08 3727720 ----a-w- c:\windows\d3dx9_35.dll
2010-09-27 18:33 . 2010-09-28 12:09 -------- d-----w- c:\users\Nelgio\AppData\Local\LogMeIn Hamachi
2010-09-27 17:16 . 2010-09-26 05:11 208896 --sh--r- c:\windows\system32\gaolu.exe
2010-09-27 08:45 . 2010-09-27 08:45 238592 ----a-w- c:\windows\Jwojua.exe
2010-09-26 05:11 . 2010-09-26 05:11 208896 --sh--r- c:\windows\system32\gaolux.exe
2010-09-21 15:57 . 2010-09-21 15:57 -------- d-----w- c:\users\Nelgio\AppData\Local\HTC
2010-09-21 15:56 . 2010-09-21 15:56 -------- d-----w- c:\programdata\HTC
2010-09-21 15:55 . 2010-09-21 15:56 -------- d-----w- c:\program files\Common Files\Teleca Shared
2010-09-21 15:55 . 2010-09-21 15:56 -------- d-----w- c:\programdata\Teleca
2010-09-21 15:53 . 2010-09-21 15:53 -------- d-----w- c:\program files\HTC
2010-09-21 15:50 . 2010-09-21 15:50 -------- d-----w- c:\users\Nelgio\AppData\Local\Downloaded Installations
2010-09-21 15:10 . 2010-09-21 15:10 -------- d-sh--w- c:\windows\ftpcache
2010-09-15 14:22 . 2010-08-21 05:32 316928 ----a-w- c:\windows\system32\spoolsv.exe
2010-09-06 15:35 . 2010-09-06 15:35 -------- d-----w- c:\users\Nelgio\AppData\Local\LAG
2010-09-06 15:35 . 2010-09-06 15:35 -------- d-----w- c:\programdata\LAG
2010-09-06 15:26 . 2010-09-06 15:26 -------- d-----w- c:\program files\Common Files\Steam
2010-08-31 12:38 . 2010-08-31 12:38 -------- d-----w- c:\programdata\PopCap Games

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-28 17:35 . 2009-07-13 23:32 369568 ----a-w- c:\windows\system32\drivers\cng.sys
2010-09-28 11:40 . 2010-09-28 11:40 63488 ----a-w- c:\users\Nelgio\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-09-28 11:40 . 2010-09-28 11:40 52224 ----a-w- c:\users\Nelgio\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-09-28 11:40 . 2010-09-28 11:40 117760 ----a-w- c:\users\Nelgio\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-09-28 11:34 . 2009-07-26 17:53 626362 ----a-w- c:\windows\system32\perfh005.dat
2010-09-28 11:34 . 2009-07-26 17:53 120664 ----a-w- c:\windows\system32\perfc005.dat
2010-09-26 13:17 . 2010-03-27 08:30 -------- d-----w- c:\users\Nelgio\AppData\Roaming\uTorrent
2010-09-21 15:58 . 2010-05-19 17:39 -------- d-----w- c:\users\Nelgio\AppData\Roaming\Teleca
2010-09-21 15:22 . 2010-03-25 15:56 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-09-07 15:12 . 2010-07-08 18:18 38848 ----a-w- c:\windows\avastSS.scr
2010-09-07 15:11 . 2010-03-25 15:46 167592 ------w- c:\windows\system32\aswBoot.exe
2010-09-07 14:52 . 2010-03-25 15:47 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-07 14:52 . 2010-03-25 15:47 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-07 14:47 . 2010-03-25 15:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-07 14:47 . 2010-03-25 15:47 50768 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-09-07 14:47 . 2010-03-25 15:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-06 15:22 . 2010-05-05 20:25 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-09-05 08:53 . 2010-03-25 15:56 -------- d-----w- c:\program files\Common Files\InstallShield
2010-08-29 08:54 . 2010-03-25 16:39 -------- d-----w- c:\users\Nelgio\AppData\Roaming\App Launcher Gadget
2010-08-17 07:38 . 2010-08-17 07:38 -------- d-----w- c:\program files\WinPcap
2010-08-04 05:15 . 2010-07-28 09:00 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-08-03 08:56 . 2010-07-28 09:00 -------- d-----w- c:\programdata\Blizzard Entertainment
2010-07-29 06:30 . 2010-08-11 05:21 197632 ----a-w- c:\windows\system32\ir32_32.dll
2010-07-29 06:30 . 2010-08-11 05:21 82944 ----a-w- c:\windows\system32\iccvid.dll
2010-07-28 10:48 . 2010-07-28 10:48 47364 ----a-w- c:\programdata\Blizzard Entertainment\Battle.net\Cache\Download\Scan.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"DAEMON Tools Lite"="c:\programy\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"Google Update"="c:\users\Nelgio\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-08-16 136176]
"Steam"="c:\games\steam\steam.exe" [2010-09-06 1242448]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-09-10 2424560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-03-12 483422]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"Mobile Connectivity Suite"="c:\programy\HTC SYNC\Application Launcher\Application Launcher.exe" [2009-11-19 598016]
"LogMeIn Hamachi Ui"="c:\programy\Hamachi\hamachi-2-ui.exe" [2010-03-30 1820040]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"3FWHZQA3LT"=c:\users\Nelgio\AppData\Local\Temp\Jf2.exe
"Advanced SystemCare 3"="c:\programy\Advanced SystemCare 3\AWC.exe" /startup
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe"
"hirin"=c:\users\Nelgio\hirin.exe /E

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"QuickTime Task"="c:\programy\Quick Time\QTTask.exe" -atboottime

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-22 1343400]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-03-25 691696]
S1 aswSP;aswSP; [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\programy\Hamachi\hamachi-2.exe [2010-03-30 1107336]
S2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-11-16 50704]

.
Obsah adresáře 'Naplánované úlohy'

2010-03-25 c:\windows\Tasks\CreateChoiceProcessTask.job
- c:\windows\System32\browserchoice.exe [2010-03-25 07:10]

2010-09-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-733698393-836852717-2586388751-1001Core.job
- c:\users\Nelgio\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-16 07:10]

2010-09-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-733698393-836852717-2586388751-1001UA.job
- c:\users\Nelgio\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-16 07:10]
.
.
------- Doplňkový sken -------
.
FF - ProfilePath - c:\users\Nelgio\AppData\Roaming\Mozilla\Firefox\Profiles\gzv0b9ck.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - component: c:\users\Nelgio\AppData\Roaming\Mozilla\Firefox\Profiles\gzv0b9ck.default\extensions\DTToolbar@toolbarnet.com\components\DTToolbarFF.dll
FF - plugin: c:\programy\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\programy\Quick Time\Plugins\npqtplugin.dll
FF - plugin: c:\programy\Quick Time\Plugins\npqtplugin2.dll
FF - plugin: c:\programy\Quick Time\Plugins\npqtplugin3.dll
FF - plugin: c:\programy\Quick Time\Plugins\npqtplugin4.dll
FF - plugin: c:\programy\Quick Time\Plugins\npqtplugin5.dll
FF - plugin: c:\programy\Quick Time\Plugins\npqtplugin6.dll
FF - plugin: c:\programy\Quick Time\Plugins\npqtplugin7.dll
FF - plugin: c:\users\Nelgio\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll

---- NASTAVENÍ FIREFOXU ----
c:\programy\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\programy\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\programy\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\programy\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-hirin - c:\users\Nelgio\hirin.exe
SafeBoot-dmboot.sys
SafeBoot-dmio.sys
SafeBoot-dmload.sys
SafeBoot-dmadmin
SafeBoot-dmserver
SafeBoot-SRService

.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-733698393-836852717-2586388751-1001\Software\SecuROM\License information*]
"datasecu"=hex:34,8f,9a,00,9d,19,76,66,cf,02,7c,96,71,7e,ba,7a,a9,1d,14,e7,bb,
9c,c2,b8,e0,e6,9a,97,ae,3c,13,71,0e,2b,df,1f,b9,cb,14,3f,35,60,3d,53,9c,7c,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_ef7356bc77a65e9e\STacSV.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\conhost.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\msiexec.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\MsiExec.exe
c:\windows\system32\MsiExec.exe
.
**************************************************************************
.
Celkový čas: 2010-09-28 14:16:00 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-09-28 12:15

Před spuštěním: Volných bajtů: 88 207 593 472
Po spuštění: Volných bajtů: 88 127 012 864

- - End Of File - - E530DA1E4F2A078F6CEB5F6740A147EF

#8 Příspěvek od **vyosek** » 28 Zář 2010 13:28

Vypada to, ze mate poskozeny i Avast - odinstalujte jej pomoci tohodle http://www.avast.com/cs-cz/uninstall-utility a znovu nainstalujte

Flash disky opet zapojte pokud jste je vyjmul

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

Folder::
c:\users\Nelgio\AppData\Local\Temp\


Collect::
c:\users\Nelgio\hirin.exe

File::
K:\Autorun.inf
c:\windows\Tasks\CreateChoiceProcessTask.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-733698393-836852717-2586388751-1001Core.job¨
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-733698393-836852717-2586388751-1001UA.job

Registry::
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"3FWHZQA3LT"=-
"Advanced SystemCare 3"=-
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="-
"hirin"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"=-
"QuickTime Task"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=-
"Google Update"=-
"Steam"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"=-
"Adobe ARM"=-
"Mobile Connectivity Suite"=-
"LogMeIn Hamachi Ui"=-

RegLock::
[HKEY_USERS\S-1-5-21-733698393-836852717-2586388751-1001\Software\SecuROM\License information*]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

hazik · #9 Příspěvek od **hazik** » 28 Zář 2010 13:55

Diky moc...

ComboFix 10-09-27.05 - Nelgio 28.09.2010 14:44:44.2.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.2022.1204 [GMT 2:00]
Spuštěný z: C:\Users\Nelgio\Downloads\ComboFix.exe
Použité ovládací přepínače :: C:\Users\Nelgio\Desktop\CFScript.txt
SP: SUPERAntiSpyware *enabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}

FILE ::
"c:\windows\Tasks\CreateChoiceProcessTask.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-733698393-836852717-2586388751-1001Core.job¨"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-733698393-836852717-2586388751-1001UA.job"
"K:\Autorun.inf"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Nelgio\AppData\Local\Temp\
c:\users\Nelgio\AppData\Local\Temp\\catchme.dll
c:\users\Nelgio\AppData\Local\Temp\\FXSAPIDebugLogFile.txt
c:\windows\Tasks\CreateChoiceProcessTask.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-733698393-836852717-2586388751-1001UA.job

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-08-28 do 2010-09-28 )))))))))))))))))))))))))))))))
.

2010-09-28 12:50:51 . 2010-09-28 12:50:51 -------- d-----w- C:\Users\Public\AppData\Local\temp
2010-09-28 12:50:51 . 2010-09-28 12:50:51 -------- d-----w- C:\Users\Default\AppData\Local\temp
2010-09-28 12:42:44 . 2010-09-28 12:43:38 -------- d-----w- C:\32788R22FWJFW
2010-09-28 12:42:18 . 2010-09-07 14:52:03 165584 ----a-w- C:\Windows\system32\drivers\aswSP.sys
2010-09-28 12:42:18 . 2010-09-07 14:47:07 17744 ----a-w- C:\Windows\system32\drivers\aswFsBlk.sys
2010-09-28 12:42:15 . 2010-09-07 14:47:46 23376 ----a-w- C:\Windows\system32\drivers\aswRdr.sys
2010-09-28 12:42:14 . 2010-09-07 14:52:25 46672 ----a-w- C:\Windows\system32\drivers\aswTdi.sys
2010-09-28 12:42:09 . 2010-09-07 14:47:30 50768 ----a-w- C:\Windows\system32\drivers\aswMonFlt.sys
2010-09-28 12:41:54 . 2010-09-07 15:11:54 167592 ----a-w- C:\Windows\system32\aswBoot.exe
2010-09-28 11:57:19 . 2009-07-14 00:01:41 7168 ----a-w- C:\Windows\system32\drivers\rdprefmp.sys
2010-09-28 11:40:06 . 2010-09-28 11:40:06 63488 ----a-w- C:\Users\Nelgio\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-09-28 11:40:04 . 2010-09-28 11:40:04 52224 ----a-w- C:\Users\Nelgio\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-09-28 11:40:02 . 2010-09-28 11:40:02 117760 ----a-w- C:\Users\Nelgio\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-09-28 11:39:31 . 2010-09-28 11:39:31 -------- d-----w- C:\Users\Nelgio\AppData\Roaming\SUPERAntiSpyware.com
2010-09-28 11:39:31 . 2010-09-28 11:39:31 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com
2010-09-28 11:39:24 . 2010-09-28 11:39:39 -------- d-----w- C:\Program Files\SUPERAntiSpyware
2010-09-28 11:38:14 . 2010-09-28 11:38:15 3359801 ----a-w- C:\UsbFix_Upload_Me_NELGIO-PC.zip
2010-09-28 11:35:55 . 2010-09-28 11:37:17 -------- d-----w- C:\zaloha
2010-09-28 11:33:12 . 2010-09-28 11:38:15 -------- d-----w- C:\UsbFix
2010-09-28 11:14:59 . 2010-09-28 11:15:09 -------- d-----w- C:\Program Files\trend micro
2010-09-28 11:14:58 . 2010-09-28 11:15:13 -------- d-----w- C:\rsit
2010-09-28 10:55:06 . 2010-09-28 11:53:12 -------- d-----w- C:\Program Files\Spybot - Search & Destroy
2010-09-28 10:55:06 . 2010-09-28 11:34:59 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2010-09-27 19:08:00 . 2010-09-27 19:08:04 3727720 ----a-w- C:\Windows\d3dx9_35.dll
2010-09-27 18:33:08 . 2010-09-28 12:37:31 -------- d-----w- C:\Users\Nelgio\AppData\Local\LogMeIn Hamachi
2010-09-27 17:16:20 . 2010-09-26 05:11:51 208896 --sh--r- C:\Windows\system32\gaolu.exe
2010-09-27 08:45:41 . 2010-09-27 08:45:22 238592 ----a-w- C:\Windows\Jwojua.exe
2010-09-26 05:11:51 . 2010-09-26 05:11:51 208896 --sh--r- C:\Windows\system32\gaolux.exe
2010-09-21 15:57:46 . 2010-09-21 15:57:46 -------- d-----w- C:\Users\Nelgio\AppData\Local\HTC
2010-09-21 15:56:28 . 2010-09-21 15:56:28 -------- d-----w- C:\ProgramData\HTC
2010-09-21 15:55:48 . 2010-09-21 15:56:36 -------- d-----w- C:\Program Files\Common Files\Teleca Shared
2010-09-21 15:55:48 . 2010-09-21 15:56:08 -------- d-----w- C:\ProgramData\Teleca
2010-09-21 15:53:56 . 2010-09-21 15:53:56 -------- d-----w- C:\Program Files\HTC
2010-09-21 15:50:46 . 2010-09-21 15:50:46 -------- d-----w- C:\Users\Nelgio\AppData\Local\Downloaded Installations
2010-09-21 15:10:12 . 2010-09-21 15:10:12 -------- d-sh--w- C:\Windows\ftpcache
2010-09-15 14:22:40 . 2010-08-21 05:32:37 316928 ----a-w- C:\Windows\system32\spoolsv.exe
2010-09-06 15:35:10 . 2010-09-06 15:35:16 -------- d-----w- C:\Users\Nelgio\AppData\Local\LAG
2010-09-06 15:35:10 . 2010-09-06 15:35:10 -------- d-----w- C:\ProgramData\LAG
2010-09-06 15:26:42 . 2010-09-06 15:26:42 -------- d-----w- C:\Program Files\Common Files\Steam
2010-08-31 12:38:47 . 2010-08-31 12:38:47 -------- d-----w- C:\ProgramData\PopCap Games

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-28 17:35:55 . 2009-07-13 23:32:57 369568 ----a-w- C:\Windows\system32\drivers\cng.sys
2010-09-28 12:41:50 . 2010-03-25 15:46:45 -------- d-----w- C:\Program Files\Alwil Software
2010-09-28 11:34:55 . 2009-07-26 17:53:09 626362 ----a-w- C:\Windows\system32\perfh005.dat
2010-09-28 11:34:55 . 2009-07-26 17:53:09 120664 ----a-w- C:\Windows\system32\perfc005.dat
2010-09-26 13:17:42 . 2010-03-27 08:30:01 -------- d-----w- C:\Users\Nelgio\AppData\Roaming\uTorrent
2010-09-21 15:58:46 . 2010-05-19 17:39:04 -------- d-----w- C:\Users\Nelgio\AppData\Roaming\Teleca
2010-09-21 15:22:21 . 2010-03-25 15:56:53 -------- d--h--w- C:\Program Files\InstallShield Installation Information
2010-09-07 15:12:17 . 2010-07-08 18:18:52 38848 ----a-w- C:\Windows\avastSS.scr
2010-09-06 15:22:35 . 2010-05-05 20:25:41 -------- d-----w- C:\Program Files\Common Files\Wise Installation Wizard
2010-09-05 08:53:13 . 2010-03-25 15:56:49 -------- d-----w- C:\Program Files\Common Files\InstallShield
2010-08-29 08:54:37 . 2010-03-25 16:39:30 -------- d-----w- C:\Users\Nelgio\AppData\Roaming\App Launcher Gadget
2010-08-17 07:38:57 . 2010-08-17 07:38:57 -------- d-----w- C:\Program Files\WinPcap
2010-08-04 05:15:31 . 2010-07-28 09:00:20 -------- d-----w- C:\Program Files\Common Files\Blizzard Entertainment
2010-08-03 08:56:36 . 2010-07-28 09:00:20 -------- d-----w- C:\ProgramData\Blizzard Entertainment
2010-07-29 06:30:49 . 2010-08-11 05:21:47 197632 ----a-w- C:\Windows\system32\ir32_32.dll
2010-07-29 06:30:34 . 2010-08-11 05:21:47 82944 ----a-w- C:\Windows\system32\iccvid.dll
2010-07-28 10:48:17 . 2010-07-28 10:48:16 47364 ----a-w- C:\ProgramData\Blizzard Entertainment\Battle.net\Cache\Download\Scan.dll
2009-06-10 21:26:35 . 2009-07-14 02:04:20 9633792 --sha-r- C:\Windows\Fonts\StaticCache.dat
2009-07-14 01:14:45 . 2009-07-13 23:42:17 396800 --sha-w- C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2009-07-14 01:14:38 1173504]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-09-10 16:20:20 2424560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="C:\Program Files\IDT\WDM\sttray.exe" [2009-03-12 11:53:46 483422]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2009-09-23 17:30:48 173592]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2009-09-23 17:30:48 150552]
"avast5"="C:\Program Files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 15:12:02 2838912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 11:16:28 130384]
R3 WatAdminSvc;Služba Technologie aktivace Windows;C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-22 19:14:26 1343400]
R4 sptd;sptd;C:\Windows\system32\Drivers\sptd.sys [2010-03-25 16:47:40 691696]
S1 aswSP;aswSP; [x]
S1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 18:25:48 12872]
S1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 18:41:30 67656]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;C:\Windows\system32\drivers\aswMonFlt.sys [2010-09-07 14:47:30 50768]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;C:\Programy\Hamachi\hamachi-2.exe [2010-03-30 09:16:12 1107336]
S2 npf;NetGroup Packet Filter Driver;C:\Windows\system32\drivers\npf.sys [2009-11-16 16:33:38 50704]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - ASWMONFLT
*NewlyCreated* - ASWRDR
.
Obsah adresáře 'Naplánované úlohy'

2010-09-26 C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-733698393-836852717-2586388751-1001Core.job
- C:\Users\Nelgio\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-16 07:10:50 . 2010-08-16 07:10:49]
.
.
------- Doplňkový sken -------
.
FF - ProfilePath - C:\Users\Nelgio\AppData\Roaming\Mozilla\Firefox\Profiles\gzv0b9ck.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - component: C:\Users\Nelgio\AppData\Roaming\Mozilla\Firefox\Profiles\gzv0b9ck.default\extensions\DTToolbar@toolbarnet.com\components\DTToolbarFF.dll
FF - plugin: C:\Programy\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: C:\Programy\Quick Time\Plugins\npqtplugin.dll
FF - plugin: C:\Programy\Quick Time\Plugins\npqtplugin2.dll
FF - plugin: C:\Programy\Quick Time\Plugins\npqtplugin3.dll
FF - plugin: C:\Programy\Quick Time\Plugins\npqtplugin4.dll
FF - plugin: C:\Programy\Quick Time\Plugins\npqtplugin5.dll
FF - plugin: C:\Programy\Quick Time\Plugins\npqtplugin6.dll
FF - plugin: C:\Programy\Quick Time\Plugins\npqtplugin7.dll
FF - plugin: C:\Users\Nelgio\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll

---- NASTAVENÍ FIREFOXU ----
C:\Programy\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
C:\Programy\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
C:\Programy\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
C:\Programy\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-733698393-836852717-2586388751-1001\Software\SecuROM\License information*]
"datasecu"=hex:34,8f,9a,00,9d,19,76,66,cf,02,7c,96,71,7e,ba,7a,a9,1d,14,e7,bb,
9c,c2,b8,e0,e6,9a,97,ae,3c,13,71,0e,2b,df,1f,b9,cb,14,3f,35,60,3d,53,9c,7c,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
Celkový čas: 2010-09-28 14:55:01
ComboFix-quarantined-files.txt 2010-09-28 12:55:00
ComboFix2.txt 2010-09-28 12:16:01

Před spuštěním: Volných bajtů: 87 945 682 944
Po spuštění: Volných bajtů: 87 528 923 136

- - End Of File - - DCB2F42CDB72E447BE66A90F861F5C52

#10 Příspěvek od **vyosek** » 28 Zář 2010 13:57

Ten Avast jste preinstaloval

hazik · #11 Příspěvek od **hazik** » 28 Zář 2010 13:58

Ano. Nouzovy rezim + aplikace z avastu

#12 Příspěvek od **vyosek** » 28 Zář 2010 14:01

Dobre

Jdeme dale

Zapojte opet flash disky

Spustte USBFix a kliknete na Vaccination

Jeste jeden test pro jistotu jelikoz PC bylo Vy vite v jakem stavu

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) (viz muj podpis)

Provedte aktualizaci - treti zalozka
Provedte uplny sken - nic nemazte
MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

hazik · #13 Příspěvek od **hazik** » 29 Zář 2010 14:15

tak to doběhlo 13 chyb a nikde nevidím log...

#14 Příspěvek od **vyosek** » 29 Zář 2010 15:11

Spustte MBAM a v zalozce karantena by mely byt soubory ktere mazal, pokud jste je dal smazat...Pripadne udelejte KOMPLETNI sken znovu...

hazik · #15 Příspěvek od **hazik** » 29 Zář 2010 15:21

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4710

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

29.9.2010 16:20:55
mbam-log-2010-09-29 (16-20-55).txt

Typ skenu: Rychlý sken
Skenované objekty: 136226
Uplynulý čas: 4 minuta(y), 39 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 1
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
HKEY_CURRENT_USER\SOFTWARE\SMH2B46TDP (Trojan.FakeAlert) -> No action taken.

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

VIRY.CZ

Kontrola logu - hirin.exe

Kontrola logu - hirin.exe

Re: Kontrola logu - hirin.exe

Re: Kontrola logu - hirin.exe

Re: Kontrola logu - hirin.exe

Re: Kontrola logu - hirin.exe

Re: Kontrola logu - hirin.exe

Re: Kontrola logu - hirin.exe

Re: Kontrola logu - hirin.exe

Re: Kontrola logu - hirin.exe

Re: Kontrola logu - hirin.exe

Re: Kontrola logu - hirin.exe

Re: Kontrola logu - hirin.exe

Re: Kontrola logu - hirin.exe

Re: Kontrola logu - hirin.exe

Re: Kontrola logu - hirin.exe