kontrola logu

[darth]

Logfile of random's system information tool 1.08 (written by random/random)
Run by Petr Novak at 2010-09-30 13:29:39
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 128 MB (0%) free of 153 GB
Total RAM: 1018 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:30:20, on 30.9.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\EasyVPN\crdphService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\cfdrive32.exe
C:\WINDOWS\system32\msvmiode.exe
C:\Program Files\COMODO\EasyVPN\Vpnservice.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\TP-LINK\TL-WN321G\COMMON\RegistryWriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\DirectX\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Opera\opera.exe
C:\PROGRA~1\ICQLite\icq.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Petr Novak\Plocha\RSIT.exe
C:\Program Files\trend micro\Petr Novak.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedi ... &gc=1&q=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe,,c:\program files\microsoft\desktoplayer.exe
O1 - Hosts: Z6NFNnDCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4VgdE6yojxS!zkvYSqt7uAKx!jkioQY8HXQejmcGZQwbdCafws9n
O1 - Hosts: SozOlJkN0D0leAgIoBIDRbtCEPhbKNpxU5Rsnnlr!hqKgfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA
O1 - Hosts: IV3XavwQY0BeO8JRdnaMHHFLtlt5AiBGJz4CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6N
O1 - Hosts: NnDCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4VgdE6yojxS!zkvYSqt7uAKx!jkioQY
O1 - Hosts: QejmcGZQwbdCafws9nSSozOlJkN0D0leAgIoBIDRbtCEPhbKNpxU5Rsnnlr!hqKgfympfKiTQuhFujzMrrbb
O1 - Hosts: T9F4E8sGsphDA2IV3XavwQY0BeO8JRdnaMHHFLtlt5AiBGJz4CcUOBZODT7LLvfMcrIm
O1 - Hosts: qv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFNnDCV14TmFwdSUiRQcpO6Pz6wu3G2KPj
O1 - Hosts: gdE6yojxS!zkvYSqt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgIoBIDRbtCEPhbKNp
O1 - Hosts: U5Rsnnlr!hqKgfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3Xavw
O1 - Hosts: Y0BeO8JRdnaMHHFLtlt5AiBGJz4CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFN
O1 - Hosts: DCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4VgdE6yojxS!zk
O1 - Hosts: qt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgIoBIDRbtCEPhbKNpxU5Rsnnlr!hq
O1 - Hosts: gfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3XavwQY0BeO8JRdnaMHHFLtlt5AiBGJz
O1 - Hosts: CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFNnDCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4Vgd
O1 - Hosts: 6yojxS!zkvYSqt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgI
O1 - Hosts: DRbtCEPhbKNpxU5Rsnnlr!hqKgfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3Xavw
O1 - Hosts: Y0BeO8JRdnaMHHFLtlt5AiBGJz4CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFN
O1 - Hosts: DCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4VgdE6yojxS!zk
O1 - Hosts: qt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgIoBIDRbtCEPhbKNpxU5Rsnnlr!hq
O1 - Hosts: gfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3XavwQY0BeO8JRdnaMHHFLtlt5AiBGJz
O1 - Hosts: CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFNnDCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4Vgd
O1 - Hosts: 6yojxS!zkvYSqt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgI
O1 - Hosts: DRbtCEPhbKNpxU5Rsnnlr!hqKgfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3Xavw
O1 - Hosts: Y0BeO8JRdnaMHHFLtlt5AiBGJz4CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFN
O1 - Hosts: DCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4VgdE6yojxS!zk
O1 - Hosts: qt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgIoBIDRbtCEPhbKNpxU5Rsnnlr!hq
O1 - Hosts: gfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3XavwQY0BeO8JRdnaMHHFLtlt5AiBGJz
O1 - Hosts: CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFNnDCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4Vgd
O1 - Hosts: 6yojxS!zkvYSqt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgI
O1 - Hosts: DRbtCEPhbKNpxU5Rsnnlr!hqKgfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3Xavw
O1 - Hosts: Y0BeO8JRdnaMHHFLtlt5AiBGJz4CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFN
O1 - Hosts: DCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4VgdE6yojxS!zk
O1 - Hosts: qt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgIoBIDRbtCEPhbKNpxU5Rsnnlr!hq
O1 - Hosts: gfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3XavwQY0BeO8JRdnaMHHFLtlt5AiBGJz
O1 - Hosts: CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFNnDCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4Vgd
O1 - Hosts: 6yojxS!zkvYSqt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgI
O1 - Hosts: DRbtCEPhbKNpxU5Rsnnlr!hqKgfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3Xavw
O1 - Hosts: Y0BeO8JRdnaMHHFLtlt5AiBGJz4CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFN
O1 - Hosts: DCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4VgdE6yojxS!zk
O1 - Hosts: qt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgIoBIDRbtCEPhbKNpxU5Rsnnlr!hq
O1 - Hosts: gfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3XavwQY0BeO8JRdnaMHHFLtlt5AiBGJz
O1 - Hosts: CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFNnDCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4Vgd
O1 - Hosts: 6yojxS!zkvYSqt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgI
O1 - Hosts: DRbtCEPhbKNpxU5Rsnnlr!hqKgfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3Xavw
O1 - Hosts: Y0BeO8JRdnaMHHFLtlt5AiBGJz4CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFN
O1 - Hosts: DCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4VgdE6yojxS!zk
O1 - Hosts: qt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgIoBIDRbtCEPhbKNpxU5Rsnnlr!hq
O1 - Hosts: gfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3XavwQY0BeO8JRdnaMHHFLtlt5AiBGJz
O1 - Hosts: CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFNnDCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4Vgd
O1 - Hosts: 6yojxS!zkvYSqt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgI
O1 - Hosts: DRbtCEPhbKNpxU5Rsnnlr!hqKgfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3Xavw
O1 - Hosts: Y0BeO8JRdnaMHHFLtlt5AiBGJz4CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFN
O1 - Hosts: DCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4VgdE6yojxS!zk
O1 - Hosts: qt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgIoBIDRbtCEPhbKNpxU5Rsnnlr!hq
O1 - Hosts: gfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3XavwQY0BeO8JRdnaMHHFLtlt5AiBGJz
O1 - Hosts: CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFNnDCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4Vgd
O1 - Hosts: 6yojxS!zkvYSqt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgI
O1 - Hosts: DRbtCEPhbKNpxU5Rsnnlr!hqKgfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3Xavw
O1 - Hosts: Y0BeO8JRdnaMHHFLtlt5AiBGJz4CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFN
O1 - Hosts: DCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4VgdE6yojxS!zk
O1 - Hosts: qt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgIoBIDRbtCEPhbKNpxU5Rsnnlr!hq
O1 - Hosts: gfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3XavwQY0BeO8JRdnaMHHFLtlt5AiBGJz
O1 - Hosts: CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFNnDCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4Vgd
O1 - Hosts: 6yojxS!zkvYSqt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgI
O1 - Hosts: DRbtCEPhbKNpxU5Rsnnlr!hqKgfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3Xavw
O1 - Hosts: Y0BeO8JRdnaMHHFLtlt5AiBGJz4CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFN
O1 - Hosts: DCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4VgdE6yojxS!zk
O1 - Hosts: qt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgIoBIDRbtCEPhbKNpxU5Rsnnlr!hq
O1 - Hosts: gfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3XavwQY0BeO8JRdnaMHHFLtlt5AiBGJz
O1 - Hosts: CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFNnDCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4Vgd
O1 - Hosts: 6yojxS!zkvYSqt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgI
O1 - Hosts: DRbtCEPhbKNpxU5Rsnnlr!hqKgfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3Xavw
O1 - Hosts: Y0BeO8JRdnaMHHFLtlt5AiBGJz4CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFN
O1 - Hosts: DCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4VgdE6yojxS!zk
O1 - Hosts: qt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgIoBIDRbtCEPhbKNpxU5Rsnnlr!hq
O1 - Hosts: gfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3XavwQY0BeO8JRdnaMHHFLtlt5AiBGJz
O1 - Hosts: CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFNnDCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4Vgd
O1 - Hosts: 6yojxS!zkvYSqt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgI
O1 - Hosts: DRbtCEPhbKNpxU5Rsnnlr!hqKgfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3Xavw
O1 - Hosts: Y0BeO8JRdnaMHHFLtlt5AiBGJz4CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFN
O1 - Hosts: DCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4VgdE6yojxS!zk
O1 - Hosts: qt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgIoBIDRbtCEPhbKNpxU5Rsnnlr!hq
O1 - Hosts: gfympfKiTQuhFujzMrrbbIT9F4E8sGsphDA2IV3XavwQY0BeO8JRdnaMHHFLtlt5AiBGJz
O1 - Hosts: CcUOBZODT7LLvfMcrImHqv1MJBXUkLelguyQfhsEy8pMaxqdQ22Z6NFNnDCV14TmFwdSUiRQcpO6Pz6wu3G2KPjP4Vgd
O1 - Hosts: 6yojxS!zkvYSqt7uAKx!jkioQY8HXQejmcGZQwbdCafws9nSSozOlJkN0D0leAgI
O1 - Hosts: DRbtCEPd9GJltQ1Npjjhn7dmGcbuilbGePMrdCqfwInn99EP5BZA4oColdAwYERYT8rs
O1 - Hosts: U6xaK4FN!j8IDDBHphp1weyCFv1y0QKxVKzP3HHrbI0nEiDmrQIFxTQgHahcquMbdoAu5mI8tm!MXXV
O1 - Hosts: JBJjzyRQZPiBs!OReNT0lK2Lv3sqYCXGLfLZRc!A2ukftO7vgrUOnp3qwGt7ggekMV4DTSafi0CVMt9!y8bso5kOP
O1 - Hosts: hFgJ6z6iawcEkxEzN9pyALd9GJltQ1Npjjhn7dmGcbuilbGePMrdCqfwInn99EP5BZA4oC
O1 - Hosts: ldAwYERYT8rsSU6xaK4FN!j8IDDBHphp1weyCFv1y0QKx
O1 - Hosts: P3HHrbI0nEiDmrQIFxTQgHahcquMbdoAu5mI8tm!MXXV2JBJjzyRQZPiB
O1 - Hosts: !OReNT0lK2Lv3sqYCXGLfLZRc!A2ukftO7vgrUOnp3qwGt7gge
O1 - Hosts: MV4DTSafi0CVMt9!y8bso5kOPkvKhFgJ6z6iawcEk
O1 - Hosts: N9pyALd9GJltQ1Npjjhn7dmGcbuilbGePMrdCqfwInn99EP5BZA4oColdA
O1 - Hosts: YERYT8rsSU6xaK4FN!j8IDDBHphp1weyCFv1y0QKxVKzP3HHrbI0nE
O1 - Hosts: DmrQIFxTQgHahcquMbdoAu5mI8tm!MXXV2JBJjz
O1 - Hosts: ZPiBs!OReNT0lK2Lv3sqYCXGLfLZRc!A2ukftO7vgrUOnp3qwGt7ggekMV4DTSafi0CVMt9!y8bso5kOPkv
O1 - Hosts: hFgJ6z6iawcEkxEzN9pyALd9GJltQ1Npjjhn7dmGcbuilbGePMrdCqfwInn99EP5BZA4oC
O1 - Hosts: ldAwYERYT8rsSU6xaK4FN!j8IDDBHphp1weyCFv1y0QKx
O1 - Hosts: KzP3HHrbI0nEiDmrQIFxTQgHahcquMbdoAu5mI8tm!MXXV2JBJjzyRQZPiBs!OReNT0lK2Lv3sqYCXGLfLZ
O1 - Hosts: A2ukftO7vgrUOnp3qwGt7ggekMV4DTSafi0CVMt9!y8bso5kOPkvKhFgJ6z6iawcEkxEzN9pyALd9GJltQ1Npjjhn7dmGcbuilb
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [MSODESNV7] C:\WINDOWS\system32\msvmiode.exe
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\DOCUME~1\PETRNO~1\LOCALS~1\Temp\2500423.exe
O4 - HKCU\..\Run: [psysjo3] C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1455\psyjo3.exe
O4 - HKCU\..\RunOnce: [17303586] "C:\DOCUME~1\PETRNO~1\LOCALS~1\DATAAP~1\17303586.exe" 3 40
O4 - HKLM\..\Policies\Explorer\Run: [Microsoft Driver Setup] C:\WINDOWS\cfdrive32.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [cleansweep.exe] C:\cleansweep.exe\cleansweep.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: syscron.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ Lite - {E59EB121-F339-4851-A3BA-FE49C35617C2} - ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {E59EB121-F339-4851-A3BA-FE49C35617C2} - ICQ.exe (file missing)
O17 - HKLM\System\CCS\Services\Tcpip\..\{3DC7322A-0B46-4823-969C-1EF0A435A0E3}: NameServer = 217.117.216.7
O17 - HKLM\System\CCS\Services\Tcpip\..\{EFB4421D-B824-4D44-926B-62B0C51CD0FA}: NameServer = 217.117.216.7
O17 - HKLM\System\CS1\Services\Tcpip\..\{3DC7322A-0B46-4823-969C-1EF0A435A0E3}: NameServer = 217.117.216.7
O17 - HKLM\System\CS2\Services\Tcpip\..\{3DC7322A-0B46-4823-969C-1EF0A435A0E3}: NameServer = 217.117.216.7
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO EasyVPN VNC Service (CrdphService) - COMODO - C:\Program Files\COMODO\EasyVPN\crdphService.exe
O23 - Service: COMODO EasyVPN Service (EasyVpnAdpt) - Unknown owner - C:\Program Files\COMODO\EasyVPN\Vpnservice.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ralink Registry Writer (RalinkRegistryWriter) - Unknown owner - C:\Program Files\TP-LINK\TL-WN321G\COMMON\RegistryWriter.exe
O23 - Service: Windows Service Manager (svchost32) - Unknown owner - C:\WINDOWS\system32\DirectX\svchost.exe

--
End of file - 14601 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-12-10 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-08-07 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2010-03-25 968000]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"MSODESNV7"=C:\WINDOWS\system32\msvmiode.exe [2010-09-20 192512]
"Advanced DHTML Enable"=C:\DOCUME~1\PETRNO~1\LOCALS~1\Temp\2500423.exe [2010-09-24 45056]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"Microsoft Driver Setup"=C:\WINDOWS\cfdrive32.exe [2010-09-17 102400]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"psysjo3"=C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1455\psyjo3.exe [2010-09-22 24576]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"17303586"=C:\DOCUME~1\PETRNO~1\LOCALS~1\DATAAP~1\17303586.exe [2010-09-29 1244672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^TL-WN321G Wireless Utility.lnk]
C:\PROGRA~1\TP-LINK\TL-WN3~1\COMMON\ApUI.exe [2010-08-07 1011712]

C:\Documents and Settings\Petr Novak\Nabídka Start\Programy\Po spuštění
syscron.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2006-05-03 61440]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"HonorAutorunSetting"=1
"NoRecentDocsNetHood"=1
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"HonorAutorunSetting"=1
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\ICQLite\icq.exe"="C:\Program Files\ICQLite\icq.exe:*:Enabled:ICQ Lite"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Documents and Settings\Petr Novak\Local Settings\Data aplikací\Google\Google Talk Plugin\googletalkplugin.dll"="C:\Documents and Settings\Petr Novak\Local Settings\Data aplikací\Google\Google Talk Plugin\googletalkplugin.dll:*:Enabled:Google Talk Plugin"
"C:\Documents and Settings\Petr Novak\Local Settings\Data aplikací\Google\Google Talk Plugin\googletalkplugin.exe"="C:\Documents and Settings\Petr Novak\Local Settings\Data aplikací\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\VALVe\Counter-Strike Source\hl2.exe"="C:\Program Files\VALVe\Counter-Strike Source\hl2.exe:*:Enabled:hl2"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQLite\icq.exe"="C:\Program Files\ICQLite\icq.exe:*:Enabled:ICQ Lite"

======List of files/folders created in the last 1 months======

2010-09-18 21:43:53 ----A---- C:\WINDOWS\system32\41.exe
2010-09-18 21:21:06 ----A---- C:\WINDOWS\system32\63.exe
2010-09-18 20:02:48 ----A---- C:\WINDOWS\system32\54.exe
2010-09-17 14:05:07 ----A---- C:\WINDOWS\system32\22.exe
2010-09-11 08:42:56 ----A---- C:\WINDOWS\system32\10.exe
2010-09-10 10:00:06 ----A---- C:\WINDOWS\system32\74.exe
2010-09-10 09:26:42 ----A---- C:\WINDOWS\system32\73.exe
2010-09-10 09:23:21 ----A---- C:\WINDOWS\system32\87.exe
2010-09-10 08:40:56 ----A---- C:\WINDOWS\system32\04.exe
2010-09-09 22:23:58 ----A---- C:\WINDOWS\system32\35.exe
2010-09-09 20:40:06 ----A---- C:\WINDOWS\system32\76.exe
2010-09-09 20:19:02 ----A---- C:\WINDOWS\system32\53.exe
2010-09-09 19:33:25 ----A---- C:\WINDOWS\system32\81.exe
2010-09-09 18:47:17 ----A---- C:\WINDOWS\system32\47.exe
2010-09-09 18:26:50 ----A---- C:\WINDOWS\system32\66.exe
2010-09-09 18:03:32 ----A---- C:\WINDOWS\system32\37.exe
2010-09-09 17:20:08 ----A---- C:\WINDOWS\system32\56.exe
2010-09-09 16:46:44 ----A---- C:\WINDOWS\system32\68.exe
2010-09-09 16:13:26 ----A---- C:\WINDOWS\system32\07.exe
2010-09-09 15:55:29 ----A---- C:\WINDOWS\system32\14.exe
2010-09-09 15:40:11 ----A---- C:\WINDOWS\system32\06.exe
2010-09-09 15:32:59 ----A---- C:\WINDOWS\system32\25.exe
2010-09-08 16:03:55 ----A---- C:\WINDOWS\system32\46.exe
2010-09-04 15:10:52 ----A---- C:\WINDOWS\Sysvxd.exe

======List of files/folders modified in the last 1 months======

2010-09-30 13:29:54 ----D---- C:\Documents and Settings\Petr Novak\Data aplikací\uTorrent
2010-09-30 13:29:52 ----D---- C:\Program Files\trend micro
2010-09-30 13:20:15 ----D---- C:\WINDOWS\Prefetch
2010-09-30 13:11:31 ----D---- C:\WINDOWS
2010-09-30 13:10:41 ----D---- C:\WINDOWS\Temp
2010-09-30 12:41:36 ----D---- C:\Program Files\ICQLite
2010-09-30 12:08:51 ----N---- C:\WINDOWS\SchedLgU.Txt
2010-09-29 10:37:10 ----D---- C:\Documents and Settings\Petr Novak\Data aplikací\icq
2010-09-27 10:46:53 ----D---- C:\Documents and Settings\Petr Novak\Data aplikací\vlc
2010-09-26 15:38:52 ----D---- C:\Soldat
2010-09-26 15:38:49 ----RSD---- C:\WINDOWS\Fonts
2010-09-26 15:33:57 ----D---- C:\WINDOWS\system32\CatRoot2
2010-09-22 14:26:21 ----SHD---- C:\RECYCLER
2010-09-20 11:10:47 ----A---- C:\WINDOWS\system32\msvmiode.exe
2010-09-18 21:43:53 ----D---- C:\WINDOWS\system32
2010-09-18 21:27:31 ----A---- C:\WINDOWS\system32\82.exe
2010-09-18 20:38:06 ----D---- C:\Program Files\Microsoft
2010-09-18 19:46:28 ----A---- C:\WINDOWS\system32\15.exe
2010-09-17 14:38:55 ----A---- C:\WINDOWS\ExplorerSrv.exe
2010-09-17 14:21:34 ----A---- C:\WINDOWS\system32\08.exe
2010-09-17 14:04:26 ----N---- C:\WINDOWS\cfdrive32.exe
2010-09-09 22:45:36 ----HD---- C:\WINDOWS\inf
2010-09-09 21:50:13 ----A---- C:\WINDOWS\system32\44.exe
2010-09-09 20:58:57 ----A---- C:\WINDOWS\system32\00.exe
2010-09-09 19:32:21 ----A---- C:\WINDOWS\system32\50.exe
2010-09-09 19:13:20 ----SHD---- C:\WINDOWS\Installer
2010-09-09 19:13:04 ----D---- C:\Program Files\Opera
2010-09-08 15:47:29 ----A---- C:\WINDOWS\system32\03.exe
2010-09-04 14:12:02 ----D---- C:\WINDOWS\system32\DirectX

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 giveio;giveio; C:\WINDOWS\system32\giveio.sys [1996-04-03 5248]
R0 speedfan;speedfan; C:\WINDOWS\system32\speedfan.sys [2006-09-24 5248]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-08-06 691696]
R0 uagp35;Filtr Microsoft AGPv3.5; C:\WINDOWS\system32\DRIVERS\uagp35.sys [2008-04-14 44672]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 SiSkp;SiSkp; C:\WINDOWS\system32\DRIVERS\srvkp.sys [2007-08-03 18688]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.7.5.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2010-02-04 21361]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-05-03 1540608]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51; C:\WINDOWS\system32\DRIVERS\sisnicxp.sys [2006-02-14 32768]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2006-03-09 222848]
S3 akphrhnb;akphrhnb; C:\WINDOWS\system32\drivers\akphrhnb.sys []
S3 ATP;Comodo EasyVPN Miniport Driver; C:\WINDOWS\system32\DRIVERS\cmdatp.sys [2010-03-26 17816]
S3 catchme;catchme; \??\C:\DOCUME~1\PETRNO~1\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2010-02-03 26176]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 RT73;TL-WN321G USB Wireless Adapter; C:\WINDOWS\system32\DRIVERS\rt73.sys [2008-10-21 465152]
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-13 20992]
S3 SiS315;SiS315; C:\WINDOWS\system32\DRIVERS\sisgrp.sys [2007-08-03 321536]
S3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\system32\DRIVERS\sisnic.sys [2008-04-14 32768]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 snpstd2;VideoCAM Look; C:\WINDOWS\system32\DRIVERS\snpstd2.sys [2004-07-28 334080]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-08-28 40448]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-05-03 413696]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 CrdphService;COMODO EasyVPN VNC Service; C:\Program Files\COMODO\EasyVPN\crdphService.exe [2010-03-29 491768]
R2 EasyVpnAdpt;COMODO EasyVPN Service; C:\Program Files\COMODO\EasyVPN\Vpnservice.exe [2010-03-29 45304]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-12-10 153376]
R2 RalinkRegistryWriter;Ralink Registry Writer; C:\Program Files\TP-LINK\TL-WN321G\COMMON\RegistryWriter.exe [2009-01-05 69632]
R2 svchost32;Windows Service Manager; C:\WINDOWS\system32\DirectX\svchost.exe [2010-09-04 48508]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2006-05-03 520192]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2010-01-22 545576]

-----------------EOF-----------------

[vyosek]

Zdravim a pekny den preji

A tohle jste "nakoupil" prosim kde Uprimne, zaliskane jak jetel to mate

Stahnete na plochu RKill http://download.bleepingcomputer.com/grinler/rkill.com

• Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
• Spustte tradicne dvojklikem - program probehne temer okamzite a ukonci i svou cinnost
• RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
• V zadnem pripade ted nerestartujte PC - prisli byste o ucinek RKillu

Pri stahovani ComboFixu (navod a postup nize), jej ulozte jako Beruska.com

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Vložte do PC vsechny USB klice (flash disky, ext.disky apod.)
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

[darth]

Dobrý den,
sam se divim kde se to vzalo.. zde log z comboFixu
dělal sem ho na 2x, protože poprvé se to ukončilo těsně před koncem díky Security Tool.ink, ten sem poté smazal z dat aplikací a podruhé vše proběhlo jak mělo.

ComboFix 10-09-29.04 - Petr Novak 30.09.2010 16:16:59.7.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1018.544 [GMT 2:00]
Spuštěný z: c:\documents and settings\Petr Novak\Plocha\Beruska.com.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Internet Explorer\dmlconf.dat
c:\program files\Microsoft\DesktopLayer.exe
c:\windows\ExplorerSrv.exe
.
---- Předchozí spuštění -------
.
c:\cleansweep.exe\cleansweep.exe
c:\cleansweep.exe\config.bin
c:\program files\Internet Explorer\complete.dat
c:\program files\Internet Explorer\dmlconf.dat
c:\program files\Microsoft\DesktopLayer.exe
c:\windows\cfdrive32.exe
c:\windows\ExplorerSrv.exe
c:\windows\hosts
c:\windows\system32\00.exe
c:\windows\system32\03.exe
c:\windows\system32\04.exe
c:\windows\system32\06.exe
c:\windows\system32\07.exe
c:\windows\system32\08.exe
c:\windows\system32\10.exe
c:\windows\system32\14.exe
c:\windows\system32\15.exe
c:\windows\system32\22.exe
c:\windows\system32\25.exe
c:\windows\system32\30.exe
c:\windows\system32\35.exe
c:\windows\system32\37.exe
c:\windows\system32\41.exe
c:\windows\system32\44.exe
c:\windows\system32\46.exe
c:\windows\system32\47.exe
c:\windows\system32\50.exe
c:\windows\system32\53.exe
c:\windows\system32\54.exe
c:\windows\system32\56.exe
c:\windows\system32\57.exe
c:\windows\system32\63.exe
c:\windows\system32\66.exe
c:\windows\system32\68.exe
c:\windows\system32\73.exe
c:\windows\system32\74.exe
c:\windows\system32\76.exe
c:\windows\system32\81.exe
c:\windows\system32\82.exe
c:\windows\system32\85.exe
c:\windows\system32\87.exe
c:\windows\system32\hosts
c:\windows\system32\msvmiode.exe
c:\windows\Sysvxd.exe

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SVCHOST32
-------\Service_svchost32


((((((((((((((((((((((((( Soubory vytvořené od 2010-08-28 do 2010-09-30 )))))))))))))))))))))))))))))))
.

2010-09-30 13:54 . 2010-09-30 13:54 -------- d--h--w- c:\windows\PIF
2010-09-30 13:11 . 2010-09-30 13:29 -------- d-----w- C:\Beruska.com
2010-09-30 13:00 . 2010-08-08 09:59 81920 --sh--r- c:\documents and settings\Administrator\Data aplikací\ltzqai.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-30 14:21 . 2010-08-06 22:07 -------- d-----w- c:\program files\Microsoft
2010-09-30 13:04 . 2010-07-22 19:23 -------- d-----w- c:\program files\trend micro
2010-09-30 12:05 . 2009-12-22 11:39 -------- d-----w- c:\program files\ICQLite
2010-09-26 13:38 . 2010-01-06 16:19 1 ----a-w- c:\documents and settings\Petr Novak\Data aplikací\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-09-20 09:08 . 2010-08-13 14:00 69469 ----a-w- c:\windows\system32\drivers\hosts
2010-09-09 17:13 . 2009-12-09 20:06 -------- d-----w- c:\program files\Opera
2010-08-23 07:56 . 2010-08-20 15:10 -------- d-----w- c:\program files\syst
2010-08-13 14:00 . 2010-08-13 14:00 64512 ----a-w- c:\windows\system32\syscache.exe
2010-08-08 22:10 . 2010-08-07 10:07 -------- d-----w- c:\program files\riva
2010-08-08 09:59 . 2010-08-04 16:14 81920 --sh--r- c:\documents and settings\Petr Novak\Data aplikací\ltzqai.exe
2010-08-07 09:51 . 2010-08-07 09:51 -------- d-----w- c:\program files\COMODO
2010-08-07 09:50 . 2010-08-06 20:25 544736 ---ha-w- c:\documents and settings\All Users\Data aplikací\COMODO\EasyVPN\$instmp\Dpinst.exe
2010-08-06 22:07 . 2010-07-31 10:57 163840 ----a-w- c:\documents and settings\Petr Novak\Data aplikací\Soldat\Battleye\BEClient.dll
2010-08-06 22:07 . 2010-07-31 10:57 155648 ----a-w- c:\documents and settings\Petr Novak\Data aplikací\Soldat\Battleye\BEServer.dll
2010-08-06 22:07 . 2010-02-04 16:13 589824 ----a-w- c:\documents and settings\All Users\Data aplikací\TP-LINK Driver\TL-WN321G Wireless Utility\Driver\RaInst.exe
2010-08-06 22:07 . 2010-02-04 16:13 253952 ----a-w- c:\documents and settings\All Users\Data aplikací\TP-LINK Driver\TL-WN321G Wireless Utility\Driver\CoInstaller.dll
2010-08-06 19:29 . 2010-08-06 19:29 0 ----a-w- c:\windows\system32\Access.dat
2010-08-06 18:24 . 2010-08-06 18:24 -------- d-----w- c:\program files\Microsoft Games
2010-08-06 17:02 . 2010-08-06 17:02 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-08-06 17:02 . 2009-12-10 18:42 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-08-06 17:02 . 2009-12-10 18:42 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-08-04 09:57 . 2010-03-31 12:46 -------- d-----w- c:\program files\Hamachi
2010-08-03 20:04 . 2010-08-03 20:04 -------- d-----w- c:\program files\gta2gh
2010-08-03 19:44 . 2010-08-03 19:44 -------- d-----w- c:\program files\gta2
2010-08-03 18:27 . 2010-08-03 18:18 -------- d-----w- c:\program files\Tremulous
2010-07-31 10:57 . 2010-07-31 10:57 0 ----a-r- C:\logwmemory.bin
2010-07-16 12:48 . 2009-12-09 19:41 2426 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-07-16 12:47 . 2009-12-09 19:41 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-07-16 10:39 . 2009-12-09 19:41 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-07-11 16:58 . 2010-07-11 16:58 1078 ----a-r- c:\documents and settings\Petr Novak\Data aplikací\Microsoft\Installer\{6C472DFC-6D44-4947-9E1A-F79A2469D953}\_A17AA8D98E556D75E7296B.exe
2010-07-11 16:58 . 2010-07-11 16:58 1078 ----a-r- c:\documents and settings\Petr Novak\Data aplikací\Microsoft\Installer\{6C472DFC-6D44-4947-9E1A-F79A2469D953}\_511E40F8F51A826696DCAB.exe
.

------- Sigcheck -------

[-] 2008-06-12 . 977034D14621DE018E779C672DDF8472 . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\tcpip.sys

[-] 2008-12-18 . C71BB4782833750BF4C02AC30ED670B7 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-07-22_22.03.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-08-06 17:21 . 2010-08-06 17:21 82432 c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\msxml4r.dll
+ 2010-09-30 14:21 . 2010-09-30 14:21 16384 c:\windows\Temp\Perflib_Perfdata_f8.dat
+ 2002-02-04 00:43 . 2002-02-04 00:43 82432 c:\windows\system32\msxml4r.dll
+ 2010-08-07 09:51 . 2010-03-26 12:41 17816 c:\windows\system32\DRVSTORE\cmdatp_C7DE50010EA94305AA4A39FB4D88FBD33905C161\cmdatp.sys
+ 2010-08-06 19:29 . 2009-09-16 06:02 27136 c:\windows\system32\drivers\tap0901t.sys
+ 2009-09-23 08:41 . 2010-02-03 13:56 26176 c:\windows\system32\drivers\hamachi.sys
+ 2010-08-07 09:30 . 2010-03-26 12:41 17816 c:\windows\system32\drivers\cmdatp.sys
+ 2010-09-04 12:10 . 2010-09-04 12:10 48508 c:\windows\system32\DirectX\svchost.exe
- 2009-12-09 19:46 . 2010-07-21 16:55 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-12-09 19:46 . 2010-09-29 08:36 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-12-09 19:46 . 2010-09-29 08:36 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-12-09 19:46 . 2010-07-21 16:55 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-08-07 10:07 . 2010-09-29 08:36 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2010-07-21 16:55 . 2010-07-21 16:55 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-08-06 17:21 . 2010-08-06 17:21 89600 c:\windows\Installer\f7f6c.msi
+ 2009-12-09 20:06 . 2010-08-07 09:17 118952 c:\windows\system32\FNTCACHE.DAT
+ 2010-08-06 17:21 . 2010-08-06 17:21 1230336 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.1.0.0_x-ww_b319d8da\msxml4.dll
+ 2002-02-04 00:52 . 2002-02-04 00:52 1230336 c:\windows\system32\msxml4.dll
+ 2010-09-09 17:13 . 2010-09-09 17:13 2647552 c:\windows\Installer\cca017.msi
+ 2010-08-07 09:51 . 2010-08-07 09:51 1227264 c:\windows\Installer\8e914.msi
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Petr Novak\Nabˇdka Start\Programy\Po spuçtŘnˇ\
syscron.exe [2008-4-14 107008]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,,c:\program files\microsoft\desktoplayer.exe"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^TL-WN321G Wireless Utility.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\TL-WN321G Wireless Utility.lnk
backup=c:\windows\pss\TL-WN321G Wireless Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\ICQLite\\icq.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\Petr Novak\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Petr Novak\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\VALVe\\Counter-Strike Source\\hl2.exe"=

R2 CrdphService;COMODO EasyVPN VNC Service;c:\program files\COMODO\EasyVPN\crdphService.exe [29.3.2010 17:44 491768]
R2 EasyVpnAdpt;COMODO EasyVPN Service;c:\program files\COMODO\EasyVPN\Vpnservice.exe [29.3.2010 17:44 45304]
S3 ATP;Comodo EasyVPN Miniport Driver;c:\windows\system32\drivers\cmdatp.sys [7.8.2010 11:30 17816]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10.12.2009 20:42 691696]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q=%s
TCP: {3DC7322A-0B46-4823-969C-1EF0A435A0E3} = 217.117.216.7
TCP: {EFB4421D-B824-4D44-926B-62B0C51CD0FA} = 217.117.216.7
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKU-Default-Run-cleansweep.exe - c:\cleansweep.exe\cleansweep.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-30 16:22
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...


c:\documents and settings\Petr Novak\Nabídka Start\Programy\Po spuštění\syscron.exe 107008 bytes executable

sken byl úspešně dokončen
skryté soubory: 1

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(532)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\TP-LINK\TL-WN321G\COMMON\RegistryWriter.exe
c:\program files\Internet Explorer\iexplore.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Celkový čas: 2010-09-30 16:25:52 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-09-30 14:25
ComboFix2.txt 2010-07-25 20:28
ComboFix3.txt 2010-07-22 22:19

Před spuštěním: 4 113 620 992
Po spuštění: 4 116 590 592

- - End Of File - - 3F6AF32F89C6AE4FCA2721E01370272B

[vyosek]

Nasledujici soubory otestujte na VirusTotalu (viz muj podpis)

• c:\documents and settings\Petr Novak\Nabídka Start\Programy\Po spuštění\syscron.exe
  c:\program files\microsoft\desktoplayer.exe
  c:\windows\system32\drivers\tcpip.sys
  c:\windows\system32\sfcfiles.dll
  c:\documents and settings\Administrator\Data aplikací\ltzqai.exe
  c:\windows\system32\syscache.exe
• Kliknete na Prochazet
• Soubor nehledejte, jen vlozte cestu souboru, ktery chci otestovat
• Pokud napise Soubor byl jiz testovan, dejte otestovat znovu
• Kliknete na Otestovat soubor
• Vysledek analyzy sem vlozte (jako odkaz)

Stahnete SytemLook (viz muj podpis) a ulozte jej na plochu

• Do okna vlozte skript nize

• Kód: Vybrat vše

  :filefind
  tcpip.sys
  sfcfiles.dll

• Kliknete na Look
• Tlacitko Look se zmeni na Scanning a zsedne
• Pockejte pokud se tlacitko Scanning opet nezmeni na Look - tak poznate ze SystemLook dokoncil svou praci
• Vyskoci na Vas log s nazvem SystemLook (pripadne bude ulozen na plose), jeho obsah mi sem vlozte

[darth]

odkazy z VirusTotal:
syscron- http://www.virustotal.com/file-scan/rep ... 1285862078
deskoplayer nešel poslat
tcpip- http://www.virustotal.com/file-scan/rep ... 1285865808
sfcfiles- http://www.virustotal.com/file-scan/rep ... 1285866041
ltzgai- http://www.virustotal.com/file-scan/rep ... 1285866231
syscache- http://www.virustotal.com/file-scan/rep ... 1285866503

SystemLook 04.09.10 by jpshortstuff
Log created at 19:25 on 30/09/2010 by Petr Novak
Administrator - Elevation successful

========== filefind ==========

Searching for "tcpip.sys"
C:\WINDOWS\system32\drivers\tcpip.sys --a---- 361344 bytes [08:16 12/06/2008] [08:16 12/06/2008] 977034D14621DE018E779C672DDF8472

Searching for "sfcfiles.dll"
C:\WINDOWS\system32\sfcfiles.dll --a---- 1571840 bytes [18:15 18/12/2008] [18:15 18/12/2008] C71BB4782833750BF4C02AC30ED670B7

-= EOF =-

[vyosek]

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  Collect::
  c:\documents and settings\Petr Novak\Nabídka Start\Programy\Po spuštění\syscron.exe
  c:\documents and settings\Petr Novak\Data aplikací\ltzqai.exe
  c:\windows\system32\syscache.exe
  c:\program files\microsoft\desktoplayer.exe
  
  Registry::
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
  "Userinit"="c:\windows\system32\userinit.exe"
  
  DDS::
  uStart Page = hxxp://start.icq.com/
  uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=%s

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

[darth]

ComboFix 10-09-30.03 - Petr Novak 01.10.2010 10:55:53.8.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1018.739 [GMT 2:00]
Spuštěný z: c:\documents and settings\Petr Novak\Plocha\Beruska.com.exe
Použité ovládací přepínače :: c:\documents and settings\Petr Novak\Plocha\CFScript.txt

file zipped: c:\documents and settings\Petr Novak\Data aplikací\ltzqai.exe
file zipped: c:\documents and settings\Petr Novak\Nabídka Start\Programy\Po spuštění\syscron.exe
file zipped: c:\program files\microsoft\desktoplayer.exe
file zipped: c:\windows\system32\syscache.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Internet Explorer\dmlconf.dat
c:\program files\microsoft\desktoplayer.exe
c:\windows\system32\syscache.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-09-01 do 2010-10-01 )))))))))))))))))))))))))))))))
.

2010-09-30 14:13 . 2010-09-30 14:25 -------- d-----w- C:\Beruska.com1292B
2010-09-30 13:54 . 2010-09-30 13:54 -------- d--h--w- c:\windows\PIF
2010-09-30 13:11 . 2010-09-30 13:29 -------- d-----w- C:\Beruska.com
2010-09-30 13:00 . 2010-08-08 09:59 81920 --sh--r- c:\documents and settings\Administrator\Data aplikací\ltzqai.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-01 08:59 . 2010-08-06 22:07 -------- d-----w- c:\program files\Microsoft
2010-10-01 08:35 . 2009-12-22 11:39 -------- d-----w- c:\program files\ICQLite
2010-09-30 13:04 . 2010-07-22 19:23 -------- d-----w- c:\program files\trend micro
2010-09-26 13:38 . 2010-01-06 16:19 1 ----a-w- c:\documents and settings\Petr Novak\Data aplikací\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-09-20 09:08 . 2010-08-13 14:00 69469 ----a-w- c:\windows\system32\drivers\hosts
2010-09-09 17:13 . 2009-12-09 20:06 -------- d-----w- c:\program files\Opera
2010-08-23 07:56 . 2010-08-20 15:10 -------- d-----w- c:\program files\syst
2010-08-08 22:10 . 2010-08-07 10:07 -------- d-----w- c:\program files\riva
2010-08-08 09:59 . 2010-08-04 16:14 81920 --sh--r- c:\documents and settings\Petr Novak\Data aplikací\ltzqai.exe
2010-08-07 09:51 . 2010-08-07 09:51 -------- d-----w- c:\program files\COMODO
2010-08-07 09:50 . 2010-08-06 20:25 544736 ---ha-w- c:\documents and settings\All Users\Data aplikací\COMODO\EasyVPN\$instmp\Dpinst.exe
2010-08-06 22:07 . 2010-07-31 10:57 163840 ----a-w- c:\documents and settings\Petr Novak\Data aplikací\Soldat\Battleye\BEClient.dll
2010-08-06 22:07 . 2010-07-31 10:57 155648 ----a-w- c:\documents and settings\Petr Novak\Data aplikací\Soldat\Battleye\BEServer.dll
2010-08-06 22:07 . 2010-02-04 16:13 589824 ----a-w- c:\documents and settings\All Users\Data aplikací\TP-LINK Driver\TL-WN321G Wireless Utility\Driver\RaInst.exe
2010-08-06 22:07 . 2010-02-04 16:13 253952 ----a-w- c:\documents and settings\All Users\Data aplikací\TP-LINK Driver\TL-WN321G Wireless Utility\Driver\CoInstaller.dll
2010-08-06 19:29 . 2010-08-06 19:29 0 ----a-w- c:\windows\system32\Access.dat
2010-08-06 18:24 . 2010-08-06 18:24 -------- d-----w- c:\program files\Microsoft Games
2010-08-06 17:02 . 2010-08-06 17:02 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-08-06 17:02 . 2009-12-10 18:42 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-08-06 17:02 . 2009-12-10 18:42 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-08-04 09:57 . 2010-03-31 12:46 -------- d-----w- c:\program files\Hamachi
2010-08-03 20:04 . 2010-08-03 20:04 -------- d-----w- c:\program files\gta2gh
2010-08-03 19:44 . 2010-08-03 19:44 -------- d-----w- c:\program files\gta2
2010-08-03 18:27 . 2010-08-03 18:18 -------- d-----w- c:\program files\Tremulous
2010-07-31 10:57 . 2010-07-31 10:57 0 ----a-r- C:\logwmemory.bin
2010-07-16 12:48 . 2009-12-09 19:41 2426 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-07-16 12:47 . 2009-12-09 19:41 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-07-16 10:39 . 2009-12-09 19:41 8972 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2010-07-11 16:58 . 2010-07-11 16:58 1078 ----a-r- c:\documents and settings\Petr Novak\Data aplikací\Microsoft\Installer\{6C472DFC-6D44-4947-9E1A-F79A2469D953}\_A17AA8D98E556D75E7296B.exe
2010-07-11 16:58 . 2010-07-11 16:58 1078 ----a-r- c:\documents and settings\Petr Novak\Data aplikací\Microsoft\Installer\{6C472DFC-6D44-4947-9E1A-F79A2469D953}\_511E40F8F51A826696DCAB.exe
.

------- Sigcheck -------

[-] 2008-06-12 . 977034D14621DE018E779C672DDF8472 . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\tcpip.sys

[-] 2008-12-18 . C71BB4782833750BF4C02AC30ED670B7 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2010-07-22_22.03.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-08-06 17:21 . 2010-08-06 17:21 82432 c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\msxml4r.dll
+ 2010-10-01 08:31 . 2010-10-01 08:31 16384 c:\windows\Temp\Perflib_Perfdata_730.dat
+ 2002-02-04 00:43 . 2002-02-04 00:43 82432 c:\windows\system32\msxml4r.dll
+ 2010-08-07 09:51 . 2010-03-26 12:41 17816 c:\windows\system32\DRVSTORE\cmdatp_C7DE50010EA94305AA4A39FB4D88FBD33905C161\cmdatp.sys
+ 2010-08-06 19:29 . 2009-09-16 06:02 27136 c:\windows\system32\drivers\tap0901t.sys
+ 2009-09-23 08:41 . 2010-02-03 13:56 26176 c:\windows\system32\drivers\hamachi.sys
+ 2010-08-07 09:30 . 2010-03-26 12:41 17816 c:\windows\system32\drivers\cmdatp.sys
+ 2010-09-04 12:10 . 2010-09-04 12:10 48508 c:\windows\system32\DirectX\svchost.exe
+ 2009-12-09 19:46 . 2010-09-29 08:36 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-12-09 19:46 . 2010-07-21 16:55 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-12-09 19:46 . 2010-09-29 08:36 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-12-09 19:46 . 2010-07-21 16:55 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-08-06 17:21 . 2010-08-06 17:21 89600 c:\windows\Installer\f7f6c.msi
+ 2009-12-09 20:06 . 2010-08-07 09:17 118952 c:\windows\system32\FNTCACHE.DAT
+ 2010-08-06 17:21 . 2010-08-06 17:21 1230336 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.1.0.0_x-ww_b319d8da\msxml4.dll
+ 2002-02-04 00:52 . 2002-02-04 00:52 1230336 c:\windows\system32\msxml4.dll
+ 2010-09-09 17:13 . 2010-09-09 17:13 2647552 c:\windows\Installer\cca017.msi
+ 2010-08-07 09:51 . 2010-08-07 09:51 1227264 c:\windows\Installer\8e914.msi
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Petr Novak\Nabˇdka Start\Programy\Po spuçtŘnˇ\
syscron.exe [2008-4-14 107008]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 1 (0x1)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^TL-WN321G Wireless Utility.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\TL-WN321G Wireless Utility.lnk
backup=c:\windows\pss\TL-WN321G Wireless Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\ICQLite\\icq.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\Petr Novak\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Petr Novak\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\VALVe\\Counter-Strike Source\\hl2.exe"=

R2 CrdphService;COMODO EasyVPN VNC Service;c:\program files\COMODO\EasyVPN\crdphService.exe [29.3.2010 17:44 491768]
R2 EasyVpnAdpt;COMODO EasyVPN Service;c:\program files\COMODO\EasyVPN\Vpnservice.exe [29.3.2010 17:44 45304]
S3 ATP;Comodo EasyVPN Miniport Driver;c:\windows\system32\drivers\cmdatp.sys [7.8.2010 11:30 17816]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10.12.2009 20:42 691696]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q=%s
TCP: {3DC7322A-0B46-4823-969C-1EF0A435A0E3} = 217.117.216.7
TCP: {EFB4421D-B824-4D44-926B-62B0C51CD0FA} = 217.117.216.7
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-01 10:59
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(516)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2010-10-01 11:01:35
ComboFix-quarantined-files.txt 2010-10-01 09:01
ComboFix2.txt 2010-09-30 14:25
ComboFix3.txt 2010-07-25 20:28
ComboFix4.txt 2010-07-22 22:19

Před spuštěním: 1 515 507 712
Po spuštění: 1 510 813 696

- - End Of File - - 9ACB11EF53C7DFCDD9194FB5A8D3661F
Nahr nˇ probŘhlo ŁspŘçnŘ

[vyosek]

Jak se chova PC

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) (viz muj podpis)

• Provedte aktualizaci - treti zalozka
• Provedte uplny sken - nic nemazte
• MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

[darth]

Jede o poznání líp, žádné chyby nevyskakují.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4727

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

1.10.2010 14:50:49
mbam-log-2010-10-01 (14-50-49).txt

Typ skenu: Úplný sken (C:\|)
Skenované objekty: 238072
Uplynulý čas: 55 minuta(y), 5 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 2
Infikované složky: 2
Infikované soubory: 78

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\program files\microsoft\desktoplayer.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (c:\windows\system32\userinit.exe,,c:\program files\microsoft\desktoplayer.exe) Good: (userinit.exe) -> No action taken.

Infikované složky:
C:\WINDOWS\system32\config\systemprofile\Data aplikací\Desktop Security 2010 (Rogue.DesktopSecurity2010) -> No action taken.
C:\WINDOWS\system32\config\systemprofile\Nabídka Start\Programy\Desktop Security 2010 (Rogue.DesktopSecurity2010) -> No action taken.

Infikované soubory:
C:\Beruska.com\NircmdBSrv.exe (Trojan.Zbot) -> No action taken.
C:\Beruska.com\pevSrv.exe (Trojan.Zbot) -> No action taken.
C:\Beruska.com\SFSrv.exe (Trojan.Zbot) -> No action taken.
C:\Beruska.com\SWREGSrv.exe (Trojan.Zbot) -> No action taken.
C:\Program Files\Google\Google Talk\googletalkSrv.exe (Trojan.Zbot) -> No action taken.
C:\Program Files\ICQLite\icqSrv.exe (Trojan.Zbot) -> No action taken.
C:\Program Files\Opera\operaSrv.exe (Trojan.Zbot) -> No action taken.
C:\Program Files\Internet Explorer\iexploreSrv.exe (Trojan.Zbot) -> No action taken.
C:\Program Files\Microsoft\DesktopLayer.exe (Trojan.Agent) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\cfdrive32.exe.vir (Backdoor.Bot) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\ExplorerSrv.exe.vir (Trojan.Agent) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\00.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\03.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\04.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\06.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\07.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\08.exe.vir (Worm.Palevo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\10.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\14.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\15.exe.vir (Worm.Palevo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\22.exe.vir (Worm.Palevo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\25.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\30.exe.vir (Trojan.Agent) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\35.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\37.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\41.exe.vir (Worm.Palevo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\44.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\46.exe.vir (Worm.Palevo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\47.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\50.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\53.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\54.exe.vir (Worm.Palevo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\56.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\57.exe.vir (Trojan.Downloader) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\63.exe.vir (Worm.Palevo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\66.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\68.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\73.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\74.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\76.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\81.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\82.exe.vir (Worm.Palevo) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\87.exe.vir (Worm.Autorun) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\lglxep.sys.vir (Rootkit.Bubnix) -> No action taken.
C:\System Volume Information\_restore{808A901B-B478-4790-A8D8-9A9988BBD41D}\RP294\A0433609.exe (Rogue.SecurityTool) -> No action taken.
C:\System Volume Information\_restore{808A901B-B478-4790-A8D8-9A9988BBD41D}\RP294\A0435569.exe (Trojan.Zbot) -> No action taken.
C:\System Volume Information\_restore{808A901B-B478-4790-A8D8-9A9988BBD41D}\RP294\A0435583.exe (Trojan.Zbot) -> No action taken.
C:\System Volume Information\_restore{808A901B-B478-4790-A8D8-9A9988BBD41D}\RP294\A0436346.exe (Trojan.Zbot) -> No action taken.
C:\System Volume Information\_restore{808A901B-B478-4790-A8D8-9A9988BBD41D}\RP294\A0436975.exe (Rogue.SecurityTool) -> No action taken.
C:\System Volume Information\_restore{808A901B-B478-4790-A8D8-9A9988BBD41D}\RP294\A0437042.exe (Trojan.Zbot) -> No action taken.
C:\System Volume Information\_restore{808A901B-B478-4790-A8D8-9A9988BBD41D}\RP294\A0437085.exe (Backdoor.Bot) -> No action taken.
C:\System Volume Information\_restore{808A901B-B478-4790-A8D8-9A9988BBD41D}\RP294\A0437086.exe (Backdoor.Bot) -> No action taken.
C:\System Volume Information\_restore{808A901B-B478-4790-A8D8-9A9988BBD41D}\RP294\A0437098.exe (Backdoor.Bot) -> No action taken.
C:\System Volume Information\_restore{808A901B-B478-4790-A8D8-9A9988BBD41D}\RP294\A0437099.exe (Backdoor.Bot) -> No action taken.
C:\System Volume Information\_restore{808A901B-B478-4790-A8D8-9A9988BBD41D}\RP294\A0437155.exe (Trojan.Zbot) -> No action taken.
C:\System Volume Information\_restore{808A901B-B478-4790-A8D8-9A9988BBD41D}\RP294\A0437168.exe (Backdoor.Bot) -> No action taken.
C:\System Volume Information\_restore{808A901B-B478-4790-A8D8-9A9988BBD41D}\RP294\A0437169.exe (Backdoor.Bot) -> No action taken.
C:\System Volume Information\_restore{808A901B-B478-4790-A8D8-9A9988BBD41D}\RP294\A0437211.exe (Trojan.Zbot) -> No action taken.
C:\System Volume Information\_restore{808A901B-B478-4790-A8D8-9A9988BBD41D}\RP294\A0437212.exe (Trojan.Zbot) -> No action taken.
C:\System Volume Information\_restore{808A901B-B478-4790-A8D8-9A9988BBD41D}\RP294\A0437222.exe (Trojan.Zbot) -> No action taken.
C:\System Volume Information\_restore{808A901B-B478-4790-A8D8-9A9988BBD41D}\RP294\A0437270.exe (Backdoor.Bot) -> No action taken.
C:\System Volume Information\_restore{808A901B-B478-4790-A8D8-9A9988BBD41D}\RP294\A0437271.exe (Backdoor.Bot) -> No action taken.
C:\WINDOWS\system32\config\systemprofile\Data aplikací\Desktop Security 2010\securitycenter.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\config\systemprofile\Data aplikací\Desktop Security 2010\securityhelper.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\config\systemprofile\Data aplikací\Desktop Security 2010\Desktop Security 2010.exe (Rogue.DesktopSecurity2010) -> No action taken.
C:\WINDOWS\system32\config\systemprofile\Data aplikací\Desktop Security 2010\taskmgr.dll (Rogue.DesktopSecurity2010) -> No action taken.
C:\WINDOWS\system32\config\systemprofile\Nabídka Start\Programy\Desktop Security 2010\Activate Desktop Security 2010.lnk (Rogue.DesktopSecurity2010) -> No action taken.
C:\WINDOWS\system32\config\systemprofile\Nabídka Start\Programy\Desktop Security 2010\Desktop Security 2010.lnk (Rogue.DesktopSecurity2010) -> No action taken.
C:\WINDOWS\system32\config\systemprofile\Nabídka Start\Programy\Desktop Security 2010\Help Desktop Security 2010.lnk (Rogue.DesktopSecurity2010) -> No action taken.
C:\WINDOWS\system32\config\systemprofile\Nabídka Start\Programy\Desktop Security 2010\How to Activate Desktop Security 2010.lnk (Rogue.DesktopSecurity2010) -> No action taken.
C:\Documents and Settings\Petr Novak\Data aplikací\avdrn.dat (Malware.Trace) -> No action taken.
C:\Documents and Settings\Petr Novak\Data aplikací\ltzqai.exe (Worm.Palevo) -> No action taken.
C:\Documents and Settings\Administrator\Data aplikací\ltzqai.exe (Worm.Palevo) -> No action taken.
C:\Documents and Settings\Petr Novak\Data aplikací\usernt.dat (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\config\systemprofile\Nabídka Start\Programy\Desktop Security 2010.LNK (Rogue.DesktopSecurity2010) -> No action taken.
C:\Documents and Settings\Petr Novak\Nabídka Start\Programy\Security Tool.LNK (Rogue.SecurityTool) -> No action taken.
C:\Documents and Settings\Petr Novak\Nabídka Start\Programy\Po spuštění\syscron.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\DirectX\svchost.exe (Trojan.Agent) -> No action taken.

[vyosek]

Boha jeho, to se da nakoupit prosim kde

Vse co nasel MBAM smazat a doporucuji sken zopakovat - log opet rad uvidim...

[darth]

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4727

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

2.10.2010 17:48:50
mbam-log-2010-10-02 (17-48-50).txt

Typ skenu: Úplný sken (C:\|)
Skenované objekty: 238491
Uplynulý čas: 51 minuta(y), 0 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 2
Infikované složky: 0
Infikované soubory: 2

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\program files\microsoft\desktoplayer.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (c:\windows\system32\userinit.exe,,c:\program files\microsoft\desktoplayer.exe) Good: (userinit.exe) -> No action taken.

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\Program Files\Microsoft\DesktopLayer.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\ExplorerSrv.exe (Trojan.Agent) -> No action taken.

[vyosek]

Vse smazat a zopakovat sken, mam pocit ze se ta mrcha stale vraci

[vyosek]

Po skenu MBAM jeste udelejte tohle

Odinstalujte vsechny emulatory virtualnich jednotek (Deamon Tools, Alcohol 120%, PowerISO apod)

Stahnete SPTD http://www.duplexsecure.com/en/downloads

• Vyberte z uvedene stranky verzi dle sveho operacniho systemu (32(x86)bit ci 64(x64)bit)
• Ulozte na plochu a spustte
• Zvolte moznost Uninstall a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte

Stahnete Defogger http://www.jpshortstuff.247fixes.com/Defogger.exe

• Ulozte na plochu a spustte
• Kliknete na Disable a restartujte PC - pokud nepujde kliknout (tlacitko bude sede), krok preskocte

Stahnete MBR na plochu http://www2.gmer.net/mbr/mbr.exe

Kliknete na Start a pote Spustit, pripadne pouzijte klavesou zkratku Win+R

• Vyskoci na Vas okenko, do ktereho zkopirujte text nize

• Kód: Vybrat vše

  "%userprofile%\plocha\mbr" -t

• Kliknete na OK
• Na plose se Vam vytvori log s nazvem mbr.txt, jeho obsah mi sem vlozte

Dejte logy z Gmeru - viz muj podpis

• Pokud bude gmer v normalnim rezimu padat, tak provest sken v nouzovem (restart PC, mackat F8, zvolit Stav nouze s praci v siti)

[darth]

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8643FEC5]<<
kernel: MBR read successfully
user & kernel MBR OK
______________________________

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-10-02 20:55:50
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\PETRNO~1\LOCALS~1\Temp\awayyfog.sys


---- Devices - GMER 1.0.15 ----

Device -> \Driver\atapi \Device\Harddisk0\DR0 862A4EC5

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

---- EOF - GMER 1.0.15 ----
_____________________________________________

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-10-03 09:53:17
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\PETRNO~1\LOCALS~1\Temp\awayyfog.sys


---- Kernel code sections - GMER 1.0.15 ----

.rsrc C:\WINDOWS\system32\DRIVERS\i8042prt.sys entry point in ".rsrc" section [0xF75A5194]

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\svchost.exe[828] ntdll.dll!NtProtectVirtualMemory 7C90D6D0 5 Bytes JMP 0085000A
.text C:\WINDOWS\system32\svchost.exe[828] ntdll.dll!NtWriteVirtualMemory 7C90DF90 5 Bytes JMP 00BC000A
.text C:\WINDOWS\system32\svchost.exe[828] ntdll.dll!KiUserExceptionDispatcher 7C90E45C 5 Bytes JMP 0084000C
.text C:\WINDOWS\system32\svchost.exe[828] ole32.dll!CoCreateInstance 774F057E 5 Bytes JMP 00C8000A
.text C:\Program Files\Internet Explorer\iexplore.exe[1144] ntdll.dll!NtProtectVirtualMemory 7C90D6D0 5 Bytes JMP 0147000A
.text C:\Program Files\Internet Explorer\iexplore.exe[1144] ntdll.dll!NtWriteVirtualMemory 7C90DF90 5 Bytes JMP 0148000A
.text C:\Program Files\Internet Explorer\iexplore.exe[1144] ntdll.dll!KiUserExceptionDispatcher 7C90E45C 5 Bytes JMP 0146000C
.text C:\WINDOWS\Explorer.EXE[1148] ntdll.dll!NtProtectVirtualMemory 7C90D6D0 5 Bytes JMP 00BA000A
.text C:\WINDOWS\Explorer.EXE[1148] ntdll.dll!NtWriteVirtualMemory 7C90DF90 5 Bytes JMP 00BB000A
.text C:\WINDOWS\Explorer.EXE[1148] ntdll.dll!KiUserExceptionDispatcher 7C90E45C 5 Bytes JMP 00B9000C

---- Devices - GMER 1.0.15 ----

Device -> \Driver\atapi \Device\Harddisk0\DR0 862A4EC5

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x57 0x55 0x67 0x54 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x3F 0x14 0xF7 0x2A ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x2D 0x9C 0xC1 0x0E ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x57 0x55 0x67 0x54 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x3F 0x14 0xF7 0x2A ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x2D 0x9C 0xC1 0x0E ...

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\DRIVERS\i8042prt.sys suspicious modification
File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

---- EOF - GMER 1.0.15 ----

[vyosek]

Nasledujici soubory otestujte na VirusTotalu (viz muj podpis)

• C:\WINDOWS\system32\DRIVERS\i8042prt.sys
  C:\WINDOWS\system32\drivers\atapi.sys
• Kliknete na Prochazet
• Soubor nehledejte, jen vlozte cestu souboru, ktery chci otestovat
• Pokud napise Soubor byl jiz testovan, dejte otestovat znovu
• Kliknete na Otestovat soubor
• Vysledek analyzy sem vlozte (jako odkaz)

Stahnete SytemLook (viz muj podpis) a ulozte jej na plochu

• Do okna vlozte skript nize

• Kód: Vybrat vše

  :filefind
  i8042prt.sys
  atapi.sys

• Kliknete na Look
• Tlacitko Look se zmeni na Scanning a zsedne
• Pockejte pokud se tlacitko Scanning opet nezmeni na Look - tak poznate ze SystemLook dokoncil svou praci
• Vyskoci na Vas log s nazvem SystemLook (pripadne bude ulozen na plose), jeho obsah mi sem vlozte