poprosim o kontrolu

[ringov]

Logfile of random's system information tool 1.08 (written by random/random)
Run by Administrator at 2011-04-10 16:43:50
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 3 GB (37%) free of 8 GB
Total RAM: 511 MB (17% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 04:46, on 10.4.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Spyware Terminator\SpyWareTerminator.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Crawler\Toolbar\CToolbar.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\explorer.exe
E:\rsit\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://pobox.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60327
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: &Crawler Toolbar Helper - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: &Crawler Toolbar Helper - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Download with Star Downloader - E:\My Download Files\ACCELELATOR PLUS\Star Downloader\sdie.htm
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AMService - Unknown owner - C:\WINDOWS\TEMP\gerx\setup.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ServiceLayer - Unknown owner - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (file missing)
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 4651 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
&Crawler Toolbar Helper - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2011-04-05 1232520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - &Crawler Toolbar - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2011-04-05 1232520]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2011-04-05 2216960]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2010-12-20 443728]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
C:\WINDOWS\SOUNDMAN.EXE [2006-11-17 577536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator^Nabídka Start^Programy^Po spuštění^setup_9.0.0.722_09.04.2011_10-43.lnk]
E:\kasper\VIRUSR~1\SETUP_~1.20~\startup.exe []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"="C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Enabled:Crawler Spyware Terminator"
"D:\hry\Nová složka (2)\age2_x1.exe"="D:\hry\Nová složka (2)\age2_x1.exe:*:Enabled:Age of Empires II Expansion"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2011-04-10 16:43:50 ----D---- C:\rsit
2011-04-10 14:39:09 ----SHD---- C:\RECYCLER
2011-04-10 14:36:31 ----D---- C:\WINDOWS\temp
2011-04-10 14:36:27 ----A---- C:\ComboFix.txt
2011-04-10 14:15:05 ----A---- C:\WINDOWS\zip.exe
2011-04-10 14:15:05 ----A---- C:\WINDOWS\SWXCACLS.exe
2011-04-10 14:15:05 ----A---- C:\WINDOWS\SWSC.exe
2011-04-10 14:15:05 ----A---- C:\WINDOWS\SWREG.exe
2011-04-10 14:15:05 ----A---- C:\WINDOWS\sed.exe
2011-04-10 14:15:05 ----A---- C:\WINDOWS\PEV.exe
2011-04-10 14:15:05 ----A---- C:\WINDOWS\NIRCMD.exe
2011-04-10 14:15:05 ----A---- C:\WINDOWS\MBR.exe
2011-04-10 14:15:05 ----A---- C:\WINDOWS\grep.exe
2011-04-10 14:14:35 ----D---- C:\Qoobox
2011-04-10 12:36:54 ----D---- C:\Documents and Settings\All Users\Data aplikací\Google
2011-04-10 09:33:06 ----D---- C:\Program Files\Defraggler
2011-04-10 07:21:49 ----D---- C:\WINDOWS\system32\PreInstall
2011-04-10 07:21:43 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2011-04-10 07:21:43 ----HD---- C:\WINDOWS\$hf_mig$
2011-04-10 01:10:38 ----A---- C:\WINDOWS\system32\drivers\rootrepeal.sys
2011-04-09 09:21:29 ----D---- C:\WINDOWS\system32\NtmsData
2011-04-09 07:25:29 ----HD---- C:\WINDOWS\system32\GroupPolicy
2011-04-09 06:46:03 ----D---- C:\WINDOWS\SxsCaPendDel
2011-04-08 15:15:29 ----A---- C:\WINDOWS\system32\drivers\23914352.sys
2011-04-08 15:15:29 ----A---- C:\WINDOWS\system32\drivers\23914351.sys
2011-04-08 15:15:29 ----A---- C:\WINDOWS\system32\drivers\2391435.sys
2011-04-08 13:30:36 ----D---- C:\Program Files\CCleaner
2011-04-08 13:29:03 ----D---- C:\Program Files\Google
2011-04-08 13:02:34 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2011-04-08 13:02:23 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2011-04-08 13:02:23 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2011-04-08 10:04:50 ----A---- C:\WINDOWS\system32\ChCfg.exe
2011-04-08 10:04:25 ----RA---- C:\WINDOWS\system32\drivers\alcxwdm.sys
2011-04-08 10:03:43 ----D---- C:\Program Files\Realtek AC97
2011-04-08 10:03:41 ----A---- C:\WINDOWS\system32\RTLCPL.exe
2011-04-08 10:03:37 ----A---- C:\WINDOWS\soundman.exe
2011-04-08 10:03:36 ----A---- C:\WINDOWS\system32\RtlCPAPI.dll
2011-04-08 10:03:32 ----A---- C:\WINDOWS\alcupd.exe
2011-04-08 10:03:32 ----A---- C:\WINDOWS\Alcrmv.exe
2011-04-07 11:48:26 ----D---- C:\Program Files\trend micro
2011-04-06 16:53:19 ----N---- C:\WINDOWS\cmaudio.ini
2011-04-06 16:53:19 ----D---- C:\Program Files\C-Media
2011-04-06 15:48:38 ----A---- C:\WINDOWS\system32\uxtuneup.dll
2011-04-06 15:24:35 ----ASH---- C:\pagefile.sys
2011-04-06 08:49:29 ----SHD---- C:\Documents and Settings\All Users\Data aplikací\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2011-04-06 00:05:19 ----D---- C:\Program Files\WinClamAVShield
2011-04-05 23:00:08 ----D---- C:\Program Files\Crawler
2011-04-05 22:59:59 ----A---- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2011-04-05 22:59:57 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Spyware Terminator
2011-04-05 22:59:45 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2011-04-05 22:59:42 ----D---- C:\Program Files\Spyware Terminator
2011-04-05 22:50:52 ----D---- C:\Program Files\Secunia
2011-04-05 21:30:29 ----D---- C:\WINDOWS\WBEM
2011-04-05 21:28:55 ----HDC---- C:\WINDOWS\ie8
2011-04-05 21:28:55 ----D---- C:\WINDOWS\system32\cs-CZ
2011-04-04 17:15:57 ----HD---- C:\Program Files\WindowsUpdate
2011-04-04 15:56:13 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2011-04-04 15:34:35 ----N---- C:\Boot.bak
2011-04-04 15:34:26 ----RASHD---- C:\cmdcons
2011-04-04 15:29:15 ----D---- C:\WINDOWS\ERDNT
2011-04-04 13:46:48 ----D---- C:\Program Files\ESET
2011-04-03 10:36:56 ----N---- C:\AILog.txt
2011-04-01 10:37:23 ----A---- C:\WINDOWS\WEBTRANS.INI
2011-04-01 10:36:28 ----A---- C:\WINDOWS\WEBWTR.INI
2011-04-01 10:36:15 ----D---- C:\WINDOWS\XXLGS

======List of files/folders modified in the last 1 months======

2011-04-10 15:07:47 ----D---- C:\WINDOWS\system32
2011-04-10 15:04:37 ----D---- C:\WINDOWS\pss
2011-04-10 15:01:26 ----SHD---- C:\WINDOWS\Installer
2011-04-10 15:01:26 ----D---- C:\Program Files\Common Files
2011-04-10 15:01:26 ----D---- C:\Config.Msi
2011-04-10 14:58:40 ----RD---- C:\Program Files
2011-04-10 14:56:33 ----D---- C:\WINDOWS\system32\drivers
2011-04-10 14:55:52 ----D---- C:\WINDOWS\WinSxS
2011-04-10 14:55:31 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-04-10 14:46:53 ----D---- C:\WINDOWS
2011-04-10 14:44:24 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-04-10 14:44:18 ----D---- C:\WINDOWS\system32\CatRoot2
2011-04-10 14:31:36 ----A---- C:\WINDOWS\system.ini
2011-04-10 14:31:08 ----D---- C:\WINDOWS\system32\drivers\etc
2011-04-10 14:25:16 ----D---- C:\WINDOWS\AppPatch
2011-04-10 12:36:34 ----SD---- C:\WINDOWS\Tasks
2011-04-10 10:34:18 ----D---- C:\WINDOWS\Minidump
2011-04-10 10:10:00 ----D---- C:\WINDOWS\Prefetch
2011-04-10 08:21:37 ----D---- C:\WINDOWS\SoftwareDistribution
2011-04-10 08:20:03 ----HD---- C:\WINDOWS\inf
2011-04-10 07:41:01 ----SHD---- C:\System Volume Information
2011-04-10 07:41:01 ----D---- C:\WINDOWS\system32\Restore
2011-04-09 22:43:21 ----D---- C:\Program Files\7-Zip
2011-04-09 22:43:10 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2011-04-09 12:02:00 ----D---- C:\Program Files\WinRAR
2011-04-09 10:06:47 ----D---- C:\WINDOWS\system32\config
2011-04-09 09:26:00 ----D---- C:\WINDOWS\repair
2011-04-09 09:25:30 ----D---- C:\WINDOWS\Registration
2011-04-09 09:21:27 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2011-04-08 13:36:10 ----D---- C:\Documents and Settings\Administrator\Data aplikací\IDM
2011-04-08 13:36:01 ----D---- C:\WINDOWS\Debug
2011-04-08 12:56:16 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-04-08 10:03:31 ----HD---- C:\Program Files\InstallShield Installation Information
2011-04-08 10:02:59 ----D---- C:\Program Files\Common Files\InstallShield
2011-04-08 09:48:52 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-04-06 15:37:28 ----RSH---- C:\boot.ini
2011-04-06 15:37:28 ----A---- C:\WINDOWS\win.ini
2011-04-06 09:07:30 ----D---- C:\Documents and Settings\All Users\Data aplikací\TuneUp Software
2011-04-06 08:58:39 ----D---- C:\ProgramData
2011-04-06 08:55:12 ----D---- C:\Documents and Settings\Administrator\Data aplikací\TuneUp Software
2011-04-06 08:17:50 ----D---- C:\Documents and Settings
2011-04-05 23:11:04 ----A---- C:\WINDOWS\system32\deployJava1.dll
2011-04-05 21:52:02 ----D---- C:\Program Files\Mozilla Firefox
2011-04-05 21:32:51 ----D---- C:\WINDOWS\Help
2011-04-05 21:32:51 ----D---- C:\Program Files\Internet Explorer
2011-04-05 21:30:19 ----D---- C:\WINDOWS\Media
2011-03-28 22:12:08 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Skype
2011-03-28 21:13:19 ----D---- C:\Documents and Settings\Administrator\Data aplikací\skypePM

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 23914352;23914352 Boot Guard Driver; C:\WINDOWS\system32\DRIVERS\23914352.sys [2009-10-22 37392]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2007-03-08 43528]
R0 sisagp;Filtr SIS sběrnice AGP ; C:\WINDOWS\System32\DRIVERS\sisagp.sys [2004-08-03 41088]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
R1 23914351;23914351; C:\WINDOWS\system32\DRIVERS\23914351.sys [2009-09-25 128016]
R1 setup_9.0.0.722_08.04.2011_14-41drv;setup_9.0.0.722_08.04.2011_14-41drv; C:\WINDOWS\system32\DRIVERS\2391435.sys [2009-10-09 315408]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R2 Fallback;Fallback; C:\WINDOWS\System32\DRIVERS\HSF_FALL.sys [2001-08-17 289887]
R2 Fsks;Fsks; C:\WINDOWS\System32\DRIVERS\HSF_FSKS.sys [2001-08-17 115807]
R2 K56;K56; C:\WINDOWS\System32\DRIVERS\HSF_K56K.sys [2001-08-17 391199]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [2004-08-03 11868]
R2 SoftFax;SoftFax; C:\WINDOWS\System32\DRIVERS\HSF_FAXX.sys [2001-08-17 199711]
R2 SpeakerPhone;SpeakerPhone; C:\WINDOWS\System32\DRIVERS\HSF_SPKP.sys [2001-08-17 73279]
R2 Tones;Tones; C:\WINDOWS\System32\DRIVERS\HSF_TONE.sys [2001-08-17 50751]
R2 V124;V124; C:\WINDOWS\System32\DRIVERS\HSF_V124.sys [2001-08-17 488383]
R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2005-02-23 11776]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2006-12-29 4026112]
R3 basic2;basic2; C:\WINDOWS\System32\DRIVERS\HSF_BSC2.sys [2001-08-17 67167]
R3 hsf_msft;hsf_msft; C:\WINDOWS\System32\DRIVERS\HSF_MSFT.sys [2001-08-17 542879]
R3 PAC207;Trust WB-1400T Webcam; C:\WINDOWS\system32\DRIVERS\PFC027.SYS [2007-05-14 508288]
R3 Rksample;Rksample; C:\WINDOWS\System32\DRIVERS\HSF_SAMP.sys [2001-08-17 57471]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
R3 S3SAVAGE4M;S3SAVAGE4M; C:\WINDOWS\System32\DRIVERS\s3sav4m.sys [2001-08-17 77824]
S1 SASDIFSV;SASDIFSV; \??\E:\My Download Files\antispywer\SASDIFSV.SYS []
S1 SASKUTIL;SASKUTIL; \??\E:\My Download Files\antispywer\SASKUTIL.sys []
S3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS []
S3 AmdLLD;AMD Low Level Device Driver; C:\WINDOWS\system32\DRIVERS\AmdLLD.sys []
S3 catchme;catchme; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 GMSIPCI;GMSIPCI; \??\F:\INSTALL\GMSIPCI.SYS []
S3 HSF_DP;HSF_DP; C:\WINDOWS\System32\DRIVERS\HSFDPSP2.sys [2004-08-03 1041536]
S3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\System32\DRIVERS\HSFBS2S2.sys [2004-08-03 220032]
S3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
S3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-18 2944]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 NTACCESS;NTACCESS; \??\F:\NTACCESS.sys []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys []
S3 SASENUM;SASENUM; \??\E:\My Download Files\antispywer\SASENUM.SYS []
S3 SetupNTGLM7X;SetupNTGLM7X; \??\F:\NTGLM7X.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 utqwndey;AVZ Kernel Driver; \??\C:\WINDOWS\system32\Drivers\utqwndey.sys []
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2011-04-05 496128]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
S2 AMService;AMService; C:\WINDOWS\TEMP\gerx\setup.exe run []
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-30 69632]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-09-26 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe []
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S4 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]

-----------------EOF-----------------

[vyosek]

Zdravim a pekny den preji

Vy umite pouzivate ComboFix - cist jeho log a nasledne vytvorit skript na docisteni ze si jej tak pouzivate CFko neni hracka - vizte nize

Nebezpeci CFka

• Je urcen primarne pro radce - jeho svevolnym pouzitim ztracite narok na podporu
• Maze stopy po haveti, takze v logu z RSIT neni nic videt
• Jeho log je treba dolustit, jelikoz neumi smazat vse - to ovsem tezko zvladnete pokud k tomu nejste vyskolen
• CF muze mit bug = sunda Vam system, pokud nevite kam co uklada, jak co obnovit, mate system v kytkam a ceka Vas reinstal
• CF taky bohuzel prozatim nekontroluje nektere dulezite knihovny (napr. hal.dll) - ty treba mazou nektere typy haveti (napr. angela) - smaze Vam po restartu hal.dll = nenajede Vam system a jste o radek vyse = reinstal

Poprosim tedy o log z CFka, je ulozen v c:\combofix.txt

[ringov]

ComboFix 11-04-09.01 - Administrator 10.04.2011 14:18:06.8.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.421.1029.18.511.217 [GMT 2:00]
Running from: E:\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\Dokumenty\cc_20110409_160558.reg
.
.
((((((((((((((((((((((((( Files Created from 2011-03-10 to 2011-04-10 )))))))))))))))))))))))))))))))
.
.
2011-04-10 07:33 . 2011-04-10 07:33 -------- d-----w- c:\program files\Defraggler
2011-04-10 05:21 . 2011-04-10 06:18 -------- d--h--w- c:\windows\$hf_mig$
2011-04-09 23:10 . 2011-04-09 23:12 34816 ----a-w- c:\windows\system32\drivers\rootrepeal.sys
2011-04-09 09:02 . 2009-10-22 11:54 37392 ----a-w- c:\windows\system32\drivers\85739342.sys
2011-04-09 09:02 . 2009-10-09 21:31 315408 ----a-w- c:\windows\system32\drivers\8573934.sys
2011-04-09 09:02 . 2009-09-25 15:59 128016 ----a-w- c:\windows\system32\drivers\85739341.sys
2011-04-09 07:21 . 2011-04-09 07:37 -------- d-----w- c:\windows\system32\NtmsData
2011-04-09 05:25 . 2011-04-09 05:25 -------- d--h--w- c:\windows\system32\GroupPolicy
2011-04-09 04:46 . 2011-04-09 08:08 -------- d-----w- c:\windows\SxsCaPendDel
2011-04-08 13:15 . 2009-10-22 11:54 37392 ----a-w- c:\windows\system32\drivers\23914352.sys
2011-04-08 13:15 . 2009-10-09 21:31 315408 ----a-w- c:\windows\system32\drivers\2391435.sys
2011-04-08 13:15 . 2009-09-25 15:59 128016 ----a-w- c:\windows\system32\drivers\23914351.sys
2011-04-08 11:34 . 2011-04-08 11:34 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Data aplikací\Google
2011-04-08 11:30 . 2011-04-08 11:30 -------- d-----w- c:\program files\CCleaner
2011-04-08 11:29 . 2011-04-10 07:33 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Temp
2011-04-08 11:29 . 2011-04-08 11:29 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Data aplikací\Google
2011-04-08 11:29 . 2011-04-10 10:36 -------- d-----w- c:\program files\Google
2011-04-08 11:02 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-08 11:02 . 2011-04-09 20:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-04-08 11:02 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-04-08 08:50 . 2011-04-08 08:50 12288 ----a-w- c:\windows\system32\drivers\sp_prot.sys
2011-04-08 08:50 . 2011-04-08 08:50 -------- d-----w- c:\program files\System Protect
2011-04-08 08:04 . 2006-08-01 13:02 49152 ----a-w- c:\windows\system32\ChCfg.exe
2011-04-08 08:04 . 2006-12-29 12:48 4026112 ----a-r- c:\windows\system32\drivers\alcxwdm.sys
2011-04-08 08:02 . 2011-04-08 08:02 331908 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\setup.dll
2011-04-07 11:22 . 2011-04-07 11:22 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache
2011-04-07 09:48 . 2011-04-09 20:49 -------- d-----w- c:\program files\trend micro
2011-04-06 14:53 . 2011-04-06 14:53 -------- d-----w- c:\program files\C-Media
2011-04-06 14:05 . 2011-04-06 14:05 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2011-04-06 13:48 . 2010-12-14 12:39 29504 ----a-w- c:\windows\system32\uxtuneup.dll
2011-04-06 07:08 . 2011-04-06 07:08 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2011-04-06 06:49 . 2011-04-06 06:49 -------- d-sh--w- c:\documents and settings\All Users\Data aplikací\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2011-04-05 22:05 . 2011-04-10 05:15 -------- d-----w- c:\program files\WinClamAVShield
2011-04-05 21:13 . 2011-04-05 21:13 -------- d-----w- c:\program files\Common Files\Java
2011-04-05 21:13 . 2011-04-05 21:11 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-04-05 21:00 . 2011-04-05 21:00 -------- d-----w- c:\program files\Crawler
2011-04-05 20:59 . 2011-04-05 20:59 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2011-04-05 20:59 . 2011-04-10 09:16 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Spyware Terminator
2011-04-05 20:59 . 2011-04-10 07:22 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spyware Terminator
2011-04-05 20:59 . 2011-04-10 07:18 -------- d-----w- c:\program files\Spyware Terminator
2011-04-05 20:51 . 2011-04-05 20:51 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Secunia PSI
2011-04-05 20:50 . 2011-04-05 20:50 -------- d-----w- c:\program files\Secunia
2011-04-05 20:11 . 2011-04-05 20:11 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2011-04-05 19:52 . 2011-03-18 18:05 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-04-05 19:52 . 2011-03-18 18:05 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-04-05 19:52 . 2011-03-18 18:05 728024 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-04-05 19:52 . 2011-03-18 18:05 1975768 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-04-05 19:52 . 2011-03-18 18:05 1893336 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-04-05 19:52 . 2011-03-18 18:05 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-04-05 19:52 . 2011-03-18 18:05 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-04-05 19:52 . 2011-03-18 18:05 142296 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-04-05 19:33 . 2011-04-05 19:33 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2011-04-05 19:28 . 2011-04-05 19:30 -------- d-----w- c:\windows\system32\cs-CZ
2011-04-05 19:28 . 2011-04-05 19:29 -------- dc-h--w- c:\windows\ie8
2011-04-04 11:46 . 2011-04-05 21:25 -------- d-----w- c:\program files\ESET
2011-04-01 08:36 . 2011-04-01 08:36 -------- d-----w- c:\windows\XXLGS
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-05 21:11 . 2010-08-02 15:22 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-03-06 17:06 . 2011-03-06 16:46 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll
2011-03-06 17:01 . 2010-09-26 23:31 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-02-26 13:06 . 2011-02-26 13:06 172032 ----a-w- c:\windows\system32\AniGIF.ocx
2011-03-18 18:05 . 2011-04-05 19:52 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2011-04-05 2216960]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]
.
[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Nabídka Start^Programy^Po spuštění^setup_9.0.0.722_09.04.2011_10-43.lnk]
path=c:\documents and settings\Administrator\Nabídka Start\Programy\Po spuštění\setup_9.0.0.722_09.04.2011_10-43.lnk
backup=c:\windows\pss\setup_9.0.0.722_09.04.2011_10-43.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-17 13:49 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2010-12-20 16:08 443728 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2006-11-17 03:42 577536 ----a-w- c:\windows\soundman.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-10-29 12:49 249064 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"d:\\hry\\Nová složka (2)\\age2_x1.exe"=
.
R0 23914352;23914352 Boot Guard Driver;c:\windows\system32\drivers\23914352.sys [8.4.2011 15:15 37392]
R0 85739342;85739342 Boot Guard Driver;c:\windows\system32\drivers\85739342.sys [9.4.2011 11:02 37392]
R1 23914351;23914351;c:\windows\system32\drivers\23914351.sys [8.4.2011 15:15 128016]
R1 85739341;85739341;c:\windows\system32\drivers\85739341.sys [9.4.2011 11:02 128016]
R1 setup_9.0.0.722_08.04.2011_14-41drv;setup_9.0.0.722_08.04.2011_14-41drv;c:\windows\system32\drivers\2391435.sys [8.4.2011 15:15 315408]
R1 setup_9.0.0.722_09.04.2011_10-43drv;setup_9.0.0.722_09.04.2011_10-43drv;c:\windows\system32\drivers\8573934.sys [9.4.2011 11:02 315408]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [5.4.2011 22:59 142592]
R3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\drivers\PFC027.SYS [14.5.2007 10:26 508288]
R3 S3SAVAGE4M;S3SAVAGE4M;c:\windows\system32\drivers\s3sav4m.sys [7.7.2008 18:00 77824]
R3 sp_prot;System Protect Filter Driver;c:\windows\system32\drivers\sp_prot.sys [8.4.2011 10:50 12288]
S1 SASDIFSV;SASDIFSV;\??\e:\my download files\antispywer\SASDIFSV.SYS --> e:\my download files\antispywer\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\e:\my download files\antispywer\SASKUTIL.sys --> e:\my download files\antispywer\SASKUTIL.sys [?]
S2 AMService;AMService;c:\windows\TEMP\gerx\setup.exe run --> c:\windows\TEMP\gerx\setup.exe run [?]
S2 SP_Service;System Protect Deletion Prevention Service;c:\program files\System Protect\SysProtect_srv.exe [8.4.2011 10:50 598528]
S3 SASENUM;SASENUM;\??\e:\my download files\antispywer\SASENUM.SYS --> e:\my download files\antispywer\SASENUM.SYS [?]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\f:\ntglm7x.sys --> f:\NTGLM7X.sys [?]
S3 utqwndey;AVZ Kernel Driver;\??\c:\windows\system32\Drivers\utqwndey.sys --> c:\windows\system32\Drivers\utqwndey.sys [?]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - MBAMSwissArmy
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://pobox.sk/
mWindow Title = Microsoft Internet Explorer
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 4.00\AMVConverter\grab.html
IE: Crawler Search - tbr:iemenu
IE: Download with Star Downloader - e:\my download files\ACCELELATOR PLUS\Star Downloader\sdie.htm
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 4.00\MediaManager\grab.html
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\sa3oy8yh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2463487&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - pobox.sk
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx? ... 60076&qkw=
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-10 14:31
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1957994488-1677128483-854245398-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,57,fe,94,e8,f9,a9,65,49,b0,f4,f4,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,57,fe,94,e8,f9,a9,65,49,b0,f4,f4,prepacte u z ho asi nepouzijem.Mam virus? \
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,57,fe,94,e8,f9,a9,65,49,b0,f4,f4,\
.
Completion time: 2011-04-10 14:36:24
ComboFix-quarantined-files.txt 2011-04-10 12:36
.
Pre-Run: 2 982 899 712
Post-Run: 2 971 127 808
.
Current=7 Default=7 Failed=6 LastKnownGood=2 Sets=1,2,4,5,6,7
- - End Of File - - 791681F55A87CE4F8047DEEA5BAB67C0

[vyosek]

Zdravim a pekny den preji

Vy umite pouzivate ComboFix - cist jeho log a nasledne vytvorit skript na docisteni ze si jej tak pouzivate CFko neni hracka - vizte nize

[ringov]

mam comp. v poriadku?

[vyosek]

Ja se ptal prvni

[ringov]

nie neviem pouzivet cf,len som si myslel ze to znici viry. uz ho viac nepouzijem.

[vyosek]

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Driver::
  23914352
  85739342
  23914351
  85739341
  setup_9.0.0.722_08.04.2011_14-41drv
  setup_9.0.0.722_09.04.2011_10-43drv
  AMService
  utqwndey
  
  File::
  c:\windows\system32\drivers\23914352.sys
  c:\windows\system32\drivers\85739342.sys
  c:\windows\system32\drivers\23914351.sys
  c:\windows\system32\drivers\85739341.sys
  c:\windows\system32\drivers\2391435.sys
  c:\windows\system32\drivers\8573934.sys
  c:\windows\TEMP\gerx\setup.exe run 
  c:\windows\system32\Drivers\utqwndey.sys 
  
  Registry::
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "AntiVirusOverride"=dword:00000000
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
  
  RegLock::
  [HKEY_USERS\S-1-5-21-1957994488-1677128483-854245398-500\Software\Microsoft\Internet Explorer\User Preferences]
  
  Firefox::
  FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\sa3oy8yh.default\
  FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

[ringov]

<html>
<head><meta http-equiv="content-type" content="text/html;"></head>
<body><b><br> - - ComboFix - - -</b><br><br>
<span>&nbsp;&nbsp;&nbsp;&nbsp;</span>
<a href="https://www.paypal.com/cgi-bin/webscr?c ... et=UTF%2d8">
<img src="QooBox\image001.gif" v:shapes="_x0000_i1103" width="62" border="0" height="31"></a><br><br>
je to ok? dakujem Submit malware to Bleeping Computer for analysis.
<br /><br />
<form enctype="multipart/form-data" action="http://www.bleepingcomputer.com/pf.php" method="post">
<input name="MAX_FILE_SIZE" value="5120000" type="hidden">
<input name="User" value="Submitted via ComboFix." type="hidden">
<input name="Referer" value="hxxp://z11.invisionfree.com/sUBs/index.php?showtopic=119467" type="hidden">
<input name="channel" value="4" type="hidden">
<input name="userfile" size="65" type="file">
<input value="Send" type="submit"><br><br>
Copy/Paste the filepath below into the box above and click Send.
<br /><br /><i>File path ---> </i><B>
C:\Qoobox\Quarantine\[4]-Submit_2011-04-10_22.39.56.zip
</B></form></body></html>

[vyosek]

Asi nejaka chybka

Prihlaste se do nouzoveho rezimu (restart PC, mackat F8, zvolit Stav nouze s praci v siti)

Opakujte krok s aplikovanim skriptu pro ComboFix

[tuvok07]

Chlape, to vám jeden rádce nestačí?!
Podívejte, jak je z vás chudák zmatený, to si nezasloužil.
POKRAČUJTE JEN TU http://www.viry.cz/forum/viewtopic.php? ... 7&start=15 JINAK BUDE ZLE
Vzkaz od torpéda (veverky vědí)

[vyosek]

Vevercak dekuje a prosi o

[Pavuk29]

Vevercak dekuje a prosi o

Pavuk dakuje a prosi o
Jaj kua, zamykam