Infekce

[Teochi]

Nazdar mistři a úctivá poklona . Můj PC byl infikován, šlo o vir typu že se mi stáhnul fake antivir který blokoval veškeré spuštění jakéhékoliv programu, včetně antiviru a začal sosat další sračky do PC . Povedlo se mi vrátit v restore point v nouzáku a ted se to jeví v pořádku, ale tohle mě určitě problému zbavilo pouze dočasně. Posílám tedy svůj log a budu rád, když se mi na něj mrknete

Teochi

log:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Jura at 2011-06-14 16:03:44
Microsoft Windows 7 Professional
System drive C: has 22 GB (37%) free of 60 GB
Total RAM: 3326 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:04:07, on 14.6.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16766)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Security Client\msseces.exe
D:\junior\winamp\winampa.exe
C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
C:\Program Files\Saitek\SD6\Software\SaiMfd.exe
C:\Program Files\Lexmark 2300 Series\lxcgmon.exe
C:\Program Files\Lexmark 2300 Series\ezprint.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
D:\junior\dock\RocketDock\RocketDock.exe
D:\junior\daemon tools\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Opera\opera.exe
D:\junior\totalcmd\TOTALCMD.EXE
D:\zbytek\flash disk\___\oprava\RSIT.exe
C:\Program Files\trend micro\Jura.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [WinampAgent] D:\junior\winamp\winampa.exe
O4 - HKLM\..\Run: [ProfilerU] C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
O4 - HKLM\..\Run: [SaiMfd] C:\Program Files\Saitek\SD6\Software\SaiMfd.exe
O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxcgmon.exe] "C:\Program Files\Lexmark 2300 Series\lxcgmon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2300 Series\ezprint.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [RocketDock] "D:\junior\dock\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\junior\daemon tools\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: lxcg_device - - C:\Windows\system32\lxcgcoms.exe
O23 - Service: @C:\Program Files\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files\Nero\Update\NASvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

--
End of file - 6553 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-01-30 62376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Nero Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2011-02-01 1487240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-04-19 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2011-01-20 988480]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Nero Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2011-02-01 1487240]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2010-11-30 997408]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe [2011-01-30 35736]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-11-15 932288]
"WinampAgent"=D:\junior\winamp\winampa.exe [2010-12-09 74752]
"ProfilerU"=C:\Program Files\Saitek\SD6\Software\ProfilerU.exe [2007-12-07 233472]
"SaiMfd"=C:\Program Files\Saitek\SD6\Software\SaiMfd.exe [2007-12-07 131072]
"LXCGCATS"=rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16 []
"lxcgmon.exe"=C:\Program Files\Lexmark 2300 Series\lxcgmon.exe [2007-04-29 205744]
"EzPrint"=C:\Program Files\Lexmark 2300 Series\ezprint.exe [2007-04-29 103344]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-10-29 249064]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"=D:\junior\dock\RocketDock\RocketDock.exe [2007-09-02 495616]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2010-11-10 4240760]
"DAEMON Tools Lite"=D:\junior\daemon tools\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]

C:\Users\Jura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLinkedConnections"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2011-05-30 18:12:02 ----D---- C:\Program Files\trend micro
2011-05-30 18:12:01 ----D---- C:\rsit
2011-05-28 14:56:24 ----A---- C:\Windows\system32\frapsvid.dll
2011-05-27 18:30:46 ----D---- C:\Windows\system32\appmgmt
2011-05-23 09:02:25 ----D---- C:\Users\Jura\AppData\Roaming\LolClient
2011-05-23 08:57:34 ----A---- C:\Windows\system32\d3dx10_39.dll
2011-05-23 08:57:34 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2011-05-23 08:57:33 ----A---- C:\Windows\system32\D3DX9_39.dll
2011-05-18 20:01:25 ----D---- C:\ProgramData\Electronic Arts
2011-05-18 20:01:25 ----D---- C:\ProgramData\EA Core
2011-05-16 14:50:07 ----A---- C:\Windows\system32\npptNT2.sys

======List of files/folders modified in the last 1 months======

2011-06-14 23:11:13 ----D---- C:\Windows\system32\config
2011-06-14 23:11:10 ----D---- C:\Windows\Tasks
2011-06-14 23:11:10 ----D---- C:\Windows\system32\wfp
2011-06-14 23:11:10 ----D---- C:\Windows\system32\wbem
2011-06-14 23:11:10 ----D---- C:\Windows\system32\DriverStore
2011-06-14 23:11:10 ----D---- C:\Windows\system32\catroot2
2011-06-14 23:11:10 ----D---- C:\Windows
2011-06-14 23:11:09 ----SHD---- C:\Windows\Installer
2011-06-14 23:11:09 ----D---- C:\Windows\AppCompat
2011-06-14 23:11:09 ----D---- C:\Users\Jura\AppData\Roaming\winamp
2011-06-14 23:11:08 ----D---- C:\Users\Jura\AppData\Roaming\GHISLER
2011-06-14 23:11:05 ----D---- C:\Windows\registration
2011-06-14 23:10:56 ----HD---- C:\ProgramData
2011-06-14 16:04:02 ----D---- C:\Windows\Prefetch
2011-06-14 14:31:32 ----D---- C:\Windows\Temp
2011-06-14 14:30:59 ----D---- C:\Windows\System32
2011-06-14 14:30:54 ----A---- C:\Windows\system32\PnkBstrB.exe
2011-06-14 13:23:19 ----SHD---- C:\System Volume Information
2011-06-14 13:16:41 ----D---- C:\Windows\inf
2011-06-14 13:16:41 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-06-14 13:12:20 ----D---- C:\ProgramData\NVIDIA
2011-06-11 12:56:46 ----AD---- C:\ProgramData\TEMP
2011-06-11 12:38:55 ----D---- C:\ProgramData\PMB Files
2011-06-10 14:11:20 ----D---- C:\Users\Jura\AppData\Roaming\vlc
2011-06-07 20:05:23 ----D---- C:\ProgramData\Autodesk
2011-06-07 20:05:03 ----D---- C:\Program Files\Common Files\Autodesk Shared
2011-06-07 20:02:27 ----D---- C:\Windows\winsxs
2011-06-07 19:59:59 ----RSD---- C:\Windows\Fonts
2011-06-07 19:59:15 ----RSD---- C:\Windows\assembly
2011-06-07 19:57:41 ----D---- C:\Program Files\Common Files
2011-06-07 19:47:07 ----D---- C:\Program Files\Autodesk
2011-06-02 11:06:14 ----D---- C:\Program Files\Ask.com
2011-06-02 11:06:12 ----D---- C:\Windows\system32\Tasks
2011-06-01 16:32:36 ----SD---- C:\Users\Jura\AppData\Roaming\Microsoft
2011-05-30 18:30:46 ----D---- C:\Users\Jura\AppData\Roaming\Opera
2011-05-30 18:30:45 ----D---- C:\Program Files\Opera
2011-05-30 18:12:02 ----RD---- C:\Program Files
2011-05-30 17:59:19 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2011-05-29 10:24:08 ----D---- C:\Program Files\Lx_cats
2011-05-23 08:55:06 ----HD---- C:\Program Files\InstallShield Installation Information
2011-05-22 18:53:37 ----D---- C:\Windows\system32\drivers
2011-05-22 18:48:46 ----D---- C:\ProgramData\Skype Extras
2011-05-19 21:19:08 ----D---- C:\Windows\Minidump
2011-05-19 21:19:08 ----D---- C:\Windows\debug
2011-05-19 19:06:17 ----D---- C:\Windows\LiveKernelReports

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2011-03-01 691696]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2010-10-24 165264]
R1 MpKslc1ae8997;MpKslc1ae8997; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A21B6F88-19E9-4D93-A832-77B0196E4A5D}\MpKslc1ae8997.sys [2011-06-14 28752]
R1 MpKsldcfe929e;MpKsldcfe929e; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{607D73BE-5848-426B-8D06-88ED3DABBAFC}\MpKsldcfe929e.sys []
R1 SCDEmu;SCDEmu; C:\Windows\system32\drivers\SCDEmu.sys [2010-04-12 59388]
R1 VBoxDrv;VirtualBox Service; C:\Windows\system32\DRIVERS\VBoxDrv.sys [2011-02-17 160560]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [2011-02-17 44784]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 MpNWMon;Microsoft Malware Protection Network Driver; C:\Windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]
R3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2009-07-14 139776]
R3 SaiK0CEA;SaiK0CEA; C:\Windows\system32\DRIVERS\SaiK0CEA.sys [2008-04-04 104960]
R3 SaiMini;SaiMini; C:\Windows\system32\DRIVERS\SaiMini.sys [2008-01-14 14080]
R3 SaiNtBus;SaiNtBus; C:\Windows\system32\drivers\SaiBus.sys [2008-01-14 35456]
R3 SaiU0CEA;SaiU0CEA; C:\Windows\system32\DRIVERS\SaiU0CEA.sys [2008-04-04 28544]
R3 VBoxNetFlt;VBoxNetFlt Service; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys [2011-02-17 122032]
S1 MpKsl07e36dcb;MpKsl07e36dcb; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{0D881BC3-5BC7-42D1-81B5-0F89920B3D44}\MpKsl07e36dcb.sys []
S1 MpKsl0f66fb88;MpKsl0f66fb88; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D9EF09D0-F88F-4A4D-8C8A-94A0AE14C08C}\MpKsl0f66fb88.sys []
S1 MpKsl3aae8739;MpKsl3aae8739; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{0E8A9EEC-1C36-480C-A38E-85AA1D43A551}\MpKsl3aae8739.sys []
S1 MpKsl5293f604;MpKsl5293f604; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6FB5E7F0-5EBD-4F01-9B3B-9B13777A7F07}\MpKsl5293f604.sys []
S1 MpKsl5e394837;MpKsl5e394837; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6FB5E7F0-5EBD-4F01-9B3B-9B13777A7F07}\MpKsl5e394837.sys []
S1 MpKsl680670ed;MpKsl680670ed; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{0D881BC3-5BC7-42D1-81B5-0F89920B3D44}\MpKsl680670ed.sys []
S1 MpKsld4b6afe8;MpKsld4b6afe8; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{9277E2D0-71F4-4D89-B3B1-0DF5AE5DDCC1}\MpKsld4b6afe8.sys []
S1 MpKsldf72e88d;MpKsldf72e88d; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F6EEB86E-2139-4654-A18A-7281E077A6FD}\MpKsldf72e88d.sys []
S1 MpKslfb89738b;MpKslfb89738b; \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{988C9C25-4F50-450B-BFB5-C6F94D7EEE7A}\MpKslfb89738b.sys []
S3 ah84i18f;ah84i18f; C:\Windows\system32\drivers\ah84i18f.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s115bus;Sony Ericsson Device 115 driver (WDM); C:\Windows\system32\DRIVERS\s115bus.sys [2007-04-23 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s115mdfl.sys [2007-04-23 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s115mdm.sys [2007-04-23 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s115mgmt.sys [2007-04-23 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s115obex.sys [2007-04-23 98568]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [2011-02-17 111152]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 lxcg_device;lxcg_device; C:\Windows\system32\lxcgcoms.exe [2007-04-29 537520]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [2010-11-11 11736]
R2 NAUpdate;@C:\Program Files\Nero\Update\NASvc.exe,-200; C:\Program Files\Nero\Update\NASvc.exe [2010-05-04 503080]
R2 NVSvc;NVIDIA Driver Helper Service; C:\Windows\system32\nvvsvc.exe [2011-01-07 608872]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2011-05-14 75136]
R2 PSI_SVC_2;Protexis Licensing V2; C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2009-07-24 189728]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-01-07 378984]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 1710464]
R3 NisSrv;@C:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2011-03-01 72704]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-03-01 1343400]

-----------------EOF-----------------

[vyosek]

Zdravim a pekny podvecer preji

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

• Pokud ho havet blokuje, pouzijte jeden z nasledujicich

  Rkill EXE:
  http://download.bleepingcomputer.com/grinler/rkill.exe
  
  Rkill SCR:
  http://download.bleepingcomputer.com/grinler/rkill.scr
  
  Rkill PIF:
  http://download.bleepingcomputer.com/grinler/rkill.pif

• Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
• Spustte tradicne dvojklikem - program probehne temer okamzite a ukonci i svou cinnost
• RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
• Ted nerestartujte PC - prisli byste o ucinek RKillu

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) (viz muj podpis)

• Provedte aktualizaci - treti zalozka
• Provedte uplny sken - nic nemazte
• MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

[Teochi]

Tak jo konečně hotovo omlouvám se za to, jak dlouho to trvalo, ale doufám, že jste si vklidku dal aspon kafe nebo čaj v tom lepším případě pivsona ^_^. Takže bez dalších řečí posílám log ze scany který je jen plný cracků a keygenů hahaha ^__^;;;;

hačá~:



Malwarebytes' Anti-Malware 1.51.0.1200
http://www.malwarebytes.org

Verze databáze: 6854

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

14.6.2011 17:58:52
mbam-log-2011-06-14 (17-58-48).txt

Typ: Úplná kontrola (C:\|D:\|)
Kontrolované objekty: 361551
Uplynulý čas: 1 hodin, 0 minut, 33 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 10

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
d:\junior\Bit lord\downloads\adobe photoshop cs2\KeyGen.exe (Trojan.Agent.CK) -> No action taken.
d:\junior\Bit lord\downloads\google sketchup pro 8.0.4811{h33t}{mad dog}\sketchup pro 8.0.4811\Crk\keygen google.sketchup.pro.8.0.4811-mpt.exe (RiskWare.Tool.CK) -> No action taken.
d:\junior\Bit lord\downloads\google sketchup pro 8.0.4811{h33t}{mad dog}\sketchup pro 8.0.4811\Crk\patch google.sketchup.pro.8.0.4811-mpt.exe (PUP.Hacktool.Patcher) -> No action taken.
d:\junior\Bit lord\downloads\photoshop cs2 v9.0 + working keygen\photoshop.cs2.keygen.exe (Trojan.Agent.CK) -> No action taken.
d:\junior\corel draw x4 cz\corel draw x4 cz\crack\Keygen.exe (Trojan.Dropper.PGen) -> No action taken.
d:\junior\moje !!!\videa a zbytek\removewga.exe (PUP.RemoveWGA) -> No action taken.
d:\zbytek\flash disk\activator_xp_home.exe (RiskWare.Tool.CK) -> No action taken.
d:\zbytek\flash disk\x64\xf-a2010.exe (Trojan.Agent.CK) -> No action taken.
d:\zbytek\flash disk\x86\xf-a2010.exe (Trojan.Agent) -> No action taken.
d:\zbytek\Standa\my documents\CD\inventor\Keygen.exe (RiskWare.Tool.CK) -> No action taken.

[vyosek]

A tyhle W7 Profesional mate legalni

Ja na pachani trestneho cinu v podobe porusovani autorskeho zakona nic smesneho nevidim

[Teochi]

Budete se divit, ale ano mám je legální. Každopádně mě to taky směšné nepříjde, avšak nemám statisíce na tyhle softy a myslím si, že vy taky nebudete mít v PC vše legální. Každopádně jsme trochu odbočili od tématu....

[vyosek]

No moc neodbocili, nelegalni soft nepodporujem - viz pravidla fora...

Misto PhotoShopu pouzivam Gimp a spokojenost....

Nalezy MBAMu smazte - on sice crack je "dobra" vec ze nemusite za produkt platit, ale taky v sobe ve vetsine pripadu maji nejaky ten darecek v podobe backdooru ci nejake dalsi haveti...

Stahnete OTM (viz muj podpis)

• Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
• Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

• Kód: Vybrat vše

  :reg
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  "{32099AAC-C132-4136-9E9A-4E364A424E17}"=-
  "{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "Adobe Reader Speed Launcher"=-
  "Adobe ARM"=-
  "WinampAgent"=-
  "SunJavaUpdateSched"=-
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  "RocketDock"=-
  "msnmsgr"=-
  "DAEMON Tools Lite"=-
  
  :files
  C:\Program Files\DAEMON Tools Toolbar
  C:\Program Files\Ask.com
  %windir%\system32\*.tmp.dll /s
  %windir%\system32\SET*.tmp /s
  %windir%\*.tmp
  
  :commands
  [RESETHOSTS]
  [EMPTYTEMP]
  [EMPTYFLASH]

• Kliknete na cervene tlacitko MoveIt!
• Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte

[Teochi]

No, kdyby šlo jen o photoshop, tak mlčím. Každopádně to chápu a to byl jen pokus o ironický vtip, proto jsem použil onen japonský smaijlík "^^;" nemyslete si že jsem rádoby frajírek co pirátí a machruje nad tím to proboha ne. Dělám to pro svou potřebu, nikdo o tom vědět nemusí, avšak tady se tomu ted vyhnout bohužel nešlo.... každopádně diskuzi ohledně pirátsví můžeme vést hodiny, protože pochybuju, že najdete člověka, co je v tomhle "čistý". Každý někdy stáhl nějaký ten film, hudku nebo kopírofal fotky čí obrázky atd atd... tak se omlouvám za nepochopený a nemístný vtip nezlobte se...

tady máte ten log:


All processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\WinampAgent deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\RocketDock deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\msnmsgr deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite deleted successfully.
========== FILES ==========
C:\Program Files\DAEMON Tools Toolbar\Resources folder moved successfully.
C:\Program Files\DAEMON Tools Toolbar folder moved successfully.
C:\Program Files\Ask.com\assets\oobe folder moved successfully.
C:\Program Files\Ask.com\assets folder moved successfully.
C:\Program Files\Ask.com folder moved successfully.
File/Folder C:\Windows\system32\*.tmp.dll not found.
File/Folder C:\Windows\system32\SET*.tmp not found.
File/Folder C:\Windows\*.tmp not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Jura
->Temp folder emptied: 328356 bytes
->Temporary Internet Files folder emptied: 106690 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Opera cache emptied: 188479119 bytes
->Flash cache emptied: 1179 bytes

User: m&m
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 69282 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 180,00 mb


OTM by OldTimer - Version 3.1.18.0 log created on 06142011_190256

[vyosek]

v pohode a mate pravdu ze takovy clovicek se opravdu nenajde...Ovsem co nekteri tady o crackach tvrdi vy to aspon priznate a napisete, ale nekteri tu tvrdi ze log nedaji na forum, ze tam jsou "osobni a citlive udaje" a nakonec vyleze ze to byl warezak jak poleno

Jak se chova nas pacient

[Teochi]

No to ano bohužel najdou se i takoví, oni to stejně neskryjou .

Každopádně co se pacienta týče, jeho stav byl stabilizovaný už od vrácení v restore pointu, takže mohu jen doufat, že tahle "hloubková" analýza kde já nevidím, mu pomohla. Gaždopádně si myslím, že je vše v pořádku. Děkuji za pomoc a spolupráci v jeho léčbě, oba jsme Vám vděční . Kdyby zase nějak pokašlával, příjdu opět na kontrolu. Mějte se hezky a přeji krásný zbytek dne plný sluníčka a večerního piva

[vyosek]

Jeste uklidime

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis)
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

Nemate zac, rad jsem pomohl Zase nekdy