Prosím o kontrolu

[cernohous13]

Otevři Poznámkový blok (Notepad) a zkopíruj celý zelený text z "CFscriptu".
Soubor ulož na plochu jako CFscript.txt a jeho ikonu přetáhni myší nad ikonu přejmenovaného ComboFixu - tam pusť.

ComboFix se spustí - počkej na log a vlož ho sem.

CFscript

Kód: Vybrat vše

KillAll::

File::
c:\windows\system32\drivers\rwkpbzng.dat
c:\windows\system32\drivers\sxnhyusn.dat
c:\windows\system32\drivers\uuvfreip.dat
c:\documents and settings\Jara\Local Settings\temp\_uninst_73045710.bat
c:\documents and settings\Jara\Data aplikací\MouseDriver.bat

Driver::
MpKsl1228a26d
MpKsl27c3737a
MpKsl9f6dc1ee
SetupNTGLM7X

Reboot::

[jara2011]

ComboFix 11-12-24.10 - Jara 26.12.2011 9:49.3.2 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.1023.646 [GMT 1:00]
Spuštěný z: c:\documents and settings\Jara\Plocha\zmije.com
Použité ovládací přepínače :: c:\docume~1\Jara\Plocha\CFscript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
FILE ::
"c:\documents and settings\Jara\Data aplikací\MouseDriver.bat"
"c:\documents and settings\Jara\Local Settings\temp\_uninst_73045710.bat"
"c:\windows\system32\drivers\rwkpbzng.dat"
"c:\windows\system32\drivers\sxnhyusn.dat"
"c:\windows\system32\drivers\uuvfreip.dat"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\explorer.exe . . . je infikován!!
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_MPKSL1228A26D
-------\Legacy_MPKSL27C3737A
-------\Legacy_MPKSL9F6DC1EE
-------\Legacy_SETUPNTGLM7X
-------\Service_MpKsl1228a26d
-------\Service_MpKsl27c3737a
-------\Service_MpKsl9f6dc1ee
-------\Service_SetupNTGLM7X
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-11-26 do 2011-12-26 )))))))))))))))))))))))))))))))
.
.
2011-12-26 08:55 . 2011-12-26 08:55 56200 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{516DBF1D-64C6-4F9A-B488-200CD64581C1}\offreg.dll
2011-12-26 07:46 . 2011-12-26 07:46 29904 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{516DBF1D-64C6-4F9A-B488-200CD64581C1}\MpKsl4d8a4cfb.sys
2011-12-25 20:44 . 2011-12-25 20:44 -------- d-----w- c:\documents and settings\Administrator
2011-12-25 16:58 . 2011-12-25 16:58 346 ----a-w- c:\windows\system32\drivers\rwkpbzng.dat
2011-12-25 16:18 . 2011-12-25 16:18 942 ----a-w- c:\windows\system32\drivers\sxnhyusn.dat
2011-12-25 15:49 . 2011-12-25 15:49 592 ----a-w- c:\windows\system32\drivers\uuvfreip.dat
2011-12-25 15:24 . 2011-12-25 15:25 29904 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{516DBF1D-64C6-4F9A-B488-200CD64581C1}\MpKsl52dc0ebc.sys
2011-12-25 15:21 . 2011-11-21 10:47 6823496 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{516DBF1D-64C6-4F9A-B488-200CD64581C1}\mpengine.dll
2011-12-25 15:17 . 2011-12-25 15:17 -------- d-----w- c:\program files\CleanUp!
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-25 16:41 . 2004-09-25 10:00 13824 ----a-w- c:\windows\system32\wscntfy.exe
2011-12-25 16:04 . 2004-09-22 00:17 147968 ------w- c:\windows\REGEDIT.EXE
2011-12-25 16:04 . 2004-09-22 00:17 343552 ----a-w- c:\windows\system32\MSPAINT.EXE
2011-12-25 16:04 . 2004-09-22 00:17 69632 ----a-w- c:\windows\system32\NOTEPAD.EXE
2011-12-25 16:04 . 2004-09-22 00:17 42496 ----a-w- c:\windows\system32\NET.EXE
2011-12-25 16:04 . 2004-09-22 00:17 124928 ----a-w- c:\windows\system32\NET1.EXE
2011-12-25 16:04 . 2004-09-22 00:17 389632 ----a-w- c:\windows\system32\CMD.EXE
2011-12-25 16:04 . 2004-09-22 00:17 1033728 ----a-w- c:\windows\EXPLORER.EXE
2011-12-25 16:04 . 2004-09-22 00:17 150016 ----a-w- c:\windows\system32\IMAPI.EXE
2011-12-25 16:04 . 2004-09-22 00:17 77312 ----a-w- c:\windows\system32\MSIEXEC.EXE
2011-12-25 16:04 . 2004-09-22 00:17 24576 ----a-w- c:\windows\system32\USERINIT.EXE
2011-12-25 16:04 . 2004-09-21 22:08 741376 ----a-w- c:\windows\system32\NWIZ.EXE
2011-11-19 07:10 . 2011-07-09 00:19 1409 ----a-w- c:\windows\QTFont.for
2011-11-18 10:00 . 2011-11-18 10:00 100864 ----a-w- c:\windows\system32\drivers\services.exe
2011-11-18 09:58 . 2004-09-22 00:17 182912 ----a-w- c:\windows\system32\drivers\ndis.sys
2011-11-15 22:29 . 2011-06-21 12:23 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-02 19:07 . 2011-11-02 19:07 102 ---h--w- c:\documents and settings\Jara\Data aplikací\MouseDriver.bat
2011-10-07 04:48 . 2011-07-12 12:34 6668624 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-10-03 04:06 . 2010-10-29 14:04 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-10-03 01:37 . 2007-05-07 18:11 73728 ----a-w- c:\windows\system32\javacpl.cpl
2008-05-21 20:22 . 2006-02-17 21:24 61038 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2008-05-21 20:22 . 2006-02-17 21:24 49256 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2008-05-21 20:22 . 2006-02-17 21:24 166000 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2011-12-25 . 7749C86C334F46524265B37D782C0B3D . 24576 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\userinit.exe
[-] 2011-12-25 . 3C573B5CDDE61108FBA88AEA8349A26E . 22016 . . [5.1.2600.1106] . . c:\windows\$NtServicePackUninstall$\userinit.exe
[-] 2011-12-25 . 3BBE42A83729B389BBF6905408F84611 . 26112 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\1dab8d41b73a912c39f7d3fd77a4df39\userinit.exe
[-] 2011-12-25 . 7749C86C334F46524265B37D782C0B3D . 24576 . . [5.1.2600.2180] . . c:\windows\system32\USERINIT.EXE
.
[-] 2011-12-25 . 5233CC193C59FA81A836D37EFF23C0F2 . 1032704 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe
[-] 2011-12-25 . C14EEF71476C5BBB0A7766866854A373 . 1033728 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2011-12-25 . FF93588C847E1AF1D9219474AC507E5C . 1032704 . . [6.00.2900.2180] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2011-12-25 . A054B50704711710F8A7B3486F61E3B0 . 1004544 . . [6.00.2800.1106] . . c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2011-12-25 . F40D0BF9A963B1B0D6A096556C303EB2 . 1034240 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\1dab8d41b73a912c39f7d3fd77a4df39\explorer.exe
[-] 2011-12-25 . 58074CDA3619060F3778C71EF6027209 . 1033728 . . [6.00.2900.3156] . . c:\windows\system32\dllcache\explorer.exe
[-] 2011-12-25 . 84776CF348E42DEE2005FAC5D3B39ACD . 1033728 . . [6.00.2900.3156] . . c:\windows\EXPLORER.EXE
.
[-] 2011-12-25 . DA10A0E08001FEC8100BBF435A7B875C . 147968 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\regedit.exe
[-] 2011-12-25 . 5F3469F499B7AF445A1570B8A3A6587F . 135680 . . [5.1.2600.1106] . . c:\windows\$NtServicePackUninstall$\regedit.exe
[-] 2011-12-25 . 93AB912684E75CA28345B3BFBD4367E7 . 147968 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\1dab8d41b73a912c39f7d3fd77a4df39\regedit.exe
[-] 2011-12-25 . 47F6E033F3503E990E3B16D12D3F81A2 . 147968 . . [5.1.2600.2180] . . c:\windows\REGEDIT.EXE
.
[-] 2011-12-25 . A2033D72DA395C8B5BE255EFA84EA27B . 13824 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\wscntfy.exe
[-] 2011-12-25 . 2B705A3CD6534FE62E04292DBD24DBEC . 13824 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\1dab8d41b73a912c39f7d3fd77a4df39\wscntfy.exe
[-] 2011-12-25 . A45DF5AC1ABB10811DFBF54BBA42C611 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe
.
[-] 2011-12-25 . 70998829E015994870130AEE06A77405 . 93184 . . [6.00.2900.2180] . . c:\windows\ie8\iexplore.exe
[-] 2011-12-25 . 70998829E015994870130AEE06A77405 . 93184 . . [6.00.2900.2180] . . c:\windows\ServicePackFiles\i386\iexplore.exe
[-] 2011-12-25 . 22BBCF063E20DE85EAE0997387D0F086 . 91136 . . [6.00.2800.1106] . . c:\windows\$NtServicePackUninstall$\iexplore.exe
[-] 2011-12-25 . 0A961C905A46411F2D2DD503668BFF2E . 93184 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\1dab8d41b73a912c39f7d3fd77a4df39\iexplore.exe
[-] 2009-03-08 . 32E7F65E74DF0BC988025EEFC33C73F1 . 638816 . . [8.00.6001.18702] . . c:\windows\system32\dllcache\iexplore.exe
.
.
.
((((((((((((((((((((((((((((( SnapShot@2011-12-25_20.56.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-12-26 08:55 . 2011-12-26 08:55 16384 c:\windows\temp\Perflib_Perfdata_1d4.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\System32\NVMCTRAY.DLL" [2003-09-24 49152]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-09-24 5033984]
"nwiz"="nwiz.exe" [2011-12-25 741376]
"ICQ Lite"="c:\program files\ICQLite\ICQLite.exe" [2006-07-11 3144800]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 54832]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
c:\documents and settings\Jara\Nabídka Start\Programy\Po spuštění\
_uninst_73045710.lnk - c:\documents and settings\Jara\Local Settings\temp\_uninst_73045710.bat [N/A]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-9-22 113664]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2005-1-28 102400]
Rychlé spuštění aplikace HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-12 73728]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ\\Icq.exe"=
"c:\\TOTALCMD\\TOTALCMD.EXE"=
"c:\\WINDOWS\\System32\\ftp.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\ICQLite\\ICQLite.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"update_services"= c:\\WINDOWS\\system32\\drivers\\services.exe
.
R0 pnpshark;pnpshark;c:\windows\system32\drivers\pnpshark.sys [2.10.2003 3:16 119552]
R0 st3shark;st3shark;c:\windows\system32\drivers\st3shark.sys [27.9.2003 14:37 5504]
R1 MpKsl4d8a4cfb;MpKsl4d8a4cfb;c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{516DBF1D-64C6-4F9A-B488-200CD64581C1}\MpKsl4d8a4cfb.sys [26.12.2011 8:46 29904]
R2 update_services;update_services;c:\windows\system32\drivers\services.exe [18.11.2011 11:00 100864]
.
Obsah adresáře 'Naplánované úlohy'
.
2011-12-26 c:\windows\Tasks\MpIdleTask.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 14:39]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz\www
TCP: DhcpNameServer = 10.0.2.254 8.8.8.8
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {CCA0B877-CB5E-4ADC-AD30-457C379512DD} - hxxp://192.168.1.11/xplugLiteDL.cab
FF - ProfilePath - c:\documents and settings\Jara\Data aplikací\Mozilla\Firefox\Profiles\xhrj528m.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-26 09:56
Windows 5.1.2600 Service Pack 2 FAT NTAPI
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(3032)
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2011-12-26 09:58:54 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-12-26 08:58
ComboFix2.txt 2011-12-25 21:01
.
Před spuštěním: Volných bajtů: 127 305 482 240
Po spuštění: Volných bajtů: 127 317 540 864
.
- - End Of File - - 79D1000F43A455D10459AEBD9F1784CD

[cernohous13]

explorer.rar

(355.36 KiB) Staženo 50 x

Stáhni soubor z přílohy a rozbal jej jako C:\explorer.exe

Stahni Avenger zde:
http://swandog46.geekstogo.com/avenger.exe
Spusť a všude souhlas „Yes“
Hlavní okno

dole dej fajfku do obou čtverečků

Do pole „Input script here“ zkopíruj zelený text scriptu -> „Execute“ -> „Yes“
Bude restart a je potřeba vyčkat na otevření Notepadu a jeho obsah sem vložit. (C:\avenger.txt)

Script

Kód: Vybrat vše

Files to move:
c:\explorer.exe | c:\windows

následně C:\windows\explorer.exe otestuj na VirusTotal

[jara2011]

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: could not move file "c:\explorer.exe"
File move operation "c:\explorer.exe|c:\windows" failed!
Status: 0xc0000035 (STATUS_OBJECT_NAME_COLLISION)
--> another object exists already with the same name


Completed script processing.

*******************

Finished! Terminate.



C:\windows\explorer.exe
http://www.virustotal.com/file-scan/rep ... 1324895009

[cernohous13]

Tak zkusíme upravený script pro Avenger

Kód: Vybrat vše

Files to delete:
C:\windows\explorer.exe
Files to move:
c:\explorer.exe | c:\windows

[jara2011]

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: file "C:\windows\explorer.exe" is whitelisted
Deletion of file "C:\windows\explorer.exe" failed!
Status: 0xc0000022 (STATUS_ACCESS_DENIED)


Error: could not move file "c:\explorer.exe"
File move operation "c:\explorer.exe|c:\windows" failed!
Status: 0xc0000035 (STATUS_OBJECT_NAME_COLLISION)
--> another object exists already with the same name


Completed script processing.

*******************

Finished! Terminate.

[cernohous13]

Stáhni OTM z jednoho odkazu a rozbal nejlépe na plochu.
http://oldtimer.geekstogo.com/OTM.exe
http://www.itxassociates.com/OT-Tools/OTM.exe

Spusť program „OTM.exe“ (pro Vistu a Win7 – pravým a „Run As Administrator“).
Do okna pod žlutou čáru vlož celý text zeleným písmem ze „Scriptu“

Klikni na červené „Moveit!“

Při nabídce restartu „YES“
a log potom najdeš v C:\_OTM\MovedFiles\

Script OTM

Kód: Vybrat vše

:Commands
[emptytemp]
[emptyflash]
[clearallrestorepoints]

:Files
[override]
C:\WINDOWS\explorer.exe|c:\explorer.exe /replace
[stopoverride]
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp /s
c:\windows\system32\drivers\rwkpbzng.dat
c:\windows\system32\drivers\sxnhyusn.dat
c:\windows\system32\drivers\uuvfreip.dat

[jara2011]

Tady je výsledný log, při restartu se PC sekl, musel jsem ho restartovat ručne.

All processes killed
========== COMMANDS ==========

[EMPTYTEMP]

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Jara
->Temp folder emptied: 264467 bytes
->Temporary Internet Files folder emptied: 9382745 bytes
->Java cache emptied: 43636612 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 22723 bytes

User: HelpAssistant
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Jarakbpki

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 10966 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 49554 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 51,00 mb


[EMPTYFLASH]

User: Default User

User: All Users

User: NetworkService

User: LocalService

User: Jara
->Flash cache emptied: 0 bytes

User: HelpAssistant

User: Jarakbpki

User: Administrator

Total Flash Files Cleaned = 0,00 mb



========== FILES ==========
File C:\WINDOWS\explorer.exe successfully replaced with c:\explorer.exe
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOWS\system32\SET*.tmp not found.
C:\WINDOWS\Installer\MSID7.tmp moved successfully.
C:\WINDOWS\Installer\MSI6.tmp moved successfully.
C:\WINDOWS\Installer\MSIB.tmp moved successfully.
C:\WINDOWS\Installer\MSI65.tmp moved successfully.
C:\WINDOWS\Installer\MSI6A.tmp moved successfully.
C:\WINDOWS\Installer\MSI15.tmp moved successfully.
C:\WINDOWS\Installer\MSI2A.tmp moved successfully.
C:\WINDOWS\Installer\MSI31.tmp moved successfully.
C:\WINDOWS\Installer\MSI2F.tmp moved successfully.
C:\WINDOWS\Installer\MSI35.tmp moved successfully.
C:\WINDOWS\Installer\MSIAA.tmp moved successfully.
C:\WINDOWS\Installer\MSIB0.tmp moved successfully.
C:\WINDOWS\Installer\MSI1F.tmp moved successfully.
C:\WINDOWS\twain_32\hpqgnds2.tmp moved successfully.
c:\windows\system32\drivers\rwkpbzng.dat moved successfully.
c:\windows\system32\drivers\sxnhyusn.dat moved successfully.
c:\windows\system32\drivers\uuvfreip.dat moved successfully.

OTM by OldTimer - Version 3.1.19.0 log created on 12282011_123516

Files moved on Reboot...
C:\Documents and Settings\Jara\Local Settings\Temp\ZTR4D.tmp moved successfully.
C:\Documents and Settings\Jara\Local Settings\Temp\ZTR50.tmp moved successfully.

Registry entries deleted on Reboot...

[cernohous13]

Mohl bys ještě znovu spustit ComboFix pro kontrolu?

[jara2011]

Tady je log z combofixu, jak jsem jej přejmenovával podle rady na zmije.com:

ComboFix 11-12-24.10 - Jara 29.12.2011 0:38.4.2 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.1023.661 [GMT 1:00]
Spuštěný z: c:\documents and settings\Jara\Plocha\zmije.com
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\explorer.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-11-28 do 2011-12-28 )))))))))))))))))))))))))))))))
.
.
2011-12-28 23:33 . 2011-12-28 23:34 29904 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{9AC666AF-8616-407F-BFA3-01C8D71EC597}\MpKsl477070de.sys
2011-12-28 23:33 . 2011-12-28 23:33 56200 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{9AC666AF-8616-407F-BFA3-01C8D71EC597}\offreg.dll
2011-12-28 11:35 . 2011-12-28 11:35 -------- d-----w- C:\_OTM
2011-12-26 10:32 . 2011-11-21 10:47 6823496 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{9AC666AF-8616-407F-BFA3-01C8D71EC597}\mpengine.dll
2011-12-25 20:44 . 2011-12-25 20:44 -------- d-----w- c:\documents and settings\Administrator
2011-12-25 15:17 . 2011-12-25 15:17 -------- d-----w- c:\program files\CleanUp!
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-25 16:41 . 2004-09-25 10:00 13824 ----a-w- c:\windows\system32\wscntfy.exe
2011-12-25 16:04 . 2004-09-22 00:17 147968 ------w- c:\windows\REGEDIT.EXE
2011-12-25 16:04 . 2004-09-22 00:17 343552 ----a-w- c:\windows\system32\MSPAINT.EXE
2011-12-25 16:04 . 2004-09-22 00:17 69632 ----a-w- c:\windows\system32\NOTEPAD.EXE
2011-12-25 16:04 . 2004-09-22 00:17 42496 ----a-w- c:\windows\system32\NET.EXE
2011-12-25 16:04 . 2004-09-22 00:17 124928 ----a-w- c:\windows\system32\NET1.EXE
2011-12-25 16:04 . 2004-09-22 00:17 389632 ----a-w- c:\windows\system32\CMD.EXE
2011-12-25 16:04 . 2004-09-22 00:17 150016 ----a-w- c:\windows\system32\IMAPI.EXE
2011-12-25 16:04 . 2004-09-22 00:17 77312 ----a-w- c:\windows\system32\MSIEXEC.EXE
2011-12-25 16:04 . 2004-09-22 00:17 24576 ----a-w- c:\windows\system32\USERINIT.EXE
2011-12-25 16:04 . 2004-09-21 22:08 741376 ----a-w- c:\windows\system32\NWIZ.EXE
2011-11-21 10:47 . 2011-07-12 12:34 6823496 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-11-19 07:10 . 2011-07-09 00:19 1409 ----a-w- c:\windows\QTFont.for
2011-11-18 10:00 . 2011-11-18 10:00 100864 ----a-w- c:\windows\system32\drivers\services.exe
2011-11-18 09:58 . 2004-09-22 00:17 182912 ----a-w- c:\windows\system32\drivers\ndis.sys
2011-11-15 22:29 . 2011-06-21 12:23 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-02 19:07 . 2011-11-02 19:07 102 ---h--w- c:\documents and settings\Jara\Data aplikací\MouseDriver.bat
2011-10-03 04:06 . 2010-10-29 14:04 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-10-03 01:37 . 2007-05-07 18:11 73728 ----a-w- c:\windows\system32\javacpl.cpl
2008-05-21 20:22 . 2006-02-17 21:24 61038 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2008-05-21 20:22 . 2006-02-17 21:24 49256 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2008-05-21 20:22 . 2006-02-17 21:24 166000 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2011-12-25 . 7749C86C334F46524265B37D782C0B3D . 24576 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\userinit.exe
[-] 2011-12-25 . 3C573B5CDDE61108FBA88AEA8349A26E . 22016 . . [5.1.2600.1106] . . c:\windows\$NtServicePackUninstall$\userinit.exe
[-] 2011-12-25 . 3BBE42A83729B389BBF6905408F84611 . 26112 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\1dab8d41b73a912c39f7d3fd77a4df39\userinit.exe
[-] 2011-12-25 . 7749C86C334F46524265B37D782C0B3D . 24576 . . [5.1.2600.2180] . . c:\windows\system32\USERINIT.EXE
.
[-] 2011-12-25 . 5233CC193C59FA81A836D37EFF23C0F2 . 1032704 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe
[-] 2011-12-25 . C14EEF71476C5BBB0A7766866854A373 . 1033728 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2011-12-25 . FF93588C847E1AF1D9219474AC507E5C . 1032704 . . [6.00.2900.2180] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2011-12-25 . A054B50704711710F8A7B3486F61E3B0 . 1004544 . . [6.00.2800.1106] . . c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2011-12-25 . F40D0BF9A963B1B0D6A096556C303EB2 . 1034240 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\1dab8d41b73a912c39f7d3fd77a4df39\explorer.exe
[-] 2011-12-25 . 58074CDA3619060F3778C71EF6027209 . 1033728 . . [6.00.2900.3156] . . c:\windows\system32\dllcache\explorer.exe
[-] 2008-04-14 . 27AFD587C462E280EE046B8CCA3C2CD1 . 1034240 . . [6.00.2900.5512] . . c:\windows\EXPLORER.EXE
.
[-] 2011-12-25 . DA10A0E08001FEC8100BBF435A7B875C . 147968 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\regedit.exe
[-] 2011-12-25 . 5F3469F499B7AF445A1570B8A3A6587F . 135680 . . [5.1.2600.1106] . . c:\windows\$NtServicePackUninstall$\regedit.exe
[-] 2011-12-25 . 93AB912684E75CA28345B3BFBD4367E7 . 147968 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\1dab8d41b73a912c39f7d3fd77a4df39\regedit.exe
[-] 2011-12-25 . 47F6E033F3503E990E3B16D12D3F81A2 . 147968 . . [5.1.2600.2180] . . c:\windows\REGEDIT.EXE
.
[-] 2011-12-25 . A2033D72DA395C8B5BE255EFA84EA27B . 13824 . . [5.1.2600.2180] . . c:\windows\ServicePackFiles\i386\wscntfy.exe
[-] 2011-12-25 . 2B705A3CD6534FE62E04292DBD24DBEC . 13824 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\1dab8d41b73a912c39f7d3fd77a4df39\wscntfy.exe
[-] 2011-12-25 . A45DF5AC1ABB10811DFBF54BBA42C611 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe
.
[-] 2011-12-25 . 70998829E015994870130AEE06A77405 . 93184 . . [6.00.2900.2180] . . c:\windows\ie8\iexplore.exe
[-] 2011-12-25 . 70998829E015994870130AEE06A77405 . 93184 . . [6.00.2900.2180] . . c:\windows\ServicePackFiles\i386\iexplore.exe
[-] 2011-12-25 . 22BBCF063E20DE85EAE0997387D0F086 . 91136 . . [6.00.2800.1106] . . c:\windows\$NtServicePackUninstall$\iexplore.exe
[-] 2011-12-25 . 0A961C905A46411F2D2DD503668BFF2E . 93184 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\1dab8d41b73a912c39f7d3fd77a4df39\iexplore.exe
[-] 2009-03-08 . 32E7F65E74DF0BC988025EEFC33C73F1 . 638816 . . [8.00.6001.18702] . . c:\windows\system32\dllcache\iexplore.exe
.
.
.
((((((((((((((((((((((((((((( SnapShot@2011-12-25_20.56.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-12-28 23:34 . 2011-12-28 23:34 16384 c:\windows\temp\Perflib_Perfdata_1e8.dat
+ 2004-09-22 18:25 . 2011-12-28 11:33 2481664 c:\windows\Installer\180cee0.msi
- 2004-09-22 18:25 . 2011-11-09 17:15 2481664 c:\windows\Installer\180cee0.msi
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\System32\NVMCTRAY.DLL" [2003-09-24 49152]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-09-24 5033984]
"nwiz"="nwiz.exe" [2011-12-25 741376]
"ICQ Lite"="c:\program files\ICQLite\ICQLite.exe" [2006-07-11 3144800]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 54832]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
c:\documents and settings\Jara\Nabídka Start\Programy\Po spuštění\
_uninst_73045710.lnk - c:\documents and settings\Jara\Local Settings\temp\_uninst_73045710.bat [N/A]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-9-22 113664]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2005-1-28 102400]
Rychlé spuštění aplikace HP Image Zone.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-5-12 73728]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ\\Icq.exe"=
"c:\\TOTALCMD\\TOTALCMD.EXE"=
"c:\\WINDOWS\\System32\\ftp.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\ICQLite\\ICQLite.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"update_services"= c:\\WINDOWS\\system32\\drivers\\services.exe
.
R0 pnpshark;pnpshark;c:\windows\system32\drivers\pnpshark.sys [2.10.2003 3:16 119552]
R0 st3shark;st3shark;c:\windows\system32\drivers\st3shark.sys [27.9.2003 14:37 5504]
R1 MpKsl477070de;MpKsl477070de;c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{9AC666AF-8616-407F-BFA3-01C8D71EC597}\MpKsl477070de.sys [29.12.2011 0:33 29904]
S2 update_services;update_services;c:\windows\system32\drivers\services.exe [18.11.2011 11:00 100864]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MPKSL477070DE
.
Obsah adresáře 'Naplánované úlohy'
.
2011-12-28 c:\windows\Tasks\MpIdleTask.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 14:39]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: mojebanka.cz\www
Trusted Zone: mojebanka.cz\www
TCP: DhcpNameServer = 10.0.2.254 8.8.8.8
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {CCA0B877-CB5E-4ADC-AD30-457C379512DD} - hxxp://192.168.1.11/xplugLiteDL.cab
FF - ProfilePath - c:\documents and settings\Jara\Data aplikací\Mozilla\Firefox\Profiles\xhrj528m.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-29 00:43
Windows 5.1.2600 Service Pack 2 FAT NTAPI
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
Celkový čas: 2011-12-29 00:45:46
ComboFix-quarantined-files.txt 2011-12-28 23:45
ComboFix2.txt 2011-12-26 08:58
ComboFix3.txt 2011-12-25 21:01
.
Před spuštěním: Volných bajtů: 127 235 653 632
Po spuštění: Volných bajtů: 127 214 649 344
.
- - End Of File - - C8C56D8ABFFDD6BCFD4BCE346B8D7E2D

[cernohous13]

Tak by mělo být čisto -uklidíme

Smaž c:\documents and settings\Jara\Nabídka Start\Programy\Po spuštění\_uninst_73045710.lnk

ComboFix odinstalujeme
jdi Start -> Spustit... a zkopíruj ComboFix /Uninstall (pozor, za x je mezera) -> OK

Stáhni a spusť T-cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe - uklidí po použitých čističích.
Po spuštění ignoruj případné varování antiviru - je to v pořádku
Po provedení akce T-cleaner smažeš

stáhni program OTC tady: http://oldtimer.geekstogo.com/OTC.exe - spusť ho -> "CleanUp" (smaže dříve použité čističe)

Mohu doporučit kontrolu a vyčištění Ccleanerem

Stáhni Ccleaner - http://www.slunecnice.cz/sw/ccleaner/
Při instalaci vyhodit fajfku u "Instalovat Yahoo! Toolbar"

zavřít Internetový prohlížeč a
spustit "Čistič" > "Spustit Ccleaner" - odstraní nepotřebné
spustit "Registry" > "Hledej problémy" > "Opravit vybrané problémy"
souhlas se zálohou registrů - opakovat dokud nebudou registry čisté.
spustit "Nástroje" > "Obnova systému" - 1.řádek zachovej, ostatní "Odstranit"
spustit "Nástroje" > "Start" - tady můžeš zkusit deaktivovat procesy, které při spuštění nepotřebuješ (pokud by ti potom něco nechodilo, stejným způsobem je povolíš)

Návod:http://jnp.zive.cz/Clanky/Prirucka-do-k ... fault.aspx

Ten si můžeš nechat i na budoucí občasné čištění.

Po vyčištění by se hodila defragmentace
doporučuji http://www.slunecnice.cz/sw/defraggler/ + čeština

aktualizuj SP3
http://windows.microsoft.com/cs-CZ/wind ... pack-3-sp3
http://windows.microsoft.com/cs-CZ/wind ... windows-xp

Kdyby něco z návodu nefungovalo, pokračuj dalším krokem.

[jara2011]

Všechny kroky OK, právě provádím defragmentaci a poté nainstaluji SP3. Děkuji mnohokrát za pomoc při léčení!

[cernohous13]

Nemáš zač - rádo se stalo a jsme tady i příště

A za celý tým děkuji za zvažovanou podporu