VIRY.CZ

Omlouvam se, musela jsem na obed. Co mam udelat nyni??

Prosim prosim, pocitac je staje nakazen, pri prvnim spusteni exploreru me to zas nekam presmerovalo a NOD stale hlasi napadeni, ktere neumi vylecit!!

Ano, ja vim, uz pisu docistovaci skript pro ComboFix - mel jsem nejake studijni povinnosti na fakulte...Dejte mi prosim par minut...

Jasne, mate je mit, budu stastna kdyz to dame doporadku.

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Folder::
  c:\documents and settings\Standa\Data aplikací\Antivirus Protection
  
  Registry::
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "Skype"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "BCU"=-
  "Malwarebytes' Anti-Malware"=-
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaSuite.exe]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSU_agent]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
  "netsvcs"=hex(7):36,74,6F,34,00,41,70,70,4D,67,6D,74,00,41,\
    75,64,69,6F,53,72,76,00,42,72,6F,77,73,65,72,00,43,72,79,70,74,53,76,\
    63,00,44,4D,53,65,72,76,65,72,00,44,48,43,50,00,45,52,53,76,63,00,45,\
    76,65,6E,74,53,79,73,74,65,6D,00,46,61,73,74,55,73,65,72,53,77,69,74,\
    63,68,69,6E,67,43,6F,6D,70,61,74,69,62,69,6C,69,74,79,00,48,69,64,53,\
    65,72,76,00,49,61,73,00,49,70,72,69,70,00,49,72,6D,6F,6E,00,4C,61,6E,\
    6D,61,6E,53,65,72,76,65,72,00,4C,61,6E,6D,61,6E,57,6F,72,6B,73,74,61,\
    74,69,6F,6E,00,4D,65,73,73,65,6E,67,65,72,00,4E,65,74,6D,61,6E,00,4E,\
    6C,61,00,4E,74,6D,73,73,76,63,00,4E,57,43,57,6F,72,6B,73,74,61,74,69,\
    6F,6E,00,4E,77,73,61,70,61,67,65,6E,74,00,52,61,73,61,75,74,6F,00,52,\
    61,73,6D,61,6E,00,52,65,6D,6F,74,65,61,63,63,65,73,73,00,53,63,68,65,\
    64,75,6C,65,00,53,65,63,6C,6F,67,6F,6E,00,53,45,4E,53,00,53,68,61,72,\
    65,64,61,63,63,65,73,73,00,53,52,53,65,72,76,69,63,65,00,54,61,70,69,\
    73,72,76,00,54,68,65,6D,65,73,00,54,72,6B,57,6B,73,00,57,33,32,54,69,\
    6D,65,00,57,5A,43,53,56,43,00,57,6D,69,00,57,6D,64,6D,50,6D,53,70,00,77,\
    69,6E,6D,67,6D,74,00,77,73,63,73,76,63,00,78,6D,6C,70,72,6F,76,00,6E,\
    61,70,61,67,65,6E,74,00,68,6B,6D,73,76,63,00,42,49,54,53,00,77,75,61,\
    75,73,65,72,76,00,53,68,65,6C,6C,48,57,44,65,74,65,63,74,69,6F,6E,00,68,\
    65,6C,70,73,76,63,00,57,6D,64,6D,50,6D,53,4E,00,55,78,54,75,6E,65,55,\
    70,00,00
  
  File::
  c:\windows\Tasks\Ad-Aware Update (Weekly).job
  c:\windows\Tasks\FMYGONIYV.job
  
  Collect::
  c:\windows\system32\ati2dvaak.dll
  
  RegNull::
  [HKEY_USERS\S-1-5-21-854245398-1450960922-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{442806E0-DBCA-6158-9848-EA2FB23525C5}*]
  
  AtJob::
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

Zde je log z CF

ComboFix 12-04-01.01 - Standa 02.04.2012 14:01:42.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3292.2767 [GMT 2:00]
Spuštěný z: c:\documents and settings\Standa\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Standa\Plocha\CFScript.txt
AV: ESET Smart Security 4.0 *Disabled/Outdated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
FW: ESET personal firewall *Enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Rezidentní štít AV je zapnutý
.
.
FILE ::
"c:\windows\Tasks\Ad-Aware Update (Weekly).job"
"c:\windows\Tasks\FMYGONIYV.job"
.
file zipped: c:\windows\system32\ati2dvaak.dll
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\ati2dvaak.dll
c:\windows\Tasks\Ad-Aware Update (Weekly).job
c:\windows\Tasks\FMYGONIYV.job
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-03-02 do 2012-04-02 )))))))))))))))))))))))))))))))
.
.
2012-04-02 08:47 . 2012-04-02 08:47 -------- d-----w- C:\TDSSKiller_Quarantine
2012-04-02 07:21 . 2012-04-02 07:24 -------- d-----w- c:\documents and settings\Administrator
2012-04-02 07:14 . 2012-04-02 07:14 -------- d-----w- c:\documents and settings\Standa\Data aplikací\Antivirus Protection
2012-03-28 11:45 . 2010-06-16 15:01 59464 ----a-w- c:\windows\system32\drivers\RT-USB.SYS
2012-03-28 11:44 . 2012-03-29 11:54 -------- d-----w- C:\Auto-diagnostika
2012-03-06 07:17 . 2012-04-02 07:37 -------- d-----w- c:\program files\trend micro
2012-03-06 07:17 . 2012-03-06 07:18 -------- d-----w- C:\rsit
2012-03-05 11:26 . 2012-03-05 10:44 16432 ----a-w- c:\windows\system32\lsdelete.exe
2012-03-05 10:46 . 2012-03-05 10:46 -------- d-----w- c:\documents and settings\LocalService\Plocha
2012-03-05 10:44 . 2012-03-05 10:44 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2012-03-05 10:40 . 2011-12-23 06:12 64512 ----a-w- c:\windows\system32\drivers\Lbd.sys
2012-03-05 10:39 . 2012-03-05 10:39 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Lavasoft
2012-03-05 10:39 . 2012-03-05 10:39 -------- d-----w- c:\program files\Lavasoft
2012-03-05 10:06 . 2012-03-05 10:06 -------- d-----w- c:\documents and settings\Standa\Data aplikací\Malwarebytes
2012-03-05 10:06 . 2012-03-05 10:06 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2012-03-05 10:06 . 2011-12-10 14:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-03-05 10:06 . 2012-03-05 10:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-02 12:06 . 2011-01-23 21:03 17488 ----a-w- c:\windows\gdrv.sys
2012-04-02 08:48 . 2004-08-17 13:43 188288 ----a-w- c:\windows\system32\drivers\acpi.sys
2012-04-02 08:48 . 2004-08-03 20:59 62976 ----a-w- c:\windows\system32\drivers\cdrom.sys
2012-03-29 05:27 . 2004-08-17 13:49 26112 ----a-w- c:\windows\system32\userinit.exe
2012-02-21 06:38 . 2011-05-18 05:26 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-03 09:57 . 2004-08-17 13:44 1860096 ----a-w- c:\windows\system32\win32k.sys
2012-01-11 19:07 . 2012-02-15 06:12 3072 ------w- c:\windows\system32\iacenc.dll
2012-01-09 16:20 . 2011-01-21 20:45 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2012-04-02_09.35.59 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-04-02 12:06 . 2012-04-02 12:06 16384 c:\windows\temp\Perflib_Perfdata_4ec.dat
+ 2012-04-02 12:06 . 2012-04-02 12:06 16384 c:\windows\temp\Perflib_Perfdata_48c.dat
+ 2012-04-02 12:07 . 2012-04-02 12:07 16384 c:\windows\temp\Perflib_Perfdata_464.dat
- 2001-10-25 12:00 . 2012-04-02 09:08 75228 c:\windows\system32\perfc009.dat
+ 2001-10-25 12:00 . 2012-04-02 12:03 75228 c:\windows\system32\perfc009.dat
+ 2001-10-25 12:00 . 2012-04-02 12:03 85810 c:\windows\system32\perfc005.dat
- 2001-10-25 12:00 . 2012-04-02 09:08 85810 c:\windows\system32\perfc005.dat
+ 2001-10-25 12:00 . 2012-04-02 12:03 450758 c:\windows\system32\perfh009.dat
- 2001-10-25 12:00 . 2012-04-02 09:08 450758 c:\windows\system32\perfh009.dat
+ 2001-10-25 12:00 . 2012-04-02 12:03 447284 c:\windows\system32\perfh005.dat
- 2001-10-25 12:00 . 2012-04-02 09:08 447284 c:\windows\system32\perfh005.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2010-02-25 18791456]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-23 174104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-23 144920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Standa\Nabídka Start\Programy\Po spuštění\
DOSPRN.lnk - c:\program files\DOSPRN\DOSprn.exe [2011-1-24 815104]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^ADnews.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\ADnews.lnk
backup=c:\windows\pss\ADnews.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Service Manager.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Service Manager.lnk
backup=c:\windows\pss\Service Manager.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Standa^Nabídka Start^Programy^Po spuštění^RT-Updater.lnk]
path=c:\documents and settings\Standa\Nabídka Start\Programy\Po spuštění\RT-Updater.lnk
backup=c:\windows\pss\RT-Updater.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCU]
2009-10-15 13:06 375000 ----a-w- c:\program files\DeviceVM\Browser Configuration Utility\BCU.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\egui]
2009-11-16 07:03 2054360 ----a-w- c:\program files\ESET\ESET Smart Security\egui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2012-01-13 13:53 460872 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" -autorun
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Služba Acronis Scheduler2"="c:\program files\Common Files\Acronis\Plán2\schedhlp.exe"
"TrueImageMonitor.exe"=c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"BCU"="c:\program files\DeviceVM\Browser Configuration Utility\BCU.exe"
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" /s
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
"PsaStart"=c:\applic\ddc\bin\psastart.exe c:\applic\ddc\bin\psaagent.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\APP\\PPS\\mozilla.exe"=
"c:\\APPLIC\\Portail\\mozilla.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"c:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe"=
"c:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Keys Server\\sntlkeyssrvr.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer_Service.exe"=
"c:\\pemicro\\prog08sz\\prog08sz.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Air Live IP Wizard II\\IPWizardII.exe"=
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [5.3.2012 12:40 64512]
R0 tdrpman258;Acronis Try&Decide and Restore Points filter (build 258);c:\windows\system32\drivers\tdrpm258.sys [19.7.2011 7:42 911680]
R1 AppleCharger;AppleCharger;c:\windows\system32\drivers\AppleCharger.sys [23.1.2011 22:53 19496]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [11.10.2011 7:42 232512]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16.11.2009 9:03 108792]
R1 oreans32;oreans32;c:\windows\system32\drivers\oreans32.sys [27.1.2011 11:58 33824]
R2 afcdpsrv;Acronis Nonstop Backup service;c:\program files\Common Files\Acronis\CDP\afcdpsrv.exe [19.7.2011 7:42 2480048]
R2 BCUService;Browser Configuration Utility Service;c:\program files\DeviceVM\Browser Configuration Utility\BCUService.exe [15.10.2009 15:06 223464]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [16.11.2009 9:04 735960]
R2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [23.1.2011 22:44 68136]
R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\app\FIREBIRD\bin\fbguard.exe -s --> c:\app\FIREBIRD\bin\fbguard.exe -s [?]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [23.12.2011 8:12 2152152]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [5.3.2012 12:06 652360]
R2 MSSQL$SFN;MSSQL$SFN;c:\program files\Microsoft SQL Server\MSSQL$SFN\Binn\sqlservr.exe -sSFN --> c:\program files\Microsoft SQL Server\MSSQL$SFN\Binn\sqlservr.exe -sSFN [?]
R2 pardrv;pardrv;c:\windows\system32\drivers\pardrv.sys [24.1.2011 8:11 9728]
R2 PEDRV;P&E Microcomputer System PCI Driver.;c:\windows\system32\drivers\pedrv.sys [16.10.2009 16:28 28080]
R2 SentinelKeysServer;Sentinel Keys Server;c:\program files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [11.7.2008 2:02 328992]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [25.2.2010 11:59 1047880]
R2 WorkshopDBService;WorkshopDBService;c:\progra~1\VIVIDW~1\WORKSH~1.EXE -zglaxservice WorkshopDBService --> c:\progra~1\VIVIDW~1\WORKSH~1.EXE -zglaxservice WorkshopDBService [?]
R3 adatadrv;Autodata Protection Service;c:\windows\system32\drivers\adatadrv.sys [15.2.2011 15:09 762112]
R3 afcdp;afcdp;c:\windows\system32\drivers\afcdp.sys [19.7.2011 7:42 160288]
R3 BrUsbScn;Ovladač skeneru Brother MFC USB;c:\windows\system32\drivers\BrUsbScn.sys [24.1.2011 9:27 10368]
R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\app\FIREBIRD\bin\fbserver.exe -s --> c:\app\FIREBIRD\bin\fbserver.exe -s [?]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [5.3.2012 12:06 20464]
R3 PciPPorts;PCI ECP Parallel Port;c:\windows\system32\drivers\PciPPorts.sys [23.1.2011 23:00 82944]
R3 PciSPorts;High-Speed PCI Serial Port;c:\windows\system32\drivers\PciSPorts.sys [23.1.2011 23:00 115200]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [25.2.2010 11:18 10064]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [23.1.2011 22:41 1691480]
S3 AMTCAR;Amt-Cartech System Driver (AmtCar.Sys);c:\windows\system32\drivers\AmtCar.sys [14.5.2010 12:40 31712]
S3 AppleChargerSrv;AppleChargerSrv;system32\AppleChargerSrv.exe --> system32\AppleChargerSrv.exe [?]
S3 CTU2K;CTU2K.SYS CTU2K device driver;c:\windows\system32\drivers\CTU2K.sys [24.1.2011 12:20 24197]
S3 ezusb;ezusb;c:\windows\system32\drivers\ezusb.sys [16.9.2002 12:43 15360]
S3 FTD2XX;VAGUSB.sys VAG-Com USB driver;c:\windows\system32\drivers\VAGUSB.sys [24.1.2011 12:19 25596]
S3 HS4l;Handyscope HS4 driver (before renumeration);c:\windows\system32\drivers\HS4l.sys [12.5.2011 13:37 18944]
S3 HS4r;Handyscope HS4 driver;c:\windows\system32\drivers\HS4r.sys [12.5.2011 13:37 19840]
S3 jlink;J-Link driver;c:\windows\system32\drivers\jlink.sys [7.10.2011 8:15 14208]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [23.12.2011 8:12 15232]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [13.12.2011 8:16 137472]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [13.12.2011 8:16 8576]
S3 RT-USB;Ross-Tech USB driver;c:\windows\system32\drivers\RT-USB.SYS [28.3.2012 13:45 59464]
S3 SIUSBXP;SIUSBXP;c:\windows\system32\drivers\SiUSBXp.sys [20.1.2012 12:10 14592]
S3 SQLAgent$SFN;SQLAgent$SFN;c:\program files\Microsoft SQL Server\MSSQL$SFN\Binn\sqlagent.EXE -i SFN --> c:\program files\Microsoft SQL Server\MSSQL$SFN\Binn\sqlagent.EXE -i SFN [?]
S3 VCommUSB;Service for ACTIA USB Devices;c:\windows\system32\drivers\VCommUSB.sys [24.1.2011 13:57 40576]
S3 zlportio;zlportio;\??\z:\car\Dashboard\Utility\Calculators\Licznik 8 novy !!!!\Licznik 8\licznic686\licznik8\zlportio.sys --> z:\car\Dashboard\Utility\Calculators\Licznik 8 novy !!!!\Licznik 8\licznic686\licznik8\zlportio.sys [?]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
DPF: {336C9D79-263A-4D75-AA7C-60DAF945AE67} - hxxp://178.72.207.174/classes/OvisLinkCamV_H264.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-04-02 14:07
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(1816)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Common Files\Acronis\Plán2\schedul2.exe
c:\windows\system32\crypserv.exe
c:\app\FIREBIRD\bin\fbguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft SQL Server\MSSQL$SFN\Binn\sqlservr.exe
c:\program files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
c:\progra~1\VIVIDW~1\WORKSH~1.EXE
c:\program files\Vivid WorkshopData ATI\jre\bin\java.exe
c:\windows\system32\BRMFRSMG.EXE
c:\windows\RTHDCPL.EXE
c:\app\FIREBIRD\bin\fbserver.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Celkový čas: 2012-04-02 14:11:31 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-04-02 12:11
ComboFix2.txt 2012-04-02 09:40
.
Před spuštěním: Volných bajtů: 396 411 060 224
Po spuštění: Volných bajtů: 394 312 474 624
.
- - End Of File - - FE9634F522418DF11AE29EA2A5CB86AE
Nahr nˇ probŘhlo ŁspŘçnŘ

Odinstalujte Lavasoft Ad-Adware

Stahnete OTM http://oldtimer.geekstogo.com/OTM.exe

• Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
• Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

• Kód: Vybrat vše

  :reg
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCU]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
  
  :files
  c:\documents and settings\Standa\Data aplikací\Antivirus Protection
  %windir%\system32\*.tmp.dll /s
  %windir%\system32\SET*.tmp /s
  %windir%\*.tmp
  
  :commands
  [RESETHOSTS]
  [EMPTYTEMP]
  [EMPTYFLASH]

• Kliknete na cervene tlacitko MoveIt!
• Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte

Log OTM

All processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCU\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware\ deleted successfully.
========== FILES ==========
c:\documents and settings\Standa\Data aplikací\Antivirus Protection folder moved successfully.
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOWS\system32\SET*.tmp not found.
C:\WINDOWS\002864_.tmp moved successfully.
C:\WINDOWS\SET3.tmp moved successfully.
C:\WINDOWS\SET4.tmp moved successfully.
C:\WINDOWS\SET8.tmp moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 2571 bytes
->Flash cache emptied: 615 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32835 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Standa
->Temp folder emptied: 16384 bytes
->Temporary Internet Files folder emptied: 2118435 bytes
->Java cache emptied: 2486826 bytes
->Flash cache emptied: 2828603 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2504 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3072 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 7,00 mb


[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Default User

User: LocalService

User: NetworkService

User: Standa
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb


OTM by OldTimer - Version 3.1.19.0 log created on 04022012_141951

Files moved on Reboot...
File C:\Documents and Settings\Standa\Local Settings\Temp\Perflib_Perfdata_994.dat not found!

Registry entries deleted on Reboot...

Tak zatim vypada, ze vse je OK? jeste dam jedno restartovat a trochu posurfuju po netu

Tak vse je doposud OK, pokud mam jeste neco udelat, napiste prosim, jestli ne, tak napiste ze je to OK at muzu klidne spat. Cekam na OK a pak Vas podporim, moc dekuji za pomoc !!!!!!!!!!!!!!!!!!!

Napiste jak podporit

Odinstalujte Combofix

• Prejmenujte ComboFix na Uninstall
• Spustte jej
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

Poprosim o novy log z RSIT a napiste co nas pacient

Moznosti podpory fora jsou v mem podpisu