Kontrola logu

[pitimir]

1) Skopiruj do poznamkoveho bloku:

Kód: Vybrat vše

@echo off
expand X:\i386\proquota.ex_ c:\windows\system32\proquota.exe
del %0
exit

Uloz ako expand.bat (typ vsetky subory) na plochu a spust.

Poznamka: Miesto "X" treba do poznamkoveho bloku nastavit pismeno priradene tvojej CD-ROM. Vacsinou ide o D ci E.


2) Presun ikonu CF na plochu, vypni vsetky otvorene aplikacie, ako aj rezidenty antiviru, antispywaru a firewall a otvor poznamkovy blok. Donho skopiruj:

Kód: Vybrat vše

KillAll::
DDS::
uSearchAssistant = hxxp://search.qip.ru
uSearchURL,(Default) = hxxp://search.qip.ru/search?query=%s&from=IE

FCopy::
c:\windows\system32\proquota.exe | c:\windows\system32\dllcache\proquota.exe

Uloz na plochu ako CFScript.txt a mysou pretiahni nad ikonou CF.



Program script spracuje a spravi novy log.


Pozor: Ak po aplikacii skriptu nenabehne Windows, restartuj PC, stlac F8 a zvol Poslednu znamu funkcnu konfiguraciu.

[Mr.Hol]

ComboFix 10-01-27.06 - Uživatel 28.01.2010 20:43:51.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2943.2462 [GMT 1:00]
Spuštěný z: c:\documents and settings\Uživatel\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Uživatel\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100128-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\proquota.exe . . . chybí !!

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-28 do 2010-01-28 )))))))))))))))))))))))))))))))
.

2010-01-27 21:01 . 2010-01-27 21:01 -------- d-----w- C:\_OTL
2010-01-27 18:06 . 2010-01-27 18:08 -------- d-----w- c:\program files\trend micro
2010-01-27 18:06 . 2010-01-27 18:08 -------- d-----w- C:\rsit
2010-01-14 20:41 . 2010-01-15 07:45 -------- d-----w- c:\program files\MpcStar
2010-01-08 08:51 . 2010-01-08 08:51 -------- d-----w- c:\program files\Microsoft Silverlight

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-28 11:23 . 2008-09-27 16:16 -------- d-----w- c:\program files\BitComet
2010-01-28 11:18 . 2009-05-28 16:03 -------- d-----w- c:\program files\Spyware Terminator
2010-01-28 10:59 . 2009-12-29 17:23 -------- d-----w- c:\program files\AoA Video Joiner
2010-01-10 12:51 . 2008-12-25 18:13 -------- d-----w- c:\program files\Yahoo!
2009-12-21 13:25 . 2009-04-30 18:11 -------- d-----w- c:\program files\Java
2009-12-19 15:20 . 2009-12-19 15:19 -------- d-----w- c:\program files\TmNationsForever
2009-12-01 17:00 . 2009-12-01 17:00 -------- d-----w- c:\program files\Autodesk
2009-12-01 17:00 . 2009-12-01 17:00 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-12-01 17:00 . 2009-12-01 17:00 12464 ----a-w- c:\windows\system32\drivers\CDAC15BA.SYS
2009-12-01 17:00 . 2009-12-01 17:00 54784 ----a-w- c:\windows\system32\drivers\CDAC11BA.EXE
2009-12-01 17:00 . 2009-12-01 16:59 -------- d-----w- c:\program files\AutoCAD 2004
2009-12-01 17:00 . 2009-12-01 17:00 -------- d-----w- c:\program files\AnswerWorks 4.0
2009-12-01 17:00 . 2009-12-01 16:59 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2009-11-24 23:54 . 2009-05-27 15:00 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2009-05-27 15:00 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:50 . 2009-05-27 15:00 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-11-24 23:50 . 2009-05-27 15:00 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2009-05-27 15:00 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2009-05-27 15:00 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2009-05-27 15:00 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2009-05-27 15:00 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2009-05-27 15:00 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-06 11:15 . 2008-04-14 12:00 69114 ----a-w- c:\windows\system32\perfc005.dat
2009-11-06 11:15 . 2008-04-14 12:00 390176 ----a-w- c:\windows\system32\perfh005.dat
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-09-28 700416]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATKHOTKEY"="c:\program files\ATK Hotkey\Hcontrol.exe" [2007-07-12 225280]
"ATKOSD2"="c:\program files\ATKOSD2\ATKOSD2.exe" [2007-10-17 7737344]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-30 16269312]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784]
"Wireless Console 2"="c:\program files\Wireless Console 2\wcourier.exe" [2007-07-05 1040384]
"ACU"="c:\program files\Atheros\ACU.exe" [2007-10-23 376921]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 61440]
"ASUS Live Update"="c:\program files\ASUS\ASUS Live Update\ALU.exe" [2007-11-30 51768]
"Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2006-07-26 90112]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2007-07-10 851968]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"ACROMOUSE"="c:\program files\Tech\Office Program Selector\2.0\ACROMAPP.exe" [2005-04-29 554496]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-23 198160]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\U§ivatel\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-5-22 2756608]

[HKLM\~\startupfolder\C:^Documents and Settings^Uživatel^Nabídka Start^Programy^Po spuštění^CCC.lnk]
path=c:\documents and settings\Uživatel\Nabídka Start\Programy\Po spuštění\CCC.lnk
backup=c:\windows\pss\CCC.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-07-24 15:02 490952 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2008-02-28 08:59 570664 ----a-w- c:\program files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-01-26 13:31 2144088 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2009-07-26 12:50 1217784 ----a-w- c:\program files\Valve\Steam\Steam.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\forcce\\counter-strike\\hl.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Documents and Settings\\Uživatel\\Plocha\\GAMES\\Manhattan Project\\prism3d.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23460:TCP"= 23460:TCP:BitComet 23460 TCP
"23460:UDP"= 23460:UDP:BitComet 23460 UDP

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12.10.2008 18:36 717296]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [27.5.2009 16:00 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [27.5.2009 16:00 20560]
S2 ImapiServiceShellHWDetection;Služba modelu COM pro zápis na disk CD (IMAPI) ImapiServiceShellHWDetection;c:\windows\system32\adptifd.exe srv --> c:\windows\system32\adptifd.exe srv [?]
S3 hamachi_oem;PlayLinc Adapter;c:\windows\system32\drivers\gan_adapter.sys [28.8.2006 23:54 10664]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://google.atcomet.com/b/
uSearchAssistant = hxxp://search.qip.ru
uSearchURL,(Default) = hxxp://search.qip.ru/search?query=%s&from=IE
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {0FB23C71-9EDB-43F7-9BB7-766D8F4A2E7F} = 10.12.0.1,10.6.0.1
TCP: {3177557D-4A84-4BA9-A758-945B7BA9FEBD} = 10.12.0.1
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\documents and settings\Uživatel\Data aplikací\Mozilla\Firefox\Profiles\vggw09mg.default\
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-28 20:53
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll prosync1.sys atapi.sys spbi.sys >>UNKNOWN [0x8A41C938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba8ecf28
\Driver\ACPI -> ACPI.sys @ 0xba667cb8
\Driver\atapi -> prosync1.sys @ 0xbadae6c1
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Atheros AR5007EG Wireless Network Adapter -> SendCompleteHandler -> NDIS.sys @ 0xba519bd4
PacketIndicateHandler -> NDIS.sys @ 0xba507a0d
SendHandler -> NDIS.sys @ 0xba51bb40
user & kernel MBR OK

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-606747145-527237240-1417001333-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:c1,04,5b,9e,44,ec,f4,7d,a6,06,67,e1,31,21,a7,e8,ef,0d,94,6a,e1,57,19,
54,3b,44,54,6a,2b,b6,2c,40,fe,35,03,2a,6f,d3,e3,8b,f0,b4,ef,58,81,83,ea,97,\
"??"=hex:29,2b,93,45,e0,a7,7f,a0,af,df,26,fa,f9,3c,a3,0e
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(896)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2172)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Tech\Office Program Selector\2.0\ACROMDLL.DLL
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\acs.exe
c:\windows\system32\drivers\CDAC11BA.EXE
c:\windows\system32\CTsvcCDA.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\IoctlSvc.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\ATK Hotkey\ATKOSD.exe
c:\program files\ATK Hotkey\KBFiltr.exe
c:\program files\ATK Hotkey\WDC.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\ACEngSvr.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
c:\windows\system32\wscntfy.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Common Files\Nero\Lib\NMIndexingService.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
.
**************************************************************************
.
Celkový čas: 2010-01-28 21:01:52 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-28 20:01
ComboFix2.txt 2010-01-28 18:05
ComboFix3.txt 2010-01-28 17:30

Před spuštěním: Volných bajtů: 147 125 805 056
Po spuštění: Volných bajtů: 147 012 096 000

- - End Of File - - 8C2D7426CB8738BA5983BB74BBBA7073

[pitimir]

Houston, mame problem...
No nic, najprv dokoncime odvirovanie a potom chybajuci subor. Instalacne CD neodkladaj daleko.

1) Stiahni Defogger. Spust, klik na "Disable" -> "OK". V mieste spustenia by sa mal zjavit log, ten sem vloz.


2) Start -> Spustit -> (napis) cmd /c mbr.exe -t >log.txt&start log.txt
Otvori sa textak (log.txt), aj jeho obsah sem skopiruj.

[Mr.Hol]

tak tady je log z defoggeru:

defogger_disable by jpshortstuff (25.01.10.1)
Log created at 21:21 on 28/01/2010 (Uživatel)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
Unable to read sptd.sys
SPTD -> Disabled (Service running -> reboot required)


-=E.O.F=-


a druhy mame tady:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll prosync1.sys atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK

[pitimir]

Super. A teraz prichadza druha cast problemu - chybajuci subor. Niekde nastala chyba a prevdepodobne nebol expandovany. Overime to dalsim CFScriptom (postup rovnaky ako v predoslych pripadoch):

Kód: Vybrat vše

KillAll::
SRPeek::
c:\windows\system32\proquota.exe

Ak by nebol najdeny, zajtra poobede by som poslal navod na expand a dorazili by sme to do konca

[Mr.Hol]

ComboFix 10-01-27.06 - Uživatel 28.01.2010 21:54:46.4.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.2943.2459 [GMT 1:00]
Spuštěný z: c:\documents and settings\Uživatel\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Uživatel\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100128-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\proquota.exe . . . chybí !!

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-28 do 2010-01-28 )))))))))))))))))))))))))))))))
.

2010-01-27 21:01 . 2010-01-27 21:01 -------- d-----w- C:\_OTL
2010-01-27 18:06 . 2010-01-27 18:08 -------- d-----w- c:\program files\trend micro
2010-01-27 18:06 . 2010-01-27 18:08 -------- d-----w- C:\rsit
2010-01-14 20:41 . 2010-01-15 07:45 -------- d-----w- c:\program files\MpcStar
2010-01-08 08:51 . 2010-01-08 08:51 -------- d-----w- c:\program files\Microsoft Silverlight

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-28 11:23 . 2008-09-27 16:16 -------- d-----w- c:\program files\BitComet
2010-01-28 11:18 . 2009-05-28 16:03 -------- d-----w- c:\program files\Spyware Terminator
2010-01-28 10:59 . 2009-12-29 17:23 -------- d-----w- c:\program files\AoA Video Joiner
2010-01-10 12:51 . 2008-12-25 18:13 -------- d-----w- c:\program files\Yahoo!
2009-12-21 13:25 . 2009-04-30 18:11 -------- d-----w- c:\program files\Java
2009-12-19 15:20 . 2009-12-19 15:19 -------- d-----w- c:\program files\TmNationsForever
2009-12-01 17:00 . 2009-12-01 17:00 -------- d-----w- c:\program files\Autodesk
2009-12-01 17:00 . 2009-12-01 17:00 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-12-01 17:00 . 2009-12-01 17:00 12464 ----a-w- c:\windows\system32\drivers\CDAC15BA.SYS
2009-12-01 17:00 . 2009-12-01 17:00 54784 ----a-w- c:\windows\system32\drivers\CDAC11BA.EXE
2009-12-01 17:00 . 2009-12-01 16:59 -------- d-----w- c:\program files\AutoCAD 2004
2009-12-01 17:00 . 2009-12-01 17:00 -------- d-----w- c:\program files\AnswerWorks 4.0
2009-12-01 17:00 . 2009-12-01 16:59 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2009-11-24 23:54 . 2009-05-27 15:00 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2009-05-27 15:00 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-11-24 23:50 . 2009-05-27 15:00 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-11-24 23:50 . 2009-05-27 15:00 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2009-05-27 15:00 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2009-05-27 15:00 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2009-05-27 15:00 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2009-05-27 15:00 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2009-05-27 15:00 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-06 11:15 . 2008-04-14 12:00 69114 ----a-w- c:\windows\system32\perfc005.dat
2009-11-06 11:15 . 2008-04-14 12:00 390176 ----a-w- c:\windows\system32\perfh005.dat
.

(((((((((((((((((((((((((((((((((((((((((( SR_Search ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
((((((((((((((((((((((((((((( SnapShot@2010-01-28_19.52.26 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-28 21:01 . 2010-01-28 21:01 16384 c:\windows\Temp\Perflib_Perfdata_78c.dat
+ 2010-01-28 21:01 . 2010-01-28 21:01 16384 c:\windows\Temp\Perflib_Perfdata_73c.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-09-28 700416]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATKHOTKEY"="c:\program files\ATK Hotkey\Hcontrol.exe" [2007-07-12 225280]
"ATKOSD2"="c:\program files\ATKOSD2\ATKOSD2.exe" [2007-10-17 7737344]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-30 16269312]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784]
"Wireless Console 2"="c:\program files\Wireless Console 2\wcourier.exe" [2007-07-05 1040384]
"ACU"="c:\program files\Atheros\ACU.exe" [2007-10-23 376921]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 61440]
"ASUS Live Update"="c:\program files\ASUS\ASUS Live Update\ALU.exe" [2007-11-30 51768]
"Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2006-07-26 90112]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2007-07-10 851968]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"ACROMOUSE"="c:\program files\Tech\Office Program Selector\2.0\ACROMAPP.exe" [2005-04-29 554496]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-23 198160]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\U§ivatel\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-5-22 2756608]

[HKLM\~\startupfolder\C:^Documents and Settings^Uživatel^Nabídka Start^Programy^Po spuštění^CCC.lnk]
path=c:\documents and settings\Uživatel\Nabídka Start\Programy\Po spuštění\CCC.lnk
backup=c:\windows\pss\CCC.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-07-24 15:02 490952 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2008-02-28 08:59 570664 ----a-w- c:\program files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-01-26 13:31 2144088 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2009-07-26 12:50 1217784 ----a-w- c:\program files\Valve\Steam\Steam.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\forcce\\counter-strike\\hl.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Documents and Settings\\Uživatel\\Plocha\\GAMES\\Manhattan Project\\prism3d.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23460:TCP"= 23460:TCP:BitComet 23460 TCP
"23460:UDP"= 23460:UDP:BitComet 23460 UDP

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [27.5.2009 16:00 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [27.5.2009 16:00 20560]
S2 ImapiServiceShellHWDetection;Služba modelu COM pro zápis na disk CD (IMAPI) ImapiServiceShellHWDetection;c:\windows\system32\adptifd.exe srv --> c:\windows\system32\adptifd.exe srv [?]
S3 hamachi_oem;PlayLinc Adapter;c:\windows\system32\drivers\gan_adapter.sys [28.8.2006 23:54 10664]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12.10.2008 18:36 717296]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://google.atcomet.com/b/
uSearchAssistant = hxxp://search.qip.ru
uSearchURL,(Default) = hxxp://search.qip.ru/search?query=%s&from=IE
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {0FB23C71-9EDB-43F7-9BB7-766D8F4A2E7F} = 10.12.0.1,10.6.0.1
TCP: {3177557D-4A84-4BA9-A758-945B7BA9FEBD} = 10.12.0.1
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\documents and settings\Uživatel\Data aplikací\Mozilla\Firefox\Profiles\vggw09mg.default\
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-28 22:02
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-606747145-527237240-1417001333-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:c1,04,5b,9e,44,ec,f4,7d,a6,06,67,e1,31,21,a7,e8,ef,0d,94,6a,e1,57,19,
54,3b,44,54,6a,2b,b6,2c,40,fe,35,03,2a,6f,d3,e3,8b,f0,b4,ef,58,81,83,ea,97,\
"??"=hex:29,2b,93,45,e0,a7,7f,a0,af,df,26,fa,f9,3c,a3,0e
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(880)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3316)
c:\progra~1\WINDOW~2\wmpband.dll
c:\program files\Tech\Office Program Selector\2.0\ACROMDLL.DLL
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\acs.exe
c:\windows\system32\drivers\CDAC11BA.EXE
c:\windows\system32\CTsvcCDA.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\IoctlSvc.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\ACEngSvr.exe
c:\program files\ATK Hotkey\ATKOSD.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
c:\program files\ATK Hotkey\KBFiltr.exe
c:\program files\ATK Hotkey\WDC.exe
c:\program files\Common Files\Nero\Lib\NMIndexingService.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\windows\system32\wscntfy.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
.
**************************************************************************
.
Celkový čas: 2010-01-28 22:09:57 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-28 21:09
ComboFix2.txt 2010-01-28 20:01
ComboFix3.txt 2010-01-28 18:05
ComboFix4.txt 2010-01-28 17:30

Před spuštěním: Volných bajtů: 147 033 706 496
Po spuštění: Volných bajtů: 146 991 620 096

- - End Of File - - D6EA48C69C748B7F14C5A2E2D041A3A5

[pitimir]

OK, tym padom nam ostava expand...

Nabootujes do Konzoly pre zotavenie (Recovery Console) a v nej zadas tieto prikazy:

Kód: Vybrat vše

expand X:\i386\proquota.ex_ c:\proquota.exe

Enter.

Kód: Vybrat vše

exit

Enter.

Znova ta ista poznamka: miesto "X" treba dosadit pismeno patriace tvojej CD-ROMke, v ktorej sa nachadza disk.

Ked budes mat, daj vediet. Pri uspesnom skopirovani by sa mala zobrazit hlaska v zmysle, ze subor bol spoceny uspesne.

[Mr.Hol]

Promin, ale moc tomu ted nerozumim

jak mam otevrit tu konzoly? a mam pri tom mit v mechanice disk s windowsama?

omlouvam se, ale moc se v tomto nevyznam

[pitimir]

V pohode, radsej sa spytaj

Na >>tomto<< linku najdes navodik ohladom Recovery Console, ako ju spustit a co v nej robit. Odporucam precitat, avsak nic nerobit.

Potom restartujes pocitac, dostanes sa do RC a v nej zadas LEN tieto dva prikazy:

Kód: Vybrat vše

expand X:\i386\proquota.ex_ c:\proquota.exe

Enter. Za "X" treba dosadit pismeno patriace tvojej CD-ROMke. V pripade uspesneho skopirovania sa objavi hlaska v zmysle, ze jeden subor bol uspesne skopirovany. A potomr prejdes na druhy prikaz:

Kód: Vybrat vše

exit

Nim sa dostanes VON z RC. Vytiahnes CD a PC sa restartuje. Normalne nabootujes do Windowsu a tam spravis nasledovne:


Stiahni SystemLook. Uloz na plochu a spust. Do okna skopiruj:

Kód: Vybrat vše

:filefind
proquota.exe

Klikni na "Look" a nechaj program dokoncit scan. Po jeho skonceni sa ti zobrazi log, ktory potrebujem vidiet. V pripade problemov sa nachadza aj na ploche.

[Mr.Hol]

Tak jsem udelal vse tak jak jsem mel, nejspis, a presto se mi to nedari
muj postup byl nasledovny:
1. precetl sem si co a jak a moc moudry sem z toho nebyl
2. vlozil disk do mechaniky a restartoval jsem PC
3. pri spousteni windowsu jsem vybral spusteni RC
4. objevila se mi tabulka - neco ve smyslu jakou instalaci Windowsu mam na mysli, tak jsem zvolil 1, nic jineho taky neslo
5. zkousel jsem tam vlozit ten kod, ale hlasilo mi to, ze se v mechanice nenachazi zadny disk (X jsem prepsal na D)

navod vypadal srozumitelne, ale nejspis je chyba ve me, protoze tyto veci jdou mimo me

[pitimir]

Pod pismenom D mas mechaniku, v ktorej si mal instalacne CD?

[Mr.Hol]

Ano, mam

V prubehu vikendu to jeste zkusim, ovsem nevim presne kdy to bude. Kazdpodane do pondelka do vecera se znovu ozvu jestli se to povedlo, nebo ne

[pitimir]

OK, netrpezlivo ocakavam odpoved

[Mr.Hol]

Tak jsem to zkusil znovu, opet stejna hlaska

[pitimir]

Tak este raz a inak:
Znova do konzole, tentokrat to budu 4 prikazy, po kazdom treba stlacit Enter.

Kód: Vybrat vše

D:

Kód: Vybrat vše

cd I386

Kód: Vybrat vše

expand proquota.ex_ c:\windows\system32\

Kód: Vybrat vše

exit