VIRY.CZ

Norton už odinstalovanej je, ale novej free ještě ne. Který je nejlepší? Měla jsem AVG, ale chytla jsem vir.

Avg je spise parodie na antivir

Nainstalujte Avast Free http://www.avast.com/get/gWR5mo92

Hotovo! Je nainstalován.

Tak jeste uklidime

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

Dejte novy log z RSIT a napiste co PC

vše jsem udělala. Jenže nyní mi ty složky na externím disku, které se ukazovaly jen jako zástupce Avast úplně zablokuje, protože tam prý je trojský kůň. Jak se mám dostat k těm datům? Prosím poraďte.

log:
Logfile of random's system information tool 1.06 (written by random/random)
Run by Ivona at 2013-01-27 17:59:55
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 49 GB (32%) free of 153 GB
Total RAM: 511 MB (39% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:00:14, on 27.1.2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\FsUsbExService.Exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Smart PC Solutions\Magic Speed\MagicSpeedBooster.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\Program Files\Canon\SELPHY Photo Print\CIC_SPPhelper.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Ivona.DOMA-QO9I0VR7RQ\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\Ivona.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O1 - Hosts: ˙ţ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~1\ArcSoft\MEDIAC~1\INTERN~1\ARCURL~1.DLL
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\TRANSLAT\WEBIE.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\TRANSLAT\WEBIE.DLL
O3 - Toolbar: Alive Text to Speech - {954F618B-0DEC-4D1A-9317-E0FC96F87865} - C:\PROGRA~1\ALIVEM~1\TEXTTO~1\IETOOL~1.DLL
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MagicSpeedBooster] C:\Program Files\Smart PC Solutions\Magic Speed\MagicSpeedBooster.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Hlavní panel ATI CATALYST.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: SELPHY Photo Print Launcher.lnk = C:\Program Files\Canon\SELPHY Photo Print\CIC_SPPhelper.exe
O4 - Global Startup: Wi-Fi MediaConnect.lnk = C:\Program Files\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: WikiKomentáře Google... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\TRANSLAT\WEBIE.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 5008663953
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crl ... crlocx.ocx
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: AVGIDSAgent - Unknown owner - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FsUsbExService - Teruten - C:\WINDOWS\system32\FsUsbExService.Exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MemeoBackgroundService - Memeo - C:\Program Files\Memeo\AutoBackup\MemeoBackgroundService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

--
End of file - 11051 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\avast! Emergency Update.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-24 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11222041-111B-46E3-BD29-EFB2449479B1}]
IEPlugin Class - C:\PROGRA~1\ArcSoft\MEDIAC~1\INTERN~1\ARCURL~1.DLL [2008-12-24 145920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\TRANSLAT\WEBIE.DLL [2007-09-18 360448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2011-11-10 325408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-10-30 1227736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-02-05 279664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll [2010-09-17 842296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-11-10 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-11-10 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\TRANSLAT\WEBIE.DLL [2007-09-18 360448]
{954F618B-0DEC-4D1A-9317-E0FC96F87865} - Alive Text to Speech - C:\PROGRA~1\ALIVEM~1\TEXTTO~1\IETOOL~1.DLL [2003-08-21 226304]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-02-05 279664]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2012-10-30 1227736]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2005-05-04 14396416]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"ATICCC"=C:\Program Files\ATI Technologies\ATI.ACE\cli.exe [2005-08-06 61440]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [2010-09-08 47904]
"ArcSoft Connection Service"=C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [2010-10-27 207424]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2012-10-30 4297136]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"MagicSpeedBooster"=C:\Program Files\Smart PC Solutions\Magic Speed\MagicSpeedBooster.exe [2009-05-05 192784]

C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění
Hlavní panel ATI CATALYST.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
SELPHY Photo Print Launcher.lnk - C:\Program Files\Canon\SELPHY Photo Print\CIC_SPPhelper.exe
Wi-Fi MediaConnect.lnk - C:\Program Files\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-08-04 46080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2009-01-30 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoInstrumentation"=1
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\ICQLite\ICQLite.exe"="C:\Program Files\ICQLite\ICQLite.exe:*:Enabled:ICQ Lite"
"C:\Program Files\FlashGet\flashget.exe"="C:\Program Files\FlashGet\flashget.exe:*:Enabled:Flashget"
"C:\Program Files\ICQ6\ICQ.exe"="C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\River Past\Wave@MP3\WaveAtMp3.exe"="C:\Program Files\River Past\Wave@MP3\WaveAtMp3.exe:*:Enabled:River Past Wave@MP3"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"G:\wd_windows_tools\samsung5210\npsasvr.exe"="G:\wd_windows_tools\samsung5210\npsasvr.exe:*:Enabled:KTF MUSIC AoD Server"
"G:\wd_windows_tools\samsung5210\npsvsvr.exe"="G:\wd_windows_tools\samsung5210\npsvsvr.exe:*:Enabled:KTF MUSIC VoD Server"
"C:\Program Files\ICQ7.1\ICQ.exe"="C:\Program Files\ICQ7.1\ICQ.exe:*:Enabled:ICQ7.1"
"C:\Program Files\ICQ7.1\aolload.exe"="C:\Program Files\ICQ7.1\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\Air Mouse\Air Mouse\Air Mouse.exe"="C:\Program Files\Air Mouse\Air Mouse\Air Mouse.exe:*:Enabled:AirMouse"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Java\jre6\launch4j-tmp\Stanza.exe"="C:\Program Files\Java\jre6\launch4j-tmp\Stanza.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"="C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Enabled:Spyware Terminator Update Support"
"C:\Program Files\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe"="C:\Program Files\Philips\Wi-Fi MediaConnect\Wi-Fi MediaConnect.exe:*:Enabled:Wi-Fi MediaConnect"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\ICQ7.1\ICQ.exe"="C:\Program Files\ICQ7.1\ICQ.exe:*:Enabled:ICQ7.1"
"C:\Program Files\ICQ7.1\aolload.exe"="C:\Program Files\ICQ7.1\aolload.exe:*:Enabled:aolload.exe"

======List of files/folders created in the last 1 months======

2013-01-27 17:59:55 ----D---- C:\rsit
2013-01-25 20:00:35 ----A---- C:\WINDOWS\system32\aswBoot.exe
2013-01-25 19:59:14 ----D---- C:\Program Files\AVAST Software
2013-01-25 19:59:14 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\AVAST Software
2013-01-22 20:26:17 ----A---- C:\Documents and Settings\Ivona.DOMA-QO9I0VR7RQ\Data aplikací\Sexmxe.exe

======List of files/folders modified in the last 1 months======

2013-01-27 18:00:14 ----D---- C:\Program Files\Trend Micro
2013-01-27 17:59:41 ----D---- C:\WINDOWS\Prefetch
2013-01-27 17:59:16 ----D---- C:\WINDOWS
2013-01-27 17:59:16 ----A---- C:\WINDOWS\TRNCOM.INI
2013-01-27 17:57:42 ----D---- C:\WINDOWS\Temp
2013-01-27 17:57:07 ----A---- C:\WINDOWS\NeroDigital.ini
2013-01-27 17:52:41 ----D---- C:\Program Files
2013-01-27 17:44:50 ----D---- C:\WINDOWS\system32\drivers
2013-01-27 17:42:25 ----D---- C:\WINDOWS\system32
2013-01-27 17:33:39 ----D---- C:\WINDOWS\Debug
2013-01-27 17:28:14 ----D---- C:\WINDOWS\system32\Lang
2013-01-27 17:25:33 ----A---- C:\Log.txt
2013-01-27 17:22:51 ----N---- C:\WINDOWS\SchedLgU.Txt
2013-01-26 21:14:36 ----D---- C:\WINDOWS\Minidump
2013-01-26 20:59:37 ----SHD---- C:\System Volume Information
2013-01-26 20:59:37 ----D---- C:\WINDOWS\system32\Restore
2013-01-25 20:10:25 ----D---- C:\Program Files\Mozilla Firefox
2013-01-25 20:01:58 ----SD---- C:\WINDOWS\Tasks
2013-01-25 20:01:15 ----SHD---- C:\WINDOWS\Installer
2013-01-25 20:01:14 ----D---- C:\Config.Msi
2013-01-25 20:01:13 ----D---- C:\WINDOWS\WinSxS
2013-01-22 20:36:48 ----D---- C:\Program Files\DAEMON Tools Toolbar
2013-01-22 20:19:18 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Norton
2013-01-22 20:12:11 ----D---- C:\Program Files\Common Files\Symantec Shared
2013-01-14 20:15:30 ----HDC---- C:\WINDOWS\$NtUninstallKB921503$

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2012-10-30 25256]
R1 AswRdr;aswRdr; C:\WINDOWS\system32\drivers\AswRdr.sys [2012-10-30 35928]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2012-10-30 738504]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2012-10-30 361032]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2012-10-30 54232]
R1 cdrbsdrv;cdrbsdrv; C:\WINDOWS\system32\drivers\cdrbsdrv.sys [2004-03-08 13567]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2006-03-18 26844]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2003-04-16 12032]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2012-10-30 21256]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2012-10-30 97608]
R3 3xHybrid;Pinnacle PCTV Stereo service; C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2004-12-03 969728]
R3 actser;actser; C:\WINDOWS\system32\drivers\actser.sys [2004-01-28 22912]
R3 ati2mtag;ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2005-08-04 1273344]
R3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e1e5132.sys [2005-09-14 179200]
R3 FsUsbExDisk;FsUsbExDisk; \??\C:\WINDOWS\system32\FsUsbExDisk.SYS []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\System32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-05-04 2951680]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\System32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 Pcouffin;Low level access layer for CD devices; C:\WINDOWS\System32\Drivers\Pcouffin.sys [2007-05-12 47360]
R3 rt2870;Belkin 802.11n USB Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERS\rt2870.sys [2007-07-28 517632]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 WFMC_VAD;WFMC Virtual Audio Device (WDM); C:\WINDOWS\system32\DRIVERS\wfmcvad.sys [2010-02-08 19328]
S3 ab7wj1fs;ab7wj1fs; C:\WINDOWS\system32\drivers\ab7wj1fs.sys []
S3 actvcomm;actvcomm; C:\WINDOWS\system32\drivers\actvcomm.sys [2004-04-28 78848]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2003-03-09 51024]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2003-03-09 16080]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2003-03-09 21456]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
S3 MPE;Filtr MPE BDA; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-13 15232]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632]
S3 pctvvbi;PCTVVBI; C:\WINDOWS\system32\DRIVERS\pctvvbi.sys [2002-11-11 6400]
S3 Ser2pl;SIEMENS Serial port driver; C:\WINDOWS\system32\DRIVERS\ser2pl.sys [2003-05-07 41472]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM); C:\WINDOWS\system32\DRIVERS\ss_bbus.sys [2009-03-20 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter); C:\WINDOWS\system32\DRIVERS\ss_bmdfl.sys [2009-03-20 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem; C:\WINDOWS\system32\DRIVERS\ss_bmdm.sys [2009-03-20 121856]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2011-05-10 42496]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 VNUSB;VN Series Device; C:\WINDOWS\system32\DRIVERS\VNUSB.sys [2006-04-07 38496]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2009-01-30 38528]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WUDFRd;WUDFRd; C:\WINDOWS\system32\DRIVERS\WUDFRd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2010-03-18 113152]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2011-05-25 37664]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\System32\Ati2evxx.exe [2005-08-04 380928]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-10-30 44808]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-07-12 387944]
R2 FsUsbExService;FsUsbExService; C:\WINDOWS\system32\FsUsbExService.Exe [2009-03-31 233472]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-11-10 153376]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared files\RichVideo.exe [2008-10-24 244904]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2011-06-28 496128]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2005-08-05 516096]
S2 AVGIDSAgent;AVGIDSAgent; C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe []
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 MemeoBackgroundService;MemeoBackgroundService; C:\Program Files\Memeo\AutoBackup\MemeoBackgroundService.exe [2008-11-07 25824]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2007-08-13 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-11-08 182768]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2011-08-19 821096]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2003-03-09 65795]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592]
S3 SwitchBoard;SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2009-02-04 913920]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------


log:

Zapojte do PC externi disk

• Stahne a ulozte na plochu UsbFix http://www.viry.cz/forum/viewtopic.php?f=24&t=102308
• Spustte a kliknete na Deletion
• Po dokonceni sem vlozte log, pokud na Vas nevyskoci, najdete jej zde C:\UsbFix.txt

Díky moc!!! Teď už to funguje. Akorát když UsbFix dojel, tak to chtělo uploudnout zip složku asi s tím zabaleným virem. Ale vypadl mi internet a pak už to nešlo. Vadí to hodně? Jinak log:
############################## | UsbFix V 7.096 | [Deletion]

User: Ivona (Administrator) # DOMA-QO9I0VR7RQ
Updated 15/08/2012 by El Desaparecido
Started at 20:33:10 | 28/01/2013

Website: http://eldesaparecido.com
Forum: http://forum.eldesaparecido.com
Suspicious file ? : http://eldesaparecido.com/upload.php
Contact: contact@eldesaparecido.com

PC: ATComputers (TRILINE PROFI ) (X86-based PC) # Desktop Computer
CPU: Intel(R) Pentium(R) 4 CPU 3.00GHz (3000)
RAM -> [Total : 511 | Free : 148]
BIOS: BIOS Date: 10/27/05 14:05:38 Ver: 08.00.10
BOOT: Normal boot

OS: Systém Microsoft Windows XP Professional (5.1.2600 32-Bit) # Service Pack 3
WB: Windows Internet Explorer 8.0.6001.18702

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Fixed drive # 149 Gb (48 Mb free - 32%) [] # NTFS
D:\ -> CD-ROM
E:\ -> CD-ROM
G:\ -> Fixed drive # 931 Gb (821 Mb free - 88%) [My Book] # FAT32
H:\ -> Removable drive # 984 Mb (658 Mb free - 67%) [KINGSTON] # FAT

################## | Active Processes |

C:\WINDOWS\System32\smss.exe (684)
C:\WINDOWS\system32\winlogon.exe (932)
C:\WINDOWS\system32\services.exe (976)
C:\WINDOWS\system32\lsass.exe (988)
C:\WINDOWS\System32\Ati2evxx.exe (1172)
C:\WINDOWS\system32\svchost.exe (1188)
C:\WINDOWS\System32\svchost.exe (1392)
C:\WINDOWS\system32\svchost.exe (1432)
C:\Program Files\AVAST Software\Avast\AvastSvc.exe (1864)
C:\WINDOWS\system32\spoolsv.exe (1996)
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (248)
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (260)
C:\Program Files\Bonjour\mDNSResponder.exe (296)
C:\WINDOWS\system32\FsUsbExService.Exe (728)
C:\Program Files\Java\jre6\bin\jqs.exe (748)
C:\Program Files\Memeo\AutoBackup\MemeoBackgroundService.exe (836)
C:\Program Files\CyberLink\Shared files\RichVideo.exe (2628)
C:\WINDOWS\system32\Ati2evxx.exe (2636)
C:\Program Files\Spyware Terminator\sp_rsser.exe (2776)
C:\WINDOWS\System32\svchost.exe (2840)
C:\WINDOWS\Explorer.EXE (3144)
C:\WINDOWS\system32\wuauclt.exe (3168)
C:\WINDOWS\RTHDCPL.EXE (2412)
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (2584)
C:\Program Files\AVAST Software\Avast\avastUI.exe (2608)
C:\WINDOWS\system32\ctfmon.exe (2656)
C:\Program Files\Smart PC Solutions\Magic Speed\MagicSpeedBooster.exe (3024)
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac (3056)
C:\Program Files\Canon\SELPHY Photo Print\CIC_SPPhelper.exe (3592)
C:\WINDOWS\system32\wuauclt.exe (3132)
C:\Program Files\AVAST Software\Avast\setup\avast.setup (3640)
C:\UsbFix\Go.exe (3004)
C:\WINDOWS\system32\wscntfy.exe (1580)

################## | Stopped processes |

Stopped! C:\WINDOWS\System32\Ati2evxx.exe (1172)
Stopped! C:\Program Files\AVAST Software\Avast\AvastSvc.exe (1864)
Stopped! C:\WINDOWS\system32\spoolsv.exe (1996)
Stopped! C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (248)
Stopped! C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (260)
Stopped! C:\Program Files\Bonjour\mDNSResponder.exe (296)
Stopped! C:\WINDOWS\system32\FsUsbExService.Exe (728)
Stopped! C:\Program Files\Java\jre6\bin\jqs.exe (748)
Stopped! C:\Program Files\Memeo\AutoBackup\MemeoBackgroundService.exe (836)
Stopped! C:\Program Files\CyberLink\Shared files\RichVideo.exe (2628)
Stopped! C:\WINDOWS\system32\Ati2evxx.exe (2636)
Stopped! C:\Program Files\Spyware Terminator\sp_rsser.exe (2776)
Stopped! C:\WINDOWS\Explorer.EXE (3144)
Stopped! C:\WINDOWS\system32\wuauclt.exe (3168)
Stopped! C:\WINDOWS\RTHDCPL.EXE (2412)
Stopped! C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (2584)
Stopped! C:\Program Files\AVAST Software\Avast\avastUI.exe (2608)
Stopped! C:\WINDOWS\system32\ctfmon.exe (2656)
Stopped! C:\Program Files\Smart PC Solutions\Magic Speed\MagicSpeedBooster.exe (3024)
Stopped! C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac (3056)
Stopped! C:\Program Files\Canon\SELPHY Photo Print\CIC_SPPhelper.exe (3592)
Stopped! C:\WINDOWS\system32\wuauclt.exe (3132)
Stopped! C:\WINDOWS\system32\wscntfy.exe (1580)

################## | Files # Infected Folders |

Deleted ! C:\Documents and Settings\Ivona.DOMA-QO9I0VR7RQ\Data aplikací\B.tmp
Deleted ! C:\Documents and Settings\Ivona.DOMA-QO9I0VR7RQ\Data aplikací\Sexmxe.exe
Deleted ! H:\Melodie-na-mobil.lnk
Not deleted ! C:\Recycler\S-1-5-21-1659004503-1757981266-725345543-1003
Deleted ! C:\Recycler\S-1-5-21-1993962763-606747145-725345543-1003
Not deleted ! C:\Recycler\S-1-5-21-527237240-362288127-682003330-1003
Deleted ! G:\RECYCLER\470a1245.exe
Deleted ! G:\Recycler\desktop.ini
Deleted ! H:\RECYCLER\470a1245.exe
Deleted ! H:\Recycler\desktop.ini

(!) Temporary files deleted.

################## | Registry |


################## | Mountpoints2 |


################## | Listing |

[08/11/2006 - 16:07:19 | D ] C:\$VAULT$.AVG
[23/02/2007 - 17:40:08 | D ] C:\31926ee518054421a61b
[27/12/2006 - 15:38:17 | D ] C:\5388defb4a07c388b3bb20e5
[16/01/2009 - 17:42:37 | D ] C:\5c6fbcd00f57901f42aab35832
[14/06/2009 - 14:52:24 | D ] C:\60792de3c4ed3aed16
[17/07/2006 - 15:59:37 | D ] C:\8
[17/07/2006 - 16:02:56 | D ] C:\9219313d25f1ad9623f557
[21/12/2006 - 17:40:52 | D ] C:\950ed19da15aa239d9ae685f055d
[17/07/2006 - 16:08:54 | D ] C:\a431565cdd53b046dbbc2bac06
[17/07/2006 - 16:08:09 | D ] C:\aacbb1b
[06/03/2007 - 17:08:05 | N | 7680] C:\AssistentGraph.grf
[14/11/2009 - 12:50:49 | D ] C:\ATLAS Consulting
[09/12/2012 - 12:11:42 | RASHD ] C:\Autorun.inf
[17/07/2006 - 16:01:56 | D ] C:\b917487eac6d4359a547
[05/05/2006 - 17:26:14 | D ] C:\Binaries
[19/06/2007 - 16:30:58 | N | 213] C:\Boot.bak
[11/12/2012 - 20:51:46 | N | 327] C:\boot.ini
[16/04/2003 - 13:00:00 | N | 4952] C:\Bootfont.bin
[01/09/2009 - 09:47:54 | N | 148] C:\ccJobMgr.dat
[11/12/2012 - 20:51:45 | D ] C:\cmdcons
[03/08/2004 - 23:00:04 | N | 261312] C:\cmldr
[25/11/2006 - 11:41:05 | D ] C:\col6596
[25/01/2013 - 20:01:15 | D ] C:\Config.Msi
[05/05/2006 - 14:53:10 | N | 0] C:\CONFIG.SYS
[30/07/2006 - 14:29:02 | D ] C:\DBBackup
[05/03/2010 - 20:00:31 | D ] C:\Documents and Settings
[31/01/2010 - 20:23:17 | D ] C:\Downloads
[30/08/2011 - 15:22:37 | N | 190] C:\drwtsn32.log
[28/12/2006 - 19:19:40 | N | 2005] C:\dvdfab_burn.log
[10/07/2011 - 11:59:46 | N | 90] C:\error.log
[28/11/2012 - 14:58:42 | N | 523] C:\hpfr3420.xml
[28/11/2012 - 14:58:42 | N | 389668] C:\hpfr3425.log
[29/09/2007 - 15:31:53 | N | 18017] C:\initemp.dat
[05/05/2006 - 14:53:10 | N | 0] C:\IO.SYS
[26/05/2010 - 19:41:26 | D ] C:\jexepackres
[28/01/2013 - 20:04:59 | N | 0] C:\Log.txt
[05/05/2006 - 14:53:10 | N | 0] C:\MSDOS.SYS
[12/07/2006 - 16:46:33 | RHD ] C:\MSOCache
[26/02/2007 - 17:26:10 | N | 47564] C:\NTDETECT.COM
[26/10/2008 - 14:04:26 | N | 250576] C:\ntldr
[22/05/2010 - 20:26:42 | D ] C:\Output Files
[28/01/2013 - 20:04:27 | ASH | 805306368] C:\pagefile.sys
[19/12/2006 - 17:55:10 | N | 13030] C:\PDOXUSRS.NET
[23/02/2007 - 17:04:40 | D ] C:\PLUGINS
[27/01/2013 - 17:52:41 | D ] C:\Program Files
[31/08/2011 - 14:00:28 | D ] C:\rafazon
[28/01/2013 - 20:42:04 | SHD ] C:\RECYCLER
[27/01/2013 - 18:00:22 | D ] C:\rsit
[20/06/2009 - 12:51:34 | N | 21536] C:\SDSSetup.log
[26/01/2013 - 20:59:37 | SHD ] C:\System Volume Information
[07/03/2010 - 16:31:11 | D ] C:\temp
[05/08/2007 - 13:09:35 | D ] C:\totalcmd
[18/09/2007 - 16:01:09 | D ] C:\TRANSLAT
[05/08/2007 - 13:27:13 | N | 59690] C:\treeinfo.wc
[04/08/2011 - 21:51:50 | D ] C:\Updater
[28/01/2013 - 20:42:04 | D ] C:\UsbFix
[28/01/2013 - 20:42:05 | A | 5021] C:\UsbFix.txt
[26/11/2006 - 17:18:41 | N | 18034] C:\vm404.log
[28/01/2013 - 20:29:45 | D ] C:\WINDOWS
[21/02/2010 - 20:32:48 | D ] C:\_CLTUI_E894D6B5_E3CA_4561_A244_272400640573_Session0
[21/02/2010 - 20:32:48 | D ] C:\_CLTUI_E894D6B5_E3CA_4561_A244_272400640573_Session1
[29/08/2011 - 14:04:34 | SHD ] G:\RECYCLER
[09/12/2012 - 12:11:44 | D ] G:\Autorun.inf
[31/03/2008 - 11:57:12 | N | 87] G:\Install.ini
[03/12/2008 - 13:38:50 | N | 319488] G:\Setup.exe
[06/04/2009 - 16:48:46 | D ] G:\wd_windows_tools
[06/04/2009 - 16:50:12 | D ] G:\wd_mac_tools
[06/04/2009 - 16:50:14 | D ] G:\Documentation
[06/04/2009 - 16:50:20 | D ] G:\autorun
[12/11/2009 - 17:20:54 | SHD ] G:\System Volume Information
[12/11/2009 - 18:46:16 | SHD ] G:\Recycled
[31/08/2011 - 17:23:00 | D ] G:\9e9a674fcd8efbffbcf4176ddfd5ea
[30/10/2012 - 14:47:16 | ASH | 5632] G:\Thumbs.db
[08/11/2011 - 20:12:48 | D ] G:\672ec64c47a8ec25842cb697dbc38aca
[08/11/2011 - 20:20:20 | D ] G:\b4edd5a44d7f595015d9ff156a
[31/08/2010 - 17:58:48 | N | 3611392] G:\Make It Through The Day-Hanson.m4r
[31/08/2010 - 17:55:50 | N | 3103663] G:\Give A Little-Hanson.m4r
[31/08/2010 - 17:52:28 | N | 4112832] G:\And I Waited-Hanson.m4r
[17/02/2012 - 17:47:34 | N | 2788427] G:\And I Waited-Hanson-1.m4r
[12/11/2009 - 19:04:20 | D ] G:\Dokumenty
[27/01/2013 - 17:56:50 | N | 281] G:\Plocha.lnk
[13/11/2009 - 14:07:20 | D ] G:\Ivona__Backup
[19/06/2009 - 19:19:58 | N | 412788] G:\faktura_id_5200907928.pdf
[05/06/2009 - 17:53:10 | N | 4595166] G:\Submerge_1.7.2v48.dmg
[21/03/2009 - 17:18:52 | N | 4350196] G:\RESI - e-shop.mht
[15/09/2009 - 16:19:44 | N | 25607] G:\dictionary.txt
[24/09/2009 - 20:05:54 | N | 2163518] G:\Charmed_1x01_Something_Wicca_This_Way_Comes_Trailer_(HQ).avi
[24/09/2009 - 20:11:38 | N | 3394548] G:\Charmed_trailer_1x02_(_fan_made_).avi
[24/09/2009 - 20:13:12 | N | 2412254] G:\Charmed_Australian_Trailer___1x03.avi
[13/11/2009 - 15:59:18 | D ] G:\Ivona_Backup_HD
[19/11/2009 - 18:10:12 | D ] G:\Hry
[08/04/2010 - 22:08:50 | D ] G:\61dab42e7799f7358101
[15/04/2010 - 22:10:12 | D ] G:\15ff429ec372eeeb1315a51fded3
[25/04/2010 - 20:54:44 | N | 4324273] G:\webbuilder6.zip
[24/07/2010 - 22:15:40 | N | 78] G:\Install.log
[26/09/2010 - 22:20:20 | D ] G:\50de869c79d5daf950
[01/11/2010 - 22:05:48 | D ] G:\f02dcda1b28ab1965d
[07/02/2011 - 22:37:40 | D ] G:\98fc17485a9177fc0c
[22/03/2012 - 16:16:38 | N | 2039129] H:\IvonaUrbanova.pdf
[24/05/2012 - 21:23:32 | HD ] H:\RECYCLER
[24/05/2012 - 20:28:46 | N | 22896145] H:\Melodie-na-mobil.rar
[25/05/2012 - 15:23:44 | D ] H:\Melodie-na-mobil
[24/05/2012 - 15:51:32 | N | 95752] H:\Státnice Ab.docx
[26/05/2012 - 13:31:34 | N | 181208] H:\download.pdf
[02/05/2012 - 14:52:06 | N | 309356608] H:\Tomas_Klus-komplet.zip
[27/11/2012 - 15:35:48 | N | 155702] H:\SKMBT_C22012112711510.pdf
[27/11/2012 - 14:29:02 | N | 119704] H:\37321.jpg
[23/11/2012 - 16:53:46 | N | 1775616] H:\Hand,-Cynthia---Nadpozemská.doc
[25/11/2012 - 14:18:28 | N | 1077530] H:\Sophie-Jordan---Firelight.pdf
[27/11/2012 - 14:16:38 | N | 11994] H:\imagesCAP0SJN2.jpg
[23/11/2012 - 16:04:34 | N | 3762795] H:\Fitzpatrick,-Becca---Ticho-(3.).doc
[09/12/2012 - 12:11:44 | D ] H:\Autorun.inf

################## | Vaccin |

C:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
G:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
H:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_DOMA-QO9I0VR7RQ.zip
http://eldesaparecido.com/upload.php
Thank you for your contribution.

################## | E.O.F |

ne nevadi

nekde se nam to tam natahuje zpatky

Udelejte sken AVPTool http://forum.viry.cz/viewtopic.php?f=29&t=58179

je to ono?
Status: Deleted (events: 6)
4.2.2013 20:53:29 Deleted Trojan program Backdoor.Win32.Ruskill.hgh C:\UsbFix\Quarantine\C\Documents and Settings\Ivona.DOMA-QO9I0VR7RQ\Data aplikací\B.tmp.vir High
4.2.2013 20:53:14 Deleted Trojan program Backdoor.Win32.Ruskill.hgh C:\UsbFix\Quarantine\C\Documents and Settings\Ivona.DOMA-QO9I0VR7RQ\Data aplikací\Sexmxe.exe.vir High
4.2.2013 20:54:04 Deleted Trojan program Backdoor.Win32.Ruskill.hgh C:\UsbFix\Quarantine\G\RECYCLER\470a1245.exe.vir High
4.2.2013 20:53:35 Deleted Trojan program Trojan.WinLNK.Runner.bl C:\UsbFix\Quarantine\H\Melodie-na-mobil.lnk.vir High
4.2.2013 20:54:26 Deleted Trojan program Backdoor.Win32.Ruskill.hgh C:\UsbFix\Quarantine\H\RECYCLER\470a1245.exe.vir High
4.2.2013 22:35:23 Deleted Trojan program Backdoor.Win32.Ruskill.hgh G:\System Volume Information\_restore{358001EF-91EC-4F38-8478-3BA4A091B63D}\RP866\A0184412.exe High

Ano je...

Stahnete Malwarebytes Anti-Rootkit http://www.bleepingcomputer.com/downloa ... i-rootkit/

• Ulozte nejlepe na Plochu a rozbalte
• Spustte kliknutim na mbanr
• Nyni postupne kliknete na Next a Update
• Po dokonceni update (aktualizace) databaze kliknete opet na Next
• Nechte zaskrtnute vsechny tri moznosti a klinete na Scan cimz spustite prohledavani PC
• Po dokonceni skenu (cca 5 minutek) zkontrolujte, zda-li je u vsech nalezu (samozrejme pokud budou) zatrzitko
• Tez zkontrolujte, jetsli je zatrzitko u Create Restore point
• Nyni kliknete na CleanUp cimz nalezenou infekci odstranime
• PC bude restartovan
• Slozka mbar by mela obsahovat log (a zrejme se i sam otevre) mbar-log-rok-mesic-den (hodina-minuta-sekunda).txt, ten mi sem dejte

Nic to nenašlo.

Zapojte opet flash disky\externi disky

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

Všechno normálně projede, ale po restartu PC se log neobjeví a ani na C: není.

OK, spustte na Avastu Test po restartu

omlouvám se, že jsem zbytečně obtěžovala. Nakonec PC stejně skončil v opravě.