100% CPU - kernel32.dll

Zpráva

morfeus24 · #31 Příspěvek od **morfeus24** » 21 črc 2010 09:47

Uz som bol taky stastny vcera ze vsetko dobre a ty toto

1,

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verzia databázy: 4332

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

21. 7. 2010 10:04:57
mbam-log-2010-07-21 (10-04-57).txt

Typ kontroly: Úplná kontrola (A:\|C:\|D:\|F:\|)
Objektov kontrolovaných: 248930
Uplynulý čas: 1 hod, 5 min, 50 sek

Infikované služby pamäte: 0
Infikované moduly pamäte: 0
Infikované registračné kľúče: 0
Infikované registračné hodnoty: 0
Infikované položky registračných dát: 0
Infikované priečinky: 0
Infikované súbory: 35

Infikované služby pamäte:
(Škodlivé položky neboli zistené)

Infikované moduly pamäte:
(Škodlivé položky neboli zistené)

Infikované registračné kľúče:
(Škodlivé položky neboli zistené)

Infikované registračné hodnoty:
(Škodlivé položky neboli zistené)

Infikované položky registračných dát:
(Škodlivé položky neboli zistené)

Infikované priečinky:
(Škodlivé položky neboli zistené)

Infikované súbory:
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP2\A0004222.exe (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP2\A0004223.exe (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005344.sys (Rootkit.Bubnix) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005347.scr (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005348.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005351.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005355.SCR (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005356.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005358.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005359.EXE (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005362.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005363.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005365.EXE (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005366.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005367.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005368.EXE (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005369.EXE (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005370.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005372.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005373.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005374.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005375.EXE (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005376.EXE (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005377.EXE (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005378.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005379.EXE (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP5\A0005380.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP7\A0005396.rbf (Adware.WidgiToolbar) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP7\A0005397.rbf (Adware.WidgiToolbar) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP7\A0005399.exe (Adware.Agent) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP7\A0005405.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP7\A0005406.EXE (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP7\A0005407.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP7\A0005408.DLL (Adware.MyWebSearch) -> No action taken.
C:\System Volume Information\_restore{82B2A5A5-E4C3-4EE2-9C31-4238F6D7F926}\RP8\A0005483.dll (Adware.MyWebSearch) -> No action taken.

2,

to som tam nenasiel teda bud to neexistuje alebo neviem kde to moze byt... uz som ti pisal ze som to hladal aj cestou C:Program files.... ale je tam iba TeaTimer a advcheck.dll

3,

ComboFix 10-07-20.03 - JA . 07. 2010 10:22:43.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1029.18.510.230 [GMT 2:00]
Running from: c:\documents and settings\JA\Plocha\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: NVIDIA Firewall *disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}
.

((((((((((((((((((((((((( Files Created from 2010-06-21 to 2010-07-21 )))))))))))))))))))))))))))))))
.

2010-07-20 20:16 . 2010-07-20 20:16 -------- d-----w- c:\program files\CCleaner
2010-07-20 19:57 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-20 19:57 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-20 19:30 . 2010-07-20 19:30 -------- d-----w- C:\_OTM
2010-07-20 16:41 . 2010-07-20 16:42 -------- d-----w- c:\program files\trend micro
2010-07-20 16:41 . 2010-07-20 16:43 -------- d-----w- C:\rsit
2010-07-20 13:41 . 2010-07-20 13:40 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-07-20 13:41 . 2010-07-20 13:41 -------- dc----w- c:\windows\system32\DRVSTORE
2010-07-12 14:12 . 2008-04-14 06:52 366080 -c--a-w- c:\windows\system32\dllcache\w3svc.dll
2010-07-12 14:12 . 2001-10-25 12:00 73728 -c--a-w- c:\windows\system32\dllcache\w3ext.dll
2010-07-12 14:12 . 2001-10-25 12:00 5632 -c--a-w- c:\windows\system32\dllcache\w3svapi.dll
2010-07-12 14:12 . 2001-10-25 12:00 48256 -c--a-w- c:\windows\system32\dllcache\w32.dll
2010-07-12 14:12 . 2001-10-25 12:00 4608 -c--a-w- c:\windows\system32\dllcache\w3ctrs51.dll
2010-07-12 14:12 . 2001-10-25 12:00 101376 -c--a-w- c:\windows\system32\dllcache\srusbusd.dll
2010-07-12 14:10 . 2001-10-25 12:00 45568 -c--a-w- c:\windows\system32\dllcache\browscap.dll
2010-07-12 14:08 . 2001-10-25 12:00 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe
2010-07-12 14:08 . 2008-04-14 06:51 7168 -c--a-w- c:\windows\system32\dllcache\bitsprx4.dll
2010-07-12 14:08 . 2008-04-14 06:51 7168 ----a-w- c:\windows\system32\bitsprx4.dll
2010-07-12 14:06 . 2008-04-14 06:52 53248 ----a-w- c:\windows\system32\tsgqec.dll
2010-07-12 14:06 . 2008-04-14 06:51 290304 ----a-w- c:\windows\system32\rhttpaa.dll
2010-07-12 14:06 . 2008-04-14 06:51 136192 -c--a-w- c:\windows\system32\dllcache\aaclient.dll
2010-07-12 14:06 . 2008-04-14 06:51 136192 ----a-w- c:\windows\system32\aaclient.dll
2010-07-12 14:05 . 2008-04-14 06:51 27648 ----a-w- c:\windows\system32\irmon.dll
2010-07-12 14:05 . 2008-04-14 06:52 152064 ----a-w- c:\windows\system32\irftp.exe
2010-07-12 14:05 . 2008-04-14 06:52 8192 ----a-w- c:\windows\system32\wshirda.dll
2010-07-12 14:05 . 2008-04-13 22:24 88192 ----a-w- c:\windows\system32\drivers\irda.sys
2010-07-12 14:02 . 2001-10-25 12:00 45109 -c--a-w- c:\windows\system32\dllcache\imjpuex.exe
2010-07-12 13:55 . 2001-08-17 19:51 18688 ----a-w- c:\windows\system32\drivers\irsir.sys
2010-07-12 13:46 . 2001-08-17 19:51 19584 ----a-w- c:\windows\system32\drivers\rasirda.sys
2010-07-12 13:43 . 2001-10-25 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2010-07-12 13:43 . 2001-10-25 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2010-07-12 13:43 . 2001-10-25 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2010-07-12 13:43 . 2001-10-25 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2010-07-10 15:02 . 2010-07-10 15:02 -------- d-----w- c:\program files\Common Files\Java
2010-07-10 15:01 . 2010-04-12 15:29 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-06-29 17:50 . 2010-07-01 08:48 -------- d-----w- c:\program files\uTorrent
2010-06-25 09:39 . 2006-07-28 07:30 236824 ----a-w- c:\windows\system32\xactengine2_3.dll
2010-06-25 09:39 . 2006-07-28 07:30 62744 ----a-w- c:\windows\system32\xinput1_2.dll
2010-06-23 15:13 . 2010-06-23 15:15 -------- d-----w- c:\program files\ICQ7.2

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-20 19:08 . 2009-02-13 14:57 -------- d-----w- c:\program files\Google
2010-07-20 13:36 . 2009-04-11 10:07 -------- d-----w- c:\program files\Lavasoft
2010-07-19 21:06 . 2010-02-19 11:46 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-07-12 14:25 . 2009-01-10 17:39 2740 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-07-12 14:20 . 2001-10-25 14:00 79044 ----a-w- c:\windows\system32\perfc005.dat
2010-07-12 14:20 . 2001-10-25 14:00 431978 ----a-w- c:\windows\system32\perfh005.dat
2010-07-12 14:06 . 2009-01-10 17:37 22916 ----a-w- c:\windows\system32\emptyregdb.dat
2010-07-10 15:00 . 2009-05-10 09:02 -------- d-----w- c:\program files\Java
2010-07-01 16:06 . 2009-09-10 17:40 -------- d-----w- c:\program files\Opera
2010-06-23 15:14 . 2009-01-10 17:54 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-20 10:12 . 2009-02-04 15:16 -------- d-----w- c:\program files\Mario Forever
2010-06-20 10:10 . 2009-02-23 12:32 -------- d-----w- c:\program files\EA SPORTS
2010-05-30 19:14 . 2010-03-13 13:55 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-05-29 19:09 . 2009-11-10 15:55 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-04-29 18:47 . 2010-04-29 18:47 3600384 ----a-w- c:\windows\system32\GPhotos.scr
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{208722fa-38e0-4142-83e5-a341b43a35dd}"= "c:\program files\Power_Challenge\tbPow0.dll" [2010-05-14 2515552]
"{dd02a4eb-4afd-4d60-99d8-e67f964ca813}"= "c:\program files\PHPNukeEN\tbPHP0.dll" [2010-05-14 2515552]

[HKEY_CLASSES_ROOT\clsid\{208722fa-38e0-4142-83e5-a341b43a35dd}]

[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{208722fa-38e0-4142-83e5-a341b43a35dd}]
2010-05-14 19:51 2515552 ----a-w- c:\program files\Power_Challenge\tbPow0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
2010-05-14 19:51 2515552 ----a-w- c:\program files\PHPNukeEN\tbPHP0.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{208722fa-38e0-4142-83e5-a341b43a35dd}"= "c:\program files\Power_Challenge\tbPow0.dll" [2010-05-14 2515552]
"{dd02a4eb-4afd-4d60-99d8-e67f964ca813}"= "c:\program files\PHPNukeEN\tbPHP0.dll" [2010-05-14 2515552]

[HKEY_CLASSES_ROOT\clsid\{208722fa-38e0-4142-83e5-a341b43a35dd}]

[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{208722FA-38E0-4142-83E5-A341B43A35DD}"= "c:\program files\Power_Challenge\tbPow0.dll" [2010-05-14 2515552]
"{DD02A4EB-4AFD-4D60-99D8-E67F964CA813}"= "c:\program files\PHPNukeEN\tbPHP0.dll" [2010-05-14 2515552]

[HKEY_CLASSES_ROOT\clsid\{208722fa-38e0-4142-83e5-a341b43a35dd}]

[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-04-24 203928]
"ICQ"="c:\program files\ICQ7.2\ICQ.exe" [2010-06-23 133368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-25 13680640]
"nwiz"="nwiz.exe" [2008-12-25 1657376]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 61952]
"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2005-12-12 69632]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-25 86016]
"RTHDCPL"="RTHDCPL.EXE" [2005-11-10 15473664]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-13 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-13 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-07-20 524632]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\JA\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *sprestrt

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nTrayFw]
2005-07-29 16:25 270336 ----a-w- c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"d:\\jav\\jre-6u13-windows-i586-p-s.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\EA SPORTS\\FIFA 08\\FIFA08.exe"=
"c:\\Documents and Settings\\JA\\Plocha\\FIFA08.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"d:\\utorrent\\utorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58676:TCP"= 58676:TCP:Pando Media Booster
"58676:UDP"= 58676:UDP:Pando Media Booster

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [20.7.2010 15:41 64160]
R2 Angelnt;Angelnt;c:\windows\system32\drivers\ANGELNT.SYS [2.12.2009 18:36 51072]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [16.2.2010 19:39 108289]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18.1.2009 23:34 1029456]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [13.3.2009 15:56 721904]
S2 PskSvcRetailInst;PskSvcRetailInst;c:\docume~1\JA\LOCALS~1\Temp\ISSCAN\PskSvc.exe --> c:\docume~1\JA\LOCALS~1\Temp\ISSCAN\PskSvc.exe [?]
S3 ddsxeiservice;ddsxeiservice2;\??\c:\program files\sXe Injected\ddsxei.sys --> c:\program files\sXe Injected\ddsxei.sys [?]
S3 FXDRV;FXDRV;\??\f:\fxdrv.sys --> f:\Fxdrv.sys [?]
S3 FXDrv32;FXDrv32;\??\f:\fxdrv32.sys --> f:\FXDrv32.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-07-20 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 13:40]

2010-07-16 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://radiobar.toolbarhome.com?hp=df
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - c:\program files\ICQ7.2\ICQ.exe
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-21 10:31
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(780)
c:\windows\system32\nvappfilter.dll
.
Completion time: 2010-07-21 10:36:35
ComboFix-quarantined-files.txt 2010-07-21 08:36
ComboFix2.txt 2010-07-20 21:08

Pre-Run: Volných bajtů: 15 375 810 560
Post-Run: Volných bajtů: 15 357 292 544

Current=4 Default=4 Failed=0 LastKnownGood=6 Sets=1,2,3,4,5,6
- - End Of File - - B0FD3E55063D6CDE06003358D3715AF0

cakam na tvoje vyjadrenie... dufam ze bude prijemnejsie

#32 Příspěvek od **stell** » 21 črc 2010 09:51

stale vidim v Malwarebytes No action taken.
Zmazal si co nasiel,,ci nie>??

morfeus24 · #33 Příspěvek od **morfeus24** » 21 črc 2010 09:57

ano ukazali sa mi vysledky a dal som to odstranit... neviem ale nemoze byt chyba v tom ze pocas toho procesu mi vyskakovali upozornia od Avira Antiviru ze nasiel virus a ja som dal Dany access a tak OK...

#34 Příspěvek od **stell** » 21 črc 2010 10:00

nie,,dobre

Vypni obnovu systemu-restart a zapni spat.
system volume information/restore (Obnova systému):
1. Je potřeba vypnout nástroj obnova systému - Ovládací panely>systém>obnovení systému>vypnout nástroj obnovení systému>OK nebo použít a nyní jen restartovat PC
2. Po restartu je tento adresář kompletně smazán, obnovu opět zapnout.http://www.viry.cz/forum/viewtopic.php?f=11&t=47040

Pri tejto akcii je nutné mať ComboFix na ploche.

Vypni>FIREWALL>Antivir>Antispyware>vsetko rezidentne.

Otvor Notepad (Poznámkový blok) a zkopíruj do neho celý zeleny tex:

Kód: Vybrat vše

KILLALL::
Driver::
PskSvcRetailInst
Rootkit::
c:\docume~1\JA\LOCALS~1\Temp\ISSCAN\PskSvc.exe
Folder::
c:\program files\Spybot - Search & Destroy
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=-
"ICQ"=-

Potom klik na Subor -> Uložiť ako.. .. -> Ako je Názov souboru tak do toho riadku napiš:CFScript.txt
Typ súboru tak tam vyberies *všetky súbory
A ulož ho na plochu.> Pozor CFScript.txt>Neotvarat a nemoze byt ani>CFScript.txt.txt A Urobis Toto :
Obrázek

Po skonceni skenu vlož log čo ComboFix vytvorí

morfeus24 · #35 Příspěvek od **morfeus24** » 21 črc 2010 10:23

Vypni>FIREWALL>Antivir>Antispyware>vsetko rezidentne. nechapem co je rezidentne

#36 Příspěvek od **stell** » 21 črc 2010 10:30

rezidentne su stity antiviru Firewallu-teda bezia a su v pamati,,a preto su rezidentne,,,ale ak mas stym problem,nechaj tak,,potom ignoruj hlasku combofixu a daj ok,

morfeus24 · #37 Příspěvek od **morfeus24** » 21 črc 2010 10:57

No tak tu je log

ComboFix 10-07-20.03 - JA . 07. 2010 11:37:23.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.421.1029.18.510.217 [GMT 2:00]
Running from: c:\documents and settings\JA\Plocha\ComboFix.exe
Command switches used :: c:\documents and settings\JA\Plocha\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: NVIDIA Firewall *disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Spybot - Search & Destroy
c:\program files\Spybot - Search & Destroy\advcheck.dll
c:\program files\Spybot - Search & Destroy\TeaTimer.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_PSKSVCRETAILINST
-------\Service_PskSvcRetailInst

((((((((((((((((((((((((( Files Created from 2010-06-21 to 2010-07-21 )))))))))))))))))))))))))))))))
.

2010-07-20 20:16 . 2010-07-20 20:16 -------- d-----w- c:\program files\CCleaner
2010-07-20 19:57 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-20 19:57 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-20 19:30 . 2010-07-20 19:30 -------- d-----w- C:\_OTM
2010-07-20 16:41 . 2010-07-20 16:42 -------- d-----w- c:\program files\trend micro
2010-07-20 16:41 . 2010-07-20 16:43 -------- d-----w- C:\rsit
2010-07-20 13:41 . 2010-07-20 13:40 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-07-20 13:41 . 2010-07-20 13:41 -------- dc----w- c:\windows\system32\DRVSTORE
2010-07-12 14:12 . 2008-04-14 06:52 366080 -c--a-w- c:\windows\system32\dllcache\w3svc.dll
2010-07-12 14:12 . 2001-10-25 12:00 73728 -c--a-w- c:\windows\system32\dllcache\w3ext.dll
2010-07-12 14:12 . 2001-10-25 12:00 5632 -c--a-w- c:\windows\system32\dllcache\w3svapi.dll
2010-07-12 14:12 . 2001-10-25 12:00 48256 -c--a-w- c:\windows\system32\dllcache\w32.dll
2010-07-12 14:12 . 2001-10-25 12:00 4608 -c--a-w- c:\windows\system32\dllcache\w3ctrs51.dll
2010-07-12 14:12 . 2001-10-25 12:00 101376 -c--a-w- c:\windows\system32\dllcache\srusbusd.dll
2010-07-12 14:10 . 2001-10-25 12:00 45568 -c--a-w- c:\windows\system32\dllcache\browscap.dll
2010-07-12 14:08 . 2001-10-25 12:00 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe
2010-07-12 14:08 . 2008-04-14 06:51 7168 -c--a-w- c:\windows\system32\dllcache\bitsprx4.dll
2010-07-12 14:08 . 2008-04-14 06:51 7168 ----a-w- c:\windows\system32\bitsprx4.dll
2010-07-12 14:06 . 2008-04-14 06:52 53248 ----a-w- c:\windows\system32\tsgqec.dll
2010-07-12 14:06 . 2008-04-14 06:51 290304 ----a-w- c:\windows\system32\rhttpaa.dll
2010-07-12 14:06 . 2008-04-14 06:51 136192 -c--a-w- c:\windows\system32\dllcache\aaclient.dll
2010-07-12 14:06 . 2008-04-14 06:51 136192 ----a-w- c:\windows\system32\aaclient.dll
2010-07-12 14:05 . 2008-04-14 06:51 27648 ----a-w- c:\windows\system32\irmon.dll
2010-07-12 14:05 . 2008-04-14 06:52 152064 ----a-w- c:\windows\system32\irftp.exe
2010-07-12 14:05 . 2008-04-14 06:52 8192 ----a-w- c:\windows\system32\wshirda.dll
2010-07-12 14:05 . 2008-04-13 22:24 88192 ----a-w- c:\windows\system32\drivers\irda.sys
2010-07-12 14:02 . 2001-10-25 12:00 45109 -c--a-w- c:\windows\system32\dllcache\imjpuex.exe
2010-07-12 13:55 . 2001-08-17 19:51 18688 ----a-w- c:\windows\system32\drivers\irsir.sys
2010-07-12 13:46 . 2001-08-17 19:51 19584 ----a-w- c:\windows\system32\drivers\rasirda.sys
2010-07-12 13:43 . 2001-10-25 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2010-07-12 13:43 . 2001-10-25 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2010-07-12 13:43 . 2001-10-25 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2010-07-12 13:43 . 2001-10-25 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2010-07-10 15:02 . 2010-07-10 15:02 -------- d-----w- c:\program files\Common Files\Java
2010-07-10 15:01 . 2010-04-12 15:29 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-06-29 17:50 . 2010-07-01 08:48 -------- d-----w- c:\program files\uTorrent
2010-06-25 09:39 . 2006-07-28 07:30 236824 ----a-w- c:\windows\system32\xactengine2_3.dll
2010-06-25 09:39 . 2006-07-28 07:30 62744 ----a-w- c:\windows\system32\xinput1_2.dll
2010-06-23 15:13 . 2010-06-23 15:15 -------- d-----w- c:\program files\ICQ7.2

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-21 09:29 . 2009-01-10 17:39 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-07-21 09:29 . 2009-01-10 17:39 2740 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2010-07-20 19:08 . 2009-02-13 14:57 -------- d-----w- c:\program files\Google
2010-07-20 13:36 . 2009-04-11 10:07 -------- d-----w- c:\program files\Lavasoft
2010-07-19 21:06 . 2010-02-19 11:46 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-07-12 14:20 . 2001-10-25 14:00 79044 ----a-w- c:\windows\system32\perfc005.dat
2010-07-12 14:20 . 2001-10-25 14:00 431978 ----a-w- c:\windows\system32\perfh005.dat
2010-07-12 14:06 . 2009-01-10 17:37 22916 ----a-w- c:\windows\system32\emptyregdb.dat
2010-07-10 15:00 . 2009-05-10 09:02 -------- d-----w- c:\program files\Java
2010-07-01 16:06 . 2009-09-10 17:40 -------- d-----w- c:\program files\Opera
2010-06-23 15:14 . 2009-01-10 17:54 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-20 10:12 . 2009-02-04 15:16 -------- d-----w- c:\program files\Mario Forever
2010-06-20 10:10 . 2009-02-23 12:32 -------- d-----w- c:\program files\EA SPORTS
2010-05-30 19:14 . 2010-03-13 13:55 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-05-29 19:09 . 2009-11-10 15:55 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-04-29 18:47 . 2010-04-29 18:47 3600384 ----a-w- c:\windows\system32\GPhotos.scr
.

((((((((((((((((((((((((((((( SnapShot@2010-07-21_08.31.07 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-07-21 09:47 . 2010-07-21 09:47 16384 c:\windows\temp\Perflib_Perfdata_76c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{208722fa-38e0-4142-83e5-a341b43a35dd}"= "c:\program files\Power_Challenge\tbPow0.dll" [2010-05-14 2515552]
"{dd02a4eb-4afd-4d60-99d8-e67f964ca813}"= "c:\program files\PHPNukeEN\tbPHP0.dll" [2010-05-14 2515552]

[HKEY_CLASSES_ROOT\clsid\{208722fa-38e0-4142-83e5-a341b43a35dd}]

[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{208722fa-38e0-4142-83e5-a341b43a35dd}]
2010-05-14 19:51 2515552 ----a-w- c:\program files\Power_Challenge\tbPow0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]
2010-05-14 19:51 2515552 ----a-w- c:\program files\PHPNukeEN\tbPHP0.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{208722fa-38e0-4142-83e5-a341b43a35dd}"= "c:\program files\Power_Challenge\tbPow0.dll" [2010-05-14 2515552]
"{dd02a4eb-4afd-4d60-99d8-e67f964ca813}"= "c:\program files\PHPNukeEN\tbPHP0.dll" [2010-05-14 2515552]

[HKEY_CLASSES_ROOT\clsid\{208722fa-38e0-4142-83e5-a341b43a35dd}]

[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{208722FA-38E0-4142-83E5-A341B43A35DD}"= "c:\program files\Power_Challenge\tbPow0.dll" [2010-05-14 2515552]
"{DD02A4EB-4AFD-4D60-99D8-E67F964CA813}"= "c:\program files\PHPNukeEN\tbPHP0.dll" [2010-05-14 2515552]

[HKEY_CLASSES_ROOT\clsid\{208722fa-38e0-4142-83e5-a341b43a35dd}]

[HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-04-24 203928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-25 13680640]
"nwiz"="nwiz.exe" [2008-12-25 1657376]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 61952]
"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2005-12-12 69632]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-25 86016]
"RTHDCPL"="RTHDCPL.EXE" [2005-11-10 15473664]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-13 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-13 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-07-20 524632]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\JA\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *sprestrt

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nTrayFw]
2005-07-29 16:25 270336 ----a-w- c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"d:\\jav\\jre-6u13-windows-i586-p-s.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\EA SPORTS\\FIFA 08\\FIFA08.exe"=
"c:\\Documents and Settings\\JA\\Plocha\\FIFA08.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"d:\\utorrent\\utorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58676:TCP"= 58676:TCP:Pando Media Booster
"58676:UDP"= 58676:UDP:Pando Media Booster

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [20.7.2010 15:41 64160]
R2 Angelnt;Angelnt;c:\windows\system32\drivers\ANGELNT.SYS [2.12.2009 18:36 51072]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [16.2.2010 19:39 108289]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18.1.2009 23:34 1029456]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [13.3.2009 15:56 721904]
S3 ddsxeiservice;ddsxeiservice2;\??\c:\program files\sXe Injected\ddsxei.sys --> c:\program files\sXe Injected\ddsxei.sys [?]
S3 FXDRV;FXDRV;\??\f:\fxdrv.sys --> f:\Fxdrv.sys [?]
S3 FXDrv32;FXDrv32;\??\f:\fxdrv32.sys --> f:\FXDrv32.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-07-20 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 13:40]

2010-07-16 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://radiobar.toolbarhome.com?hp=df
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - c:\program files\ICQ7.2\ICQ.exe
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-21 11:49
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(784)
c:\windows\system32\nvappfilter.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Completion time: 2010-07-21 11:55:15 - machine was rebooted
ComboFix-quarantined-files.txt 2010-07-21 09:55
ComboFix2.txt 2010-07-21 08:36
ComboFix3.txt 2010-07-20 21:08

Pre-Run: Volných bajtů: 15 876 820 992
Post-Run: Volných bajtů: 15 856 447 488

Current=4 Default=4 Failed=0 LastKnownGood=6 Sets=1,2,3,4,5,6
- - End Of File - - CF78C854808401656E9A3C00FF4F2D09

#38 Příspěvek od **stell** » 21 črc 2010 10:59

ok
este otestuj na www.virustotal.com
tento subor;
f:\FXDrv32.sys

morfeus24 · #39 Příspěvek od **morfeus24** » 21 črc 2010 11:05

co je vlastne to f ? lebo ja mam disky C a D a F je Jednotka Dvd ram a tam nic nemam

#40 Příspěvek od **stell** » 21 črc 2010 11:12

ak je jednotka dvd-tak nic,,

odinstaluj combofix-klik-start-klik-spustit-skopiruj do okna combofix /uninstall
klik ok.

precisti znova CCleanerom-hlavne register,a odskusaj pc,,ak vsetko bude ok tot vse,.

morfeus24 · #41 Příspěvek od **morfeus24** » 21 črc 2010 11:14

naspat som zapol firewall antivir a aktualizaciu pocitaca.... zapnutu aktualizaciu som skoro nikdy nemal a teraz CPU vyskakuje od 0 po 99 nejde o svchost ale o Necinne procesy.. co s tym?

#42 Příspěvek od **stell** » 21 črc 2010 11:23

Necinne procesy.. co s tym?
Precitaj to este raz pomaly Necinne procesy-to jest procesor je necinny-na 99%-a to takto ma byt,ci co sa ti nepaci??

morfeus24 · #43 Příspěvek od **morfeus24** » 21 črc 2010 11:33

Nevedel som ci to ma nieco spolocne s aktualizaciou pocitaca.... lebo teraz PC ide tak pomaly ako predtym.... takze to spomaluje ta aktualizacia alebo co?

#44 Příspěvek od **stell** » 21 črc 2010 11:34

Teraz neviem na co myslis-pocitac stahuje aktualizacie??

morfeus24 · #45 Příspěvek od **morfeus24** » 21 črc 2010 11:36

ano PC stahuje aktualizacie

VIRY.CZ

100% CPU - kernel32.dll

Re: 100% CPU - kernel32.dll

Re: 100% CPU - kernel32.dll

Re: 100% CPU - kernel32.dll

Re: 100% CPU - kernel32.dll

Re: 100% CPU - kernel32.dll

Re: 100% CPU - kernel32.dll

Re: 100% CPU - kernel32.dll

Re: 100% CPU - kernel32.dll

Re: 100% CPU - kernel32.dll

Re: 100% CPU - kernel32.dll

Re: 100% CPU - kernel32.dll

Re: 100% CPU - kernel32.dll

Re: 100% CPU - kernel32.dll

Re: 100% CPU - kernel32.dll

Re: 100% CPU - kernel32.dll