VIRY.CZ

Fajn, zkuste tohle znovu. Doufám že net máte pořád odpojený.

motji píše: Stáhněte Avenger
http://swandog46.geekstogo.com/avenger.exe

-spustíte program a potvrdíte kliknutím na ok,tím potvrzujete, že všechny činnosti s tím spojené činíte na vlastní riziko.
-Po odkliknutí se objeví hlavní okno programu,do bílého okna něj zkopírujte tento skript:

Kód: Vybrat vše

Begin copying here:
Files to move:
c:\windows\ServicePackFiles\i386\atapi.sys | c:\windows\system32\drivers\atapi.sys

-zaškrtněte políčko scan for rootkits

a klikněte na tlačítko Execute.
-Potom se objeví okno,kde kliknutím Yes potvrdíte spuštění skriptu. Pak znovu tlačítkem yes potvrdíte restart počítače.
-Po restartu by se měl otevřít poznámkový blok s logem o vykonání skriptu, bude také uložený v C:\avenger.txt.
-Log vložte sem

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: file "c:\windows\ServicePackFiles\i386\atapi.sys" not found!
File move operation "c:\windows\ServicePackFiles\i386\atapi.sys|c:\windows\system32\drivers\atapi.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.

Omlouvám se, dala jsem Vám špatný skript

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File move operation "c:\atapi.sys|c:\windows\system32\drivers\atapi.sys" completed successfully.

Completed script processing.

*******************

Finished! Terminate.

Poprosím o nový combofix

ComboFix 11-08-21.01 - Filip 24.08.2011 23:58:37.6.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1574 [GMT 2:00]
Spuštěný z: c:\documents and settings\Filip\Plocha\ComboFix.exe
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Předchozí spuštění -------
.
c:\program files\Ask.com\cb_80f.ico
c:\program files\Ask.com\cobrand.ico
c:\program files\Ask.com\favicon.ico
c:\program files\Ask.com\fv_80e.ico
c:\program files\Ask.com\GenericAskToolbar.dll
c:\program files\Ask.com\precache.exe
c:\program files\Ask.com\UpdateTask.exe
c:\windows\av_ico\ico_avira_start.ico
c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
c:\windows\ufa\ufa.exe
c:\windows\unrar.exe
c:\windows\update.7.1\svchostdriver.exe
c:\windows\update.tray-8-0-lnk\svchost.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ddservice
-------\Legacy_ddservice
-------\Service_ddservice
-------\Service_ddservice
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-24 do 2011-08-24 )))))))))))))))))))))))))))))))
.
.
2011-08-24 21:04 . 2011-08-24 21:04 -------- d-----w- C:\_OTL
2011-08-24 19:19 . 2011-08-24 19:19 512 ----a-w- C:\PhysicalMBR.bin
2011-08-22 19:51 . 2011-08-22 19:51 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Martau
2011-08-22 19:51 . 2011-08-22 19:51 -------- d-----w- c:\program files\Total Uninstall 5
2011-08-21 20:14 . 2011-08-21 20:14 -------- d-----w- c:\documents and settings\Filip\Data aplikací\Malwarebytes
2011-08-21 20:14 . 2011-08-21 20:14 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-08-21 20:14 . 2010-11-29 15:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-21 20:14 . 2011-08-21 20:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-21 20:14 . 2010-11-29 15:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-21 16:34 . 2011-08-24 10:10 -------- d-----w- c:\program files\Valve
2011-08-21 11:39 . 2011-08-21 11:39 -------- d-----w- c:\windows\system32\wbem\Repository
2011-08-21 11:05 . 2011-08-21 11:33 -------- d-----w- c:\documents and settings\Filip\Data aplikací\Sammsoft
2011-08-20 18:14 . 2011-08-24 21:33 -------- d-----w- c:\program files\trend micro
2011-08-20 18:14 . 2011-08-20 18:14 -------- d-----w- C:\rsit
2011-08-20 11:46 . 2011-08-24 18:01 139488 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-08-20 11:46 . 2011-08-24 18:01 270776 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-08-20 11:46 . 2011-08-24 18:00 270776 ----a-w- c:\windows\system32\PnkBstrB.ex0
2011-08-20 11:46 . 2011-08-20 11:57 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2011-08-12 08:20 . 2011-08-12 08:20 -------- d-----w- c:\documents and settings\Filip\Local Settings\Data aplikací\PCHealth
2011-08-11 17:18 . 2011-06-24 14:10 139656 ------w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-11 17:17 . 2011-07-08 14:02 10496 ------w- c:\windows\system32\dllcache\ndistapi.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-24 18:01 . 2010-01-29 20:39 270776 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-07-15 13:29 . 2004-08-04 06:15 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2001-08-18 04:55 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-29 10:14 . 2009-09-25 11:21 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-06-29 10:14 . 2009-09-25 11:21 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-06-24 14:10 . 2004-08-17 22:49 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-21 18:18 . 2004-08-17 22:49 668160 ----a-w- c:\windows\system32\wininet.dll
2011-06-21 18:18 . 2004-08-04 05:59 61952 ----a-w- c:\windows\system32\tdc.ocx
2011-06-21 18:18 . 2004-08-17 22:49 81920 ----a-w- c:\windows\system32\ieencode.dll
2011-06-21 18:16 . 2004-08-17 22:44 370176 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2004-08-17 22:49 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-06 11:35 . 2004-08-17 22:44 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-30 14:18 . 2010-09-25 14:26 2474 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2011-05-11 20:20 . 2011-05-11 20:20 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-04-13 18:40 . !HASH: COULD NOT OPEN FILE !!!!! . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys
[7] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys
[7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys
[7] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys
.
((((((((((((((((((((((((((((( SnapShot@2011-08-21_20.00.33 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-24 21:36 . 2011-08-24 21:36 16384 c:\windows\temp\Perflib_Perfdata_1e4.dat
+ 2011-08-24 21:36 . 2011-08-24 21:36 16384 c:\windows\temp\Perflib_Perfdata_1d4.dat
+ 2009-09-24 19:45 . 2011-08-22 14:45 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-09-24 19:45 . 2011-08-21 20:01 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2011-08-21 14:06 . 2011-08-22 14:45 326656 c:\windows\system32\config\systemprofile\Local Settings\Data aplikací\AskToolbar\cache.dat
- 2011-08-21 14:06 . 2011-08-21 20:02 326656 c:\windows\system32\config\systemprofile\Local Settings\Data aplikací\AskToolbar\cache.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-07-29 17361032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-04-07 318488]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb12.exe" [2005-03-08 176128]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13684736]
"nwiz"="nwiz.exe" [2009-03-27 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 86016]
"SPC230NC_Monitor"="c:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"SPC_Monitor"="c:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"Copperhead"="c:\program files\CopperheadAntiSpyware\CopperScheduler.exe" [2007-10-02 1596345]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-5-15 384512]
.
c:\documents and settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-5-15 384512]
.
c:\documents and settings\Filip\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-5-15 384512]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
TrayMin230.lnk - c:\program files\Philips\Philips SPC230NC Webcam\TrayMin230.exe [2009-10-13 241664]
Wireless Utility.lnk - c:\program files\EDIMAX\Common\RaUI.exe [2011-2-22 1601536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Philips\\Intelligent Agent\\Philips Intelligent Agent.exe"=
"c:\\Documents and Settings\\Administrator\\Plocha\\Fiuypek\\Warcraft III\\Warcraft III.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\CAPCOM\\DARK VOID\\Launcher.exe"=
"c:\\Program Files\\CAPCOM\\DARK VOID\\nativePC\\Binaries\\ShippingPC-SkyGame.exe"=
"c:\\Program Files\\EA Sports\\FIFA 10\\FIFA10.exe"=
"c:\\Program Files\\CAPCOM\\Dead Rising 2\\deadrising2.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer_Service.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Filip\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\Firefly Studios\\Stronghold Crusader\\Stronghold Crusader.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [27.8.2010 16:22 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [27.8.2010 16:22 5248]
R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [4.1.2011 20:33 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [4.1.2011 20:33 5248]
R2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [24.9.2009 21:41 576024]
R2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [7.12.2010 12:32 2228008]
R3 PAEAFLT.sys;USB Composite Device;c:\windows\system32\drivers\PAEAFLT.sys [13.10.2009 16:43 8576]
R3 SPC230NC;Philips SPC230NC Webcam;c:\windows\system32\drivers\SPC230NC.SYS [13.10.2009 16:43 461056]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;"c:\program files\Avira\AntiVir Desktop\sched.exe" --> c:\program files\Avira\AntiVir Desktop\sched.exe [?]
S2 AntiVirWebService;Avira AntiVir WebGuard;"c:\program files\Avira\AntiVir Desktop\AVWEBGRD.EXE" --> c:\program files\Avira\AntiVir Desktop\AVWEBGRD.EXE [?]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6.5.2010 12:02 135664]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [10.11.2009 18:19 36608]
S3 GarenaPEngine;GarenaPEngine; [x]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [6.5.2010 12:02 135664]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [10.11.2009 15:36 136704]
S4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
.
Obsah adresáře 'Naplánované úlohy'
.
2011-08-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-06 10:02]
.
2011-08-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-06 10:02]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.sk/
mStart Page =
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 213.215.94.33 8.8.8.8
FF - ProfilePath - c:\documents and settings\Filip\Data aplikací\Mozilla\Firefox\Profiles\1x93r0uw.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2405280&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/
FF - prefs.js: keyword.URL - hxxp://gb.toolbarhome.com/search.aspx?srch=ku&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-25 00:03
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(652)
c:\program files\Avira\AntiVir Desktop\avsda.dll
.
- - - - - - - > 'explorer.exe'(2452)
c:\windows\system32\nview.dll
c:\windows\system32\NVWRSCS.DLL
c:\windows\system32\nvwddi.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2011-08-25 00:04:14
ComboFix-quarantined-files.txt 2011-08-24 22:04
ComboFix2.txt 2011-08-24 12:09
ComboFix3.txt 2011-08-23 09:15
ComboFix4.txt 2011-08-21 20:45
ComboFix5.txt 2011-08-24 14:02
.
Před spuštěním: Volných bajtů: 148.246.974.464
Po spuštění: Volných bajtů: 148.232.876.032
.
- - End Of File - - 6BAAB4831D5BB2A4D6B00ADA1D9E6F9F

Pořád se nám ten soubor vrací . Stále tam máte pozůstatky Daemonu nebo alcoholu, máte ho opravdu odinstalovaný?


Stáhněte SPTD http://www.duplexsecure.com/en/downloads
-vyberte verzi podle svého operačního systému. SPTD for Windows (32 bit) nebo (64b)
-uložte na plochu a spusťte
- zvolte možnost Uninstall
- restart PC


Stahněte http://www.jpshortstuff.247fixes.com/Defogger.exe
- spustte,
- potvrdte disabled
-log vložte zde

Nasiel som este deamon.exe tak som ho odstranil.

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:34 on 25/08/2011 (Filip)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
a347bus -> Disabled (Service running -> reboot required)
a347scsi -> Disabled (Service running -> reboot required)
Unable to read atapi.sys
d347prt -> Disabled (Service running -> reboot required)
SPTD -> Already disabled
d347bus -> Disabled (Service running -> reboot required)


-=E.O.F=-

Tak ale odstrante i ty drivery, nebo to můžeme měnit pořád dokola

Driveri ?? co ako to mam spravit ??

Teď už nic s drivery.
Takže opět si vybalte atapi s raru a znovu skript pro avenger.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File move operation "c:\atapi.sys|c:\windows\system32\drivers\atapi.sys" completed successfully.

Completed script processing.

*******************

Finished! Terminate.

A nový log z combofixu prosím

ComboFix 11-08-21.01 - Filip 25.08.2011 19:31:07.7.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1423 [GMT 2:00]
Spuštěný z: c:\documents and settings\Filip\Plocha\ComboFix.exe
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-25 do 2011-08-25 )))))))))))))))))))))))))))))))
.
.
2011-08-24 21:04 . 2011-08-24 21:04 -------- d-----w- C:\_OTL
2011-08-24 19:19 . 2011-08-24 19:19 512 ----a-w- C:\PhysicalMBR.bin
2011-08-22 19:51 . 2011-08-22 19:51 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Martau
2011-08-22 19:51 . 2011-08-22 19:51 -------- d-----w- c:\program files\Total Uninstall 5
2011-08-21 20:14 . 2011-08-21 20:14 -------- d-----w- c:\documents and settings\Filip\Data aplikací\Malwarebytes
2011-08-21 20:14 . 2011-08-21 20:14 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-08-21 20:14 . 2010-11-29 15:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-21 20:14 . 2011-08-21 20:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-21 20:14 . 2010-11-29 15:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-21 16:34 . 2011-08-24 10:10 -------- d-----w- c:\program files\Valve
2011-08-21 11:39 . 2011-08-21 11:39 -------- d-----w- c:\windows\system32\wbem\Repository
2011-08-21 11:05 . 2011-08-21 11:33 -------- d-----w- c:\documents and settings\Filip\Data aplikací\Sammsoft
2011-08-20 18:14 . 2011-08-24 21:33 -------- d-----w- c:\program files\trend micro
2011-08-20 18:14 . 2011-08-20 18:14 -------- d-----w- C:\rsit
2011-08-20 11:46 . 2011-08-25 12:23 139488 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-08-20 11:46 . 2011-08-25 12:23 270776 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-08-20 11:46 . 2011-08-25 11:19 270776 ----a-w- c:\windows\system32\PnkBstrB.ex0
2011-08-20 11:46 . 2011-08-20 11:57 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2011-08-12 08:20 . 2011-08-12 08:20 -------- d-----w- c:\documents and settings\Filip\Local Settings\Data aplikací\PCHealth
2011-08-11 17:18 . 2011-06-24 14:10 139656 ------w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-11 17:17 . 2011-07-08 14:02 10496 ------w- c:\windows\system32\dllcache\ndistapi.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-25 12:23 . 2010-01-29 20:39 270776 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-07-15 13:29 . 2004-08-04 06:15 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2001-08-18 04:55 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-29 10:14 . 2009-09-25 11:21 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-06-29 10:14 . 2009-09-25 11:21 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-06-24 14:10 . 2004-08-17 22:49 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-21 18:18 . 2004-08-17 22:49 668160 ----a-w- c:\windows\system32\wininet.dll
2011-06-21 18:18 . 2004-08-04 05:59 61952 ----a-w- c:\windows\system32\tdc.ocx
2011-06-21 18:18 . 2004-08-17 22:49 81920 ----a-w- c:\windows\system32\ieencode.dll
2011-06-21 18:16 . 2004-08-17 22:44 370176 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2004-08-17 22:49 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-06 11:35 . 2004-08-17 22:44 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-30 14:18 . 2010-09-25 14:26 2474 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2011-05-11 20:20 . 2011-05-11 20:20 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-21_20.00.33 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-25 14:01 . 2011-08-25 14:01 16384 c:\windows\temp\Perflib_Perfdata_a8.dat
+ 2011-08-25 14:01 . 2011-08-25 14:01 16384 c:\windows\temp\Perflib_Perfdata_7f0.dat
+ 2009-09-24 19:45 . 2011-07-08 13:49 46080 c:\windows\system32\tzchange.exe
- 2009-09-24 19:45 . 2010-11-03 13:12 46080 c:\windows\system32\tzchange.exe
- 2009-11-10 13:35 . 2010-02-22 14:20 18296 c:\windows\system32\spmsg.dll
+ 2009-11-10 13:35 . 2010-07-05 13:13 18296 c:\windows\system32\spmsg.dll
+ 2004-08-04 05:59 . 2008-04-13 18:40 96512 c:\windows\system32\drivers\atapi.sys
- 2009-09-24 19:45 . 2011-08-21 20:01 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-09-24 19:45 . 2011-08-22 14:45 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2011-08-21 14:06 . 2011-08-22 14:45 326656 c:\windows\system32\config\systemprofile\Local Settings\Data aplikací\AskToolbar\cache.dat
- 2011-08-21 14:06 . 2011-08-21 20:02 326656 c:\windows\system32\config\systemprofile\Local Settings\Data aplikací\AskToolbar\cache.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-07-29 17361032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-04-07 318488]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb12.exe" [2005-03-08 176128]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13684736]
"nwiz"="nwiz.exe" [2009-03-27 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 86016]
"SPC230NC_Monitor"="c:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"SPC_Monitor"="c:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"Copperhead"="c:\program files\CopperheadAntiSpyware\CopperScheduler.exe" [2007-10-02 1596345]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-5-15 384512]
.
c:\documents and settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-5-15 384512]
.
c:\documents and settings\Filip\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-5-15 384512]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
TrayMin230.lnk - c:\program files\Philips\Philips SPC230NC Webcam\TrayMin230.exe [2009-10-13 241664]
Wireless Utility.lnk - c:\program files\EDIMAX\Common\RaUI.exe [2011-2-22 1601536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Philips\\Intelligent Agent\\Philips Intelligent Agent.exe"=
"c:\\Documents and Settings\\Administrator\\Plocha\\Fiuypek\\Warcraft III\\Warcraft III.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\CAPCOM\\DARK VOID\\Launcher.exe"=
"c:\\Program Files\\CAPCOM\\DARK VOID\\nativePC\\Binaries\\ShippingPC-SkyGame.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version6\\TeamViewer_Service.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Filip\\Local Settings\\Data aplikací\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [24.9.2009 21:41 576024]
R2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [7.12.2010 12:32 2228008]
R3 PAEAFLT.sys;USB Composite Device;c:\windows\system32\drivers\PAEAFLT.sys [13.10.2009 16:43 8576]
R3 SPC230NC;Philips SPC230NC Webcam;c:\windows\system32\drivers\SPC230NC.SYS [13.10.2009 16:43 461056]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;"c:\program files\Avira\AntiVir Desktop\sched.exe" --> c:\program files\Avira\AntiVir Desktop\sched.exe [?]
S2 AntiVirWebService;Avira AntiVir WebGuard;"c:\program files\Avira\AntiVir Desktop\AVWEBGRD.EXE" --> c:\program files\Avira\AntiVir Desktop\AVWEBGRD.EXE [?]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6.5.2010 12:02 135664]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [10.11.2009 18:19 36608]
S3 GarenaPEngine;GarenaPEngine; [x]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [6.5.2010 12:02 135664]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [10.11.2009 15:36 136704]
S4 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [27.8.2010 16:22 160640]
S4 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [27.8.2010 16:22 5248]
S4 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [4.1.2011 20:33 155136]
S4 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [4.1.2011 20:33 5248]
S4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
.
Obsah adresáře 'Naplánované úlohy'
.
2011-08-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-06 10:02]
.
2011-08-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-06 10:02]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.sk/
mStart Page =
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
FF - ProfilePath - c:\documents and settings\Filip\Data aplikací\Mozilla\Firefox\Profiles\1x93r0uw.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2405280&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sk/
FF - prefs.js: keyword.URL - hxxp://gb.toolbarhome.com/search.aspx?srch=ku&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-25 19:35
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(760)
c:\program files\Avira\AntiVir Desktop\avsda.dll
.
- - - - - - - > 'explorer.exe'(2232)
c:\windows\system32\nview.dll
c:\windows\system32\NVWRSCS.DLL
c:\windows\system32\nvwddi.dll
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2011-08-25 19:36:40
ComboFix-quarantined-files.txt 2011-08-25 17:36
ComboFix2.txt 2011-08-24 22:04
ComboFix3.txt 2011-08-24 12:09
ComboFix4.txt 2011-08-23 09:15
ComboFix5.txt 2011-08-25 17:30
.
Před spuštěním: Volných bajtů: 185.667.432.448
Po spuštění: Volných bajtů: 185.654.128.640
.
- - End Of File - - 52F5A5D7C8CEB54884DA618FC1BC8EB8