Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Infiltrace typu Win32/Olmarik

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
zion.g
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 22 dub 2010 07:31

Infiltrace typu Win32/Olmarik

#1 Příspěvek od zion.g »

Dobrý den,
Eset Smart Security zaznamenává po každém startu infiltraci Win32/Olmarik, kterou nelze léčit, a poté několik pokusů o infiltraci z podezřelých URL.V PC už něco určitě je, nelze spustit Firefox, funguje pouze IE. Zde posílám log z RSIT, děkuji za každou pomoc.


Logfile of random's system information tool 1.06 (written by random/random)
Run by OEM at 2010-04-22 08:32:39
Microsoft® Windows Vista™ Home Basic Service Pack 2
System drive C: has 93 GB (19%) free of 477 GB
Total RAM: 3326 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:32, on 2010-04-22
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\ICQ7.0\ICQ.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\OEM\Desktop\RSIT.exe
C:\Users\OEM\Desktop\OEM.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget2 urlcatch - {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} - C:\Program Files\FlashGet\ComDlls\bhoCATCH.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\OEM\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.0\ICQ.exe" silent loginmode=4
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: &Download All by FlashGet - C:\Program Files\FlashGet\ComDlls\Bhoall.htm
O8 - Extra context menu item: &Download by FlashGet - C:\Program Files\FlashGet\ComDlls\Bholink.htm
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{63A4CA88-DBFC-45FD-881B-0A6CC9F0CCB2}: NameServer = 192.168.1.1,192.168.1.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Služba Google Update (gupdate1ca1058efc68952) (gupdate1ca1058efc68952) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 6331 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Google Software Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1545557754-3061685998-956643779-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1545557754-3061685998-956643779-1000UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1F364306-AA45-47B5-9F9D-39A8B94E7EF1}]
FG2CatchUrl - C:\Program Files\FlashGet\ComDlls\bhoCATCH.dll [2008-08-19 104016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-07-29 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-03-09 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-05-07 6139904]
"NeroFilterCheck"=C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2007-03-01 153136]
"NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2007-12-03 2213160]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-11-11 417792]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-11-12 141600]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-10-07 1461080]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2008-01-24 2289664]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-07-24 490952]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]
"Google Update"=C:\Users\OEM\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-18 136176]
"ICQ"=C:\Program Files\ICQ7.0\ICQ.exe [2010-03-28 133368]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AirVideoServer]
C:\Program Files\AirVideoServer\AirVideoServer.exe [2009-10-08 4125640]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2009-11-12 141600]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2010-03-30 1820040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2009-11-11 417792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2010-02-22 26101032]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Steam\Steam.exe [2010-03-03 1217872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Air Mouse.lnk]
C:\PROGRA~1\AIRMOU~1\AIRMOU~1\AIRMOU~1.EXE [2010-01-07 504320]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
C:\PROGRA~1\MCAFEE~1\20DEB9~1.181\SSSCHE~1.EXE []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PSEXESVC]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\FlashGet\FlashGet.exe"="C:\Program Files\FlashGet\FlashGet.exe:*:Enabled:Flashget2"
"C:\Program Files\FlashGet\LiveUpdate.exe"="C:\Program Files\FlashGet\LiveUpdate.exe:*:Enabled:FGLiveUpdate"
"C:\Program Files\FlashGet\LiveUpdateEx.exe"="C:\Program Files\FlashGet\LiveUpdateEx.exe:*:Enabled:FGLiveUpdateEx"
"C:\Windows\system32\svchost.exe"="C:\Windows\system32\svchost.exe:*:Enabled:svchost.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c7a8a1e-a465-11dd-8bf9-001fd0274f50}]
shell\AutoRun\command - I:\Autorun.exe


======List of files/folders created in the last 1 months======

2010-04-22 08:21:24 ----D---- C:\rsit
2010-04-15 20:39:27 ----A---- C:\Windows\system32\vbscript.dll
2010-04-15 20:38:25 ----A---- C:\Windows\system32\iphlpsvc.dll
2010-04-15 16:13:32 ----A---- C:\Windows\system32\MRT.INI
2010-04-15 14:08:47 ----A---- C:\Windows\system32\wintrust.dll
2010-04-15 14:08:42 ----A---- C:\Windows\system32\cabview.dll
2010-03-31 19:06:32 ----A---- C:\Windows\system32\mshtml.dll
2010-03-31 19:06:30 ----A---- C:\Windows\system32\wininet.dll
2010-03-31 19:06:29 ----A---- C:\Windows\system32\urlmon.dll
2010-03-31 19:06:24 ----A---- C:\Windows\system32\ieframe.dll
2010-03-31 19:06:19 ----A---- C:\Windows\system32\ieui.dll
2010-03-31 19:06:18 ----A---- C:\Windows\system32\mshtmled.dll
2010-03-31 19:06:14 ----A---- C:\Windows\system32\iepeers.dll
2010-03-31 19:06:12 ----A---- C:\Windows\system32\ieencode.dll
2010-03-31 19:06:04 ----A---- C:\Windows\system32\ieapfltr.dll
2010-03-30 20:51:19 ----D---- C:\ProgramData\Sun
2010-03-30 20:51:17 ----D---- C:\Program Files\Common Files\Java
2010-03-30 20:51:03 ----A---- C:\Windows\system32\javaws.exe
2010-03-30 20:51:03 ----A---- C:\Windows\system32\javaw.exe
2010-03-30 20:51:03 ----A---- C:\Windows\system32\java.exe
2010-03-30 14:12:41 ----D---- C:\Users\OEM\AppData\Roaming\Mozilla
2010-03-30 14:04:25 ----D---- C:\Program Files\LogMeIn Hamachi
2010-03-27 14:58:28 ----D---- C:\Users\OEM\AppData\Roaming\TS3Client
2010-03-27 14:58:01 ----D---- C:\Program Files\TeamSpeak 3 Client
2010-03-25 00:00:08 ----A---- C:\Windows\winconfig.txt
2010-03-24 23:58:30 ----A---- C:\Windows\Windows-Firewall.exe
2010-03-24 23:27:42 ----D---- C:\EmuHack
2010-03-24 21:49:41 ----D---- C:\Users\OEM\AppData\Roaming\opie
2010-03-24 15:18:50 ----D---- C:\ProgramData\McAfee

======List of files/folders modified in the last 1 months======

2010-04-22 08:32:43 ----D---- C:\Windows\temp
2010-04-22 08:27:18 ----D---- C:\Windows\Prefetch
2010-04-22 08:23:58 ----D---- C:\Windows\System32
2010-04-22 08:23:58 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-04-22 08:23:57 ----D---- C:\Windows\inf
2010-04-22 08:20:09 ----D---- C:\Windows\Tasks
2010-04-22 08:17:52 ----D---- C:\Users\OEM\AppData\Roaming\ICQ
2010-04-20 14:50:42 ----A---- C:\Windows\NeroDigital.ini
2010-04-18 10:06:05 ----SHD---- C:\Windows\Installer
2010-04-18 10:05:49 ----D---- C:\Program Files\Google
2010-04-16 14:16:48 ----D---- C:\Windows\winsxs
2010-04-16 14:06:42 ----D---- C:\Windows\system32\catroot
2010-04-16 14:04:56 ----D---- C:\Windows\system32\drivers
2010-04-16 14:04:56 ----D---- C:\Program Files\Windows Mail
2010-04-15 14:21:27 ----D---- C:\Windows\system32\catroot2
2010-04-13 17:57:10 ----D---- C:\Seriály
2010-04-13 17:36:50 ----D---- C:\Users\OEM\AppData\Roaming\BITS
2010-04-07 23:02:39 ----D---- C:\Users\OEM\AppData\Roaming\Skype
2010-04-07 19:45:49 ----D---- C:\Users\OEM\AppData\Roaming\skypePM
2010-04-07 12:25:45 ----D---- C:\ProgramData\Adobe
2010-04-06 19:52:54 ----A---- C:\Windows\system32\mrt.exe
2010-03-31 19:02:43 ----D---- C:\Program Files\ICQ7.0
2010-03-30 20:51:19 ----HD---- C:\ProgramData
2010-03-30 20:51:17 ----D---- C:\Program Files\Common Files
2010-03-30 20:51:01 ----D---- C:\Program Files\Java
2010-03-30 15:11:41 ----D---- C:\Mp3
2010-03-30 14:16:54 ----D---- C:\Users\OEM\AppData\Roaming\uTorrent
2010-03-30 14:10:51 ----D---- C:\Program Files\Mozilla Firefox
2010-03-30 14:04:25 ----RD---- C:\Program Files
2010-03-30 14:03:58 ----SD---- C:\Windows\Downloaded Program Files
2010-03-29 22:25:01 ----D---- C:\Windows\system32\Tasks
2010-03-29 19:22:17 ----D---- C:\Windows\pss
2010-03-25 00:00:28 ----D---- C:\Windows
2010-03-24 20:30:51 ----SD---- C:\Users\OEM\AppData\Roaming\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 easdrv;easdrv; C:\Windows\system32\DRIVERS\easdrv.sys [2009-10-07 54184]
R1 epfwtdi;epfwtdi; C:\Windows\system32\DRIVERS\epfwtdi.sys [2009-10-07 55256]
R2 eamon;EAMON; C:\Windows\system32\DRIVERS\eamon.sys [2009-10-07 40824]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2009-10-07 73760]
R3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 464384]
R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2009-10-07 32072]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-04-23 26176]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-05-07 2134424]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2010-01-12 11586280]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-02-14 118784]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
S3 a1mnuejk;a1mnuejk; C:\Windows\system32\drivers\a1mnuejk.sys []
S3 ALSysIO;ALSysIO; \??\C:\Users\OEM\AppData\Local\Temp\ALSysIO.sys []
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 cpuz130;cpuz130; \??\C:\Users\OEM\AppData\Local\Temp\cpuz130\cpuz_x32.sys []
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 ENTECH;ENTECH; \??\C:\Windows\system32\DRIVERS\ENTECH.sys [2008-09-17 27672]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2008-10-21 16608]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-04-11 236544]
S3 Inspect;Comodo Firewall Network Driver; C:\Windows\system32\DRIVERS\inspect.sys []
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 Netaapl;Apple Mobile Device Ethernet Service; C:\Windows\system32\DRIVERS\netaapl.sys [2009-08-28 17408]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-08-28 40448]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2008-01-21 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 ekrn;Eset Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-10-07 472280]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-01-24 73728]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2010-01-11 129640]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2010-03-05 75064]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-11-12 545568]
S2 gupdate1ca1058efc68952;Služba Google Update (gupdate1ca1058efc68952); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-07-29 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-29 190448]
S2 NOD32FiXTemDono;Eset Nod32 Boot; C:\Windows\system32\regedt32.exe [2006-11-02 9216]
S2 SPService;SPService; C:\Windows\system32\svchost.exe [2008-01-21 21504]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2009-03-30 31048]
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-10-07 20680]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2009-07-16 316664]
S4 Apache2.2;Apache2.2; c:\xampp\apache\bin\apache.exe [2007-03-05 16896]
S4 MySQL;MySQL; C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld --defaults-file=C:\Program Files\MySQL\MySQL Server 5.1\my.ini MySQL []
S4 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2007-12-03 869672]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2007-12-13 447784]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Infiltrace typu Win32/Olmarik

#2 Příspěvek od motji »

Hezké odpoledne :)

:arrow: Z mého podpisu stahněte Ccleaner
- nainstalujte, při výběru, co se má nainstalovat, dejte pryč fajfku u instalace yahoo toolbaru

Obrázekzáložka čistič
-nechejte v levém sloupečku zatrhnuté vše jak je, klikněte na analyzovat
-po analýze klikněte na Spustit Ccleaner

Obrázekzáložka Registry
- klikněte na hledej problémy
- pak klikněte na opravit vybrané problémy -- udělat zálohu registrů - nemusíte
- kliknete opravit všechny problémy :arrow: ok :arrow: zavřít

Obrázek Záložka Nástroje
- zde můžete odinstalovat programy. Je to důkladnější odinstalace než u přidat/odebrat programy ve Windows.

Ccleaner - čistič doporučuji používat, krásně pročistí pc od dočasných souborů.
Registry pročistí třeba po odinstalaci nějakého programu.


:arrow: Combofix stahněte takto:
- pravým myšítkem klikněte na odkaz combofixu --uložit jako.. ,a teď ho přejmenujte na Potvora.com a uložte.


:arrow: Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe


- ComboFix je třeba spustit pod účtem s právy administrátora

- Před použitím vypněte všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary

- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího se okna :!:

- Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, zkopírujte celý jeho obsah sem
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
zion.g
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 22 dub 2010 07:31

Re: Infiltrace typu Win32/Olmarik

#3 Příspěvek od zion.g »

ComboFix 10-04-21.01 - OEM 2010-04-22 13:08:11.2.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1250.1.1029.18.3326.2219 [GMT 2:00]
Spuštěný z: c:\users\OEM\Desktop\potvora.com
AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
SP: ESET Smart Security 3.0 *enabled* (Updated) {E5E70D32-0101-4B98-A4D6-D1D15C3BB448}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\adobe\sp.Dll
c:\users\OEM\AppData\Roaming\BITS
c:\users\OEM\AppData\Roaming\BITS\BITS.ini
c:\users\OEM\AppData\Roaming\BITS\DHTTable.dat
c:\users\OEM\AppData\Roaming\BITS\ProxyList.ini
c:\users\OEM\AppData\Roaming\BITS\Torrent\20091214095232.torrent
c:\users\OEM\AppData\Roaming\BITS\Torrent\20091214095232.torrent.~tmp
c:\users\OEM\AppData\Roaming\BITS\Torrent\20091214095232.torrent.bits
c:\users\OEM\AppData\Roaming\BITS\Torrent\20091214095232.torrent.filelist
c:\users\OEM\AppData\Roaming\BITS\Torrent\20091214095232.torrent.hybridlist
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100330150848.torrent
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100330150848.torrent.bits
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100330150848.torrent.filelist
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100330150848.torrent.hybridlist
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100330150848.torrent.seeds
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100413165137.torrent
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100413165137.torrent.bits
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100413165137.torrent.filelist
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100413165137.torrent.hybridlist
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100413165137.torrent.seeds
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100413170100.torrent
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100413170100.torrent.bits
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100413170100.torrent.filelist
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100413170100.torrent.hybridlist
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100413170100.torrent.seeds
c:\windows\Windows-Firewall.exe

Nakažená kopie c:\windows\system32\drivers\atapi.sys byla nalezena a vyléčena.
Obnovena kopie z - Kitty had a snack :p
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_SPService


((((((((((((((((((((((((( Soubory vytvořené od 2010-03-22 do 2010-04-22 )))))))))))))))))))))))))))))))
.

2010-04-22 11:16 . 2010-04-22 11:16 -------- d-----w- c:\users\OEM\AppData\Local\temp
2010-04-22 11:16 . 2010-04-22 11:16 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-04-22 10:42 . 2010-04-22 10:42 -------- d-----w- c:\program files\CCleaner
2010-04-22 06:21 . 2010-04-22 06:21 -------- d-----w- C:\rsit
2010-04-15 18:39 . 2010-03-04 17:33 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-04-15 18:38 . 2010-02-23 11:10 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-15 18:38 . 2010-02-23 11:10 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-15 18:38 . 2010-02-23 11:10 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-15 18:38 . 2010-02-18 14:07 904576 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-15 18:38 . 2010-02-18 11:28 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2010-04-15 18:38 . 2010-02-18 13:30 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-04-15 12:08 . 2009-12-23 11:33 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-04-15 12:08 . 2010-01-13 17:34 98304 ----a-w- c:\windows\system32\cabview.dll
2010-03-31 17:06 . 2010-03-09 15:42 834048 ----a-w- c:\windows\system32\wininet.dll
2010-03-31 17:06 . 2010-03-09 16:25 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-03-30 18:51 . 2010-03-30 18:51 -------- d-----w- c:\program files\Common Files\Java
2010-03-30 12:04 . 2010-03-30 12:04 -------- d-----w- c:\program files\LogMeIn Hamachi
2010-03-27 12:58 . 2010-03-27 13:06 -------- d-----w- c:\users\OEM\AppData\Roaming\TS3Client
2010-03-27 12:58 . 2010-03-27 12:58 -------- d-----w- c:\program files\TeamSpeak 3 Client
2010-03-24 21:27 . 2010-04-13 11:41 -------- d-----w- C:\EmuHack
2010-03-24 19:49 . 2010-03-24 20:47 -------- d-----w- c:\users\OEM\AppData\Roaming\opie
2010-03-24 13:18 . 2010-03-24 13:18 -------- d-----w- c:\programdata\McAfee

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-22 11:20 . 2008-10-28 07:53 -------- d-----w- c:\users\OEM\AppData\Roaming\ICQ
2010-04-22 11:17 . 2010-01-29 14:41 79001 ----a-w- c:\programdata\nvModes.dat
2010-04-22 11:15 . 2008-01-21 06:13 635756 ----a-w- c:\windows\system32\perfh005.dat
2010-04-22 11:15 . 2008-01-21 06:13 134582 ----a-w- c:\windows\system32\perfc005.dat
2010-04-22 10:54 . 2009-06-22 17:30 -------- d-----w- c:\program files\Aspyr
2010-04-22 10:46 . 2010-01-22 11:48 -------- d-----w- c:\program files\Frets on Fire
2010-04-22 10:44 . 2010-03-16 20:28 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-04-19 17:48 . 2008-11-02 09:46 1 ----a-w- c:\users\OEM\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-04-18 08:05 . 2009-07-29 14:28 -------- d-----w- c:\program files\Google
2010-04-16 12:04 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-04-07 21:02 . 2008-11-25 11:01 -------- d-----w- c:\users\OEM\AppData\Roaming\Skype
2010-04-07 17:45 . 2008-11-25 11:02 -------- d-----w- c:\users\OEM\AppData\Roaming\skypePM
2010-03-31 17:02 . 2010-01-24 15:41 -------- d-----w- c:\program files\ICQ7.0
2010-03-30 18:51 . 2008-12-03 14:30 -------- d-----w- c:\program files\Java
2010-03-30 12:16 . 2008-10-28 08:24 -------- d-----w- c:\users\OEM\AppData\Roaming\uTorrent
2010-03-16 20:31 . 2010-03-16 20:28 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-03-16 15:49 . 2008-10-28 08:24 -------- d-----w- c:\program files\uTorrent
2010-03-11 21:34 . 2008-10-27 21:53 139128 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-03-11 21:34 . 2008-10-27 21:53 215128 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-03-09 02:28 . 2008-12-03 14:31 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-03-05 06:54 . 2008-10-27 21:53 138056 ----a-w- c:\users\OEM\AppData\Roaming\PnkBstrK.sys
2010-03-05 06:54 . 2008-10-27 21:53 138056 ----a-w- c:\users\OEM\AppData\Roaming\PnkBstrK.sys
2010-03-05 06:54 . 2008-10-27 21:53 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-03-05 06:54 . 2010-03-05 06:54 2434856 ----a-w- c:\windows\system32\pbsvc_bc2.exe
2010-03-05 06:50 . 2009-04-18 15:13 -------- d-----w- c:\program files\Electronic Arts
2010-03-04 08:00 . 2010-01-25 13:17 -------- d-----w- c:\program files\Mass Effect 2
2010-03-03 19:35 . 2010-03-03 19:35 -------- d-----r- c:\program files\Skype
2010-03-03 19:35 . 2010-03-03 19:35 -------- d-----w- c:\program files\Common Files\Skype
2010-03-03 19:35 . 2008-11-25 11:01 -------- d-----w- c:\programdata\Skype
2010-03-03 17:12 . 2009-11-13 15:03 -------- d-----w- c:\program files\Steam
2010-03-02 10:21 . 2008-10-21 09:30 54704 ----a-w- c:\users\OEM\AppData\Local\GDIPFONTCACHEV1.DAT
2010-03-01 14:21 . 2008-10-21 09:36 -------- d-----w- c:\programdata\NVIDIA
2010-03-01 14:17 . 2008-10-21 09:30 1356 ----a-w- c:\users\OEM\AppData\Local\d3d9caps.dat
2010-02-24 08:16 . 2009-10-14 18:31 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-03 13:56 . 2009-10-14 18:12 26176 ---ha-w- c:\windows\system32\hamachi.sys
2010-01-25 12:00 . 2010-03-02 07:27 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-01-25 12:00 . 2010-03-02 07:27 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-01-25 12:00 . 2010-03-02 07:27 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-01-25 12:00 . 2010-03-02 07:27 471552 ----a-w- c:\windows\system32\secproc.dll
2010-01-25 11:58 . 2010-03-02 07:27 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-01-25 08:21 . 2010-03-02 07:27 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-01-25 08:21 . 2010-03-02 07:27 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-01-25 08:21 . 2010-03-02 07:27 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-01-25 08:21 . 2010-03-02 07:27 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-01-23 10:11 . 2010-01-23 10:11 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2010-01-23 09:26 . 2010-03-02 07:27 2048 ----a-w- c:\windows\system32\tzres.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-01-24 2289664]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"Google Update"="c:\users\OEM\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-03-18 136176]
"ICQ"="c:\program files\ICQ7.0\ICQ.exe" [2010-03-28 133368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-05-07 6139904]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-12-03 2213160]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-10-07 1461080]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Air Mouse.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Air Mouse.lnk
backup=c:\windows\pss\Air Mouse.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AirVideoServer]
2009-10-08 00:36 4125640 ----a-w- c:\program files\AirVideoServer\AirVideoServer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-11-12 15:33 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2010-03-30 09:16 1820040 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-02-22 11:42 26101032 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 15:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-03-03 17:08 1217872 ----a-w- c:\program files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 09:43 248040 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):83,0f,34,f4,45,57,ca,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1545557754-3061685998-956643779-1000]
"EnableNotificationsRef"=dword:00000001

R2 gupdate1ca1058efc68952;Služba Google Update (gupdate1ca1058efc68952);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-29 133104]
R2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2006-11-02 9216]
R3 ALSysIO;ALSysIO;c:\users\OEM\AppData\Local\Temp\ALSysIO.sys [x]
R3 cpuz130;cpuz130;c:\users\OEM\AppData\Local\Temp\cpuz130\cpuz_x32.sys [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2009-08-28 17408]
R4 Apache2.2;Apache2.2;c:\xampp\apache\bin\apache.exe [2007-03-05 16896]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2008-10-27 717296]
S2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2009-10-07 472280]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-01-24 10:30 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'

2010-04-22 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-29 14:28]

2010-04-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-29 14:29]

2010-04-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-29 14:29]

2010-04-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1545557754-3061685998-956643779-1000Core.job
- c:\users\OEM\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-29 13:56]

2010-04-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1545557754-3061685998-956643779-1000UA.job
- c:\users\OEM\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-29 13:56]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Settings,ProxyOverride = *.local
IE: &Download All by FlashGet - c:\program files\FlashGet\ComDlls\Bhoall.htm
IE: &Download by FlashGet - c:\program files\FlashGet\ComDlls\Bholink.htm
IE: {{88EB38EF-4D2C-436D-ABD3-56B232674062} - c:\program files\ICQ7.0\ICQ.exe
TCP: {63A4CA88-DBFC-45FD-881B-0A6CC9F0CCB2} = 192.168.1.1,192.168.1.2
FF - ProfilePath - c:\users\OEM\AppData\Roaming\Mozilla\Firefox\Profiles\yukm43xw.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

ShellIconOverlayIdentifiers-{96AFBE69-C3B0-4b00-8578-D933D2896EE2} - (no file)
MSConfigStartUp-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-22 13:20
Windows 6.0.6002 Service Pack 2 NTFS

skenování skrytých procesů ...

[0] 0x09000000

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...


c:\windows\TEMP\TMP00000009F1C38B5B7F9FE908 524288 bytes executable

sken byl úspešně dokončen
skryté soubory: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MySQL]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 5.1\bin\mysqld\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.1\my.ini\" MySQL"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1545557754-3061685998-956643779-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:c9,9d,7b,5f,19,17,66,6a,84,1f,55,3e,40,50,51,b2,f6,d8,a3,83,6d,3c,d6,
cf,9e,1a,c5,35,f9,45,c0,29,3c,b3,b4,82,10,4b,22,fe,eb,02,f4,ae,74,0c,b1,9f,\
"??"=hex:e0,96,37,fd,df,0b,bb,fd,74,c9,4d,27,99,b0,d9,01

[HKEY_USERS\S-1-5-21-1545557754-3061685998-956643779-1000\Software\SecuROM\License information*]
"datasecu"=hex:be,d7,56,f3,5c,4a,b2,a1,28,68,70,ca,d3,fd,06,c5,27,6e,c4,f9,8b,
0a,f8,bd,fc,89,20,f9,c8,88,d5,08,39,18,e1,71,67,8e,e3,27,d1,ae,35,6d,5d,1a,\
"rkeysecu"=hex:38,28,dd,60,64,5f,47,35,ec,f9,2a,be,fe,f6,d3,1f
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(4784)
c:\program files\WinSCP\DragExt.dll
c:\progra~1\SPYBOT~1\SDHelper.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\windows\system32\conime.exe
c:\windows\RtHDVCpl.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\servicing\TrustedInstaller.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2010-04-22 13:25:36 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-04-22 11:25

Před spuštěním: Volných bajtů: 106,939,174,912
Po spuštění: Volných bajtů: 106,650,230,784

- - End Of File - - AF17C79D24AE1F18D456FE957A96F080
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Infiltrace typu Win32/Olmarik

#4 Příspěvek od motji »

Tak první řadě odinstalujte ten nelegální Eset - je to proti pravidlům fora.
Až nainstalujete nějaký free anitivr, Avast nebo Aviru, vložte log ze Rsitu a pak budeme pokračovat :James008:
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
zion.g
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 22 dub 2010 07:31

Re: Infiltrace typu Win32/Olmarik

#5 Příspěvek od zion.g »

Omlouvám se za svůj prohřešek a děkuji za trpělivost, na Vaši radu jsem si nainstaloval avast. Zde přikládám RSIT log.

Logfile of random's system information tool 1.06 (written by random/random)
Run by OEM at 2010-04-22 22:38:32
Microsoft® Windows Vista™ Home Basic Service Pack 2
System drive C: has 99 GB (21%) free of 477 GB
Total RAM: 3326 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:38, on 2010-04-22
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\ICQ7.0\ICQ.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Users\OEM\Desktop\RSIT.exe
C:\Users\OEM\Desktop\OEM.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget2 urlcatch - {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} - C:\Program Files\FlashGet\ComDlls\bhoCATCH.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\OEM\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.0\ICQ.exe" silent loginmode=4
O8 - Extra context menu item: &Download All by FlashGet - C:\Program Files\FlashGet\ComDlls\Bhoall.htm
O8 - Extra context menu item: &Download by FlashGet - C:\Program Files\FlashGet\ComDlls\Bholink.htm
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{63A4CA88-DBFC-45FD-881B-0A6CC9F0CCB2}: NameServer = 192.168.1.1,192.168.1.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Služba Google Update (gupdate1ca1058efc68952) (gupdate1ca1058efc68952) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 5948 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Google Software Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1545557754-3061685998-956643779-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1545557754-3061685998-956643779-1000UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1F364306-AA45-47B5-9F9D-39A8B94E7EF1}]
FG2CatchUrl - C:\Program Files\FlashGet\ComDlls\bhoCATCH.dll [2008-08-19 104016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-07-29 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-03-09 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-05-07 6139904]
"NeroFilterCheck"=C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2007-03-01 153136]
"NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2007-12-03 2213160]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-11-11 417792]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-11-12 141600]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-04-14 2790472]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2008-01-24 2289664]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-07-24 490952]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]
"Google Update"=C:\Users\OEM\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-18 136176]
"ICQ"=C:\Program Files\ICQ7.0\ICQ.exe [2010-03-28 133368]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AirVideoServer]
C:\Program Files\AirVideoServer\AirVideoServer.exe [2009-10-08 4125640]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2009-11-12 141600]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2010-03-30 1820040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2009-11-11 417792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2010-02-22 26101032]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Steam\Steam.exe [2010-03-03 1217872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Air Mouse.lnk]
C:\PROGRA~1\AIRMOU~1\AIRMOU~1\AIRMOU~1.EXE [2010-01-07 504320]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
C:\PROGRA~1\MCAFEE~1\20DEB9~1.181\SSSCHE~1.EXE []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\FlashGet\FlashGet.exe"="C:\Program Files\FlashGet\FlashGet.exe:*:Enabled:Flashget2"
"C:\Program Files\FlashGet\LiveUpdate.exe"="C:\Program Files\FlashGet\LiveUpdate.exe:*:Enabled:FGLiveUpdate"
"C:\Program Files\FlashGet\LiveUpdateEx.exe"="C:\Program Files\FlashGet\LiveUpdateEx.exe:*:Enabled:FGLiveUpdateEx"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2010-04-22 22:37:00 ----A---- C:\Windows\system32\aswBoot.exe
2010-04-22 22:36:53 ----D---- C:\ProgramData\Alwil Software
2010-04-22 22:36:53 ----D---- C:\Program Files\Alwil Software
2010-04-22 15:55:13 ----A---- C:\Windows\system32\browserchoice.exe
2010-04-22 13:25:39 ----D---- C:\Windows\temp
2010-04-22 13:25:37 ----A---- C:\ComboFix.txt
2010-04-22 13:17:53 ----SHD---- C:\$RECYCLE.BIN
2010-04-22 13:02:39 ----A---- C:\Windows\MBR.exe
2010-04-22 13:02:37 ----A---- C:\Windows\PEV.exe
2010-04-22 12:57:59 ----D---- C:\Qoobox
2010-04-22 12:57:40 ----A---- C:\Windows\SWXCACLS.exe
2010-04-22 12:42:20 ----D---- C:\Program Files\CCleaner
2010-04-22 08:21:24 ----D---- C:\rsit
2010-04-15 20:39:27 ----A---- C:\Windows\system32\vbscript.dll
2010-04-15 20:39:16 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-04-15 20:39:16 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-04-15 20:38:25 ----A---- C:\Windows\system32\iphlpsvc.dll
2010-04-15 16:13:32 ----A---- C:\Windows\system32\MRT.INI
2010-04-15 14:08:47 ----A---- C:\Windows\system32\wintrust.dll
2010-04-15 14:08:42 ----A---- C:\Windows\system32\cabview.dll
2010-03-31 19:06:32 ----A---- C:\Windows\system32\mshtml.dll
2010-03-31 19:06:30 ----A---- C:\Windows\system32\wininet.dll
2010-03-31 19:06:29 ----A---- C:\Windows\system32\urlmon.dll
2010-03-31 19:06:24 ----A---- C:\Windows\system32\ieframe.dll
2010-03-31 19:06:19 ----A---- C:\Windows\system32\ieui.dll
2010-03-31 19:06:18 ----A---- C:\Windows\system32\mshtmled.dll
2010-03-31 19:06:14 ----A---- C:\Windows\system32\iepeers.dll
2010-03-31 19:06:12 ----A---- C:\Windows\system32\ieencode.dll
2010-03-31 19:06:04 ----A---- C:\Windows\system32\ieapfltr.dll
2010-03-30 20:51:19 ----D---- C:\ProgramData\Sun
2010-03-30 20:51:17 ----D---- C:\Program Files\Common Files\Java
2010-03-30 20:51:03 ----A---- C:\Windows\system32\javaws.exe
2010-03-30 20:51:03 ----A---- C:\Windows\system32\javaw.exe
2010-03-30 20:51:03 ----A---- C:\Windows\system32\java.exe
2010-03-30 14:12:41 ----D---- C:\Users\OEM\AppData\Roaming\Mozilla
2010-03-30 14:04:25 ----D---- C:\Program Files\LogMeIn Hamachi
2010-03-27 14:58:28 ----D---- C:\Users\OEM\AppData\Roaming\TS3Client
2010-03-27 14:58:01 ----D---- C:\Program Files\TeamSpeak 3 Client
2010-03-25 00:00:08 ----A---- C:\Windows\winconfig.txt
2010-03-24 23:27:42 ----D---- C:\EmuHack
2010-03-24 21:49:41 ----D---- C:\Users\OEM\AppData\Roaming\opie
2010-03-24 15:18:50 ----D---- C:\ProgramData\McAfee

======List of files/folders modified in the last 1 months======

2010-04-22 22:38:00 ----D---- C:\Windows\system32\drivers
2010-04-22 22:37:53 ----SHD---- C:\Windows\Installer
2010-04-22 22:37:52 ----D---- C:\Windows\winsxs
2010-04-22 22:37:00 ----D---- C:\Windows\System32
2010-04-22 22:36:53 ----RD---- C:\Program Files
2010-04-22 22:36:53 ----D---- C:\ProgramData
2010-04-22 22:36:49 ----SHD---- C:\System Volume Information
2010-04-22 22:36:39 ----D---- C:\Windows\Tasks
2010-04-22 22:34:22 ----D---- C:\Users\OEM\AppData\Roaming\ICQ
2010-04-22 22:30:45 ----D---- C:\Windows\system32\catroot
2010-04-22 22:30:45 ----D---- C:\Windows\inf
2010-04-22 22:29:57 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-04-22 13:25:39 ----D---- C:\Windows
2010-04-22 13:24:45 ----D---- C:\Windows\ERDNT
2010-04-22 13:19:16 ----D---- C:\Windows\system32\catroot2
2010-04-22 13:17:41 ----A---- C:\Windows\system.ini
2010-04-22 13:16:42 ----D---- C:\Windows\system32\config
2010-04-22 13:16:42 ----D---- C:\Boot
2010-04-22 13:16:03 ----D---- C:\ProgramData\Adobe
2010-04-22 13:13:14 ----D---- C:\Windows\AppPatch
2010-04-22 13:13:13 ----D---- C:\Program Files\Common Files
2010-04-22 12:59:52 ----D---- C:\ComboFix
2010-04-22 12:57:59 ----D---- C:\Windows\Prefetch
2010-04-22 12:56:12 ----A---- C:\Windows\NeroDigital.ini
2010-04-22 12:54:40 ----D---- C:\Program Files\Aspyr
2010-04-22 12:46:40 ----D---- C:\Program Files\Frets on Fire
2010-04-22 12:44:21 ----D---- C:\ProgramData\Spybot - Search & Destroy
2010-04-22 12:44:17 ----D---- C:\Windows\Minidump
2010-04-22 12:44:17 ----D---- C:\Windows\Debug
2010-04-18 10:05:49 ----D---- C:\Program Files\Google
2010-04-16 14:04:56 ----D---- C:\Program Files\Windows Mail
2010-04-13 17:57:10 ----D---- C:\Seriály
2010-04-07 23:02:39 ----D---- C:\Users\OEM\AppData\Roaming\Skype
2010-04-07 19:45:49 ----D---- C:\Users\OEM\AppData\Roaming\skypePM
2010-04-06 19:52:54 ----A---- C:\Windows\system32\mrt.exe
2010-03-31 19:02:43 ----D---- C:\Program Files\ICQ7.0
2010-03-30 20:51:01 ----D---- C:\Program Files\Java
2010-03-30 15:11:41 ----D---- C:\Mp3
2010-03-30 14:16:54 ----D---- C:\Users\OEM\AppData\Roaming\uTorrent
2010-03-30 14:10:51 ----D---- C:\Program Files\Mozilla Firefox
2010-03-30 14:03:58 ----SD---- C:\Windows\Downloaded Program Files
2010-03-29 22:25:01 ----D---- C:\Windows\system32\Tasks
2010-03-29 19:22:17 ----D---- C:\Windows\pss
2010-03-24 20:30:51 ----SD---- C:\Users\OEM\AppData\Roaming\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-04-14 23376]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-04-14 162768]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-04-14 46672]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-04-14 19024]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-04-14 51792]
R3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 464384]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-04-23 26176]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-05-07 2134424]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2010-01-12 11586280]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-02-14 118784]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
S3 ALSysIO;ALSysIO; \??\C:\Users\OEM\AppData\Local\Temp\ALSysIO.sys []
S3 catchme;catchme; \??\C:\potvora\catchme.sys []
S3 cpuz130;cpuz130; \??\C:\Users\OEM\AppData\Local\Temp\cpuz130\cpuz_x32.sys []
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 ENTECH;ENTECH; \??\C:\Windows\system32\DRIVERS\ENTECH.sys [2008-09-17 27672]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2008-10-21 16608]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-04-11 236544]
S3 Inspect;Comodo Firewall Network Driver; C:\Windows\system32\DRIVERS\inspect.sys []
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 Netaapl;Apple Mobile Device Ethernet Service; C:\Windows\system32\DRIVERS\netaapl.sys [2009-08-28 17408]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-08-28 40448]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]
S4 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2008-10-27 717296]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2008-01-21 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-04-14 40384]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-01-24 73728]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2010-01-11 129640]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2010-03-05 75064]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-04-14 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-04-14 40384]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-11-12 545568]
S2 gupdate1ca1058efc68952;Služba Google Update (gupdate1ca1058efc68952); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-07-29 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-29 190448]
S2 NOD32FiXTemDono;Eset Nod32 Boot; C:\Windows\system32\regedt32.exe [2006-11-02 9216]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2009-03-30 31048]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2009-07-16 316664]
S4 Apache2.2;Apache2.2; c:\xampp\apache\bin\apache.exe [2007-03-05 16896]
S4 MySQL;MySQL; C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld --defaults-file=C:\Program Files\MySQL\MySQL Server 5.1\my.ini MySQL []
S4 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2007-12-03 869672]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2007-12-13 447784]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Infiltrace typu Win32/Olmarik

#6 Příspěvek od motji »

:arrow: Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

Driver::
NOD32FiXTemDono
ALSysIO
cpuz130

File::
c:\users\OEM\AppData\Local\Temp\ALSysIO.sys
c:\users\OEM\AppData\Local\Temp\cpuz130\cpuz_x32.sys

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:

Obrázek


-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
zion.g
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 22 dub 2010 07:31

Re: Infiltrace typu Win32/Olmarik

#7 Příspěvek od zion.g »

Po restartování počítače ComboFixem Windows opravdu naběhnout nechtěly, tak jsem spouštěl přes Poslední funkční konfiguraci. A taky mi zmizelo pozadí plochy :) . Tady dávám log:

ComboFix 10-04-21.01 - OEM 2010-04-23 14:46:21.3.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1250.1.1029.18.3326.2106 [GMT 2:00]
Spuštěný z: c:\users\OEM\Desktop\combofix.exe
Použité ovládací přepínače :: c:\users\OEM\Desktop\CFScript.txt
FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!

FILE ::
"c:\users\OEM\AppData\Local\Temp\ALSysIO.sys"
"c:\users\OEM\AppData\Local\Temp\cpuz130\cpuz_x32.sys"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\OEM\AppData\Roaming\BITS
c:\users\OEM\AppData\Roaming\BITS\BITS.ini
c:\users\OEM\AppData\Roaming\BITS\DHTTable.dat
c:\users\OEM\AppData\Roaming\BITS\ProxyList.ini
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100423132754.torrent
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100423132754.torrent.bits
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100423132754.torrent.filelist
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100423132754.torrent.hybridlist
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100423132817.torrent
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100423132817.torrent.bits
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100423132817.torrent.filelist
c:\users\OEM\AppData\Roaming\BITS\Torrent\20100423132817.torrent.hybridlist
c:\windows\system32\msconfig.exe

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ALSYSIO
-------\Legacy_CPUZ130
-------\Service_ALSysIO
-------\Service_cpuz130
-------\Service_hkmsvc
-------\Service_NOD32FiXTemDono


((((((((((((((((((((((((( Soubory vytvořené od 2010-03-24 do 2010-04-24 )))))))))))))))))))))))))))))))
.

2010-04-23 12:43 . 2010-04-23 12:44 -------- d-----w- C:\32788R22FWJFW
2010-04-22 20:38 . 2010-04-14 16:35 162768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-04-22 20:38 . 2010-04-14 16:31 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-04-22 20:37 . 2010-04-14 16:31 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-04-22 20:37 . 2010-04-14 16:35 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-04-22 20:37 . 2010-04-14 16:31 51792 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-04-22 20:37 . 2010-04-14 16:47 38848 ----a-w- c:\windows\system32\avastSS.scr
2010-04-22 20:37 . 2010-04-14 16:47 153184 ----a-w- c:\windows\system32\aswBoot.exe
2010-04-22 20:36 . 2010-04-22 20:36 -------- d-----w- c:\programdata\Alwil Software
2010-04-22 20:36 . 2010-04-22 20:36 -------- d-----w- c:\program files\Alwil Software
2010-04-22 13:55 . 2010-02-12 10:32 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-04-22 11:25 . 2010-04-24 08:48 -------- d-----w- c:\users\OEM\AppData\Local\temp
2010-04-22 11:25 . 2010-04-22 11:25 -------- d-----w- c:\users\Public\AppData
2010-04-22 10:42 . 2010-04-22 10:42 -------- d-----w- c:\program files\CCleaner
2010-04-22 06:21 . 2010-04-22 06:21 -------- d-----w- C:\rsit
2010-04-15 18:39 . 2010-03-04 17:33 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-04-15 18:39 . 2010-02-18 14:07 3600776 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-04-15 18:39 . 2010-02-18 14:07 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-04-15 18:38 . 2010-02-23 11:10 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-15 18:38 . 2010-02-23 11:10 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-15 18:38 . 2010-02-23 11:10 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-15 18:38 . 2010-02-18 14:07 904576 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-15 18:38 . 2010-02-18 11:28 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2010-04-15 18:38 . 2010-02-18 13:30 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-04-15 12:08 . 2009-12-23 11:33 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-04-15 12:08 . 2010-01-13 17:34 98304 ----a-w- c:\windows\system32\cabview.dll
2010-03-31 17:06 . 2010-03-09 15:42 834048 ----a-w- c:\windows\system32\wininet.dll
2010-03-31 17:06 . 2010-03-09 16:25 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-03-30 18:51 . 2010-03-30 18:51 -------- d-----w- c:\program files\Common Files\Java
2010-03-30 12:04 . 2010-03-30 12:04 -------- d-----w- c:\program files\LogMeIn Hamachi
2010-03-27 12:58 . 2010-03-27 13:06 -------- d-----w- c:\users\OEM\AppData\Roaming\TS3Client
2010-03-27 12:58 . 2010-03-27 12:58 -------- d-----w- c:\program files\TeamSpeak 3 Client

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-24 08:49 . 2008-10-28 07:53 -------- d-----w- c:\users\OEM\AppData\Roaming\ICQ
2010-04-24 08:48 . 2010-01-29 14:41 79001 ----a-w- c:\programdata\nvModes.dat
2010-04-23 12:43 . 2010-03-03 19:35 -------- d-----r- c:\program files\Skype
2010-04-23 07:47 . 2009-11-13 15:03 -------- d-----w- c:\program files\Steam
2010-04-23 06:45 . 2008-01-21 06:13 635756 ----a-w- c:\windows\system32\perfh005.dat
2010-04-23 06:45 . 2008-01-21 06:13 134582 ----a-w- c:\windows\system32\perfc005.dat
2010-04-22 20:30 . 2006-11-02 10:25 86016 ----a-w- c:\windows\inf\infstor.dat
2010-04-22 20:30 . 2006-11-02 10:25 51200 ----a-w- c:\windows\inf\infpub.dat
2010-04-22 20:30 . 2006-11-02 10:25 143360 ----a-w- c:\windows\inf\infstrng.dat
2010-04-22 10:54 . 2009-06-22 17:30 -------- d-----w- c:\program files\Aspyr
2010-04-22 10:46 . 2010-01-22 11:48 -------- d-----w- c:\program files\Frets on Fire
2010-04-22 10:44 . 2010-03-16 20:28 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-04-19 17:48 . 2008-11-02 09:46 1 ----a-w- c:\users\OEM\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-04-18 08:05 . 2009-07-29 14:28 -------- d-----w- c:\program files\Google
2010-04-16 12:04 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-04-07 21:02 . 2008-11-25 11:01 -------- d-----w- c:\users\OEM\AppData\Roaming\Skype
2010-04-07 17:45 . 2008-11-25 11:02 -------- d-----w- c:\users\OEM\AppData\Roaming\skypePM
2010-03-31 17:02 . 2010-01-24 15:41 -------- d-----w- c:\program files\ICQ7.0
2010-03-30 18:51 . 2008-12-03 14:30 -------- d-----w- c:\program files\Java
2010-03-30 12:16 . 2008-10-28 08:24 -------- d-----w- c:\users\OEM\AppData\Roaming\uTorrent
2010-03-24 20:47 . 2010-03-24 19:49 -------- d-----w- c:\users\OEM\AppData\Roaming\opie
2010-03-24 13:18 . 2010-03-24 13:18 -------- d-----w- c:\programdata\McAfee
2010-03-16 20:31 . 2010-03-16 20:28 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-03-16 15:49 . 2008-10-28 08:24 -------- d-----w- c:\program files\uTorrent
2010-03-11 21:34 . 2008-10-27 21:53 139128 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-03-11 21:34 . 2008-10-27 21:53 215128 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-03-09 02:28 . 2008-12-03 14:31 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-03-05 06:54 . 2008-10-27 21:53 138056 ----a-w- c:\users\OEM\AppData\Roaming\PnkBstrK.sys
2010-03-05 06:54 . 2008-10-27 21:53 138056 ----a-w- c:\users\OEM\AppData\Roaming\PnkBstrK.sys
2010-03-05 06:54 . 2008-10-27 21:53 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-03-05 06:54 . 2010-03-05 06:54 2434856 ----a-w- c:\windows\system32\pbsvc_bc2.exe
2010-03-05 06:50 . 2009-04-18 15:13 -------- d-----w- c:\program files\Electronic Arts
2010-03-04 08:00 . 2010-01-25 13:17 -------- d-----w- c:\program files\Mass Effect 2
2010-03-03 19:35 . 2010-03-03 19:35 -------- d-----w- c:\program files\Common Files\Skype
2010-03-03 19:35 . 2008-11-25 11:01 -------- d-----w- c:\programdata\Skype
2010-03-02 10:21 . 2008-10-21 09:30 54704 ----a-w- c:\users\OEM\AppData\Local\GDIPFONTCACHEV1.DAT
2010-03-01 14:21 . 2008-10-21 09:36 -------- d-----w- c:\programdata\NVIDIA
2010-03-01 14:17 . 2008-10-21 09:30 1356 ----a-w- c:\users\OEM\AppData\Local\d3d9caps.dat
2010-02-24 08:16 . 2009-10-14 18:31 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-03 13:56 . 2009-10-14 18:12 26176 ---ha-w- c:\windows\system32\hamachi.sys
2010-01-25 12:00 . 2010-03-02 07:27 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2010-01-25 12:00 . 2010-03-02 07:27 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-01-25 12:00 . 2010-03-02 07:27 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-01-25 12:00 . 2010-03-02 07:27 471552 ----a-w- c:\windows\system32\secproc.dll
2010-01-25 11:58 . 2010-03-02 07:27 332288 ----a-w- c:\windows\system32\msdrm.dll
2010-01-25 08:21 . 2010-03-02 07:27 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-01-25 08:21 . 2010-03-02 07:27 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-01-25 08:21 . 2010-03-02 07:27 518144 ----a-w- c:\windows\system32\RMActivate.exe
2010-01-25 08:21 . 2010-03-02 07:27 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-01-24 2289664]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"Google Update"="c:\users\OEM\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-03-18 136176]
"ICQ"="c:\program files\ICQ7.0\ICQ.exe" [2010-03-28 133368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-05-07 6139904]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-12-03 2213160]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-04-14 2790472]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Air Mouse.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Air Mouse.lnk
backup=c:\windows\pss\Air Mouse.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AirVideoServer]
2009-10-08 00:36 4125640 ----a-w- c:\program files\AirVideoServer\AirVideoServer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-07-24 15:02 490952 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-11-12 15:33 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2010-03-30 09:16 1820040 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 22:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-02-22 11:42 26101032 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 15:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-03-03 17:08 1217872 ----a-w- c:\program files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 09:43 248040 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):83,0f,34,f4,45,57,ca,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1545557754-3061685998-956643779-1000]
"EnableNotificationsRef"=dword:00000001

R0 CLFS;Common Log (CLFS);c:\windows\System32\clfs.sys [2009-10-20 245736]
R0 Ecache;ReadyBoost Caching Driver;c:\windows\System32\drivers\ecache.sys [2009-10-20 141288]
R0 FileInfo;File Information FS MiniFilter;c:\windows\System32\drivers\fileinfo.sys [2008-01-21 58936]
R0 msisadrv;Ovladač třídy ISA/EISA;c:\windows\System32\drivers\msisadrv.sys [2008-01-21 16440]
R0 spldr;Security Processor Loader Driver;c:\windows\System32\drivers\spldr.sys [2008-01-21 21048]
R0 volmgr;Ovladač správce svazků;c:\windows\System32\drivers\volmgr.sys [2008-01-21 52792]
R0 volmgrx;Dynamic Volume Manager;c:\windows\System32\drivers\volmgrx.sys [2009-10-20 292840]
R1 aswSP;aswSP;c:\windows\System32\drivers\aswSP.sys [2010-04-22 162768]
R1 DfsC;DFS Namespace Client Driver;c:\windows\System32\drivers\dfsc.sys [2009-10-20 75264]
R1 nsiproxy;NSI proxy service;c:\windows\System32\drivers\nsiproxy.sys [2008-01-21 16384]
R1 RDPENCDD;RDP Encoder Mirror Driver;c:\windows\System32\drivers\RDPENCDD.sys [2008-01-21 6144]
R1 Smb;Protokol TCP/IP a TCP/IPv6 orientovaný na zprávy (relace SMB);c:\windows\System32\drivers\smb.sys [2009-10-20 66560]
R1 tdx;Ovladač pro podporu zastaralého rozhraní TDI NetIO;c:\windows\System32\drivers\tdx.sys [2009-10-20 72192]
R1 Wanarpv6;Remote Access IPv6 ARP Driver;c:\windows\System32\drivers\wanarp.sys [2008-01-21 62464]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [2010-04-22 19024]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [2010-04-22 51792]
R2 AudioEndpointBuilder;Koncové vytváření služby Windows Audio;c:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2008-01-21 21504]
R2 BFE;Služba BFE;c:\windows\system32\svchost.exe -k LocalServiceNoNetwork [2008-01-21 21504]
R2 DPS;Služba DPS (Diagnostic Policy Service);c:\windows\System32\svchost.exe -k LocalServiceNoNetwork [2008-01-21 21504]
R2 EMDMgmt;ReadyBoost;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2008-01-21 21504]
R2 FDResPub;Publikování prostředků rozpoznávání funkcí;c:\windows\system32\svchost.exe -k LocalService [2008-01-21 21504]
R2 gpsvc;Klient zásad skupiny;c:\windows\system32\svchost.exe -k netsvcs [2008-01-21 21504]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
R2 IKEEXT;Služba IKE and AuthIP IPsec Keying Modules;c:\windows\system32\svchost.exe -k netsvcs [2008-01-21 21504]
R2 IPBusEnum;Rozpoznávací modul sběrnice PnP-X IP;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2008-01-21 21504]
R2 iphlpsvc;Pomocník IP;c:\windows\System32\svchost.exe -k NetSvcs [2008-01-21 21504]
R2 KtmRm;Služba KTMRM pro koordinátor DTC;c:\windows\System32\svchost.exe -k NetworkService [2008-01-21 21504]
R2 lltdio;Link-Layer Topology Discovery Mapper I/O Driver;c:\windows\System32\drivers\lltdio.sys [2008-01-21 47104]
R2 luafv;UAC File Virtualization;c:\windows\System32\drivers\luafv.sys [2008-01-21 84480]
R2 MMCSS;Služba Plánovač multimédií;c:\windows\system32\svchost.exe -k netsvcs [2008-01-21 21504]
R2 MpsSvc;Brána firewall systému Windows;c:\windows\system32\svchost.exe -k LocalServiceNoNetwork [2008-01-21 21504]
R2 netprofm;Služba seznamu sítí;c:\windows\System32\svchost.exe -k LocalService [2008-01-21 21504]
R2 NlaSvc;Sledování umístění v síti (NLA);c:\windows\System32\svchost.exe -k NetworkService [2008-01-21 21504]
R2 nsi;Služba rozhraní síťového úložiště;c:\windows\system32\svchost.exe -k LocalService [2008-01-21 21504]
R2 PcaSvc;Program Compatibility Assistant Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2008-01-21 21504]
R2 PEAUTH;PEAUTH;c:\windows\System32\drivers\PEAuth.sys [2006-11-02 878080]
R2 ProfSvc;Služba Profil uživatele;c:\windows\system32\svchost.exe -k netsvcs [2008-01-21 21504]
R2 slsvc;Licencování softwaru;c:\windows\System32\SLsvc.exe [2009-10-20 3408896]
R2 SysMain;Superfetch;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2008-01-21 21504]
R2 TabletInputService;Služba Vstupní panel počítače Tablet PC;c:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2008-01-21 21504]
R2 tcpipreg;TCP/IP Registry Compatibility;c:\windows\System32\drivers\tcpipreg.sys [2010-03-02 30720]
R2 UxSms;Správce relací správce oken plochy;c:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2008-01-21 21504]
R2 WerSvc;Služba Zasílání zpráv o chybách systému Windows;c:\windows\System32\svchost.exe -k WerSvcGroup [2008-01-21 21504]
R2 WinDefend;Windows Defender;c:\windows\System32\svchost.exe -k secsvcs [2008-01-21 21504]
R2 Wlansvc;Automatická konfigurace sítě WLAN;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2008-01-21 21504]
R2 WPDBusEnum;Služba Výčet přenosných zařízení;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2008-01-21 21504]
R3 bowser;Bowser;c:\windows\System32\drivers\bowser.sys [2008-01-21 69632]
R3 DXGKrnl;LDDM Graphics Subsystem;c:\windows\System32\drivers\dxgkrnl.sys [2009-11-18 634880]
R3 fdPHost;Hostitel poskytovatele rozpoznávání funkce;c:\windows\system32\svchost.exe -k LocalService [2008-01-21 21504]
R3 iScsiPrt;Ovladač iScsiPort;c:\windows\System32\drivers\msiscsi.sys [2009-10-20 180712]
R3 KeyIso;Izolace klíče CNG;c:\windows\System32\lsass.exe [2009-08-31 9728]
R3 monitor;Služba ovladače funkce třídy monitorů Microsoft;c:\windows\System32\drivers\monitor.sys [2008-01-21 41984]
R3 mpsdrv;Ovladač ověření brány firewall systému Windows;c:\windows\System32\drivers\mpsdrv.sys [2008-01-21 64000]
R3 mrxsmb10;SMB 1.x MiniRedirector;c:\windows\System32\drivers\mrxsmb10.sys [2010-04-15 212992]
R3 mrxsmb20;SMB 2.0 MiniRedirector;c:\windows\System32\drivers\mrxsmb20.sys [2010-04-15 79360]
R3 NativeWifiP;Filtr NativeWiFi;c:\windows\System32\drivers\nwifi.sys [2009-10-20 148480]
R3 srv2;srv2;c:\windows\System32\drivers\srv2.sys [2009-10-15 144896]
R3 srvnet;srvnet;c:\windows\System32\drivers\srvnet.sys [2010-03-02 98816]
R3 TrustedInstaller;Instalace modulů systému Windows;c:\windows\servicing\TrustedInstaller.exe [2009-10-20 39424]
R3 tunnel;Microsoft IPv6 Tunnel Miniport Adapter Driver;c:\windows\System32\drivers\tunnel.sys [2010-04-15 25088]
R3 umbus;Ovladač sběrnice UMBus Enumerator;c:\windows\System32\drivers\umbus.sys [2008-01-21 34816]
R3 WdiSystemHost;Hostitel diagnostického systému;c:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2008-01-21 21504]
S2 gupdate1ca1058efc68952;Služba Google Update (gupdate1ca1058efc68952);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-29 133104]
S2 TBS;Služba TPM Base Services;c:\windows\System32\svchost.exe -k LocalService [2008-01-21 21504]
S3 Appinfo;Informace o aplikaci;c:\windows\system32\svchost.exe -k netsvcs [2008-01-21 21504]
S3 BrFiltLo;Brother USB Mass-Storage Lower Filter Driver;c:\windows\System32\drivers\BrFiltLo.sys [2006-11-02 13568]
S3 BrFiltUp;Brother USB Mass-Storage Upper Filter Driver;c:\windows\System32\drivers\BrFiltUp.sys [2006-11-02 5248]
S3 CertPropSvc;Šíření certifikátů;c:\windows\system32\svchost.exe -k netsvcs [2008-01-21 21504]
S3 DFSR;Replikace distribuovaného systému souborů (DFSR);c:\windows\System32\dfsr.exe [2009-10-20 2092544]
S3 E1G60;Intel(R) PRO/1000 NDIS 6 Adapter Driver;c:\windows\System32\drivers\E1G60I32.sys [2008-01-21 118784]
S3 Filetrace;FileTrace;c:\windows\System32\drivers\filetrace.sys [2008-01-21 27648]
S3 FontCache;Mezipaměť písem Windows;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-01-21 21504]
S3 lltdsvc;Mapovač zjišťování topologie linkové vrstvy;c:\windows\System32\svchost.exe -k LocalService [2008-01-21 21504]
S3 MSiSCSI;Služba iniciátoru iSCSI společnosti Microsoft;c:\windows\system32\svchost.exe -k netsvcs [2008-01-21 21504]
S3 MsRPC;MsRPC;c:\windows\System32\drivers\msrpc.sys [2009-10-20 161752]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\System32\drivers\netaapl.sys [2009-08-28 17408]
S3 pla;Výstrahy a protokolování výkonu;c:\windows\System32\svchost.exe -k LocalServiceNoNetwork [2008-01-21 21504]
S3 PNRPAutoReg;Služba publikování názvu počítače pomocí protokolu PNRP;c:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted [2008-01-21 21504]
S3 SCPolicySvc;Zásady odebrání čipové karty;c:\windows\system32\svchost.exe -k netsvcs [2008-01-21 21504]
S3 SDRSVC;Zálohování systému Windows;c:\windows\system32\svchost.exe -k SDRSVC [2008-01-21 21504]
S3 SessionEnv;Konfigurace Terminálové služby;c:\windows\System32\svchost.exe -k netsvcs [2008-01-21 21504]
S3 sffp_mmc;SFF Storage Protocol Driver for MMC;c:\windows\System32\drivers\sffp_mmc.sys [2006-11-02 12288]
S3 SLUINotify;Služba SL UI Notification Service;c:\windows\system32\svchost.exe -k LocalService [2008-01-21 21504]
S3 THREADORDER;Server pro řazení podprocesů;c:\windows\system32\svchost.exe -k LocalService [2008-01-21 21504]
S3 tssecsrv;Terminal Services Security Filter Driver;c:\windows\System32\drivers\tssecsrv.sys [2008-01-21 23552]
S3 UI0Detect;Zjišťování interaktivních služeb;c:\windows\System32\UI0Detect.exe [2008-01-21 35840]
S3 uliagpkx;Uli AGP Bus Filter;c:\windows\System32\drivers\ULIAGPKX.SYS [2006-11-02 60984]
S3 wcncsvc;Technologie Windows Connect Now – Registrátor konfigurací;c:\windows\System32\svchost.exe -k LocalService [2008-01-21 21504]
S3 WcsPlugInService;Windows Color System;c:\windows\system32\svchost.exe -k wcssvc [2008-01-21 21504]
S3 WdiServiceHost;Hostitel diagnostické služby;c:\windows\System32\svchost.exe -k wdisvc [2008-01-21 21504]
S3 Wecsvc;Sběr událostí systému Windows;c:\windows\system32\svchost.exe -k NetworkService [2008-01-21 21504]
S3 wercplsupport;Podpora ovládacího panelu Hlášení a řešení problémů;c:\windows\System32\svchost.exe -k netsvcs [2008-01-21 21504]
S3 WinRM;Vzdálená správa systému Windows (WS-Management);c:\windows\System32\svchost.exe -k NetworkService [2008-01-21 21504]
S3 WPCSvc;Rodičovská kontrola;c:\windows\system32\svchost.exe -k LocalServiceNetworkRestricted [2008-01-21 21504]
S4 adp94xx;adp94xx;c:\windows\System32\drivers\adp94xx.sys [2006-11-02 422968]
S4 adpahci;adpahci;c:\windows\System32\drivers\adpahci.sys [2006-11-02 300600]
S4 Apache2.2;Apache2.2;c:\xampp\apache\bin\apache.exe [2007-03-05 16896]
S4 arcsas;arcsas;c:\windows\System32\drivers\arcsas.sys [2006-11-02 79928]
S4 blbdrive;blbdrive;c:\windows\System32\drivers\blbdrive.sys [2008-01-21 45568]
S4 Brserid;Brother MFC Serial Port Interface Driver (WDM);c:\windows\System32\drivers\BrSerId.sys [2006-11-02 71808]
S4 BrSerWdm;Brother WDM Serial driver;c:\windows\System32\drivers\BrSerWdm.sys [2006-11-02 62336]
S4 BrUsbMdm;Brother MFC USB Fax Only Modem;c:\windows\System32\drivers\BrUsbMdm.sys [2006-11-02 12160]
S4 circlass;Consumer IR Devices;c:\windows\System32\drivers\circlass.sys [2006-11-02 35328]
S4 Crusoe;Transmeta Crusoe Processor Driver;c:\windows\System32\drivers\crusoe.sys [2006-11-02 40960]
S4 elxstor;elxstor;c:\windows\System32\drivers\elxstor.sys [2006-11-02 342584]
S4 HpCISSs;HpCISSs;c:\windows\System32\drivers\HpCISSs.sys [2006-11-02 40504]
S4 iaStorV;Intel RAID Controller Vista;c:\windows\System32\drivers\iaStorV.sys [2006-11-02 235064]
S4 IPMIDRV;IPMIDRV;c:\windows\System32\drivers\IPMIDrv.sys [2006-11-02 64512]
S4 iteraid;ITERAID_Service_Install;c:\windows\System32\drivers\iteraid.sys [2006-11-02 35944]
S4 LSI_FC;LSI_FC;c:\windows\System32\drivers\lsi_fc.sys [2006-11-02 96312]
S4 LSI_SAS;LSI_SAS;c:\windows\System32\drivers\lsi_sas.sys [2006-11-02 89656]
S4 LSI_SCSI;LSI_SCSI;c:\windows\System32\drivers\lsi_scsi.sys [2008-01-21 96312]
S4 megasas;megasas;c:\windows\System32\drivers\megasas.sys [2006-11-02 31288]
S4 mpio;Microsoft Multi-Path Bus Driver;c:\windows\System32\drivers\mpio.sys [2006-11-02 105016]
S4 msahci;msahci;c:\windows\System32\drivers\msahci.sys [2006-11-02 28728]
S4 msdsm;Microsoft Multi-Path Device Specific Module;c:\windows\System32\drivers\msdsm.sys [2006-11-02 94776]
S4 nfrd960;nfrd960;c:\windows\System32\drivers\nfrd960.sys [2006-11-02 45160]
S4 ntrigdigi;N-trig HID Tablet Driver;c:\windows\System32\drivers\ntrigdigi.sys [2006-11-02 20608]
S4 nvstor;nvstor;c:\windows\System32\drivers\nvstor.sys [2006-11-02 45112]
S4 ql2300;QLogic Fibre Channel Miniport Driver;c:\windows\System32\drivers\ql2300.sys [2006-11-02 1122360]
S4 ql40xx;QLogic iSCSI Miniport Driver;c:\windows\System32\drivers\ql40xx.sys [2006-11-02 106088]
S4 SiSRaid4;SiSRaid4;c:\windows\System32\drivers\sisraid4.sys [2006-11-02 74808]
S4 sptd;sptd;c:\windows\System32\drivers\sptd.sys [2008-10-27 717296]
S4 uliahci;uliahci;c:\windows\System32\drivers\uliahci.sys [2006-11-02 238648]
S4 ulsata2;ulsata2;c:\windows\System32\drivers\ulsata2.sys [2006-11-02 115816]
S4 usbcir;eHome Infrared Receiver (USBCIR);c:\windows\System32\drivers\usbcir.sys [2006-11-02 68608]
S4 ViaC7;VIA C7 Processor Driver;c:\windows\System32\drivers\viac7.sys [2006-11-02 41472]
S4 vsmraid;vsmraid;c:\windows\System32\drivers\vsmraid.sys [2006-11-02 130616]
S4 WacomPen;Wacom Serial Pen HID Driver;c:\windows\System32\drivers\wacompen.sys [2006-11-02 20608]
S4 Wd;Microsoft Watchdog Timer Driver;c:\windows\System32\drivers\wd.sys [2006-11-02 22072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
NetworkServiceNetworkRestricted REG_MULTI_SZ PolicyAgent
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
WerSvcGroup REG_MULTI_SZ wersvc
swprv REG_MULTI_SZ swprv
regsvc REG_MULTI_SZ RemoteRegistry
wcssvc REG_MULTI_SZ WcsPlugInService
DcomLaunch REG_MULTI_SZ PlugPlay DcomLaunch
wdisvc REG_MULTI_SZ WdiServiceHost
sdrsvc REG_MULTI_SZ sdrsvc
secsvcs REG_MULTI_SZ WinDefend
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
AeLookupSvc
wercplsupport
Themes
CertPropSvc
SCPolicySvc
lanmanserver
gpsvc
IKEEXT
AudioSrv
FastUserSwitchingCompatibility
Nla
NWCWorkstation
SRService
Wmi
WmdmPmSp
TermService
wuauserv
BITS
ShellHWDetection
LogonHours
PCAudit
helpsvc
uploadmgr
iphlpsvc
seclogon
AppInfo
msiscsi
MMCSS
ProfSvc
EapHost
winmgmt
schedule
SessionEnv
browser

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-01-24 10:30 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
2009-09-10 14:58 310784 ----a-w- c:\windows\System32\unregmp2.exe
.
Obsah adresáře 'Naplánované úlohy'

2010-04-24 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-29 14:28]

2010-04-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-29 14:29]

2010-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-29 14:29]

2010-04-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1545557754-3061685998-956643779-1000Core.job
- c:\users\OEM\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-29 13:56]

2010-04-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1545557754-3061685998-956643779-1000UA.job
- c:\users\OEM\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-29 13:56]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Settings,ProxyOverride = *.local
IE: &Download All by FlashGet - c:\program files\FlashGet\ComDlls\Bhoall.htm
IE: &Download by FlashGet - c:\program files\FlashGet\ComDlls\Bholink.htm
IE: {{88EB38EF-4D2C-436D-ABD3-56B232674062} - c:\program files\ICQ7.0\ICQ.exe
TCP: {63A4CA88-DBFC-45FD-881B-0A6CC9F0CCB2} = 192.168.1.1,192.168.1.2
FF - ProfilePath - c:\users\OEM\AppData\Roaming\Mozilla\Firefox\Profiles\yukm43xw.default\
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\users\OEM\AppData\Local\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

SafeBoot-sacsvr



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-24 10:48
Windows 6.0.6002 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'Explorer.exe'(4036)
c:\program files\WinSCP\DragExt.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\wininit.exe
c:\windows\system32\lsm.exe
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\Dwm.exe
c:\windows\RtHDVCpl.exe
c:\windows\system32\conime.exe
c:\program files\Alwil Software\Avast5\AvastUI.exe
c:\windows\system32\taskeng.exe
c:\windows\system32\taskeng.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\iPod\bin\iPodService.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Celkový čas: 2010-04-24 10:55:39 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-04-24 08:55
ComboFix2.txt 2010-04-22 11:25

Před spuštěním: Volných bajtů: 102,789,423,104
Po spuštění: Volných bajtů: 103,015,034,880

- - End Of File - - 6EF8B1AB52FF6194C02305B72ED084CE
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Infiltrace typu Win32/Olmarik

#8 Příspěvek od motji »

A po dalším restartu už plocha naběhla?

Ještě se prosím podívejte na disk C do složky Qoobox, vytahněte odtud soubor
c:\windows\system32\msconfig.exe.vir a otestujte ho na www.virustotal.com
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
zion.g
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 22 dub 2010 07:31

Re: Infiltrace typu Win32/Olmarik

#9 Příspěvek od zion.g »

Plocha už je v pořádku :) . msconfig.exe.vir je podle virustotal čistý.

Ale zkoušel jsem i C:/Windows/Windows-Firewall.exe.vir a ten jim přijde krajně podezřelý. Poradil byste mi něco? Děkuji.
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Infiltrace typu Win32/Olmarik

#10 Příspěvek od motji »

Tento soubor přejmenujte - umažte mu koncovku vir a vraťte ho do složky windows32
c:\windows\system32\msconfig.exe.vir

C:/Windows/Windows-Firewall.exe.vir - můžete mi sem dát odkaz z virustotalu? Dle mého názoru to vir je :)
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
zion.g
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 22 dub 2010 07:31

Re: Infiltrace typu Win32/Olmarik

#11 Příspěvek od zion.g »

http://www.virustotal.com/cs/analisis/2 ... 1272132308
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Infiltrace typu Win32/Olmarik

#12 Příspěvek od motji »

nechte ho v karanteně combofixu :)

:arrow: Odinstalujte combofix přes Start - Spustit
- zkopírujte do okénka:

ComboFix /Uninstall

-stiskněte Enter
-To odinstaluje ComboFix a smaže s ním související soubory a složky.


***********


:arrow: Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

-Spusťte,pro potvrzení volby mačkejte klávesu A, Enter
-po použití prográmek vymažte.Pozor,antiviry ho mohou falešně označit za vir



***********


:arrow: Z mého podpisu stahněte Ccleaner
- nainstalujte, při výběru, co se má nainstalovat, dejte pryč fajfku u instalace yahoo toolbaru

Obrázekzáložka čistič
- nechejte v levém sloupečku zatrhnuté vše jak je, klikněte na analyzovat
- po analýze klikněte na Spustit Ccleaner

Obrázekzáložka Registry
- klikněte na hledej problémy
- pak klikněte na opravit vybrané problémy -- udělat zálohu registrů - nemusíte
- kliknete opravit všechny problémy :arrow: ok :arrow: zavřít

Obrázek Záložka Nástroje
- zde můžete odinstalovat programy. Je to důkladnější odinstalace než u přidat/odebrat programy ve Windows.

Ccleaner - čistič doporučuji používat, krásně pročistí pc od dočasných souborů.
Registry pročistí třeba po odinstalaci nějakého programu.


***********



:arrow: Stahněte OTC a použijte
http://oldtimer.geekstogo.com/OTC.exe
-vyčistí tempy a po použitých programech



***********

:arrow: Vložte nový log ze RSIT a řekněte co počítač, jak se chová, už je vše v pořádku?
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
zion.g
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 22 dub 2010 07:31

Re: Infiltrace typu Win32/Olmarik

#13 Příspěvek od zion.g »

Nevím jak Vám mám poděkovat. PC šlape zase jako hodinky. :D

Ještě hážu loga.

Logfile of random's system information tool 1.06 (written by random/random)
Run by OEM at 2010-04-24 20:21:48
Microsoft® Windows Vista™ Home Basic Service Pack 2
System drive C: has 96 GB (20%) free of 477 GB
Total RAM: 3326 MB (70% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:22:05, on 24.4.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\ICQ7.0\ICQ.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\OEM\Downloads\RSIT.exe
C:\Users\OEM\Desktop\OEM.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32Info.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget2 urlcatch - {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} - C:\Program Files\FlashGet\ComDlls\bhoCATCH.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\OEM\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.0\ICQ.exe" silent loginmode=4
O8 - Extra context menu item: &Download All by FlashGet - C:\Program Files\FlashGet\ComDlls\Bhoall.htm
O8 - Extra context menu item: &Download by FlashGet - C:\Program Files\FlashGet\ComDlls\Bholink.htm
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{63A4CA88-DBFC-45FD-881B-0A6CC9F0CCB2}: NameServer = 192.168.1.1,192.168.1.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Služba Google Update (gupdate1ca1058efc68952) (gupdate1ca1058efc68952) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 5971 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Google Software Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1545557754-3061685998-956643779-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1545557754-3061685998-956643779-1000UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1F364306-AA45-47B5-9F9D-39A8B94E7EF1}]
FG2CatchUrl - C:\Program Files\FlashGet\ComDlls\bhoCATCH.dll [2008-08-19 104016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-07-29 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-03-09 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-05-07 6139904]
"NeroFilterCheck"=C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2007-03-01 153136]
"NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2007-12-03 2213160]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-11-11 417792]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-11-12 141600]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-04-14 2790472]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2008-01-24 2289664]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]
"Google Update"=C:\Users\OEM\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-18 136176]
"ICQ"=C:\Program Files\ICQ7.0\ICQ.exe [2010-03-28 133368]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AirVideoServer]
C:\Program Files\AirVideoServer\AirVideoServer.exe [2009-10-08 4125640]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-07-24 490952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2009-11-12 141600]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [2010-03-30 1820040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2009-11-11 417792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2010-02-22 26101032]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Steam\Steam.exe [2010-03-03 1217872]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Air Mouse.lnk]
C:\PROGRA~1\AIRMOU~1\AIRMOU~1\AIRMOU~1.EXE [2010-01-07 504320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"= []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\FlashGet\FlashGet.exe"="C:\Program Files\FlashGet\FlashGet.exe:*:Enabled:Flashget2"
"C:\Program Files\FlashGet\LiveUpdate.exe"="C:\Program Files\FlashGet\LiveUpdate.exe:*:Enabled:FGLiveUpdate"
"C:\Program Files\FlashGet\LiveUpdateEx.exe"="C:\Program Files\FlashGet\LiveUpdateEx.exe:*:Enabled:FGLiveUpdateEx"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2010-04-24 20:21:48 ----D---- C:\rsit
2010-04-24 10:48:12 ----D---- C:\$RECYCLE.BIN
2010-04-22 22:37:00 ----A---- C:\Windows\system32\aswBoot.exe
2010-04-22 22:36:53 ----D---- C:\ProgramData\Alwil Software
2010-04-22 22:36:53 ----D---- C:\Program Files\Alwil Software
2010-04-22 15:55:13 ----A---- C:\Windows\system32\browserchoice.exe
2010-04-22 13:25:39 ----D---- C:\Windows\temp
2010-04-22 12:42:20 ----D---- C:\Program Files\CCleaner
2010-04-15 20:39:27 ----A---- C:\Windows\system32\vbscript.dll
2010-04-15 20:39:16 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-04-15 20:39:16 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-04-15 20:38:25 ----A---- C:\Windows\system32\iphlpsvc.dll
2010-04-15 16:13:32 ----A---- C:\Windows\system32\MRT.INI
2010-04-15 14:08:47 ----A---- C:\Windows\system32\wintrust.dll
2010-04-15 14:08:42 ----A---- C:\Windows\system32\cabview.dll
2010-03-31 19:06:32 ----A---- C:\Windows\system32\mshtml.dll
2010-03-31 19:06:30 ----A---- C:\Windows\system32\wininet.dll
2010-03-31 19:06:29 ----A---- C:\Windows\system32\urlmon.dll
2010-03-31 19:06:24 ----A---- C:\Windows\system32\ieframe.dll
2010-03-31 19:06:19 ----A---- C:\Windows\system32\ieui.dll
2010-03-31 19:06:18 ----A---- C:\Windows\system32\mshtmled.dll
2010-03-31 19:06:14 ----A---- C:\Windows\system32\iepeers.dll
2010-03-31 19:06:12 ----A---- C:\Windows\system32\ieencode.dll
2010-03-31 19:06:04 ----A---- C:\Windows\system32\ieapfltr.dll
2010-03-30 20:51:19 ----D---- C:\ProgramData\Sun
2010-03-30 20:51:17 ----D---- C:\Program Files\Common Files\Java
2010-03-30 20:51:03 ----A---- C:\Windows\system32\javaws.exe
2010-03-30 20:51:03 ----A---- C:\Windows\system32\javaw.exe
2010-03-30 20:51:03 ----A---- C:\Windows\system32\java.exe
2010-03-30 14:12:41 ----D---- C:\Users\OEM\AppData\Roaming\Mozilla
2010-03-30 14:04:25 ----D---- C:\Program Files\LogMeIn Hamachi
2010-03-27 14:58:28 ----D---- C:\Users\OEM\AppData\Roaming\TS3Client
2010-03-27 14:58:01 ----D---- C:\Program Files\TeamSpeak 3 Client
2010-03-25 00:00:08 ----A---- C:\Windows\winconfig.txt

======List of files/folders modified in the last 1 months======

2010-04-24 20:22:00 ----A---- C:\Windows\NeroDigital.ini
2010-04-24 20:21:59 ----D---- C:\Windows\Prefetch
2010-04-24 20:20:30 ----D---- C:\Users\OEM\AppData\Roaming\ICQ
2010-04-24 20:16:30 ----D---- C:\Windows
2010-04-24 20:14:15 ----D---- C:\Windows\System32
2010-04-24 15:06:30 ----D---- C:\Program Files\Mozilla Firefox
2010-04-24 13:53:22 ----SHD---- C:\System Volume Information
2010-04-24 10:55:41 ----D---- C:\Windows\system32\drivers
2010-04-24 10:55:37 ----D---- C:\Windows\inf
2010-04-24 10:55:37 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-04-24 10:50:56 ----D---- C:\Windows\Tasks
2010-04-24 10:48:16 ----A---- C:\Windows\system.ini
2010-04-23 14:52:56 ----D---- C:\Windows\system32\config
2010-04-23 14:52:56 ----D---- C:\Boot
2010-04-23 14:50:02 ----D---- C:\Windows\AppPatch
2010-04-23 14:50:02 ----D---- C:\Program Files\Common Files
2010-04-23 14:49:49 ----D---- C:\Windows\system32\wbem
2010-04-23 14:43:37 ----SHD---- C:\Windows\Installer
2010-04-23 14:43:37 ----RD---- C:\Program Files\Skype
2010-04-23 11:12:40 ----D---- C:\EmuHack
2010-04-23 09:47:42 ----D---- C:\Program Files\Steam
2010-04-22 22:37:52 ----D---- C:\Windows\winsxs
2010-04-22 22:36:53 ----RD---- C:\Program Files
2010-04-22 22:36:53 ----D---- C:\ProgramData
2010-04-22 22:30:45 ----D---- C:\Windows\system32\catroot
2010-04-22 13:19:16 ----D---- C:\Windows\system32\catroot2
2010-04-22 13:16:03 ----D---- C:\ProgramData\Adobe
2010-04-22 12:54:40 ----D---- C:\Program Files\Aspyr
2010-04-22 12:46:40 ----D---- C:\Program Files\Frets on Fire
2010-04-22 12:44:21 ----D---- C:\ProgramData\Spybot - Search & Destroy
2010-04-22 12:44:17 ----D---- C:\Windows\Minidump
2010-04-22 12:44:17 ----D---- C:\Windows\Debug
2010-04-18 10:05:49 ----D---- C:\Program Files\Google
2010-04-16 14:04:56 ----D---- C:\Program Files\Windows Mail
2010-04-13 17:57:10 ----D---- C:\Seriály
2010-04-07 23:02:39 ----D---- C:\Users\OEM\AppData\Roaming\Skype
2010-04-07 19:45:49 ----D---- C:\Users\OEM\AppData\Roaming\skypePM
2010-04-06 19:52:54 ----A---- C:\Windows\system32\mrt.exe
2010-03-31 19:02:43 ----D---- C:\Program Files\ICQ7.0
2010-03-30 20:51:01 ----D---- C:\Program Files\Java
2010-03-30 15:11:41 ----D---- C:\Mp3
2010-03-30 14:16:54 ----D---- C:\Users\OEM\AppData\Roaming\uTorrent
2010-03-30 14:03:58 ----SD---- C:\Windows\Downloaded Program Files
2010-03-29 22:25:01 ----D---- C:\Windows\system32\Tasks
2010-03-29 19:22:17 ----D---- C:\Windows\pss

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-04-14 23376]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-04-14 162768]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-04-14 46672]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-04-14 19024]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-04-14 51792]
R3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 464384]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-04-23 26176]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-05-07 2134424]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2010-01-12 11586280]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-02-14 118784]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 ENTECH;ENTECH; \??\C:\Windows\system32\DRIVERS\ENTECH.sys [2008-09-17 27672]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2008-10-21 16608]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2009-04-11 236544]
S3 Inspect;Comodo Firewall Network Driver; C:\Windows\system32\DRIVERS\inspect.sys []
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 Netaapl;Apple Mobile Device Ethernet Service; C:\Windows\system32\DRIVERS\netaapl.sys [2009-08-28 17408]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-08-28 40448]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]
S4 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2008-10-27 717296]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2008-01-21 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-04-14 40384]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2010-03-30 1107336]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-01-24 73728]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2010-01-11 129640]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2010-03-05 75064]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-04-14 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-04-14 40384]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-11-12 545568]
S2 gupdate1ca1058efc68952;Služba Google Update (gupdate1ca1058efc68952); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-07-29 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-29 190448]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2009-03-30 31048]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2009-07-16 316664]
S4 Apache2.2;Apache2.2; c:\xampp\apache\bin\apache.exe [2007-03-05 16896]
S4 MySQL;MySQL; C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld --defaults-file=C:\Program Files\MySQL\MySQL Server 5.1\my.ini MySQL []
S4 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2007-12-03 869672]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2007-12-13 447784]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
motji
VIP
VIP
Příspěvky: 23302
Registrován: 23 říj 2008 08:02

Re: Infiltrace typu Win32/Olmarik

#14 Příspěvek od motji »

Omezím vám spouštění zbytečných proggramů po startu, pokud nejste proti :o
:arrow: Otevřete si Poznámkový blok a zkopírujte do něj text

Kód: Vybrat vše

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=-
"iTunesHelper"=-
"Adobe Reader Speed Launcher"=-
"Adobe ARM"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=-
-uložte jako (typ: všechny soubory) kde za název souboru zadáte "smazani.reg" bez uvozovek,
klikněte na uložit, pak na soubor standardně 2X klikněte a potvrďte dialogové okno.


:arrow: Nemáte firewall,k čemu je užitečný se dozvíte zde http://www.viry.cz/forum/viewtopic.php?f=41&t=20980


Pokud nejsou s počítačem problémy, je to vše :)
Nepoužívejte COMBOFIX bez doporučení rádce, může dojít k poškození systému!
Vždy před odvirováním počítače zazálohujte důležitá data :!:
Chcete podpořit naše forum? Informace zde

Obrázek

K zastižení jsem spíše v noci, mezi 21.-23. hodinou
Pokud máte nějaké dotazy, můžete mi napsat na email Motji(zavináč)forum.viry.cz.
Nahoru
zion.g
Návštěvník
Návštěvník
Příspěvky: 8
Registrován: 22 dub 2010 07:31

Re: Infiltrace typu Win32/Olmarik

#15 Příspěvek od zion.g »

Ještě jednou děkuji za vše. :D
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“