Prosim o kontrolu logu - zavazne podezreni na brouka

Zpráva

perish · #1 Příspěvek od **perish** » 29 čer 2010 22:32

Dobry den,vecer,

prosim o kontrolu logu. Zrejme se v nem skryva neco, co by nemelo. Uz tri dny mi pocitac samovolne vypina zvuk. Dnes dokonce zacal samovolne vyskakovat IE a to uz bylo i na me moc. Tak jsem aktualizoval, stahnul Avast. Ten nic nenasel. Nasadil jsem spyterminator, ktery nasel 4 veci, nejzavaznejsi bylo asi smss.exe, ktere se mi jak doufam podarilo odstranit. Nicmene problem se stale vyskytuje a nic jineho mi to nenaslo. Kdyz budete mit nekdo chvilku, tak se na to podivejte, neb pro me je to srozumitelne asi jako indian mluvici mandarinsky. Dik

prikladam logy u UPM a RSIT

Logfile of random's system information tool 1.07 (written by random/random)
Run by Administrator at 2010-06-29 23:28:53
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 34 GB (56%) free of 60 GB
Total RAM: 2046 MB (68% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:28:57, on 29.6.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\vsnp2uvc.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\TO2SSM\McciTrayApp.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Crawler\Toolbar\CToolbar.exe
C:\Program Files\Miranda IM\miranda32.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
E:\Ondra\Filmy\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cz.o2.com/welcome/cz/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [snp2uvc] C:\WINDOWS\vsnp2uvc.exe
O4 - HKLM\..\Run: [tsnp2uvc] C:\WINDOWS\tsnp2uvc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [TO2SSM_McciTrayApp] C:\Program Files\TO2SSM\McciTrayApp.exe
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://lnpha1.cdtel.cz/iNotes6W.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 6751 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]
C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2010-06-25 1241552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-07 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-07 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - &Crawler lišta - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll [2010-06-25 1241552]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2003-04-07 155648]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2003-04-07 114688]
"snp2uvc"=C:\WINDOWS\vsnp2uvc.exe [2007-05-15 675840]
"tsnp2uvc"=C:\WINDOWS\tsnp2uvc.exe [2007-04-24 237568]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-07 148888]
"RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2003-10-31 32768]
"TO2SSM_McciTrayApp"=C:\Program Files\TO2SSM\McciTrayApp.exe [2008-08-15 1473536]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-06-28 2837864]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"PC Suite Tray"=C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2009-11-11 1451520]
"SpywareTerminatorUpdate"=C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2010-06-29 3037696]

C:\Documents and Settings\All Users.WINDOWS\Nabídka Start\Programy\Po spuštění
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE
VPN Client.lnk - C:\WINDOWS\Installer\{A7091E1D-36A4-47F1-A739-173CC341414F}\Icon3E5562ED7.ico

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2003-04-07 315392]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Miranda IM\miranda32.exe"="C:\Program Files\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\Swapper\swapper.exe"="C:\Program Files\Swapper\swapper.exe:*:Enabled:swapper"
"C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Soldat\Soldat.exe"="C:\Soldat\Soldat.exe:*:Enabled:http://soldat.pl"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe"="C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Enabled:Nokia Software Updater"
"C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe"="C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process "
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"="C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Enabled:Crawler Spyware Terminator"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4484d7a0-3850-11df-9039-000f1f8c0c9b}]
shell\AutoRun\command - H:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4484d7a1-3850-11df-9039-000f1f8c0c9b}]
shell\AutoRun\command - H:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46d483b8-3b52-11df-903f-000f1f8c0c9b}]
shell\AutoRun\command - I:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fad44db2-9f06-11de-8f59-000f1f8c0c9b}]
shell\AutoRun\command - H:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fad44db5-9f06-11de-8f59-000f1f8c0c9b}]
shell\AutoRun\command - H:\AutoRun.exe

======List of files/folders created in the last 1 months======

2010-06-29 23:18:44 ----D---- C:\Program Files\trend micro
2010-06-29 23:18:43 ----D---- C:\rsit
2010-06-29 22:45:25 ----D---- C:\Program Files\Ultimate Process Manager
2010-06-29 20:41:52 ----HDC---- C:\WINDOWS\$NtUninstallKB980218$
2010-06-29 20:37:36 ----HDC---- C:\WINDOWS\$NtUninstallKB980195$
2010-06-29 20:37:18 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2010-06-29 20:34:28 ----SHD---- C:\Config.Msi
2010-06-29 20:31:45 ----HDC---- C:\WINDOWS\$NtUninstallKB981793$
2010-06-29 20:31:39 ----HDC---- C:\WINDOWS\$NtUninstallKB979559$
2010-06-29 20:31:16 ----D---- C:\Program Files\Crawler
2010-06-29 20:30:56 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Spyware Terminator
2010-06-29 20:30:52 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Spyware Terminator
2010-06-29 20:30:50 ----D---- C:\Program Files\Spyware Terminator
2010-06-29 20:28:27 ----HDC---- C:\WINDOWS\$NtUninstallKB978695_WM9$
2010-06-29 20:28:19 ----HDC---- C:\WINDOWS\$NtUninstallKB979482$
2010-06-29 20:28:11 ----HDC---- C:\WINDOWS\$NtUninstallKB975562$
2010-06-29 20:21:04 ----HDC---- C:\WINDOWS\$NtUninstallKB982381$
2010-06-29 19:01:31 ----A---- C:\WINDOWS\system32\aswBoot.exe
2010-06-29 18:49:37 ----D---- C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Alwil Software

======List of files/folders modified in the last 1 months======

2010-06-29 23:18:44 ----RD---- C:\Program Files
2010-06-29 23:05:32 ----D---- C:\WINDOWS\Temp
2010-06-29 22:46:10 ----D---- C:\WINDOWS\system32\CatRoot2
2010-06-29 22:31:32 ----D---- C:\RP6
2010-06-29 22:31:28 ----D---- C:\WINDOWS\Prefetch
2010-06-29 21:38:42 ----RSD---- C:\WINDOWS\assembly
2010-06-29 21:38:42 ----D---- C:\WINDOWS\Microsoft.NET
2010-06-29 21:06:30 ----D---- C:\Program Files\Mozilla Firefox
2010-06-29 21:04:01 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Skype
2010-06-29 21:02:49 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-06-29 20:44:58 ----D---- C:\WINDOWS
2010-06-29 20:44:03 ----D---- C:\WINDOWS\system32
2010-06-29 20:41:57 ----HD---- C:\WINDOWS\inf
2010-06-29 20:41:55 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-06-29 20:41:48 ----SHD---- C:\WINDOWS\Installer
2010-06-29 20:41:32 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-06-29 20:41:07 ----D---- C:\WINDOWS\WinSxS
2010-06-29 20:39:18 ----D---- C:\WINDOWS\system32\CatRoot
2010-06-29 20:37:40 ----A---- C:\WINDOWS\imsins.BAK
2010-06-29 20:37:35 ----HD---- C:\WINDOWS\$hf_mig$
2010-06-29 20:31:13 ----D---- C:\WINDOWS\system32\drivers
2010-06-29 20:04:24 ----A---- C:\WINDOWS\NeroDigital.ini
2010-06-29 18:53:10 ----D---- C:\Documents and Settings\Administrator\Data aplikací\skypePM
2010-06-29 18:52:30 ----D---- C:\Program Files\Alwil Software
2010-06-29 18:37:40 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Dofus 2
2010-06-28 20:21:55 ----D---- C:\Documents and Settings
2010-06-10 23:42:58 ----SD---- C:\Documents and Settings\Administrator\Data aplikací\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-06-28 28880]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-06-28 165456]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-06-28 46672]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 OMCI;OMCI; C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2009-03-22 5632]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-06-28 17744]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-06-28 100176]
R2 CVPNDRVA;Cisco Systems Inc. IPSec Driver; \??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys []
R3 {6080A529-897E-4629-A488-ABA0C29B635E};Intel(R) Graphics Platform (SoftBIOS) Driver; C:\WINDOWS\system32\drivers\ialmsbw.sys [2003-04-15 113504]
R3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel(R) Graphics Chipset (KCH) Driver; C:\WINDOWS\system32\drivers\ialmkchw.sys [2003-04-15 78752]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-06-28 23376]
R3 DNE;Deterministic Network Enhancer Miniport; C:\WINDOWS\system32\DRIVERS\dne2000.sys [2008-03-29 125328]
R3 Dot4;Ovladač MS IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2008-04-14 206976]
R3 Dot4Print;Ovladač třídy tiskárny standardu IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
R3 E1000;Intel(R) PRO/1000 Adapter Driver; C:\WINDOWS\system32\DRIVERS\e1000325.sys [2003-03-08 121344]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2003-04-15 90907]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2003-02-28 545024]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S2 BT848;bt848 tweaked WDM Video Capture; C:\WINDOWS\system32\drivers\BT848.sys [2001-10-08 208191]
S2 BTTUNER;bt848 tweaked WDM TvTuner; C:\WINDOWS\system32\drivers\BTTUNER.sys [2001-10-08 9187]
S2 BTXBAR;bt848 tweaked TV WDM Crossbar; C:\WINDOWS\system32\drivers\BTXBAR.sys [2001-10-08 8193]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 CVirtA;Cisco Systems VPN Adapter; C:\WINDOWS\system32\DRIVERS\CVirtA.sys [2007-01-18 5275]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys [2008-09-26 101376]
S3 MREMP50;MREMP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS []
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS []
S3 MREMPR5;MREMPR5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS []
S3 MRENDIS5;MRENDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS []
S3 MRESP50;MRESP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS []
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 nm;Ovladač programu Sledování sítě; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-14 40320]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2010-02-26 18176]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2010-02-26 22528]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent; C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2010-02-26 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic; C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2010-02-26 8320]
S3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2007-11-06 34064]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\WINDOWS\system32\DRIVERS\snp2uvc.sys [2007-06-06 9604864]
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\WINDOWS\system32\DRIVERS\sscdbus.sys [2008-02-22 87936]
S3 sscdmdfl;SAMSUNG Mobile Modem Filter; C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys [2008-02-22 14976]
S3 sscdmdm;SAMSUNG Mobile Modem Drivers; C:\WINDOWS\system32\DRIVERS\sscdmdm.sys [2008-02-22 114304]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2010-02-26 8192]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-14 26112]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2010-02-26 8192]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 usbvideo;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2009-07-14 444136]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]
R2 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
R2 CVPND;Cisco Systems, Inc. VPN Service; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [2008-06-19 1528608]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440]
R2 McciCMService;McciCMService; C:\Program Files\Common Files\Motive\McciCMService.exe [2007-10-15 303104]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2001-02-23 270336]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2010-06-29 488960]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-04-27 611840]
S2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe -service -config C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf []
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-03-26 779824]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-03-26 267824]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2007-11-06 92792]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

====================================================================

UPM:
Windows XP SP 3 (build 2600)
Boot Mode: Normal
Ověření souborů Microsoftu: Ne
Whitelist: Ne
Internet Explorer v6.00.2900.5512 (xpsp.080413-2105)
Log vygenerován: 29.6.2010 22:46:02
================================================================

SmallARK
================================================================
[R]NtClose -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtCreateKey -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtDeleteKey -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtDeleteValueKey -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtDuplicateObject -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtOpenKey -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtOpenProcess -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtOpenThread -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtQueryValueKey -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtRenameKey -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtRestoreKey -> C:\WINDOWS\system32\drivers\aswSP.SYS
[R]NtSetValueKey -> C:\WINDOWS\system32\drivers\aswSP.SYS

MBR ROOTKIT DETECTED!

Běžící procesy
================================================================

C:\WINDOWS\SYSTEM32\SMSS.EXE
C:\WINDOWS\SYSTEM32\CSRSS.EXE
C:\WINDOWS\SYSTEM32\WINLOGON.EXE
C:\WINDOWS\SYSTEM32\SERVICES.EXE
C:\WINDOWS\SYSTEM32\LSASS.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST5\AVASTSVC.EXE
C:\WINDOWS\SYSTEM32\IGFXTRAY.EXE
C:\WINDOWS\SYSTEM32\HKCMD.EXE
C:\WINDOWS\VSNP2UVC.EXE
C:\PROGRAM FILES\JAVA\JRE6\BIN\JUSCHED.EXE
C:\PROGRAM FILES\CYBERLINK\POWERDVD\PDVDSERV.EXE
C:\PROGRAM FILES\TO2SSM\MCCITRAYAPP.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST5\AVASTUI.EXE
C:\WINDOWS\SYSTEM32\CTFMON.EXE
C:\PROGRAM FILES\NOKIA\NOKIA PC SUITE 7\PCSUITE.EXE
C:\PROGRAM FILES\SPYWARE TERMINATOR\SPYWARETERMINATORUPDATE.EXE
C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORSVW.EXE
C:\PROGRAM FILES\CISCO SYSTEMS\VPN CLIENT\CVPND.EXE
C:\PROGRAM FILES\JAVA\JRE6\BIN\JQS.EXE
C:\PROGRAM FILES\COMMON FILES\LIGHTSCRIBE\LSSRVC.EXE
C:\PROGRAM FILES\COMMON FILES\MOTIVE\MCCICMSERVICE.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE
C:\PROGRAM FILES\SPYWARE TERMINATOR\SP_RSSER.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\WDFMGR.EXE
C:\PROGRAM FILES\PC CONNECTIVITY SOLUTION\SERVICELAYER.EXE
C:\WINDOWS\SYSTEM32\ALG.EXE
C:\PROGRAM FILES\PC CONNECTIVITY SOLUTION\TRANSPORTS\NCLUSBSRV.EXE
C:\PROGRAM FILES\PC CONNECTIVITY SOLUTION\TRANSPORTS\NCLRSSRV.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\PROGRA~1\CRAWLER\TOOLBAR\CTOOLBAR.EXE
C:\PROGRAM FILES\MIRANDA IM\MIRANDA32.EXE
C:\PROGRA~1\CRAWLER\TOOLBAR\CTOOLBAR.EXE
C:\WINDOWS\SYSTEM32\TASKMGR.EXE
C:\PROGRAM FILES\DOFUS 2\APP\DOFUSMOD.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\ULTIMATE PROCESS MANAGER\UPM.EXE

Scanner
================================================================
[S] explorer.exe
Spouští se po startu HKLM Winlogon [Shell]

[?] igfxtray.exe
Non Microsoft v System32:
Spouští se po startu HKLM Run [IgfxTray]

[?] hkcmd.exe
Non Microsoft v System32:
Spouští se po startu HKLM Run [HotKeysCmds]

[?] vsnp2uvc.exe
Spouští se po startu HKLM Run [snp2uvc]

[R] jusched.exe
Spouští se po startu HKLM Run [SunJavaUpdateSched]

[?] PDVDServ.exe
Spouští se po startu HKLM Run [RemoteControl]
Soubor 7%

[?] McciTrayApp.exe
Spouští se po startu HKLM Run [TO2SSM_McciTrayApp]
Soubor 7%

[R] AvastUI.exe
Spouští se po startu HKLM Run [avast5]
Skrytá cesta EXE: C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe

[S] ctfmon.exe
Spouští se po startu HKCU Run [CTFMON.EXE]

[?] PCSuite.exe
Spouští se po startu HKCU Run [PC Suite Tray]
Soubor 7%

[?] SpywareTerminatorUpdate.exe
Spouští se po startu HKCU Run [SpywareTerminatorUpdate]
EntryPoint v sekci: .ITEXT
|_ Celkový počet sekcí: 9
Soubor 70%

[R] mscorsvw.exe
Ověřený Microsoft: Ne

[?] LSSrvc.exe
Nemá okno
Soubor 7%

[?] McciCMService.exe
Nemá okno
Soubor 7%

[?] mdm.exe
Ověřený Microsoft: Ne
Nemá okno
Soubor 12%

[?] sp_rsser.exe
EntryPoint v sekci: .ITEXT
|_ Celkový počet sekcí: 9
Nemá okno
Soubor 70%

[?] ServiceLayer.exe
Soubor 7%

[?] NclUSBSrv.exe
Soubor 7%

[?] NclRSSrv.exe
Soubor 7%

[R] CToolbar.exe
EntryPoint v sekci: .ITEXT
|_ Celkový počet sekcí: 9

[?] miranda32.exe
Bez výrobce
Soubor 12%

[R] CToolbar.exe
EntryPoint v sekci: .ITEXT
|_ Celkový počet sekcí: 9

[?] DofusMod.exe
Bez výrobce
Soubor 25%

[?] UPM.exe
Soubor 7%

Po spuštění
================================================================

Moduly (Zobraz i bezpečné DLL: False, Jen bez výrobce: True, Zobraz registrované: False)
================================================================
[?] implode.dll
|_ Cesta: C:\Program Files\Corel\Shared\versions\implode.dll
|_ MD5: 6889755A917AA3C736B61842FBD3DA73
|_ Výrobce:
|_ Procesy
|_ explorer.exe (256)

[?] msvcr71.dll
|_ Cesta: C:\Program Files\Nero\Nero 7\Nero BackItUp\msvcr71.dll
|_ MD5: 86F1895AE8C5E8B17D99ECE768A70732
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ explorer.exe (256)
|_ jqs.exe (3084)

[?] rarext.dll
|_ Cesta: C:\Program Files\WinRAR\RarExt.dll
|_ MD5: A070B8C38CEB3A30CC18D1B7C433144C
|_ Výrobce: ?
|_ Procesy
|_ explorer.exe (256)

[?] vers232.dll
|_ Cesta: C:\Program Files\Corel\Shared\versions\vers232.dll
|_ MD5: 8693A9DD4A864ACF03F486707285C8A5
|_ Výrobce:
|_ Procesy
|_ explorer.exe (256)

[!] sptcontmenu.dll
|_ Cesta: C:\Program Files\Spyware Terminator\sptcontmenu.dll
|_ MD5: A5E97B2B88CC48FC178E88BF6E02F5EC
|_ Výrobce: Crawler.com
|_ Procesy
|_ explorer.exe (256)

[?] phonebrowser.dll
|_ Cesta: C:\Program Files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
|_ MD5: F0CBAF724FF71D400FF45FBCEC4F3898
|_ Výrobce: Nokia
|_ Procesy
|_ explorer.exe (256)

[?] ngscm.dll
|_ Cesta: C:\Program Files\Nokia\Nokia PC Suite 7\NGSCM.dll
|_ MD5: 83AB0FCCF90A395AE71B7EA931C90529
|_ Výrobce: Nokia
|_ Procesy
|_ explorer.exe (256)

[?] cversion.dll
|_ Cesta: C:\Program Files\Corel\Shared\versions\cversion.dll
|_ MD5: 4D291442F6FCF6495A51AFA22C1D1E7D
|_ Výrobce: Corel Corporation Limited
|_ Procesy
|_ explorer.exe (256)

[?] mccicontexthook_6-1-0_dsr.dll
|_ Cesta: C:\Program Files\Common Files\Motive\McciContextHook_6-1-0_DSR.dll
|_ MD5: D8B25453BD74930000E5A7AF1AE139A4
|_ Výrobce: Motive Communications, Inc.
|_ Procesy
|_ explorer.exe (256)
|_ igfxtray.exe (448)
|_ hkcmd.exe (456)
|_ McciTrayApp.exe (504)
|_ AvastUI.exe (528)
|_ ctfmon.exe (540)
|_ PCSuite.exe (596)
|_ SpywareTerminatorUpdate.exe (644)
|_ firefox.exe (1276)
|_ CToolbar.exe (3704)
|_ miranda32.exe (884)
|_ taskmgr.exe (3548)
|_ DofusMod.exe (3624)
|_ UPM.exe (2648)

[?] mfc71u.dll
|_ Cesta: C:\Program Files\Nero\Nero 7\Nero BackItUp\mfc71u.dll
|_ MD5: 7B93C623333F121DC9E689CCB1B7A733
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ explorer.exe (256)

[?] msvcp71.dll
|_ Cesta: C:\Program Files\Nero\Nero 7\Nero BackItUp\msvcp71.dll
|_ MD5: 561FA2ABB31DFA8FAB762145F81667C2
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ explorer.exe (256)

[?] arpot.dll
|_ Cesta: C:\Program Files\Alwil Software\Avast5\defs\10062900\ArPot.dll
|_ MD5: 14F84A5D3ED36D6C7269A496319BD5AF
|_ Výrobce: ALWIL Software
|_ Procesy
|_ AvastSvc.exe (288)

[?] clrcengine2.dll
|_ Cesta: C:\Program Files\CyberLink\Shared Files\CLRCEngine2.dll
|_ MD5: DAE211D3393343B2FAD71C65B20EC562
|_ Výrobce: CyberLink Corp.
|_ Procesy
|_ PDVDServ.exe (496)

[?] mccicontextdetectoremail_6-1-0_dsr.dll
|_ Cesta: C:\Program Files\Common Files\Motive\McciContextDetectorEmail_6-1-0_DSR.dll
|_ MD5: 408F0FEE14F7A93A9A5741D8BA5C83C1
|_ Výrobce: Motive Communications, Inc.
|_ Procesy
|_ McciTrayApp.exe (504)

[?] mccicontextx.dll
|_ Cesta: C:\Program Files\Common Files\Motive\McciContextX.dll
|_ MD5: 7F600419A94A1F175FABE0F15275583B
|_ Výrobce: Motive Communications, Inc.
|_ Procesy
|_ McciTrayApp.exe (504)

[?] mccicontextdetectorwin32_6-1-0_dsr.dll
|_ Cesta: C:\Program Files\Common Files\Motive\McciContextDetectorWin32_6-1-0_DSR.dll
|_ MD5: 6113EE7CB182422F21849B170CFBEB5B
|_ Výrobce: Motive Communications, Inc.
|_ Procesy
|_ McciTrayApp.exe (504)

[?] connapi.dll
|_ Cesta: C:\Program Files\PC Connectivity Solution\ConnAPI.dll
|_ MD5: 9BB2ED345B38157E8B2DB84E3EEB40E1
|_ Výrobce: Nokia.
|_ Procesy
|_ PCSuite.exe (596)

[?] daapi.dll
|_ Cesta: C:\Program Files\PC Connectivity Solution\DAAPI.dll
|_ MD5: F79194B03CBF2B52D5BD645BC76A5A62
|_ Výrobce: Nokia
|_ Procesy
|_ PCSuite.exe (596)

[?] pccs_abapi.dll
|_ Cesta: C:\Program Files\PC Connectivity Solution\PCCS_ABAPI.dll
|_ MD5: E7E98B1F8C0107E4B5BC0A83F39D64D5
|_ Výrobce: Nokia
|_ Procesy
|_ PCSuite.exe (596)

[?] confserver.dll
|_ Cesta: C:\Program Files\PC Connectivity Solution\ConfServer.dll
|_ MD5: CF7D4E7093E3EBDA24BEB8369F8823DB
|_ Výrobce: Nokia
|_ Procesy
|_ PCSuite.exe (596)

[?] qjpeg4.dll
|_ Cesta: C:\Program Files\Nokia\Nokia PC Suite 7\imageformats\qjpeg4.dll
|_ MD5: B6FAD59C92D1381D986CD7368A5291F4
|_ Výrobce:
|_ Procesy
|_ PCSuite.exe (596)

[?] qsvg4.dll
|_ Cesta: C:\Program Files\Nokia\Nokia PC Suite 7\imageformats\qsvg4.dll
|_ MD5: CB3B04A1D5E1F32D5E38974B5E077EA6
|_ Výrobce:
|_ Procesy
|_ PCSuite.exe (596)

[?] nglstyle.dll
|_ Cesta: C:\Program Files\Nokia\Nokia PC Suite 7\Styles\NGLStyle.dll
|_ MD5: 0435B351C4BBD710EFB2925966DB160F
|_ Výrobce: Nokia
|_ Procesy
|_ PCSuite.exe (596)

[?] cdc.dll
|_ Cesta: C:\Program Files\Nokia\Nokia PC Suite 7\CDC.dll
|_ MD5: D39835D21F82CEC4BCC0DC92A99C4B7E
|_ Výrobce: Nokia
|_ Procesy
|_ PCSuite.exe (596)

[?] qtxml4.dll
|_ Cesta: C:\Program Files\Nokia\Nokia PC Suite 7\QtXml4.dll
|_ MD5: B7AC803CF0DF5FF872DD45D48BBBDA6A
|_ Výrobce:
|_ Procesy
|_ PCSuite.exe (596)

[?] qtgui4.dll
|_ Cesta: C:\Program Files\Nokia\Nokia PC Suite 7\QtGUI4.dll
|_ MD5: 1CA1F99D167BB19F785F2D8582579CFB
|_ Výrobce:
|_ Procesy
|_ PCSuite.exe (596)

[?] qtsvg4.dll
|_ Cesta: C:\Program Files\Nokia\Nokia PC Suite 7\QtSvg4.dll
|_ MD5: 958BE76750B8B10750FB3DE7419588C1
|_ Výrobce:
|_ Procesy
|_ PCSuite.exe (596)

[?] qtcore4.dll
|_ Cesta: C:\Program Files\Nokia\Nokia PC Suite 7\QtCore4.dll
|_ MD5: 285A5075F1973E9BEB8A12EE3641EEA4
|_ Výrobce:
|_ Procesy
|_ PCSuite.exe (596)

[?] torentdll.dll
|_ Cesta: C:\Program Files\Spyware Terminator\TorentDll.dll
|_ MD5: 0B0387E70BE085C1842BC7DEB47EE54F
|_ Výrobce:
|_ Procesy
|_ SpywareTerminatorUpdate.exe (644)

[?] lssproxy.dll
|_ Cesta: C:\Program Files\Common Files\LightScribe\LSSProxy.dll
|_ MD5: D7EB32B51B7472FBEE86BFA47B3C4BC5
|_ Výrobce: Hewlett-Packard Company
|_ Procesy
|_ LSSrvc.exe (3104)

[?] lslog.dll
|_ Cesta: C:\Program Files\Common Files\LightScribe\LSLog.dll
|_ MD5: 0EE266A90D43E82A07CF33755D6DE1CC
|_ Výrobce: Hewlett-Packard Company
|_ Procesy
|_ LSSrvc.exe (3104)

[?] msdbg2.dll
|_ Cesta: C:\Program Files\Common Files\Microsoft Shared\VS7Debug\msdbg2.dll
|_ MD5: 882EAB3108383692506D32F637485C77
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ mdm.exe (3152)
|_ CToolbar.exe (3704)

[?] pccs_dbengine.dll
|_ Cesta: C:\Program Files\PC Connectivity Solution\PCCS_DBEngine.dll
|_ MD5: 27DD9CEA7B4C8EFAD06B55AED94AAAD7
|_ Výrobce: Nokia
|_ Procesy
|_ ServiceLayer.exe (3644)

[!] xcomm.dll
|_ Cesta: C:\Program Files\Crawler\Toolbar\firefox\components\xcomm.dll
|_ MD5: 25431E2DC58A422CE27C9F29D904E003
|_ Výrobce: Crawler.com
|_ Procesy
|_ firefox.exe (1276)

[?] xsupport.dll
|_ Cesta: C:\Program Files\Crawler\Toolbar\firefox\components\xsupport.dll
|_ MD5: 4C20A7877F340BE462807935C8013251
|_ Výrobce: Crawler.com
|_ Procesy
|_ firefox.exe (1276)

[!] xshared.dll
|_ Cesta: C:\Program Files\Crawler\Toolbar\firefox\components\xshared.dll
|_ MD5: B0170A9F1F0D9A668D815B3ECE135CB6
|_ Výrobce: Crawler.com
|_ Procesy
|_ firefox.exe (1276)

[!] xwsg.dll
|_ Cesta: C:\Program Files\Crawler\Toolbar\firefox\components\xwsg.dll
|_ MD5: DD248D5444448BC5182441922F3910C9
|_ Výrobce: Crawler.com
|_ Procesy
|_ firefox.exe (1276)

[?] softokn3.dll
|_ Cesta: C:\Program Files\Mozilla Firefox\softokn3.dll
|_ MD5: 35CF3FB481638306CA1A6A1A2F816D84
|_ Výrobce: Mozilla Foundation
|_ Procesy
|_ firefox.exe (1276)

[?] nssdbm3.dll
|_ Cesta: C:\Program Files\Mozilla Firefox\nssdbm3.dll
|_ MD5: F349B437ABE573013A673F0A82B1B08C
|_ Výrobce: Mozilla Foundation
|_ Procesy
|_ firefox.exe (1276)

[?] freebl3.dll
|_ Cesta: C:\Program Files\Mozilla Firefox\freebl3.dll
|_ MD5: 7ECFB8FFF406A664E35F36BDF915DFB9
|_ Výrobce: Mozilla Foundation
|_ Procesy
|_ firefox.exe (1276)

[!] ctbcomm.dll
|_ Cesta: C:\PROGRA~1\Crawler\Toolbar\ctbcomm.dll
|_ MD5: 562939F188B53D068834D0F6ACFC93F6
|_ Výrobce: Crawler.com
|_ Procesy
|_ CToolbar.exe (3704)
|_ CToolbar.exe (2404)

[!] websec~1.dll
|_ Cesta: C:\PROGRA~1\Crawler\Toolbar\WEBSEC~1.DLL
|_ MD5: 16042425E6BDF6AA012AFF5B851A16BC
|_ Výrobce: Crawler.com
|_ Procesy
|_ CToolbar.exe (3704)
|_ CToolbar.exe (2404)

[?] pdm.dll
|_ Cesta: C:\Program Files\Common Files\Microsoft Shared\VS7Debug\pdm.dll
|_ MD5: 349475945AA64B2992B2C35E5DDE5CAB
|_ Výrobce: Microsoft Corporation
|_ Procesy
|_ CToolbar.exe (3704)

[?] advaimg.dll
|_ Cesta: C:\Program Files\Miranda IM\Plugins\advaimg.dll
|_ MD5: AB2D0752C3A9268B117B27A97538660E
|_ Výrobce: Miranda IM and FreeImage
|_ Procesy
|_ miranda32.exe (884)

[?] aim.dll
|_ Cesta: C:\Program Files\Miranda IM\Plugins\Aim.dll
|_ MD5: EB561F92EC71A1AE811411DEDCE95DE1
|_ Výrobce:
|_ Procesy
|_ miranda32.exe (884)

[?] avs.dll
|_ Cesta: C:\Program Files\Miranda IM\Plugins\avs.dll
|_ MD5: 039838DA4A4D5E9EB94B4E312945F505
|_ Výrobce:
|_ Procesy
|_ miranda32.exe (884)

[?] chat.dll
|_ Cesta: C:\Program Files\Miranda IM\Plugins\chat.dll
|_ MD5: AB9ACA1DE13ED08561183F94479AD7D8
|_ Výrobce:
|_ Procesy
|_ miranda32.exe (884)

[?] icq.dll
|_ Cesta: C:\Program Files\Miranda IM\Plugins\ICQ.dll
|_ MD5: 6F45E63364B1D0783121EA22A29314B1
|_ Výrobce: ?
|_ Procesy
|_ miranda32.exe (884)

[?] jabber.dll
|_ Cesta: C:\Program Files\Miranda IM\Plugins\jabber.dll
|_ MD5: 90DCF1A753A024306CDF8EB21576F757
|_ Výrobce: Miranda
|_ Procesy
|_ miranda32.exe (884)

[?] srmm.dll
|_ Cesta: C:\Program Files\Miranda IM\Plugins\srmm.dll
|_ MD5: FEFE4200173A7EB6407C20B1A23785A7
|_ Výrobce:
|_ Procesy
|_ miranda32.exe (884)

[?] yahoo.dll
|_ Cesta: C:\Program Files\Miranda IM\Plugins\Yahoo.dll
|_ MD5: A5B9948D511F18D2A9D58F062A424FA1
|_ Výrobce: Gennady Feldman
|_ Procesy
|_ miranda32.exe (884)

[?] dbx_mmap.dll
|_ Cesta: C:\Program Files\Miranda IM\Plugins\dbx_mmap.dll
|_ MD5: 76DA4B6BAC25968E7D0EE599FAE269D4
|_ Výrobce: ?
|_ Procesy
|_ miranda32.exe (884)

[?] clist_classic.dll
|_ Cesta: C:\Program Files\Miranda IM\Plugins\clist_classic.dll
|_ MD5: 09CF9316D642B03FC7CF92D094D1F01D
|_ Výrobce:
|_ Procesy
|_ miranda32.exe (884)

[?] zlib.dll
|_ Cesta: C:\Program Files\Miranda IM\zlib.dll
|_ MD5: 0D353FF49982ACEC60924FEA5779C8A6
|_ Výrobce: ?
|_ Procesy
|_ miranda32.exe (884)

[?] msn.dll
|_ Cesta: C:\Program Files\Miranda IM\Plugins\msn.dll
|_ MD5: E3ECDE1731344CEA70052724E7F23500
|_ Výrobce: Boris Krasnovskiy, George Hazan, Richard Hughes
|_ Procesy
|_ miranda32.exe (884)

[?] import.dll
|_ Cesta: C:\Program Files\Miranda IM\Plugins\import.dll
|_ MD5: C2CF0EF83F17151DD2E89D9FF875A82F
|_ Výrobce:
|_ Procesy
|_ miranda32.exe (884)

[?] gg.dll
|_ Cesta: C:\Program Files\Miranda IM\Plugins\GG.dll
|_ MD5: 73399E24884D5144072C309B6A4ECA93
|_ Výrobce:
|_ Procesy
|_ miranda32.exe (884)

[?] irc.dll
|_ Cesta: C:\Program Files\Miranda IM\Plugins\IRC.dll
|_ MD5: 0C0E0A54DEAF97E706A44EBD5BAF1822
|_ Výrobce: ?
|_ Procesy
|_ miranda32.exe (884)

[?] adobe air.dll
|_ Cesta: C:\Program Files\Dofus 2\app\.runtime\1.5\Adobe AIR.dll
|_ MD5: CB68681427F01419941264F1A01B1608
|_ Výrobce:
|_ Procesy
|_ DofusMod.exe (3624)

[X] lde.dll
|_ Cesta: C:\Program Files\Ultimate Process Manager\LDE.dll
|_ MD5: 0F13A4173A599AAA15E3B270E5E27A7F
|_ Výrobce:
|_ Procesy
|_ UPM.exe (2648)

[?] upm.dll
|_ Cesta: C:\Program Files\Ultimate Process Manager\upm.dll
|_ MD5: 9D9AA74910EE283E95214ABEADC779BD
|_ Výrobce: Lodus Software
|_ Procesy
|_ UPM.exe (2648)

[!] prjxtab.ocx
|_ Cesta: C:\Program Files\Ultimate Process Manager\prjXTab.ocx
|_ MD5: DE745F09FC7C607841519AD559C33AC3
|_ Výrobce: xyz
|_ Procesy
|_ UPM.exe (2648)

================================================================
Ultimate Process Manager v4.1.3 - [ Lodus Software ]

---------------------------------------------------------------------------------------------------------------

1danab · #2 Příspěvek od **1danab** » 30 čer 2010 05:59

zdravím

prosím o chvilku strpení

1danab · #3 Příspěvek od **1danab** » 30 čer 2010 06:14

stáhněte a uložte nejlépe na plochu ComboFix

spusťte aplikaci pod účtem s administrátorským oprávněním
po startu se zobrazí obrazovka s licenčními podmínkami, klikněte na tlačítko Ano:

Obrázek

může dojít k varování ohledně rezidentního štítu Vašeho antiviru a upozornění na nenainstalovanou konzoli pro zotavení; zatím jí neinstalujte

sken trvá cca 10 minut (může trvat i déle, podle množství souborů a rychlosti pc); během skenu nespouštějte žádné aplikace

během skenování může být Vaše pc restartováno, proto nepropadejte panice

upozornění: pokud používate antispyware s rezidentním štítem, deaktivujte jeho rezidentní štít, protože dochází při skenu a výmazu případného malware k nežádoucím kolizím Combofixu s rezidentem antispyware

po restartování vytvoří aplikace log, uložený na C:/Combofix.txt jeho obsah vložte sem

perish · #4 Příspěvek od **perish** » 30 čer 2010 17:18

ComboFix 10-06-29.03 - Administrator 30.06.2010 17:50:03.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1640 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\install.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-05-28 do 2010-06-30 )))))))))))))))))))))))))))))))
.

2010-06-30 06:06 . 2010-06-30 06:06 -------- d-----r- c:\documents and settings\NetworkService\Oblíbené položky
2010-06-29 21:18 . 2010-06-29 21:28 -------- d-----w- c:\program files\trend micro
2010-06-29 21:18 . 2010-06-29 21:18 -------- d-----w- C:\rsit
2010-06-29 20:45 . 2010-06-29 20:46 -------- d-----w- c:\program files\Ultimate Process Manager
2010-06-29 18:31 . 2010-06-29 18:31 -------- d-----w- c:\program files\Crawler
2010-06-29 18:31 . 2010-06-29 18:31 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-06-29 18:30 . 2010-06-29 19:01 -------- d-----w- c:\program files\Spyware Terminator
2010-06-29 17:01 . 2010-06-28 20:37 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-06-29 17:01 . 2010-06-28 20:33 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-06-29 17:01 . 2010-06-28 20:32 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-06-29 17:01 . 2010-06-28 20:37 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-06-29 17:01 . 2010-06-28 20:32 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-06-29 17:01 . 2010-06-28 20:32 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-06-29 17:01 . 2010-06-28 20:32 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-06-29 17:01 . 2010-06-28 20:57 38848 ----a-w- c:\windows\avastSS.scr
2010-06-29 17:01 . 2010-06-28 20:57 165032 ----a-w- c:\windows\system32\aswBoot.exe
2010-06-28 21:14 . 2010-06-28 21:14 -------- d-----r- c:\documents and settings\LocalService\Oblíbené položky

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-29 18:41 . 2001-10-25 12:00 78430 ----a-w- c:\windows\system32\perfc005.dat
2010-06-29 18:41 . 2001-10-25 12:00 429968 ----a-w- c:\windows\system32\perfh005.dat
2010-06-29 16:52 . 2009-01-12 10:32 -------- d-----w- c:\program files\Alwil Software
2010-05-23 16:12 . 2010-05-23 16:12 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
2010-05-23 16:12 . 2010-05-23 16:12 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2010-05-23 16:05 . 2010-05-23 16:05 -------- d-----w- c:\program files\PC Connectivity Solution
2010-05-23 16:04 . 2010-01-12 19:38 -------- d-----w- c:\program files\Nokia
2010-05-23 16:00 . 2010-01-12 19:39 -------- d-----w- c:\program files\Common Files\Nokia
2010-05-02 08:09 . 2008-04-14 05:45 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-04-20 05:32 . 2008-04-14 06:37 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-16 16:08 . 2008-04-14 06:52 668160 ----a-w- c:\windows\system32\wininet.dll
2010-04-16 16:08 . 2008-04-14 06:51 81920 ----a-w- c:\windows\system32\ieencode.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-06-29 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-04-06 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2003-04-06 114688]
"snp2uvc"="c:\windows\vsnp2uvc.exe" [2007-05-15 675840]
"tsnp2uvc"="c:\windows\tsnp2uvc.exe" [2007-04-24 237568]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-07 148888]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"TO2SSM_McciTrayApp"="c:\program files\TO2SSM\McciTrayApp.exe" [2008-08-15 1473536]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users.WINDOWS\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
VPN Client.lnk - c:\windows\Installer\{A7091E1D-36A4-47F1-A739-173CC341414F}\Icon3E5562ED7.ico [2009-1-12 6144]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\Swapper\\swapper.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Soldat\\Soldat.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [29.6.2010 19:01 165456]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [29.6.2010 20:31 142592]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [29.6.2010 19:01 17744]
S2 BT848;bt848 tweaked WDM Video Capture;c:\windows\system32\drivers\BT848.sys [12.1.2009 13:38 208191]
S2 BTTUNER;bt848 tweaked WDM TvTuner;c:\windows\system32\drivers\bttuner.sys [12.1.2009 13:38 9187]
S2 BTXBAR;bt848 tweaked TV WDM Crossbar;c:\windows\system32\drivers\btxbar.sys [12.1.2009 13:38 8193]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [23.5.2010 18:04 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [23.5.2010 18:04 8320]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6.11.2007 22:22 34064]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.cz.o2.com/welcome/cz/index.html
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\1t3yvskr.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xcomm.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xshared.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xsupport.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xwsg.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-30 17:56
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
Celkový čas: 2010-06-30 17:58:10
ComboFix-quarantined-files.txt 2010-06-30 15:57

Před spuštěním: Volných bajtů: 35 297 849 344
Po spuštění: Volných bajtů: 36 552 855 552

- - End Of File - - D38B108E5AFE00187A02E4422A8D05E4

1danab · #5 Příspěvek od **1danab** » 01 črc 2010 07:23

disky I a H znáte a používáte?

perish · #6 Příspěvek od **perish** » 01 črc 2010 21:21

Kdepak, o techto discich jsme nikdy na mem pocitaci neslysel

Mam pouze disky C,D,E a F,G

1danab · #7 Příspěvek od **1danab** » 03 črc 2010 20:41

pokud jste tak ještě neučinil, přesuňte Combofix na plochu

otevřete si Poznámkový blok

do něj zkopírujte skript z následujícího okna:

Kód: Vybrat vše

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4484d7a0-3850-11df-9039-000f1f8c0c9b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4484d7a1-3850-11df-9039-000f1f8c0c9b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46d483b8-3b52-11df-903f-000f1f8c0c9b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fad44db2-9f06-11de-8f59-000f1f8c0c9b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fad44db5-9f06-11de-8f59-000f1f8c0c9b}]

uložte vámi vytvořený textový soubor jako CFScript.txt na plochu

po uložení uchopte vámi vytvořený skript levým tlačítkem myši a přesuňte jej nad ikonu Combofixu, nad níž skript upusťte:

Obrázek

po aplikaci a případném restartu pc by se měl zobrazit další log, vložte jeho obsah sem

Upozornění: je možné, že po aplikaci skriptu a restartu nenaběhnou Windows, v takovém případě znovu restartujte, po restartu mačkejte F8 a zvolte Poslední známou funkční konfiguraci

perish · #8 Příspěvek od **perish** » 05 črc 2010 14:14

ComboFix 10-06-29.03 - Administrator 05.07.2010 15:04:43.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1609 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Vytvořen nový Bod Obnovení
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-06-05 do 2010-07-05 )))))))))))))))))))))))))))))))
.

2010-06-30 19:46 . 2010-06-30 20:18 -------- d-----w- c:\program files\CCleaner
2010-06-30 06:06 . 2010-06-30 06:06 -------- d-----r- c:\documents and settings\NetworkService\Oblíbené položky
2010-06-29 21:18 . 2010-06-29 21:28 -------- d-----w- c:\program files\trend micro
2010-06-29 21:18 . 2010-06-29 21:18 -------- d-----w- C:\rsit
2010-06-29 20:45 . 2010-06-29 20:46 -------- d-----w- c:\program files\Ultimate Process Manager
2010-06-29 18:31 . 2010-06-29 18:31 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-06-29 18:30 . 2010-06-29 19:01 -------- d-----w- c:\program files\Spyware Terminator
2010-06-29 17:01 . 2010-06-28 20:37 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-06-29 17:01 . 2010-06-28 20:33 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-06-29 17:01 . 2010-06-28 20:32 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-06-29 17:01 . 2010-06-28 20:37 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-06-29 17:01 . 2010-06-28 20:32 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-06-29 17:01 . 2010-06-28 20:32 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-06-29 17:01 . 2010-06-28 20:32 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-06-29 17:01 . 2010-06-28 20:57 38848 ----a-w- c:\windows\avastSS.scr
2010-06-29 17:01 . 2010-06-28 20:57 165032 ----a-w- c:\windows\system32\aswBoot.exe
2010-06-28 21:14 . 2010-06-28 21:14 -------- d-----r- c:\documents and settings\LocalService\Oblíbené položky

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-29 18:41 . 2001-10-25 12:00 78430 ----a-w- c:\windows\system32\perfc005.dat
2010-06-29 18:41 . 2001-10-25 12:00 429968 ----a-w- c:\windows\system32\perfh005.dat
2010-06-29 16:52 . 2009-01-12 10:32 -------- d-----w- c:\program files\Alwil Software
2010-05-23 16:12 . 2010-05-23 16:12 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
2010-05-23 16:12 . 2010-05-23 16:12 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2010-05-23 16:05 . 2010-05-23 16:05 -------- d-----w- c:\program files\PC Connectivity Solution
2010-05-23 16:04 . 2010-01-12 19:38 -------- d-----w- c:\program files\Nokia
2010-05-23 16:00 . 2010-01-12 19:39 -------- d-----w- c:\program files\Common Files\Nokia
2010-05-02 08:09 . 2008-04-14 05:45 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-04-20 05:32 . 2008-04-14 06:37 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-16 16:08 . 2008-04-14 06:52 668160 ----a-w- c:\windows\system32\wininet.dll
2010-04-16 16:08 . 2008-04-14 06:51 81920 ----a-w- c:\windows\system32\ieencode.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-06-30_15.56.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-06-28 21:14 . 2010-07-05 13:01 65536 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-07-01 20:11 . 2010-07-01 20:11 16384 c:\windows\system32\config\systemprofile\Local Settings\Data aplikací\Microsoft\Internet Explorer\MSIMGSIZ.DAT
+ 2010-06-28 21:14 . 2010-07-05 13:01 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-06-30 16:44 . 2010-06-30 16:44 37888 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\f46915dfc57bc7e49c5402e9b8f7ec18\System.Windows.Presentation.ni.dll
+ 2010-06-30 16:44 . 2010-06-30 16:44 36864 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\1464c662c302ea6372a885161b983732\System.Web.DynamicData.Design.ni.dll
+ 2010-06-30 16:41 . 2010-06-30 16:41 94208 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\5d535ecadf77ac2d9278a1661beb2855\System.ComponentModel.DataAnnotations.ni.dll
+ 2010-06-30 16:41 . 2010-06-30 16:41 82944 c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\f9a75bbdc2ce7db578b5977766a09b99\System.AddIn.Contract.ni.dll
+ 2010-06-30 16:43 . 2010-06-30 16:43 55296 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\4a52287444c36c89310856b38ff52fe0\Microsoft.Vsa.ni.dll
+ 2009-01-12 10:42 . 2010-06-30 19:58 208104 c:\windows\system32\FNTCACHE.DAT
+ 2010-06-30 16:45 . 2010-06-30 16:45 400896 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\747e84d81d1de2041661f0f71b04734a\System.Xml.Linq.ni.dll
+ 2010-06-30 16:44 . 2010-06-30 16:44 129536 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\d51dfbd8d5431eb89181baaa24863e15\System.Web.Routing.ni.dll
+ 2010-06-30 16:44 . 2010-06-30 16:44 859648 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\e8ef769b3e899e62b26daadee50b97ed\System.Web.Extensions.Design.ni.dll
+ 2010-06-30 16:44 . 2010-06-30 16:44 328704 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\ce3b446b7bee5c47949c994ec89b1649\System.Web.Entity.ni.dll
+ 2010-06-30 16:44 . 2010-06-30 16:44 301056 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\ad04fe1182e55e7c01066b62a4bee6b5\System.Web.Entity.Design.ni.dll
+ 2010-06-30 16:44 . 2010-06-30 16:44 547328 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\20ba0d4d182a1a9c1f54c00d3bc29a68\System.Web.DynamicData.ni.dll
+ 2010-06-30 16:44 . 2010-06-30 16:44 141312 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\c97ecf9250c2f0794262534f27f98b72\System.Web.Abstractions.ni.dll
+ 2010-06-30 16:44 . 2010-06-30 16:44 621056 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Net\f90965b9d9a6a6604c9a66f57c37c026\System.Net.ni.dll
+ 2010-06-30 16:45 . 2010-06-30 16:45 593408 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\07da2b0e44d62f3c65d6516f4e2f94bb\System.Messaging.ni.dll
+ 2010-06-30 16:43 . 2010-06-30 16:43 998400 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\16670b6870746e5a8dc4a73a76a90bed\System.Management.ni.dll
+ 2010-06-30 16:43 . 2010-06-30 16:43 330752 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\e6bd59fec415e273c173170c6508180a\System.Management.Instrumentation.ni.dll
+ 2010-06-30 16:43 . 2010-06-30 16:43 881152 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\277619716d9136216065bea970365c65\System.DirectoryServices.AccountManagement.ni.dll
+ 2010-06-30 16:43 . 2010-06-30 16:43 939008 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\90b67e13866b176ae6cbdb23144f724d\System.Data.Services.Client.ni.dll
+ 2010-06-30 16:43 . 2010-06-30 16:43 354816 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\131a477d41a8669b15696128b94c2636\System.Data.Services.Design.ni.dll
+ 2010-06-30 16:43 . 2010-06-30 16:43 756736 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\d4990681ce373d81a52b231ee4c4afea\System.Data.Entity.Design.ni.dll
+ 2010-06-30 16:41 . 2010-06-30 16:41 135680 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\9e9d66a3a0e16fceead505c25af569eb\System.Data.DataSetExtensions.ni.dll
+ 2010-06-30 16:41 . 2010-06-30 16:41 633856 c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\849916c5cb3ff7763d15a3976766c2f6\System.AddIn.ni.dll
+ 2010-06-30 15:57 . 2010-06-30 15:57 175104 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\2fa81d363cb1496be2427d848a867409\Microsoft.Build.Utilities.v3.5.ni.dll
+ 2010-06-28 21:14 . 2010-07-05 13:01 3342336 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2010-06-30 16:45 . 2010-06-30 16:45 1356288 c:\windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\016b75f60a18535c8d6b3e5d861ab559\System.WorkflowServices.ni.dll
+ 2010-06-30 16:45 . 2010-06-30 16:45 1908224 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\6dacae37d337004345518976fb57099e\System.Workflow.Runtime.ni.dll
+ 2010-06-30 16:45 . 2010-06-30 16:45 4514304 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\c7b832bbc5bb11c6c7f128c801ce90d7\System.Workflow.ComponentModel.ni.dll
+ 2010-06-30 16:44 . 2010-06-30 16:44 2992640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\b9ea6ea910293cd6f13f765775867ebd\System.Workflow.Activities.ni.dll
+ 2010-06-30 16:44 . 2010-06-30 16:44 2209280 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\5dfda43f1991ee6ba345d62b2be4801c\System.Web.Mobile.ni.dll
+ 2010-06-30 16:44 . 2010-06-30 16:44 2403328 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\f08b3b8cdf548e3dfe61f342536175eb\System.Web.Extensions.ni.dll
+ 2010-06-30 16:44 . 2010-06-30 16:44 1706496 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\169fe0ad9d59982a2a6b89779c09885b\System.ServiceModel.Web.ni.dll
+ 2010-06-30 16:43 . 2010-06-30 16:43 1328128 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\5e6311aff5ada83d0f854922fa62faf6\System.Data.Services.ni.dll
+ 2010-06-30 16:43 . 2010-06-30 16:43 9924096 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\6abf820d8ec57a0561c3367727d274df\System.Data.Entity.ni.dll
+ 2010-06-30 16:41 . 2010-06-30 16:41 1712128 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\935b855860088a86bb65d37a19f059cc\Microsoft.VisualBasic.ni.dll
+ 2010-06-30 16:43 . 2010-06-30 16:43 2332160 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\9db8f9f7fe63ca4451bb5316a3ebb009\Microsoft.JScript.ni.dll
+ 2010-06-30 15:57 . 2010-06-30 15:57 1966080 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\c96be82d6cb00367db4e3553272165ef\Microsoft.Build.Tasks.v3.5.ni.dll
+ 2010-06-30 15:57 . 2010-06-30 15:57 1620992 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\3815de5b052187b5d9375681a6784255\Microsoft.Build.Tasks.ni.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-06-29 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-04-06 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2003-04-06 114688]
"snp2uvc"="c:\windows\vsnp2uvc.exe" [2007-05-15 675840]
"tsnp2uvc"="c:\windows\tsnp2uvc.exe" [2007-04-24 237568]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-07 148888]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"TO2SSM_McciTrayApp"="c:\program files\TO2SSM\McciTrayApp.exe" [2008-08-15 1473536]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users.WINDOWS\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
VPN Client.lnk - c:\windows\Installer\{A7091E1D-36A4-47F1-A739-173CC341414F}\Icon3E5562ED7.ico [2009-1-12 6144]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\Swapper\\swapper.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [29.6.2010 19:01 165456]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [29.6.2010 20:31 142592]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [29.6.2010 19:01 17744]
S2 BT848;bt848 tweaked WDM Video Capture;c:\windows\system32\drivers\BT848.sys [12.1.2009 13:38 208191]
S2 BTTUNER;bt848 tweaked WDM TvTuner;c:\windows\system32\drivers\bttuner.sys [12.1.2009 13:38 9187]
S2 BTXBAR;bt848 tweaked TV WDM Crossbar;c:\windows\system32\drivers\btxbar.sys [12.1.2009 13:38 8193]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [23.5.2010 18:04 137344]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [23.5.2010 18:04 8320]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6.11.2007 22:22 34064]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.cz.o2.com/welcome/cz/index.html
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\1t3yvskr.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-05 15:08
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
Celkový čas: 2010-07-05 15:10:10
ComboFix-quarantined-files.txt 2010-07-05 13:10
ComboFix2.txt 2010-06-30 20:07
ComboFix3.txt 2010-06-30 15:58

Před spuštěním: Volných bajtů: 36 334 768 128
Po spuštění: Volných bajtů: 36 371 668 992

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 7D97ABED23DB75CDF621199753F16622

perish · #9 Příspěvek od **perish** » 06 črc 2010 11:41

A jelikoz jsme aktivni, pridavam jeste scan z MWAV:

Soubor C:\Documents and Settings\Administrator\Plocha\stary disk H\Administrator\Plocha\diagnostika disku\Hdd-Scan_3.0.zip je infikovaný virem Trojan.Generic.1620893 (DB) !! Provedené akce: Ponecháno, neodstraněno!.
Objekt "SmitFraud Browser Hijacker" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
Objekt "Backdoor (IRCBot) Trojans Spyware/Adware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
Objekt "AntiSpyware Pro XP Corrupted Adware/Spyware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
Objekt "Orifice2K.plugin Trojan" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
Záznam "HKCR\InternetShortcut" odkazuje na neplatný objekt "{FBF23B40-E3F0-101B-8488-00AA003E56F8}". Provedené akce: Ponecháno, neodstraněno!.
Soubor C:\Documents and Settings\Administrator\Plocha\stary disk H\Administrator\Plocha\diagnostika disku\Hdd-Scan_3.0.zip je infikovaný virem Trojan.Generic.1620893 (DB) !! Provedené akce: Ponecháno, neodstraněno!.
Soubor C:\Program Files\AutoIt3\AutoIt3.exe je infikovaný virem Autolt.Corrupted !! Provedené akce: Ponecháno, neodstraněno!.

PC se chova nadale stejne..po zapnuti internetu se zacne systemove zapinat IEXPLORe.exe, tento proces bezi pak furt. Kdyz ho vypnu pres spravce uloh, za chvili se zase zapne. IE v liste spustenych programu nevidim, vyskoci tak 5x za hodinu. Ta vec, co iexplore.exe furt zapina bezi zrejme nonstop, neb mi furt vypina zvuk (wave zvuky) a aktivni okno zneaktivni. Je to zrejme velmi laicky popis, ale snad aspon rosku pomuze...

#10 Příspěvek od **cernohous13** » 06 črc 2010 16:01

Zdravím a omlouvám se za spam

Můj tip: Whistler Bootkit

použij :MBR
http://www2.gmer.net/mbr/mbr.exe
-ulož ho na plochu a spusť
-na ploše se vytvoří log s názvem "mbr.log", vlož ho sem

perish · #11 Příspěvek od **perish** » 06 črc 2010 17:17

no, nejsem si jist, jestli neco nedelam spatne, ale vyhodilo mi to toto:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: error reading MBR
kernel: MBR read successfully

#12 Příspěvek od **cernohous13** » 06 črc 2010 18:57

nic neděláš špatně - přesně to jsem očekával (máš tušení kde jsi k tomu přišel? - co jsi v poslední době instaloval nebo stahoval?)

Sáhni program HxD - ftp://wa651f2:anonymous@mh-nexus.de/HxDsk.zip
Rozbal soubor "HxD.exe" na plochu - neinstaluj ho -> dej OK

na ploše ho dvojklikem spustíš -> 5.ikona "Otvor disk" -> označ "Pevný disk" -> OK
otevře se okno, které zvětšíš tak, abys viděl celý Sektor 0

myší označíš stejně jako na obrázku a pravým myšítkem "Kopíruj"
pak se vrátíš sem a vložíš obsah do své odpovědi.

Stáhni http://www.esagelab.com/files/bootkit_remover.rar - soubor "remover.exe" rozbal na plochu a dvojklikem spusť.

Pak klik pravým myšítkem do černého okna a "Vybrat vše" -> zkopírovat pomocí Ctrl+C a do svého příspěvku vložit přes Ctrl+V

perish · #13 Příspěvek od **perish** » 06 črc 2010 20:54

No, to nevim co jsme instaloval v dobe kdy se to projevilo, ale mam pocit ze az na nejaky stahnuty porno, tak nic.

Ja ten pocitac neuzivam sam, takze tezko rict, co ostatni uzivatele.

logy z toho HxD:
(nejsem si jist, jake jste mel na mysli)
z fyzickych disku (mam dva a ty jsou rozdeleny na 3 virtualne):
1)
31 C0 8E D8 8E C0 8E D0 BC 00 7C BE 00 7C BF 00 06 B9 80 00 FD FC FC F3 66 A5 90 EA 20 06 00 00 66 31 C0 BE BE 07 B1 04 66 50 66 B8 37 03 00 00 66 58 66 39 44 08 72 08 66 8B 44 08 66 03 44 0C 83 C6 10 83 2E 88 06 04 E2 E8 66 09 C0 74 3E 66 83 C0 02 B9 40 00 BB 00 7C BF 08 07 83 2E 88 06 04 E8 70 00 72 27 66 68 83 C4 14 90 90 90 66 68 04 46 E2 F9 66 68 80 FF D7 30 66 68 89 C3 B9 00 66 68 BE 00 7C 66 0F 83 76 75 FD FC E8 BE BE 07 B1 04 80 3C 80 74 13 38 2C 0F 85 9A 00 83 C6 10 E2 F0 66 87 D9 66 87 CB CD 18 66 8B 44 08 89 E3 B9 01 00 E8 1E 00 73 0D 8B 4C 02 B8 01 02 CD 13 90 0F 82 8D 00 81 3E FE 7D 55 AA 0F 85 A5 00 EA 00 7C 00 00 66 60 BB AA 55 B4 41 CD 13 73 04 F9 66 61 C3 81 FB 55 AA 75 F6 F6 C1 01 74 F1 66 61 66 60 90 6A 00 6A 00 66 50 06 53 51 6A 10 B4 42 89 E6 CD 13 61 66 61 C3 66 69 DB FD 43 03 00 66 81 C3 C3 9E 26 00 66 89 D8 66 C1 E8 10 66 25 FF 00 00 00 C3 90 5E AC 08 C0 74 FC 56 1E BB 07 00 B4 0E CD 10 1F EB ED E8 EA FF 49 6E 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61 62 6C 65 00 E8 CF FF 45 72 72 6F 72 20 6C 6F 61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D 00 E8 AD FF 4D 69 73 73 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7B 8E 7B 8E 00 00 80 01 01 00 07 FE FF FF 3F 00 00 00 62 04 53 07 00 FE FF FF 0F FE FF FF A1 04 53 07 20 86 4E 0B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA

2)
31 C0 8E D8 8E C0 8E D0 BC 00 7C BE 00 7C BF 00 06 B9 80 00 FD FC FC F3 66 A5 90 EA 20 06 00 00 66 31 C0 BE BE 07 B1 04 66 50 66 B8 37 03 00 00 66 58 66 39 44 08 72 08 66 8B 44 08 66 03 44 0C 83 C6 10 83 2E 88 06 04 E2 E8 66 09 C0 74 3E 66 83 C0 02 B9 40 00 BB 00 7C BF 08 07 83 2E 88 06 04 E8 70 00 72 27 66 68 83 C4 14 90 90 90 66 68 04 46 E2 F9 66 68 80 FF D7 30 66 68 89 C3 B9 00 66 68 BE 00 7C 66 0F 83 76 75 FD FC E8 BE BE 07 B1 04 80 3C 80 74 13 38 2C 0F 85 9A 00 83 C6 10 E2 F0 66 87 D9 66 87 CB CD 18 66 8B 44 08 89 E3 B9 01 00 E8 1E 00 73 0D 8B 4C 02 B8 01 02 CD 13 90 0F 82 8D 00 81 3E FE 7D 55 AA 0F 85 A5 00 EA 00 7C 00 00 66 60 BB AA 55 B4 41 CD 13 73 04 F9 66 61 C3 81 FB 55 AA 75 F6 F6 C1 01 74 F1 66 61 66 60 90 6A 00 6A 00 66 50 06 53 51 6A 10 B4 42 89 E6 CD 13 61 66 61 C3 66 69 DB FD 43 03 00 66 81 C3 C3 9E 26 00 66 89 D8 66 C1 E8 10 66 25 FF 00 00 00 C3 90 5E AC 08 C0 74 FC 56 1E BB 07 00 B4 0E CD 10 1F EB ED E8 EA FF 49 6E 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61 62 6C 65 00 E8 CF FF 45 72 72 6F 72 20 6C 6F 61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D 00 E8 AD FF 4D 69 73 73 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F1 8E F1 8E 00 00 00 01 01 00 07 FE FF FF 3F 00 00 00 82 8A A1 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA

z virtualnich:

1)
EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00 00 00 00 00 00 F8 00 00 3F 00 FF 00 3F 00 00 00 00 00 00 00 80 00 80 00 61 04 53 07 00 00 00 00 00 00 0C 00 00 00 00 00 46 30 75 00 00 00 00 00 F6 00 00 00 01 00 00 00 3F 93 2F 54 C9 2F 54 6E 00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB B8 C0 07 8E D8 E8 16 00 B8 00 0D 8E C0 33 DB C6 06 0E 00 10 E8 53 00 68 00 0D 68 6A 02 CB 8A 16 24 00 B4 08 CD 13 73 05 B9 FF FF 8A F1 66 0F B6 C6 40 66 0F B6 D1 80 E2 3F F7 E2 86 CD C0 ED 06 41 66 0F B7 C9 66 F7 E1 66 A3 20 00 C3 B4 41 BB AA 55 8A 16 24 00 CD 13 72 0F 81 FB 55 AA 75 09 F6 C1 01 74 04 FE 06 14 00 C3 66 60 1E 06 66 A1 10 00 66 03 06 1C 00 66 3B 06 20 00 0F 82 3A 00 1E 66 6A 00 66 50 06 53 66 68 10 00 01 00 80 3E 14 00 00 0F 85 0C 00 E8 B3 FF 80 3E 14 00 00 0F 84 61 00 B4 42 8A 16 24 00 16 1F 8B F4 CD 13 66 58 5B 07 66 58 66 58 1F EB 2D 66 33 D2 66 0F B7 0E 18 00 66 F7 F1 FE C2 8A CA 66 8B D0 66 C1 EA 10 F7 36 1A 00 86 D6 8A 16 24 00 8A E8 C0 E4 06 0A CC B8 01 02 CD 13 0F 82 19 00 8C C0 05 20 00 8E C0 66 FF 06 10 00 FF 0E 0E 00 0F 85 6F FF 07 1F 66 61 C3 A0 F8 01 E8 09 00 A0 FB 01 E8 03 00 FB EB FE B4 01 8B F0 AC 3C 00 74 09 B4 0E BB 07 00 CD 10 EB F2 C3 0D 0A 43 68 79 62 61 20 9F 74 65 6E A1 20 64 69 73 6B 75 00 0D 0A 4E 54 4C 44 52 20 6E 65 6E 61 6C 65 7A 65 6E 00 0D 0A 4E 54 4C 44 52 20 6B 6F 6D 70 72 69 6D 6F 76 A0 6E 2E 00 0D 0A 52 65 73 74 61 72 74 75 6A 74 65 20 73 74 69 73 6B 6E 75 74 A1 6D 20 6B 6C A0 76 65 73 20 43 74 72 6C 2B 41 6C 74 2B 44 65 6C 2E 0D 0A 00 00 00 00 00 00 00 00 00 00 00 83 97 A9 BE 00 00 55 AA

2)
EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00 00 00 00 00 00 F8 00 00 3F 00 FF 00 3F 00 00 00 00 00 00 00 80 00 80 00 E0 85 4E 0B 00 00 00 00 00 00 0C 00 00 00 00 00 5E E8 B4 00 00 00 00 00 F6 00 00 00 01 00 00 00 06 E6 FA 78 12 FB 78 20 00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB B8 C0 07 8E D8 E8 16 00 B8 00 0D 8E C0 33 DB C6 06 0E 00 10 E8 53 00 68 00 0D 68 6A 02 CB 8A 16 24 00 B4 08 CD 13 73 05 B9 FF FF 8A F1 66 0F B6 C6 40 66 0F B6 D1 80 E2 3F F7 E2 86 CD C0 ED 06 41 66 0F B7 C9 66 F7 E1 66 A3 20 00 C3 B4 41 BB AA 55 8A 16 24 00 CD 13 72 0F 81 FB 55 AA 75 09 F6 C1 01 74 04 FE 06 14 00 C3 66 60 1E 06 66 A1 10 00 66 03 06 1C 00 66 3B 06 20 00 0F 82 3A 00 1E 66 6A 00 66 50 06 53 66 68 10 00 01 00 80 3E 14 00 00 0F 85 0C 00 E8 B3 FF 80 3E 14 00 00 0F 84 61 00 B4 42 8A 16 24 00 16 1F 8B F4 CD 13 66 58 5B 07 66 58 66 58 1F EB 2D 66 33 D2 66 0F B7 0E 18 00 66 F7 F1 FE C2 8A CA 66 8B D0 66 C1 EA 10 F7 36 1A 00 86 D6 8A 16 24 00 8A E8 C0 E4 06 0A CC B8 01 02 CD 13 0F 82 19 00 8C C0 05 20 00 8E C0 66 FF 06 10 00 FF 0E 0E 00 0F 85 6F FF 07 1F 66 61 C3 A0 F8 01 E8 09 00 A0 FB 01 E8 03 00 FB EB FE B4 01 8B F0 AC 3C 00 74 09 B4 0E BB 07 00 CD 10 EB F2 C3 0D 0A 43 68 79 62 61 20 9F 74 65 6E A1 20 64 69 73 6B 75 00 0D 0A 4E 54 4C 44 52 20 6E 65 6E 61 6C 65 7A 65 6E 00 0D 0A 4E 54 4C 44 52 20 6B 6F 6D 70 72 69 6D 6F 76 A0 6E 00 0D 0A 52 65 73 74 61 72 74 75 6A 74 65 20 73 74 69 73 6B 6E 75 74 A1 6D 20 6B 6C A0 76 65 73 20 43 74 72 6C 2B 41 6C 74 2B 44 65 6C 0D 0A 00 00 00 00 00 00 00 00 00 00 00 00 00 83 97 A9 BD 00 00 55 AA

3)
EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00 00 00 00 00 00 F8 00 00 3F 00 FF 00 3F 00 00 00 00 00 00 00 80 00 80 00 81 8A A1 12 00 00 00 00 00 00 0C 00 00 00 00 00 A8 18 2A 01 00 00 00 00 F6 00 00 00 01 00 00 00 2D F5 01 F4 0A 02 F4 0E 00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB B8 C0 07 8E D8 E8 16 00 B8 00 0D 8E C0 33 DB C6 06 0E 00 10 E8 53 00 68 00 0D 68 6A 02 CB 8A 16 24 00 B4 08 CD 13 73 05 B9 FF FF 8A F1 66 0F B6 C6 40 66 0F B6 D1 80 E2 3F F7 E2 86 CD C0 ED 06 41 66 0F B7 C9 66 F7 E1 66 A3 20 00 C3 B4 41 BB AA 55 8A 16 24 00 CD 13 72 0F 81 FB 55 AA 75 09 F6 C1 01 74 04 FE 06 14 00 C3 66 60 1E 06 66 A1 10 00 66 03 06 1C 00 66 3B 06 20 00 0F 82 3A 00 1E 66 6A 00 66 50 06 53 66 68 10 00 01 00 80 3E 14 00 00 0F 85 0C 00 E8 B3 FF 80 3E 14 00 00 0F 84 61 00 B4 42 8A 16 24 00 16 1F 8B F4 CD 13 66 58 5B 07 66 58 66 58 1F EB 2D 66 33 D2 66 0F B7 0E 18 00 66 F7 F1 FE C2 8A CA 66 8B D0 66 C1 EA 10 F7 36 1A 00 86 D6 8A 16 24 00 8A E8 C0 E4 06 0A CC B8 01 02 CD 13 0F 82 19 00 8C C0 05 20 00 8E C0 66 FF 06 10 00 FF 0E 0E 00 0F 85 6F FF 07 1F 66 61 C3 A0 F8 01 E8 09 00 A0 FB 01 E8 03 00 FB EB FE B4 01 8B F0 AC 3C 00 74 09 B4 0E BB 07 00 CD 10 EB F2 C3 0D 0A 43 68 79 62 61 20 9F 74 65 6E A1 20 64 69 73 6B 75 00 0D 0A 4E 54 4C 44 52 20 6E 65 6E 61 6C 65 7A 65 6E 00 0D 0A 4E 54 4C 44 52 20 6B 6F 6D 70 72 69 6D 6F 76 A0 6E 00 0D 0A 52 65 73 74 61 72 74 75 6A 74 65 20 73 74 69 73 6B 6E 75 74 A1 6D 20 6B 6C A0 76 65 73 20 43 74 72 6C 2B 41 6C 74 2B 44 65 6C 0D 0A 00 00 00 00 00 00 00 00 00 00 00 00 00 83 97 A9 BD 00 00 55 AA

perish · #14 Příspěvek od **perish** » 06 črc 2010 21:00

a tady je log z toho removeru.. zrejme neco nasel.. mam se bat? a jak moc je to vazny? umiram?(mam se bat o data) a muzu se jeste zeptat.. posila muj PC data ven nebo je to jen otravna havet s vyskakovanim okna? Predem dekuji za cas a ochotu

Bootkit Remover version 1.0.0.1
(c) 2009 eSage Lab
www.esagelab.com

\\.\C: -> \\.\PhysicalDrive0
MD5: 3e01b1df25d85e1dbe804df0324d13a2
\\.\D: -> \\.\PhysicalDrive0
\\.\E: -> \\.\PhysicalDrive1
MD5: 3e01b1df25d85e1dbe804df0324d13a2

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Unknown boot code
149 GB \\.\PhysicalDrive1 Unknown boot code

Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>

Press any key to quit...

#15 Příspěvek od **cernohous13** » 06 črc 2010 21:43

oprava MBR

jdi -> "Start" -> "Spustit..." do příkazového řádku zkopíruj celý červený řádek
"%userprofile%\Plocha\remover.exe" fix \\.\PhysicalDrive0
restartuj a proveď nový scan Bootkit Remover-em -> log sem

v těchto případech se doporučuje změnit všechna hesla
a pokud se podaří PC vyčistit, tak by neměla být data ohrožena.

píšeš: Nasadil jsem spyterminator, ktery nasel 4 veci, nejzavaznejsi bylo asi smss.exe
můžeš zjistit celou cestu k tomu smazanému smss.exe případně ho z karantény zazipovat a odeslat? na http://www.james008.net/havet/

VIRY.CZ

Prosim o kontrolu logu - zavazne podezreni na brouka

Prosim o kontrolu logu - zavazne podezreni na brouka

Re: Prosim o kontrolu logu - zavazne podezreni na brouka

Re: Prosim o kontrolu logu - zavazne podezreni na brouka

Re: Prosim o kontrolu logu - zavazne podezreni na brouka

Re: Prosim o kontrolu logu - zavazne podezreni na brouka

Re: Prosim o kontrolu logu - zavazne podezreni na brouka

Re: Prosim o kontrolu logu - zavazne podezreni na brouka

Re: Prosim o kontrolu logu - zavazne podezreni na brouka

Re: Prosim o kontrolu logu - zavazne podezreni na brouka

Re: Prosim o kontrolu logu - zavazne podezreni na brouka

Re: Prosim o kontrolu logu - zavazne podezreni na brouka

Re: Prosim o kontrolu logu - zavazne podezreni na brouka

Re: Prosim o kontrolu logu - zavazne podezreni na brouka

Re: Prosim o kontrolu logu - zavazne podezreni na brouka

Re: Prosim o kontrolu logu - zavazne podezreni na brouka