VIRY.CZ

Dobry den,
prosim o kontrolu logu.

Pc je pravdepodobne napadeno vice infiltracemi, bylo proscanovano nod32 antivirem a online scannerem, superAntispywarem, advanced syscarem, ccleanerem, is360 a byly provedeny vsechny updaty od windows a microsoft update. Z nouzoveho rezimu proscanovano tez. (dosud odstraneno nekolik trojskych koni, sit je vytizena stale) - proces svchost.exe vyuziva stale 50% CPU, necinne procesy systemu tez a obcas se k nim prida ekrn.exe se stejnym vytizenim, takze je nakoplej asi i nod.
Pravdepodobne rozesila spamove maily ve velkem mnozstvi, komunikace se siti probiha v obou smerech intezivne.
Nyni je odpojeno od site, log byl bez site vytvoren tez.

Nalezene infiltrace:

___
NOD32:
C:\Documents and Settings\vhruby\Data aplikací\Sun\Java\Deployment\cache\6.0\45\3d43daad-4e9d4070 - Java/TrojanDownloader.Agent.AB trojský kůň - vyléčen smazáním - uložen do karantény [1]

13.7.2010 7:51:01 Rezidentní ochrana soubor C:\WINDOWS\system32\fjhdyfhsn.bat BAT/KillFiles.NCB trojský kůň vyléčen smazáním - uložen do karantény VAK\vhruby Tato skutečnost byla zjištěna na souboru, který byl modifikován aplikací: C:\WINDOWS\system32\cmd.exe.
12.7.2010 13:33:05 HTTP filter soubor http://pantscow.ru:8080/Applet1.html JS/Exploit.JavaDepKit.A trojský kůň přerušeno spojení - uložen do karantény VAK\vhruby Infiltrace byla zachycena při přístupu na web aplikací: C:\Program Files\Internet Explorer\iexplore.exe.
3.6.2010 15:35:54 Rezidentní ochrana soubor C:\Documents and Settings\vhruby\Local Settings\Temporary Internet Files\Content.IE5\S1677MAK\modelsgonebad_com[1].htm JS/TrojanDownloader.Pegel.BH trojský kůň vyléčen smazáním - uložen do karantény VAK\vhruby Tato skutečnost byla zjištěna při pokusu o přístup k souboru aplikací: C:\Program Files\Internet Explorer\iexplore.exe.
3.6.2010 15:35:54 HTTP filter soubor http://www.modelsgonebad.com/ JS/TrojanDownloader.Pegel.BH trojský kůň přerušeno spojení - uložen do karantény VAK\vhruby Infiltrace byla zachycena při přístupu na web aplikací: C:\Program Files\Internet Explorer\iexplore.exe.
___
IObit Security 360:

OS:Windows XP
Version:1.4.5.67
Define Version:1601
Time Elapsed:00:05:42
Objects Scanned:53953
Threats Found:1

|Name|Type|Description|ID|
Trojan.Win32/Agent - Removed, Registry Value, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowCpl Value=1, 4-20196

___
SuperAntispyware:

Quarantined:
Trojan.Downloader-Gen
E:\DATA\ARCHIV\FIN_AL\FINANAL\ATLASFA\FK_DEMO\SYSTEM\SYSMGR.EXE

a spousta smazanych cookies



log RSIT:

Logfile of random's system information tool 1.08 (written by random/random)
Run by vhruby at 2010-07-16 20:50:33
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 61 GB (77%) free of 80 GB
Total RAM: 1980 MB (71% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-07-14 278192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll [2010-05-31 814648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-07-16 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-07-16 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-07-14 278192]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2008-09-01 1044480]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2009-01-11 141336]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2009-01-11 173592]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2009-01-11 141336]
"picon"=C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe [2008-07-17 773144]
"ChangeTPMAuth"=C:\Program Files\Wave Systems Corp\Common\ChangeTPMAuth.exe [2008-08-21 184320]
"WavXMgr"=C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe [2008-08-22 145408]
"SecureUpgrade"=C:\Program Files\Wave Systems Corp\SecureUpgrade.exe [2008-08-28 656696]
"EmbassySecurityCheck"=C:\Program Files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe [2008-08-28 91448]
"PDVDDXSrv"=C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [2008-05-23 128296]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2010-07-02 2202704]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"ISUSPM"=C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [2006-09-11 218032]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-04-06 39408]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Documents and Settings\vhruby\Nabídka Start\Programy\Po spuštění
srvklw32.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2007-04-19 294912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2009-01-11 205312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
wvauth

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"ForceStartMenuLogOff"=1
"NoStartMenuNetworkPlaces"=1
"ForceClassicControlPanel"=1
"NoAutoTrayNotify"=1
"NoSMBalloonTip"=1
"NoSMConfigurePrograms"=1
"DisallowCpl"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoResolveSearch"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ClientRs\ClientRS.exe"="C:\Program Files\ClientRs\ClientRS.exe:*:Enabled:ClientRS"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ClientRs\ClientRS.exe"="C:\Program Files\ClientRs\ClientRS.exe:*:Enabled:ClientRS"

======List of files/folders created in the last 1 months======

2010-07-16 20:50:33 ----D---- C:\rsit
2010-07-16 20:50:33 ----D---- C:\Program Files\trend micro
2010-07-16 20:50:13 ----D---- C:\__antivirus
2010-07-16 19:35:59 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-07-16 18:30:05 ----A---- C:\WINDOWS\ntbtlog.txt
2010-07-16 17:13:50 ----D---- C:\Documents and Settings\vhruby\Data aplikací\IObit
2010-07-16 15:41:51 ----A---- C:\esi-eula.txt
2010-07-16 15:41:02 ----A---- C:\SysInspector.exe
2010-07-16 15:18:44 ----D---- C:\Documents and Settings\vhruby\Data aplikací\SUPERAntiSpyware.com
2010-07-16 14:59:53 ----HDC---- C:\WINDOWS\$NtUninstallKB2229593$
2010-07-16 14:59:35 ----HDC---- C:\WINDOWS\$NtUninstallKB979482$
2010-07-16 14:59:32 ----HDC---- C:\WINDOWS\$NtUninstallKB980218$
2010-07-16 14:59:28 ----HDC---- C:\WINDOWS\$NtUninstallKB981793$
2010-07-16 14:59:11 ----D---- C:\WINDOWS\ie8updates
2010-07-16 14:57:52 ----N---- C:\WINDOWS\system32\browserchoice.exe
2010-07-16 14:54:38 ----D---- C:\Program Files\Common Files\Java
2010-07-16 14:54:25 ----A---- C:\WINDOWS\system32\javaws.exe
2010-07-16 14:54:25 ----A---- C:\WINDOWS\system32\javaw.exe
2010-07-16 14:54:25 ----A---- C:\WINDOWS\system32\java.exe
2010-07-16 14:54:16 ----D---- C:\Program Files\Java
2010-07-16 14:49:00 ----HD---- C:\WINDOWS\msdownld.tmp
2010-07-16 14:48:33 ----HDC---- C:\WINDOWS\ie8
2010-07-16 09:54:11 ----D---- C:\Documents and Settings\All Users\Data aplikací\SUPERAntiSpyware.com
2010-07-16 09:54:06 ----D---- C:\Program Files\SUPERAntiSpyware
2010-07-16 09:53:51 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-07-16 09:50:01 ----D---- C:\Documents and Settings\All Users\Data aplikací\IObit
2010-07-16 09:44:39 ----D---- C:\Program Files\CCleaner
2010-07-16 08:59:28 ----D---- C:\Program Files\IObit
2010-07-15 10:51:40 ----D---- C:\Program Files\ESET
2010-07-15 10:51:40 ----D---- C:\Documents and Settings\All Users\Data aplikací\ESET
2010-07-13 07:51:09 ----A---- C:\WINDOWS\system32\drivers\ynhvlcov.sys
2010-07-13 07:51:00 ----A---- C:\WINDOWS\system32\drivers\foqtn.sys
2010-07-01 11:09:56 ----HDC---- C:\WINDOWS\$NtUninstallKB980195$
2010-07-01 11:06:30 ----HDC---- C:\WINDOWS\$NtUninstallKB979559$
2010-07-01 11:06:23 ----HDC---- C:\WINDOWS\$NtUninstallKB978695_WM9$
2010-07-01 11:06:17 ----HDC---- C:\WINDOWS\$NtUninstallKB975562$

======List of files/folders modified in the last 1 months======

2010-07-16 20:50:33 ----RD---- C:\Program Files
2010-07-16 20:50:14 ----D---- C:\WINDOWS\Temp
2010-07-16 20:45:21 ----D---- C:\Program Files\ClientRs
2010-07-16 20:12:55 ----AD---- C:\WINDOWS\system32
2010-07-16 20:12:55 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-07-16 20:11:59 ----D---- C:\WINDOWS\Prefetch
2010-07-16 19:38:02 ----AD---- C:\WINDOWS
2010-07-16 19:36:10 ----A---- C:\WINDOWS\system32\log.txt
2010-07-16 19:36:09 ----D---- C:\WINDOWS\Debug
2010-07-16 18:28:39 ----D---- C:\WINDOWS\system32\CatRoot2
2010-07-16 17:21:21 ----D---- C:\WINDOWS\system32\config
2010-07-16 15:52:20 ----SHD---- C:\WINDOWS\Installer
2010-07-16 15:52:20 ----HD---- C:\Config.Msi
2010-07-16 15:39:40 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-07-16 15:38:56 ----D---- C:\WINDOWS\WinSxS
2010-07-16 15:07:13 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-07-16 15:01:54 ----D---- C:\Program Files\Internet Explorer
2010-07-16 14:59:56 ----HD---- C:\WINDOWS\inf
2010-07-16 14:59:55 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-07-16 14:59:53 ----HD---- C:\WINDOWS\$hf_mig$
2010-07-16 14:54:38 ----D---- C:\Program Files\Common Files
2010-07-16 14:54:18 ----A---- C:\WINDOWS\system32\deployJava1.dll
2010-07-16 14:52:29 ----D---- C:\WINDOWS\system32\cs-cz
2010-07-16 14:52:29 ----D---- C:\WINDOWS\Media
2010-07-16 14:52:28 ----D---- C:\WINDOWS\Help
2010-07-16 13:58:38 ----D---- C:\WINDOWS\security
2010-07-16 09:39:20 ----SHD---- C:\WINDOWS\CSC
2010-07-16 09:39:20 ----D---- C:\WINDOWS\repair
2010-07-16 09:39:20 ----D---- C:\Program Files\Zákon 4
2010-07-16 09:39:20 ----D---- C:\Program Files\Audiograbber
2010-07-16 09:39:20 ----D---- C:\Program Files\ACDSee32
2010-07-16 09:39:20 ----D---- C:\Documents and Settings\All Users\Data aplikací\Wave Systems Corp
2010-07-15 10:52:07 ----D---- C:\WINDOWS\system32\drivers
2010-07-02 12:39:06 ----A---- C:\WINDOWS\system32\MRT.exe
2010-07-01 12:51:43 ----D---- C:\WINDOWS\system32\wbem
2010-07-01 11:34:08 ----D---- C:\WINDOWS\Microsoft.NET
2010-07-01 11:33:51 ----RSD---- C:\WINDOWS\assembly
2010-07-01 11:10:49 ----A---- C:\WINDOWS\win.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\WINDOWS\system32\drivers\iaStor.sys [2008-09-01 324120]
R0 PBADRV;PBADRV; C:\WINDOWS\system32\DRIVERS\PBADRV.sys [2008-06-04 26608]
R0 SFAUDIO;Sonic Focus DSP Driver; C:\WINDOWS\system32\drivers\sfaudio.sys [2008-09-01 24064]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-04-28 114984]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2010-07-02 95896]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-07-02 140752]
R2 WavxDMgr;WavxDMgr; C:\WINDOWS\system32\DRIVERS\WavxDMgr.sys [2008-08-28 208824]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2008-09-01 338944]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K; C:\WINDOWS\system32\DRIVERS\e1k5132.sys [2008-12-30 144480]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 HECI;Intel(R) Management Engine Interface; C:\WINDOWS\system32\DRIVERS\HECI.sys [2008-09-01 40832]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2009-01-11 6273504]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2008-04-14 12160]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 AsfAlrt;AsfAlrt Service; \??\C:\WINDOWS\system32\Drivers\AsfAlrt.sys []
S3 esihdrv;esihdrv; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\esihdrv.sys []
S3 NAL;Nal Service ; \??\C:\WINDOWS\system32\Drivers\iqvw32.sys []
S3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 agp440;Filtr Intel sběrnice AGP; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-14 42368]
S4 agpCPQ;Filtr Compaq sběrnice AGP; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2008-04-14 44928]
S4 alim1541;Filtr ALI sběrnice AGP; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2008-04-14 42752]
S4 amdagp;Ovladač filtru AMD portu AGP; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2008-04-14 43008]
S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-18 13952]
S4 sisagp;Filtr SIS sběrnice AGP ; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2008-04-14 40960]
S4 viaagp;Filtr VIA sběrnice AGP ; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2008-04-14 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ASFAgent;ASF Agent; C:\Program Files\Intel\ASF Agent\ASFAgent.exe [2007-04-19 133968]
R2 ClientRS;ClientRS; C:\Program Files\ClientRs\ClientRS.exe [2009-09-23 710144]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2010-07-02 810144]
R2 IS360service;IS360service; C:\Program Files\IObit\IObit Security 360\IS360srv.exe [2010-06-11 312152]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-07-16 153376]
R2 LMS;Intel(R) Active Management Technology Local Management Service; C:\Program Files\Intel\AMT\LMS.exe [2008-07-17 174616]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 NMSAccessU;NMSAccessU; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2007-10-12 71096]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2006-03-03 69632]
R2 TdmService;TdmService; C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe [2008-08-28 966656]
R2 UNS;Intel(R) Active Management Technology User Notification Service; C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2008-07-17 2054680]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-14 268288]
S2 gupdate1c9b76f5d6ed690;Google Update Service (gupdate1c9b76f5d6ed690); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-04-07 133104]
S2 tcsd_win32.exe;NTRU TSS v1.2.1.28 TCS; C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe [2008-08-05 1249280]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2010-07-02 33584]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-29 182768]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 SecureStorageService;SecureStorageService; C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe [2008-08-27 638976]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

ComboFix 10-07-15.05 - Administrator 16.07.2010 22:30:39.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1980.1394 [GMT 2:00]
Spuštěný z: c:\documents and settings\vhruby\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-06-16 do 2010-07-16 )))))))))))))))))))))))))))))))
.

2010-07-16 18:50 . 2010-07-16 18:50 -------- d-----w- C:\rsit
2010-07-16 18:50 . 2010-07-16 18:50 -------- d-----w- c:\program files\trend micro
2010-07-16 18:50 . 2010-07-16 18:50 -------- d-----w- C:\__antivirus
2010-07-16 15:12 . 2010-07-16 15:12 -------- d-sh--w- c:\documents and settings\vhruby\IECompatCache
2010-07-16 15:12 . 2010-07-16 15:12 -------- d-sh--w- c:\documents and settings\vhruby\PrivacIE
2010-07-16 13:41 . 2010-07-16 13:39 2363360 ----a-w- C:\SysInspector.exe
2010-07-16 13:11 . 2010-07-16 13:11 -------- d-sh--w- c:\documents and settings\vhruby\IETldCache
2010-07-16 12:59 . 2010-07-16 12:59 -------- d-----w- c:\windows\ie8updates
2010-07-16 12:58 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2010-07-16 12:58 . 2010-05-06 10:35 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-07-16 12:58 . 2010-05-06 10:35 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-07-16 12:58 . 2010-05-06 10:35 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-07-16 12:57 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-07-16 12:56 . 2010-07-16 12:56 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2010-07-16 12:54 . 2010-07-16 12:54 -------- d-----w- c:\program files\Common Files\Java
2010-07-16 12:54 . 2010-07-16 12:54 -------- d-----w- c:\program files\Java
2010-07-16 12:52 . 2010-07-16 12:52 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-07-16 12:52 . 2010-07-16 12:52 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-07-16 12:49 . 2010-07-16 12:49 -------- d--h--w- c:\windows\msdownld.tmp
2010-07-16 12:48 . 2010-07-16 12:48 -------- dc-h--w- c:\windows\ie8
2010-07-16 07:54 . 2010-07-16 07:54 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-07-16 07:53 . 2010-07-16 07:53 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-07-16 07:44 . 2010-07-16 07:44 -------- d-----w- c:\program files\CCleaner
2010-07-16 06:59 . 2010-07-16 07:49 -------- d-----w- c:\program files\IObit
2010-07-15 08:51 . 2010-07-16 11:07 -------- d-----w- c:\program files\ESET

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-16 20:31 . 2009-04-03 08:23 -------- d-----w- c:\program files\ClientRs
2010-07-16 18:12 . 2008-05-07 23:42 84578 ----a-w- c:\windows\system32\perfc005.dat
2010-07-16 18:12 . 2008-05-07 23:42 442406 ----a-w- c:\windows\system32\perfh005.dat
2010-07-16 12:54 . 2010-05-03 05:58 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-16 07:39 . 2009-04-06 10:51 -------- d-----w- c:\program files\Zákon 4
2010-07-16 07:39 . 2009-04-03 09:43 -------- d-----w- c:\program files\ACDSee32
2010-07-16 07:39 . 2009-04-02 04:45 -------- d-----w- c:\program files\Audiograbber
2010-07-02 10:43 . 2008-10-24 18:53 95896 ----a-w- c:\windows\system32\drivers\epfwtdir.sys
2010-07-02 10:43 . 2008-10-24 18:45 140752 ----a-w- c:\windows\system32\drivers\eamon.sys
2010-06-14 14:31 . 2008-05-08 04:54 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-05-06 10:35 . 2008-05-07 23:42 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 11:33 . 2008-05-07 23:42 1860352 ----a-w- c:\windows\system32\win32k.sys
2010-04-28 06:17 . 2009-05-14 13:47 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-04-20 05:32 . 2008-05-07 23:42 285696 ----a-w- c:\windows\system32\atmfd.dll
1998-05-24 12:26 . 2009-04-02 04:54 351232 ----a-w- c:\program files\Salamander.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]
@="{022F2F51-CDDA-4873-8A29-72C66C808A3F}"
[HKEY_CLASSES_ROOT\CLSID\{022F2F51-CDDA-4873-8A29-72C66C808A3F}]
2009-11-06 23:07 297808 ----a-w- c:\windows\system32\mscoree.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]
@="{661963C1-99A1-44e7-A671-1CF3768AE9D4}"
[HKEY_CLASSES_ROOT\CLSID\{661963C1-99A1-44e7-A671-1CF3768AE9D4}]
2009-11-06 23:07 297808 ----a-w- c:\windows\system32\mscoree.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-09-01 1044480]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-11 141336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-11 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-11 141336]
"picon"="c:\program files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe" [2008-07-17 773144]
"ChangeTPMAuth"="c:\program files\Wave Systems Corp\Common\ChangeTPMAuth.exe" [2008-08-21 184320]
"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2008-08-22 145408]
"SecureUpgrade"="c:\program files\Wave Systems Corp\SecureUpgrade.exe" [2008-08-28 656696]
"EmbassySecurityCheck"="c:\program files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe" [2008-08-28 91448]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-05-23 128296]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-07-02 2202704]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\vhruby\Nabˇdka Start\Programy\Po spuçtŘnˇ\
srvklw32.exe [2008-4-14 37888]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 11:41 294912 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-999185605-1826778803-2130403006-1085\Scripts\Logon\0\0]
"Script"=logon.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-999185605-1826778803-2130403006-1085\Scripts\Logon\1\0]
"Script"=logon.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-999185605-1826778803-2130403006-1581\Scripts\Logon\0\0]
"Script"=logon.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-999185605-1826778803-2130403006-1581\Scripts\Logon\1\0]
"Script"=logon.cmd

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ClientRs\\ClientRS.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8886:TCP"= 8886:TCP:ClientRS_8886_TCP
"8887:TCP"= 8887:TCP:ClientRS_8887_TCP
"8888:TCP"= 8888:TCP:ClientRS_8888_TCP

R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [11.3.2009 21:53 24064]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 114984]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [24.10.2008 20:53 95896]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [28.5.2008 10:33 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [28.5.2008 10:33 55024]
R2 ASFAgent;ASF Agent;c:\program files\Intel\ASF Agent\ASFAgent.exe [19.4.2007 7:56 133968]
R2 ClientRS;ClientRS;c:\program files\ClientRs\ClientRS.exe [3.4.2009 10:23 710144]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2.7.2010 12:43 810144]
R2 UNS;Intel(R) Active Management Technology User Notification Service;c:\program files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [11.3.2009 14:18 2054680]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [11.3.2009 21:53 144480]
S2 gupdate1c9b76f5d6ed690;Google Update Service (gupdate1c9b76f5d6ed690);c:\program files\Google\Update\GoogleUpdate.exe [7.4.2009 12:55 133104]
S2 IS360service;IS360service;c:\program files\IObit\IObit Security 360\is360srv.exe [16.7.2010 9:50 312152]
S3 AsfAlrt;AsfAlrt Service;c:\windows\system32\drivers\Asfalrt.sys [19.4.2007 7:28 42832]
S3 esihdrv;esihdrv;\??\c:\docume~1\ADMINI~1\LOCALS~1\Temp\esihdrv.sys --> c:\docume~1\ADMINI~1\LOCALS~1\Temp\esihdrv.sys [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [28.5.2008 10:33 7408]

--- Ostatní služby/ovladače v paměti ---

*Deregistered* - foqtn
*Deregistered* - ynhvlcov
.
Obsah adresáře 'Naplánované úlohy'

2010-07-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-07 10:55]

2010-07-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-07 10:55]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Settings,ProxyOverride = <local>
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-16 22:33
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\foqtn]

--

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ynhvlcov]

.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-2002487788-1095242621-4268754786-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,66,e3,27,87,45,b2,bc,43,84,1f,76,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,66,e3,27,87,45,b2,bc,43,84,1f,76,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(764)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'lsass.exe'(820)
c:\windows\system32\wvauth.dll

- - - - - - - > 'explorer.exe'(4032)
c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmUserInterface.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2010-07-16 22:34:13
ComboFix-quarantined-files.txt 2010-07-16 20:34

Před spuštěním: Volných bajtů: 64 158 347 264
Po spuštění: Volných bajtů: 64 189 870 080

- - End Of File - - 3205E6C9D175E08EA7F6428D7D0692E5

Otevřte poznámkový blok a zkopírujte do něj:

Collect::
c:\documents and settings\vhruby\Nabídka Start\Programy\Po spuštění\srvklw32.exe

Driver::
foqtn
ynhvlcov

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

ComboFix 10-07-15.05 - Administrator 16.07.2010 23:33:59.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1980.1350 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!

file zipped: c:\documents and settings\vhruby\Nabídka Start\Programy\Po spuštění\srvklw32.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\vhruby\Nabídka Start\Programy\Po spuštění\srvklw32.exe

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FOQTN
-------\Legacy_YNHVLCOV
-------\Service_foqtn
-------\Service_ynhvlcov


((((((((((((((((((((((((( Soubory vytvořené od 2010-06-16 do 2010-07-16 )))))))))))))))))))))))))))))))
.

2010-07-16 18:50 . 2010-07-16 18:50 -------- d-----w- C:\rsit
2010-07-16 18:50 . 2010-07-16 18:50 -------- d-----w- c:\program files\trend micro
2010-07-16 18:50 . 2010-07-16 18:50 -------- d-----w- C:\__antivirus
2010-07-16 15:12 . 2010-07-16 15:12 -------- d-sh--w- c:\documents and settings\vhruby\IECompatCache
2010-07-16 15:12 . 2010-07-16 15:12 -------- d-sh--w- c:\documents and settings\vhruby\PrivacIE
2010-07-16 13:41 . 2010-07-16 13:39 2363360 ----a-w- C:\SysInspector.exe
2010-07-16 13:11 . 2010-07-16 13:11 -------- d-sh--w- c:\documents and settings\vhruby\IETldCache
2010-07-16 12:59 . 2010-07-16 12:59 -------- d-----w- c:\windows\ie8updates
2010-07-16 12:58 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2010-07-16 12:58 . 2010-05-06 10:35 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-07-16 12:58 . 2010-05-06 10:35 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-07-16 12:58 . 2010-05-06 10:35 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-07-16 12:57 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-07-16 12:56 . 2010-07-16 12:56 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2010-07-16 12:54 . 2010-07-16 12:54 -------- d-----w- c:\program files\Common Files\Java
2010-07-16 12:54 . 2010-07-16 12:54 -------- d-----w- c:\program files\Java
2010-07-16 12:52 . 2010-07-16 12:52 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-07-16 12:52 . 2010-07-16 12:52 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-07-16 12:49 . 2010-07-16 12:49 -------- d--h--w- c:\windows\msdownld.tmp
2010-07-16 12:48 . 2010-07-16 12:48 -------- dc-h--w- c:\windows\ie8
2010-07-16 07:54 . 2010-07-16 07:54 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-07-16 07:53 . 2010-07-16 07:53 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-07-16 07:44 . 2010-07-16 07:44 -------- d-----w- c:\program files\CCleaner
2010-07-16 06:59 . 2010-07-16 07:49 -------- d-----w- c:\program files\IObit
2010-07-15 08:51 . 2010-07-16 11:07 -------- d-----w- c:\program files\ESET
2010-07-13 05:51 . 2010-07-16 21:37 756224 ----a-w- c:\windows\system32\drivers\ynhvlcov.sys
2010-07-13 05:51 . 2010-07-16 21:37 565280 ----a-w- c:\windows\system32\drivers\foqtn.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-16 21:35 . 2009-04-03 08:23 -------- d-----w- c:\program files\ClientRs
2010-07-16 18:12 . 2008-05-07 23:42 84578 ----a-w- c:\windows\system32\perfc005.dat
2010-07-16 18:12 . 2008-05-07 23:42 442406 ----a-w- c:\windows\system32\perfh005.dat
2010-07-16 12:54 . 2010-05-03 05:58 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-16 07:39 . 2009-04-06 10:51 -------- d-----w- c:\program files\Zákon 4
2010-07-16 07:39 . 2009-04-03 09:43 -------- d-----w- c:\program files\ACDSee32
2010-07-16 07:39 . 2009-04-02 04:45 -------- d-----w- c:\program files\Audiograbber
2010-07-02 10:43 . 2008-10-24 18:53 95896 ----a-w- c:\windows\system32\drivers\epfwtdir.sys
2010-07-02 10:43 . 2008-10-24 18:45 140752 ----a-w- c:\windows\system32\drivers\eamon.sys
2010-06-14 14:31 . 2008-05-08 04:54 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-05-06 10:35 . 2008-05-07 23:42 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 11:33 . 2008-05-07 23:42 1860352 ----a-w- c:\windows\system32\win32k.sys
2010-04-28 06:17 . 2009-05-14 13:47 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-04-20 05:32 . 2008-05-07 23:42 285696 ----a-w- c:\windows\system32\atmfd.dll
1998-05-24 12:26 . 2009-04-02 04:54 351232 ----a-w- c:\program files\Salamander.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]
@="{022F2F51-CDDA-4873-8A29-72C66C808A3F}"
[HKEY_CLASSES_ROOT\CLSID\{022F2F51-CDDA-4873-8A29-72C66C808A3F}]
2009-11-06 23:07 297808 ----a-w- c:\windows\system32\mscoree.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]
@="{661963C1-99A1-44e7-A671-1CF3768AE9D4}"
[HKEY_CLASSES_ROOT\CLSID\{661963C1-99A1-44e7-A671-1CF3768AE9D4}]
2009-11-06 23:07 297808 ----a-w- c:\windows\system32\mscoree.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-09-01 1044480]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-11 141336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-11 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-11 141336]
"picon"="c:\program files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe" [2008-07-17 773144]
"ChangeTPMAuth"="c:\program files\Wave Systems Corp\Common\ChangeTPMAuth.exe" [2008-08-21 184320]
"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2008-08-22 145408]
"SecureUpgrade"="c:\program files\Wave Systems Corp\SecureUpgrade.exe" [2008-08-28 656696]
"EmbassySecurityCheck"="c:\program files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe" [2008-08-28 91448]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-05-23 128296]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-07-02 2202704]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 11:41 294912 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-999185605-1826778803-2130403006-1085\Scripts\Logon\0\0]
"Script"=logon.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-999185605-1826778803-2130403006-1085\Scripts\Logon\1\0]
"Script"=logon.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-999185605-1826778803-2130403006-1581\Scripts\Logon\0\0]
"Script"=logon.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-999185605-1826778803-2130403006-1581\Scripts\Logon\1\0]
"Script"=logon.cmd

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ClientRs\\ClientRS.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8886:TCP"= 8886:TCP:ClientRS_8886_TCP
"8887:TCP"= 8887:TCP:ClientRS_8887_TCP
"8888:TCP"= 8888:TCP:ClientRS_8888_TCP

R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [11.3.2009 21:53 24064]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 114984]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [24.10.2008 20:53 95896]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [28.5.2008 10:33 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [28.5.2008 10:33 55024]
R2 ASFAgent;ASF Agent;c:\program files\Intel\ASF Agent\ASFAgent.exe [19.4.2007 7:56 133968]
R2 ClientRS;ClientRS;c:\program files\ClientRs\ClientRS.exe [3.4.2009 10:23 710144]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2.7.2010 12:43 810144]
R2 IS360service;IS360service;c:\program files\IObit\IObit Security 360\is360srv.exe [16.7.2010 9:50 312152]
R2 UNS;Intel(R) Active Management Technology User Notification Service;c:\program files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [11.3.2009 14:18 2054680]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [11.3.2009 21:53 144480]
S2 gupdate1c9b76f5d6ed690;Google Update Service (gupdate1c9b76f5d6ed690);c:\program files\Google\Update\GoogleUpdate.exe [7.4.2009 12:55 133104]
S3 AsfAlrt;AsfAlrt Service;c:\windows\system32\drivers\Asfalrt.sys [19.4.2007 7:28 42832]
S3 esihdrv;esihdrv;\??\c:\docume~1\ADMINI~1\LOCALS~1\Temp\esihdrv.sys --> c:\docume~1\ADMINI~1\LOCALS~1\Temp\esihdrv.sys [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [28.5.2008 10:33 7408]
.
Obsah adresáře 'Naplánované úlohy'

2010-07-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-07 10:55]

2010-07-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-07 10:55]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Settings,ProxyOverride = <local>
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-16 23:40
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-2002487788-1095242621-4268754786-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,66,e3,27,87,45,b2,bc,43,84,1f,76,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,66,e3,27,87,45,b2,bc,43,84,1f,76,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(732)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'lsass.exe'(788)
c:\windows\system32\wvauth.dll

- - - - - - - > 'explorer.exe'(2668)
c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmUserInterface.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Intel\AMT\LMS.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
.
**************************************************************************
.
Celkový čas: 2010-07-16 23:42:33 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-07-16 21:42
ComboFix2.txt 2010-07-16 20:34

Před spuštěním: Volných bajtů: 64 194 236 416
Po spuštění: Volných bajtů: 64 112 586 752

- - End Of File - - 9419A1F00601C82A8C5A0CE4575832BB

mam se zkusit nyni pripojit na sit?

Ještě jednou spusťte CF tímto skriptem:

Collect::
c:\windows\system32\drivers\ynhvlcov.sys
c:\windows\system32\drivers\foqtn.sys

Driver::
ynhvlcov
foqtn

nějak se nám šmejdy vrátily.

Po par minutach prace Combofixu s poslednim scriptem vyhodil tuto hlasku (kterou jsem zavrel krizkem, bez pripojeni do site):

Pote se objevila hlaska, ze jelikoz nebylo mozne se pripojit, bude vytvoren alespon tento log (pro pozdejsi online kontroly):

ComboFix 10-07-15.05 - vhruby 17.07.2010 13:40:43.3.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1980.1502 [GMT 2:00]
Spuštěný z: c:\documents and settings\vhruby\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\vhruby\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 4.2 *On-access scanning disabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!

file zipped: c:\windows\system32\drivers\foqtn.sys
file zipped: c:\windows\system32\drivers\ynhvlcov.sys
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\foqtn.sys
c:\windows\system32\drivers\ynhvlcov.sys

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-06-17 do 2010-07-17 )))))))))))))))))))))))))))))))
.

2010-07-16 18:50 . 2010-07-16 18:50 -------- d-----w- C:\rsit
2010-07-16 18:50 . 2010-07-16 18:50 -------- d-----w- c:\program files\trend micro
2010-07-16 18:50 . 2010-07-16 18:50 -------- d-----w- C:\__antivirus
2010-07-16 15:12 . 2010-07-16 15:12 -------- d-sh--w- c:\documents and settings\vhruby\IECompatCache
2010-07-16 15:12 . 2010-07-16 15:12 -------- d-sh--w- c:\documents and settings\vhruby\PrivacIE
2010-07-16 13:41 . 2010-07-16 13:39 2363360 ----a-w- C:\SysInspector.exe
2010-07-16 13:11 . 2010-07-16 13:11 -------- d-sh--w- c:\documents and settings\vhruby\IETldCache
2010-07-16 12:59 . 2010-07-16 12:59 -------- d-----w- c:\windows\ie8updates
2010-07-16 12:58 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2010-07-16 12:58 . 2010-05-06 10:35 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-07-16 12:58 . 2010-05-06 10:35 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-07-16 12:58 . 2010-05-06 10:35 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-07-16 12:57 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-07-16 12:56 . 2010-07-16 12:56 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2010-07-16 12:54 . 2010-07-16 12:54 -------- d-----w- c:\program files\Common Files\Java
2010-07-16 12:54 . 2010-07-16 12:54 -------- d-----w- c:\program files\Java
2010-07-16 12:52 . 2010-07-16 12:52 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-07-16 12:52 . 2010-07-16 12:52 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-07-16 12:49 . 2010-07-16 12:49 -------- d--h--w- c:\windows\msdownld.tmp
2010-07-16 12:48 . 2010-07-16 12:48 -------- dc-h--w- c:\windows\ie8
2010-07-16 07:54 . 2010-07-16 07:54 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-07-16 07:53 . 2010-07-16 07:53 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-07-16 07:44 . 2010-07-16 07:44 -------- d-----w- c:\program files\CCleaner
2010-07-16 06:59 . 2010-07-16 07:49 -------- d-----w- c:\program files\IObit
2010-07-15 08:51 . 2010-07-16 11:07 -------- d-----w- c:\program files\ESET

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-17 11:42 . 2009-04-03 08:23 -------- d-----w- c:\program files\ClientRs
2010-07-16 18:12 . 2008-05-07 23:42 84578 ----a-w- c:\windows\system32\perfc005.dat
2010-07-16 18:12 . 2008-05-07 23:42 442406 ----a-w- c:\windows\system32\perfh005.dat
2010-07-16 12:54 . 2010-05-03 05:58 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-16 07:39 . 2009-04-06 10:51 -------- d-----w- c:\program files\Zákon 4
2010-07-16 07:39 . 2009-04-03 09:43 -------- d-----w- c:\program files\ACDSee32
2010-07-16 07:39 . 2009-04-02 04:45 -------- d-----w- c:\program files\Audiograbber
2010-07-02 10:43 . 2008-10-24 18:53 95896 ----a-w- c:\windows\system32\drivers\epfwtdir.sys
2010-07-02 10:43 . 2008-10-24 18:45 140752 ----a-w- c:\windows\system32\drivers\eamon.sys
2010-06-14 14:31 . 2008-05-08 04:54 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-05-06 10:35 . 2008-05-07 23:42 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 11:33 . 2008-05-07 23:42 1860352 ----a-w- c:\windows\system32\win32k.sys
2010-04-28 06:17 . 2009-05-14 13:47 114984 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2010-04-20 05:32 . 2008-05-07 23:42 285696 ----a-w- c:\windows\system32\atmfd.dll
1998-05-24 12:26 . 2009-04-02 04:54 351232 ----a-w- c:\program files\Salamander.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]
@="{022F2F51-CDDA-4873-8A29-72C66C808A3F}"
[HKEY_CLASSES_ROOT\CLSID\{022F2F51-CDDA-4873-8A29-72C66C808A3F}]
2009-11-06 23:07 297808 ----a-w- c:\windows\system32\mscoree.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]
@="{661963C1-99A1-44e7-A671-1CF3768AE9D4}"
[HKEY_CLASSES_ROOT\CLSID\{661963C1-99A1-44e7-A671-1CF3768AE9D4}]
2009-11-06 23:07 297808 ----a-w- c:\windows\system32\mscoree.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-06 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-09-01 1044480]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-11 141336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-11 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-11 141336]
"picon"="c:\program files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe" [2008-07-17 773144]
"ChangeTPMAuth"="c:\program files\Wave Systems Corp\Common\ChangeTPMAuth.exe" [2008-08-21 184320]
"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2008-08-22 145408]
"SecureUpgrade"="c:\program files\Wave Systems Corp\SecureUpgrade.exe" [2008-08-28 656696]
"EmbassySecurityCheck"="c:\program files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe" [2008-08-28 91448]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-05-23 128296]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-07-02 2202704]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceStartMenuLogOff"= 1 (0x1)
"NoStartMenuNetworkPlaces"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"DisallowCpl"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 11:41 294912 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-999185605-1826778803-2130403006-1085\Scripts\Logon\0\0]
"Script"=logon.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-999185605-1826778803-2130403006-1085\Scripts\Logon\1\0]
"Script"=logon.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-999185605-1826778803-2130403006-1581\Scripts\Logon\0\0]
"Script"=logon.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-999185605-1826778803-2130403006-1581\Scripts\Logon\1\0]
"Script"=logon.cmd

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ClientRs\\ClientRS.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8886:TCP"= 8886:TCP:ClientRS_8886_TCP
"8887:TCP"= 8887:TCP:ClientRS_8887_TCP
"8888:TCP"= 8888:TCP:ClientRS_8888_TCP

R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [11.3.2009 21:53 24064]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 114984]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [24.10.2008 20:53 95896]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [28.5.2008 10:33 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [28.5.2008 10:33 55024]
R2 ASFAgent;ASF Agent;c:\program files\Intel\ASF Agent\ASFAgent.exe [19.4.2007 7:56 133968]
R2 ClientRS;ClientRS;c:\program files\ClientRs\ClientRS.exe [3.4.2009 10:23 710144]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2.7.2010 12:43 810144]
R2 IS360service;IS360service;c:\program files\IObit\IObit Security 360\is360srv.exe [16.7.2010 9:50 312152]
R2 UNS;Intel(R) Active Management Technology User Notification Service;c:\program files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [11.3.2009 14:18 2054680]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [11.3.2009 21:53 144480]
S2 gupdate1c9b76f5d6ed690;Google Update Service (gupdate1c9b76f5d6ed690);c:\program files\Google\Update\GoogleUpdate.exe [7.4.2009 12:55 133104]
S3 AsfAlrt;AsfAlrt Service;c:\windows\system32\drivers\Asfalrt.sys [19.4.2007 7:28 42832]
S3 esihdrv;esihdrv;\??\c:\docume~1\ADMINI~1\LOCALS~1\Temp\esihdrv.sys --> c:\docume~1\ADMINI~1\LOCALS~1\Temp\esihdrv.sys [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [28.5.2008 10:33 7408]
.
Obsah adresáře 'Naplánované úlohy'

2010-07-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-07 10:55]

2010-07-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-07 10:55]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Settings,ProxyOverride = <local>
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a}
.

**************************************************************************
skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory:

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(732)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\igfxdev.dll

- - - - - - - > 'lsass.exe'(788)
c:\windows\system32\wvauth.dll
.
Celkový čas: 2010-07-17 13:43:38
ComboFix-quarantined-files.txt 2010-07-17 11:43
ComboFix2.txt 2010-07-16 21:42
ComboFix3.txt 2010-07-16 20:34

Před spuštěním: Volných bajtů: 64 111 435 776
Po spuštění: Volných bajtů: 64 100 241 408

- - End Of File - - EEB9BFC58E2F28DF36BE7078A595A692

Byl jsem v tu chvili nalogovan pod uzivatelskym uctem (oproti predchozim upravam s Combofixem, kdy jsem byl pod uctem Administratorskym), (pokud by s tim mela hlaska neco spolecneho) uzivatel ma prava Administratora, nicmene mohl byt politikama omezen z drivejsi prace na siti.

PC je pripojeno do site a i pod profilem uzivatele neni vytezovana sit, vypada to dobre. (zatim i ciste v online kontrole od esetu) Po vsech dalsich testech ktere mam k dispozici, restartuji a budu doufat, ze se nic spatneho znovu neprojevi...

Dekuji za pomoc, Rudy.
Velmi jste mi pomohl!

Oba rootkity jsou pryč a zbytek logu vypadá čistý. Nemáte zač!