PROTECTOR.K vyrus

[wink624]

Mam problem s mojim pc...pri zapnuti internetu mi sam stihne 2 subory napadnute vyrom PROTECTOR.K vyrus ktore ESET SS hned vymaze. Takto sa to opakuje pri kazdom zapnuti pc.... preto mi na mojom pc zablokovali pristup na net... viete mi pomoct?

[wink624]

Logfile of random's system information tool 1.08 (written by random/random)
Run by ds at 2010-08-13 12:16:58
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 31 GB (40%) free of 76 GB
Total RAM: 2047 MB (73% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\MP Scheduled Scan.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00011268-E188-40DF-A514-835FCD78B1BF}]
IE7Pro BHO - C:\Program Files\IEPro\iepro.dll [2008-05-20 736360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Podpora odkazu pro Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{af83e43c-dd2b-4787-826b-31b17dee52ed} - QT Breadcrumbs Address Bar - C:\WINDOWS\system32\mscoree.dll [2008-07-25 282112]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-04-10 16861184]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"VisualTaskTips"=C:\Program Files\VisualTaskTips\VisualTaskTips.exe [2008-08-16 65536]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2007-05-11 40048]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2006-11-03 866584]
"ViOrb"=C:\Program Files\extra\ViOrb\ViOrb.exe [2008-06-15 167936]
"True transparacy"=C:\Program Files\extra\True Transparency\TrueTransparency.exe [2008-06-24 372224]
"TransBar"=C:\Program Files\extra\TransBar\TransBar.exe [2005-06-02 93696]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2007-08-24 33648]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2008-07-01 1447168]
"svchost"=C:\WINDOWS\system32:svchost.exe []
"CanonSolutionMenu"=C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [2007-05-15 644696]
"CanonMyPrinter"=C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2007-04-04 1603152]
"RealTray"=C:\Program Files\K-Lite Codec Pack\Real\mpclauncher.exe [2008-03-13 685056]
"PinnacleDriverCheck"=C:\WINDOWS\system32\PSDrvCheck.exe [2003-12-04 406016]
"USBToolTip"=C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe [2007-02-20 199752]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2009-07-01 37888]
"RemoteControl"=C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [2004-06-28 32768]
"DefragTaskBar"=C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe [2008-04-18 173408]
"EPSON Stylus C62 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE [2002-04-10 74240]
"NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe []
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-03-17 421888]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-08-16 40960]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-04-11 1276416]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe ASO-616B5711-6DAE-4795-A05F-39A1E5104020 []
"CTSyncU.exe"=C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe [2006-09-28 700416]
"frwsevics"=C:\Documents and Settings\ds\frwsevics.exe []

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Nikon Monitor.lnk - C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
PlexTools Professional.lnk - C:\Program Files\Plextor\PlexTool.exe

C:\Documents and Settings\ds\Nabídka Start\Programy\Po spuštění
Aquarium Desktop 2007.lnk - C:\Program Files\Stardock\DesktopGadgets\AquariumDesktop2007\Aquarium Desktop 2007.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-02-26 126976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2008-07-29 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WIFD1F~1\MpShHook.dll [2006-11-03 83224]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"undockwithoutlogon"=1
"ShutdownWithoutLogon"=1
"NoDispCPL"=0
"NoDispSettingsPage"=0
"NoDispScrSavPage"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"HideClock"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoResolveTrack"=1
"NoViewContextMenu"=0
"NoFileAssociate"=0
"NoFind"=0
"NoRun"=0
"NoClose"=0
"StartMenuLogoff"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\IEPro\MiniDM.exe"="C:\Program Files\IEPro\MiniDM.exe:*:Enabled:MiniDM"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Pinnacle\Studio 12\Programs\RM.exe"="C:\Program Files\Pinnacle\Studio 12\Programs\RM.exe:*:Enabled:Render Manager"
"C:\Program Files\Pinnacle\Studio 12\Programs\Studio.exe"="C:\Program Files\Pinnacle\Studio 12\Programs\Studio.exe:*:Enabled:Studio"
"C:\Program Files\Pinnacle\Studio 12\Programs\umi.exe"="C:\Program Files\Pinnacle\Studio 12\Programs\umi.exe:*:Enabled:umi"
"C:\Program Files\Pinnacle\Studio 11\programs\RM.exe"="C:\Program Files\Pinnacle\Studio 11\programs\RM.exe:*:Enabled:Render Manager"
"C:\Program Files\Pinnacle\Studio 11\programs\Studio.exe"="C:\Program Files\Pinnacle\Studio 11\programs\Studio.exe:*:Enabled:Studio"
"C:\Program Files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe"="C:\Program Files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile"
"C:\Program Files\Pinnacle\Studio 11\programs\umi.exe"="C:\Program Files\Pinnacle\Studio 11\programs\umi.exe:*:Enabled:umi"
"C:\Program Files\Pinnacle\Studio 14\Programs\RM.exe"="C:\Program Files\Pinnacle\Studio 14\Programs\RM.exe:*:Enabled:Render Manager"
"C:\Program Files\Pinnacle\Studio 14\Programs\Studio.exe"="C:\Program Files\Pinnacle\Studio 14\Programs\Studio.exe:*:Enabled:Studio"
"C:\Program Files\Pinnacle\Studio 14\Programs\umi.exe"="C:\Program Files\Pinnacle\Studio 14\Programs\umi.exe:*:Enabled:umi"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"G:\OperaPortable10.60\opera.exe"="G:\OperaPortable10.60\opera.exe:*:Enabled:Opera Internet Browser"
"C:\Documents and Settings\ds\Plocha\OperaPortable10.60\opera.exe"="C:\Documents and Settings\ds\Plocha\OperaPortable10.60\opera.exe:*:Disabled:Opera Internet Browser"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-08-13 12:16:58 ----D---- C:\rsit
2010-08-13 12:16:58 ----D---- C:\Program Files\trend micro
2010-08-13 00:34:05 ----D---- C:\Program Files\AxBx
2010-08-04 18:28:12 ----D---- C:\Documents and Settings\ds\Data aplikací\skypePM
2010-08-04 18:27:25 ----D---- C:\Documents and Settings\ds\Data aplikací\Skype
2010-08-04 18:26:52 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2010-07-28 21:51:17 ----D---- C:\Documents and Settings\ds\Data aplikací\Creative
2010-07-28 21:44:34 ----D---- C:\Program Files\Audible
2010-07-28 21:42:23 ----N---- C:\WINDOWS\system32\CTSVCCTL.EXE
2010-07-28 21:42:23 ----N---- C:\WINDOWS\system32\CTSVCCDA.EXE
2010-07-28 21:42:03 ----D---- C:\Program Files\Common Files\Creative
2010-07-28 21:42:00 ----HD---- C:\Program Files\Creative Installation Information
2010-07-28 21:40:11 ----D---- C:\Documents and Settings\All Users\Data aplikací\Creative
2010-07-28 21:29:57 ----N---- C:\WINDOWS\Ctregrun.exe
2010-07-28 21:28:54 ----HDC---- C:\WINDOWS\$NtUninstallKB895316$
2010-07-28 21:25:06 ----D---- C:\Program Files\Creative
2010-07-20 18:31:15 ----D---- C:\Documents and Settings\All Users\Data aplikací\FLEXnet
2010-07-20 18:26:16 ----D---- C:\Program Files\Bonjour
2010-07-20 18:20:35 ----D---- C:\Program Files\Common Files\Macrovision Shared
2010-07-14 15:59:19 ----D---- C:\Program Files\QuickTime

======List of files/folders modified in the last 1 months======

2010-08-13 12:16:58 ----RD---- C:\Program Files
2010-08-13 12:03:16 ----D---- C:\WINDOWS\Temp
2010-08-13 11:50:31 ----SD---- C:\WINDOWS\Tasks
2010-08-13 11:45:51 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-08-13 11:43:55 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-08-13 11:43:55 ----D---- C:\WINDOWS\system32\drivers
2010-08-13 11:43:26 ----D---- C:\Program Files\Mozilla Firefox
2010-08-13 11:38:17 ----D---- C:\WINDOWS\system32\CatRoot2
2010-08-13 11:20:08 ----D---- C:\Program Files\Common Files
2010-08-13 10:55:42 ----D---- C:\WINDOWS\Prefetch
2010-08-13 10:39:53 ----SHD---- C:\WINDOWS\Installer
2010-08-13 10:39:53 ----D---- C:\Program Files\Opera
2010-08-13 10:37:57 ----D---- C:\WINDOWS
2010-08-13 00:53:41 ----AD---- C:\WINDOWS\system32
2010-07-28 21:44:21 ----HD---- C:\WINDOWS\inf
2010-07-28 21:44:21 ----D---- C:\WINDOWS\system32\CatRoot
2010-07-28 21:43:25 ----HD---- C:\Program Files\InstallShield Installation Information
2010-07-28 20:34:09 ----D---- C:\WINDOWS\system32\drivers\UMDF
2010-07-22 17:45:06 ----A---- C:\WINDOWS\CDPLAYER.INI
2010-07-22 15:18:31 ----D---- C:\Documents and Settings\ds\Data aplikací\Adobe
2010-07-20 18:27:35 ----D---- C:\Program Files\Adobe
2010-07-20 18:26:58 ----D---- C:\Program Files\Common Files\Adobe
2010-07-20 18:26:48 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2010-07-20 18:25:00 ----RSD---- C:\WINDOWS\Fonts
2010-07-19 16:57:06 ----A---- C:\WINDOWS\NeroDigital.ini
2010-07-14 15:59:17 ----D---- C:\Documents and Settings\All Users\Data aplikací\Apple Computer

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 mv61xx;mv61xx; C:\WINDOWS\system32\DRIVERS\mv61xx.sys [2007-10-19 143360]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI Texas Instruments; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-14 61696]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2009-04-29 44944]
R0 sbp2port;Ovladač sběrnice pro přenos dat zařízení podporujícího protokol SBP-2; C:\WINDOWS\system32\DRIVERS\sbp2port.sys [2008-04-13 43904]
R0 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2008-07-29 77568]
R1 easdrv;easdrv; C:\WINDOWS\system32\DRIVERS\easdrv.sys [2008-07-01 53256]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2008-07-01 54280]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 LStone;Pinnacle Systems Studio AV/DV Overlay; C:\WINDOWS\system32\DRIVERS\lstone2k.sys [2002-12-10 256113]
R1 MemAlloc;MemAlloc; C:\WINDOWS\system32\DRIVERS\memalloc.sys [2002-08-26 5543]
R2 eamon;EAMON; C:\WINDOWS\system32\DRIVERS\eamon.sys [2008-07-01 39944]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2008-07-01 71688]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-08-16 60800]
R3 ASAPIW2k;ASAPIW2K; C:\WINDOWS\system32\drivers\ASAPIW2k.sys [2003-12-04 11264]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-02-26 2863616]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2008-07-01 30728]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-04-17 4707328]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-08-16 61824]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-12-05 10368]
R3 RTHDMIAzAudService;Service for HDMI; C:\WINDOWS\system32\drivers\RtHDMI.sys [2007-05-14 3526464]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-01-04 105856]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S2 aecq;aecq; \??\C:\WINDOWS\System32\DRIVERS\aecq.sys []
S3 MarvinBus;Pinnacle Marvin Bus; C:\WINDOWS\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2008-07-29 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-07-29 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AshampooDefragService;Ashampoo Defrag Service; C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe [2008-04-18 746848]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-02-26 520192]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.exe [1999-12-12 44032]
R2 ekrn;Eset Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2008-07-14 468224]
R2 EPSONStatusAgent2;EPSON Printer Status Agent2; C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe [2001-10-25 90112]
R2 IJPLMSVC;PIXMA Extended Survey Program; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [2007-04-13 97432]
R2 WinDefend;Windows Defender; C:\Program Files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 e7aiacfeoa4ay7yk;ASF Agent; C:\WINDOWS\system32\caquarev.exe []
S2 PCLEPCI;PCLEPCI; C:\WINDOWS\system32\drivers\pclepci.sys [2005-02-09 14165]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 DfSdkS;Defragmentation-Service; C:\Program Files\Ashampoo\Ashampoo WinOptimizer 6\Dfsdks.exe [2009-01-09 410976]
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2008-07-01 19200]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-07-20 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2007-08-24 68464]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-06 913920]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe []

-----------------EOF-----------------

[stell]

Zdravim
PROSIM CITAJTE POZORNE NAVODY!!!,

Stáhněte na plochu, ukončete všechna aktivní okna >>
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Pri tejto akcii je nutné mať ComboFix na ploche.

Vypni>FIREWALL>Antivir>Antispyware>vsetko rezidentne.

Otvor Notepad (Poznámkový blok) a zkopíruj do neho celý zeleny tex:

Kód: Vybrat vše

KILLALL::
ADS::
C:\WINDOWS\system32

Potom klik na Subor -> Uložiť ako.. .. -> Ako je Názov souboru tak do toho riadku napiš:CFScript.txt
Typ súboru tak tam vyberies *všetky súbory
A ulož ho na plochu.> Pozor CFScript.txt>Neotvarat a nemoze byt ani>CFScript.txt.txt A Urobis Toto :


Po skonceni skenu vlož log čo ComboFix vytvorí



Suhlasit instalacio Konzoly pre zotavenie (Recovery console)


- ComboFix je třeba spustit pod účtem s právy administrátora.
- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano;

A este raz >ANO<

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího modreho okna

- Po dokončení skenování, trvajícího maximálně 10-15 minut, by měl program vytvořit log - C:\ComboFix.txt, zkopírujte celý jeho obsah do svého threadu na forum
- Před použitím ComboFixu je treba vypnout všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary. NAVOD: http://www.bleepingcomputer.com/forums/topic114351.html
Mohou zasahovat do činnosti ComboFixu, což může způsobit, že nebude fungovat korektně.
V případě detekce antiviru u ComboFixu se jedná o falešný poplach.

[wink624]

ComboFix 10-08-12.03 - ds 13.08.2010 13:14:25.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1541 [GMT 4,5:30]
Spuštěný z: c:\documents and settings\ds\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\ds\Plocha\CFScript.txt
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Default User\xmlUpdater.exe
c:\documents and settings\ds\ctfmon.exe
c:\documents and settings\ds\xmlUpdater.exe
c:\windows\system32\config\systemprofile\xmlUpdater.exe
c:\windows\system32\win.ini
H:\Autorun.inf

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-07-13 do 2010-08-13 )))))))))))))))))))))))))))))))
.

2010-08-13 07:46 . 2010-08-13 07:47 -------- d-----w- C:\rsit
2010-08-13 07:46 . 2010-08-13 07:46 -------- d-----w- c:\program files\trend micro
2010-08-12 20:04 . 2010-08-12 20:04 -------- d-----w- c:\program files\AxBx
2010-08-04 13:58 . 2010-08-04 13:58 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-07-28 17:14 . 2010-07-28 17:14 -------- d-----w- c:\program files\Audible
2010-07-28 17:12 . 1999-12-12 17:01 44032 ------w- c:\windows\system32\CTSVCCDA.EXE
2010-07-28 17:12 . 1999-11-17 17:00 25088 ------w- c:\windows\system32\CTSVCCTL.EXE
2010-07-28 17:12 . 2010-07-28 17:12 -------- d-----w- c:\program files\Common Files\Creative
2010-07-28 17:12 . 2010-07-28 17:12 -------- d--h--w- c:\program files\Creative Installation Information
2010-07-28 16:59 . 1999-10-10 17:00 41984 ------w- c:\windows\Ctregrun.exe
2010-07-28 16:55 . 2010-07-28 17:12 -------- d-----w- c:\program files\Creative
2010-07-20 13:56 . 2010-07-20 13:56 -------- d-----w- c:\program files\Bonjour
2010-07-20 13:50 . 2010-07-20 13:50 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-07-14 11:29 . 2010-07-14 11:29 -------- d-----w- c:\program files\QuickTime

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-13 07:13 . 2008-08-15 19:34 182912 ----a-w- c:\windows\system32\drivers\ndis.sys
2010-08-13 06:09 . 2010-07-10 18:51 -------- d-----w- c:\program files\Opera
2010-07-28 17:13 . 2010-01-15 10:54 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-20 13:56 . 2010-01-14 19:48 -------- d-----w- c:\program files\Common Files\Adobe
2010-07-13 15:51 . 2010-07-13 15:14 -------- d-----w- c:\program files\AVS4YOU
2010-07-13 15:15 . 2010-07-13 15:14 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-07-13 15:05 . 2010-07-07 17:35 -------- d-----w- c:\program files\Total Video Converter
2010-07-11 08:49 . 2010-01-15 13:33 -------- d-----w- c:\program files\AdorageI-GfxDatas
2010-07-11 08:44 . 2010-01-15 18:48 -------- d-----w- c:\program files\Ashampoo
2010-07-07 17:36 . 2010-07-07 17:36 2080 ----a-w- c:\program files\Uninstall.ini
2010-07-07 17:36 . 2009-01-07 15:54 74330 ----a-w- c:\program files\Uninstall.exe
2010-07-07 14:09 . 2010-07-07 14:09 -------- d-----w- c:\program files\Common Files\Apple
2010-07-07 14:09 . 2010-07-07 14:09 -------- d-----w- c:\program files\Apple Software Update
2010-06-21 13:44 . 2010-06-21 13:44 -------- d-----w- c:\program files\Ahead
2010-06-21 13:44 . 2010-06-21 13:44 -------- d-----w- c:\program files\Common Files\Ahead
2010-06-21 13:41 . 2010-01-14 20:04 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-06-21 13:40 . 2010-06-21 13:40 0 ----a-w- c:\windows\nsreg.dat
2010-06-21 13:36 . 2010-03-07 06:47 -------- d-----w- c:\program files\Common Files\Nero
2004-08-09 19:00 . 2010-01-15 18:20 40960 ----a-w- c:\program files\Uninstall_CDS.exe
.

------- Sigcheck -------

[-] 2008-08-15 . 12A799AD9415AE9C8ABCC5F75E9CF034 . 557056 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

[-] 2008-08-15 . 97BF1C54DAF9FF61E897846DC7329CEF . 647680 . . [5.82] . . c:\windows\system32\comctl32.dll

[-] 2008-08-15 . 412C356918583DA0A3B3082F4B37B378 . 2307072 . . [5.1.2600.5512] . . c:\windows\system32\ntoskrnl.exe

[-] 2008-08-15 . CCB32D10C69A89822E9134C0C4894BE1 . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll

[-] 2008-08-15 . F0C7CFFD1165068388311C793E32C4CC . 1482240 . . [6.00.2900.5512] . . c:\windows\explorer.exe

[-] 2008-07-28 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

[-] 2008-08-15 . 94927BB89A6825C4A5952A2BF78F027B . 40960 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe

[-] 2008-07-28 21:27 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll

[-] 2008-08-15 . 8E73066FDC4A6F14261C6745E0924B5D . 2185728 . . [5.1.2600.5512] . . c:\windows\system32\ntkrnlpa.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-04-11 1276416]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-09-28 700416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-04-10 16861184]
"VisualTaskTips"="c:\program files\VisualTaskTips\VisualTaskTips.exe" [2008-08-15 65536]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"ViOrb"="c:\program files\extra\ViOrb\ViOrb.exe" [2008-06-15 167936]
"True transparacy"="c:\program files\extra\True Transparency\TrueTransparency.exe" [2008-06-24 372224]
"TransBar"="c:\program files\extra\TransBar\TransBar.exe" [2005-06-01 93696]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-07-01 1447168]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"RealTray"="c:\program files\K-Lite Codec Pack\Real\mpclauncher.exe" [2008-03-13 685056]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-12-04 406016]
"USBToolTip"="c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe" [2007-02-20 199752]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"RemoteControl"="c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-06-28 32768]
"DefragTaskBar"="c:\program files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe" [2008-04-18 173408]
"EPSON Stylus C62 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE" [2002-04-10 74240]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-08-15 40960]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2008-04-23 124928]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2008-6-5 479232]
PlexTools Professional.lnk - c:\program files\Plextor\PlexTool.exe [2005-3-31 5623808]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IEPro\\MiniDM.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\umi.exe"=
"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\umi.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [16.8.2008 1:46 143360]
R1 LStone;Pinnacle Systems Studio AV/DV Overlay;c:\windows\system32\drivers\LStone2k.sys [15.1.2010 15:45 256113]
R1 MemAlloc;MemAlloc;c:\windows\system32\drivers\MemAlloc.sys [15.1.2010 15:45 5543]
R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [14.7.2008 9:53 468224]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3.11.2006 19:19 13592]
S2 aecq;aecq;\??\c:\windows\System32\DRIVERS\aecq.sys --> c:\windows\System32\DRIVERS\aecq.sys [?]
S2 e7aiacfeoa4ay7yk;ASF Agent;c:\windows\system32\caquarev.exe --> c:\windows\system32\caquarev.exe [?]
S3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 6\DfSdkS.exe [11.7.2010 13:14 410976]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
2008-04-23 04:16 124928 ----a-w- c:\windows\system32\advpack.dll
.
Obsah adresáře 'Naplánované úlohy'

2010-07-12 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 08:04]

2010-08-13 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 14:50]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\ds\Data aplikací\Mozilla\Firefox\Profiles\ehza19vr.default\
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: browser.blink_allowed - true
FF - user.js: network.prefetch-next - true
FF - user.js: nglayout.initialpaint.delay - 50
FF - user.js: layout.spellcheckDefault - 1
FF - user.js: browser.urlbar.autoFill - false
FF - user.js: browser.search.openintab - false
FF - user.js: browser.tabs.closeButtons - 1
FF - user.js: browser.tabs.opentabfor.middleclick - true
FF - user.js: browser.tabs.tabMinWidth - 100
FF - user.js: browser.urlbar.hideGoButton - true
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v1.02.12c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
HKCU-Run-frwsevics - c:\documents and settings\ds\frwsevics.exe
HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
HKLM-Run-svchost - c:\windows\system32:svchost.exe
ActiveSetup-{0D0E2092-26AA-197F-AD04-42AAB7AA4C5F} - c:\windows\system32:svchost.exe



**************************************************************************
skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
svchost = c:\windows\system32:svchost.exe???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory:

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\WPAEvents]
@Denied: (Full) (LocalSystem)
"OOBETimer"=hex:ff,d5,71,d6,8b,6a,8d,6f,d5,33,93,fd
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1000)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\cscui.dll
c:\windows\system32\COMRes.dll

- - - - - - - > 'lsass.exe'(1056)
c:\windows\system32\setupapi.dll

- - - - - - - > 'explorer.exe'(6168)
c:\windows\system32\SHDOCVW.dll
c:\program files\extra\True Transparency\TrueTransparencyHook.dll
c:\program files\VisualTaskTips\VttHooks.dll
c:\windows\system32\COMRes.dll
c:\windows\System32\cscui.dll
c:\program files\Bonjour\mdnsNSP.dll
c:\windows\system32\msi.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\MSVCP60.dll
c:\program files\extra\ViOrb\StartHook.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\CTsvcCDA.exe
c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragActivityMonitor.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
.
**************************************************************************
.
Celkový čas: 2010-08-13 13:21:53 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-08-13 08:51

Před spuštěním: Volných bajtů: 31 995 908 096
Po spuštění: Volných bajtů: 31 964 594 176

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]


Ta konzola pre zotavenie je dolezita aj po ukonceni combofixu? Da sa to odinstalovat?
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 1F04BBE8EA00EA1209519DD2D74046E4

[stell]

stahni si win32kdiag http://rootrepeal.psikotick.com/Win32kDiag.exe na plochu
- spust
- po dokonceni skenu by se mel objevit Win32kDiag.txt
- jeho obsah mi vloz,

[wink624]

Running from: C:\Documents and Settings\ds\Plocha\Win32kDiag.exe

Log file at : C:\Documents and Settings\ds\Plocha\Win32kDiag.txt

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...





Finished!

iba toto mi dalo...to si asi nechcel ze?

[stell]

preco,?/prave to som chcel vediet ci tam nie je aj ina infekcia,
Pri tejto akcii je nutné mať ComboFix na ploche.

Vypni>FIREWALL>Antivir>Antispyware>vsetko rezidentne.

Otvor Notepad (Poznámkový blok) a zkopíruj do neho celý zeleny tex:

Kód: Vybrat vše

KILLALL::
Driver::
aecq
e7aiacfeoa4ay7yk
Rootkit::
c:\windows\system32\caquarev.exe
c:\windows\System32\DRIVERS\aecq.sys
Registry::
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"svchost"=-
RegLock::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\WPAEvents]
srpeek::
c:\windows\system32\winlogon.exe
c:\windows\system32\comctl32.dll
c:\windows\system32\ntoskrnl.exe
c:\windows\system32\user32.dll
c:\windows\explorer.exe
c:\windows\system32\sfcfiles.dll
c:\windows\system32\ctfmon.exe
c:\windows\system32\mspmsnsv.dll
c:\windows\system32\ntkrnlpa.exe
ADS::
c:\windows

Potom klik na Subor -> Uložiť ako.. .. -> Ako je Názov souboru tak do toho riadku napiš:CFScript.txt
Typ súboru tak tam vyberies *všetky súbory
A ulož ho na plochu.> Pozor CFScript.txt>Neotvarat a nemoze byt ani>CFScript.txt.txt A Urobis Toto :


Po skonceni skenu vlož log čo ComboFix vytvorí

[wink624]

mam este otazku ako odinstalujem tu combofix konzolu?

[stell]

hm,az pride cas, tak ti to tu napisem,zatial pc mas infikovane,,takze ak chces, tak rob to co pisem.

[wink624]

Ja som skusil pustit net a uz mi to ide v poho....nvm ako je to mozne...mohol mi ten vyr vymazat ten combofix?

[stell]

Preco nerobis to, co ti pisem

Pri tejto akcii je nutné mať ComboFix na ploche.

Vypni>FIREWALL>Antivir>Antispyware>vsetko rezidentne.

Otvor Notepad (Poznámkový blok) a zkopíruj do neho celý zeleny tex:

Kód: Vybrat vše

KILLALL::
Driver::
aecq
e7aiacfeoa4ay7yk
Rootkit::
c:\windows\system32\caquarev.exe
c:\windows\System32\DRIVERS\aecq.sys
Registry::
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"svchost"=-
RegLock::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\WPAEvents]
srpeek::
c:\windows\system32\winlogon.exe
c:\windows\system32\comctl32.dll
c:\windows\system32\ntoskrnl.exe
c:\windows\system32\user32.dll
c:\windows\explorer.exe
c:\windows\system32\sfcfiles.dll
c:\windows\system32\ctfmon.exe
c:\windows\system32\mspmsnsv.dll
c:\windows\system32\ntkrnlpa.exe
ADS::
c:\windows

Potom klik na Subor -> Uložiť ako.. .. -> Ako je Názov souboru tak do toho riadku napiš:CFScript.txt
Typ súboru tak tam vyberies *všetky súbory
A ulož ho na plochu.> Pozor CFScript.txt>Neotvarat a nemoze byt ani>CFScript.txt.txt A Urobis Toto :


Po skonceni skenu vlož log čo ComboFix vytvorí

[wink624]

ComboFix 10-08-12.03 - ds 13.08.2010 15:10:08.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1412 [GMT 4,5:30]
Spuštěný z: G:\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\ds\Plocha\CFScript.txt
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AECQ
-------\Legacy_E7AIACFEOA4AY7YK
-------\Service_aecq
-------\Service_e7aiacfeoa4ay7yk


((((((((((((((((((((((((( Soubory vytvořené od 2010-07-13 do 2010-08-13 )))))))))))))))))))))))))))))))
.

2010-08-13 09:50 . 2010-08-13 09:50 -------- d-----w- c:\program files\Skype
2010-08-13 09:50 . 2010-08-13 09:50 -------- d-----w- c:\program files\Common Files\Skype
2010-08-13 07:46 . 2010-08-13 07:46 -------- d-----w- c:\program files\trend micro
2010-08-12 20:04 . 2010-08-12 20:04 -------- d-----w- c:\program files\AxBx
2010-08-04 13:58 . 2010-08-04 13:58 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-07-28 17:14 . 2010-07-28 17:14 -------- d-----w- c:\program files\Audible
2010-07-28 17:12 . 1999-12-12 17:01 44032 ------w- c:\windows\system32\CTSVCCDA.EXE
2010-07-28 17:12 . 1999-11-17 17:00 25088 ------w- c:\windows\system32\CTSVCCTL.EXE
2010-07-28 17:12 . 2010-07-28 17:12 -------- d-----w- c:\program files\Common Files\Creative
2010-07-28 17:12 . 2010-07-28 17:12 -------- d--h--w- c:\program files\Creative Installation Information
2010-07-28 16:59 . 1999-10-10 17:00 41984 ------w- c:\windows\Ctregrun.exe
2010-07-28 16:55 . 2010-07-28 17:12 -------- d-----w- c:\program files\Creative
2010-07-20 13:56 . 2010-07-20 13:56 -------- d-----w- c:\program files\Bonjour
2010-07-20 13:50 . 2010-07-20 13:50 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-07-14 11:29 . 2010-07-14 11:29 -------- d-----w- c:\program files\QuickTime

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-13 07:13 . 2008-08-15 19:34 182912 ----a-w- c:\windows\system32\drivers\ndis.sys
2010-08-13 06:09 . 2010-07-10 18:51 -------- d-----w- c:\program files\Opera
2010-07-28 17:13 . 2010-01-15 10:54 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-20 13:56 . 2010-01-14 19:48 -------- d-----w- c:\program files\Common Files\Adobe
2010-07-13 15:51 . 2010-07-13 15:14 -------- d-----w- c:\program files\AVS4YOU
2010-07-13 15:15 . 2010-07-13 15:14 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-07-13 15:05 . 2010-07-07 17:35 -------- d-----w- c:\program files\Total Video Converter
2010-07-11 08:49 . 2010-01-15 13:33 -------- d-----w- c:\program files\AdorageI-GfxDatas
2010-07-11 08:44 . 2010-01-15 18:48 -------- d-----w- c:\program files\Ashampoo
2010-07-07 17:36 . 2010-07-07 17:36 2080 ----a-w- c:\program files\Uninstall.ini
2010-07-07 17:36 . 2009-01-07 15:54 74330 ----a-w- c:\program files\Uninstall.exe
2010-07-07 14:09 . 2010-07-07 14:09 -------- d-----w- c:\program files\Common Files\Apple
2010-07-07 14:09 . 2010-07-07 14:09 -------- d-----w- c:\program files\Apple Software Update
2010-06-21 13:44 . 2010-06-21 13:44 -------- d-----w- c:\program files\Ahead
2010-06-21 13:44 . 2010-06-21 13:44 -------- d-----w- c:\program files\Common Files\Ahead
2010-06-21 13:41 . 2010-01-14 20:04 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-06-21 13:40 . 2010-06-21 13:40 0 ----a-w- c:\windows\nsreg.dat
2010-06-21 13:36 . 2010-03-07 06:47 -------- d-----w- c:\program files\Common Files\Nero
2004-08-09 19:00 . 2010-01-15 18:20 40960 ----a-w- c:\program files\Uninstall_CDS.exe
.

(((((((((((((((((((((((((((((((((((((((((( SR_Search ))))))))))))))))))))))))))))))))))))))))))))))))))))))))

c:\documents and settings\ds\ctfmon.exe [x]
[-] D41D8CD98F00B204E9800998ECF8427E 0 \RP59\A0029638.exe
.
------- Sigcheck -------

[-] 2008-08-15 . 12A799AD9415AE9C8ABCC5F75E9CF034 . 557056 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

[-] 2008-08-15 . 97BF1C54DAF9FF61E897846DC7329CEF . 647680 . . [5.82] . . c:\windows\system32\comctl32.dll

[-] 2008-08-15 . 412C356918583DA0A3B3082F4B37B378 . 2307072 . . [5.1.2600.5512] . . c:\windows\system32\ntoskrnl.exe

[-] 2008-08-15 . CCB32D10C69A89822E9134C0C4894BE1 . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll

[-] 2008-08-15 . F0C7CFFD1165068388311C793E32C4CC . 1482240 . . [6.00.2900.5512] . . c:\windows\explorer.exe

[-] 2008-07-28 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

[-] 2008-08-15 . 94927BB89A6825C4A5952A2BF78F027B . 40960 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe

[-] 2008-07-28 21:27 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll

[-] 2008-08-15 . 8E73066FDC4A6F14261C6745E0924B5D . 2185728 . . [5.1.2600.5512] . . c:\windows\system32\ntkrnlpa.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-04-11 1276416]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-09-28 700416]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-04-10 16861184]
"VisualTaskTips"="c:\program files\VisualTaskTips\VisualTaskTips.exe" [2008-08-15 65536]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
"ViOrb"="c:\program files\extra\ViOrb\ViOrb.exe" [2008-06-15 167936]
"True transparacy"="c:\program files\extra\True Transparency\TrueTransparency.exe" [2008-06-24 372224]
"TransBar"="c:\program files\extra\TransBar\TransBar.exe" [2005-06-01 93696]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-07-01 1447168]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"RealTray"="c:\program files\K-Lite Codec Pack\Real\mpclauncher.exe" [2008-03-13 685056]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-12-04 406016]
"USBToolTip"="c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe" [2007-02-20 199752]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"RemoteControl"="c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-06-28 32768]
"DefragTaskBar"="c:\program files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe" [2008-04-18 173408]
"EPSON Stylus C62 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE" [2002-04-10 74240]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-08-15 40960]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2008-04-23 124928]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2008-6-5 479232]
PlexTools Professional.lnk - c:\program files\Plextor\PlexTool.exe [2005-3-31 5623808]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IEPro\\MiniDM.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\Studio 11\\programs\\umi.exe"=
"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 14\\Programs\\umi.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [16.8.2008 1:46 143360]
R1 LStone;Pinnacle Systems Studio AV/DV Overlay;c:\windows\system32\drivers\LStone2k.sys [15.1.2010 15:45 256113]
R1 MemAlloc;MemAlloc;c:\windows\system32\drivers\MemAlloc.sys [15.1.2010 15:45 5543]
R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [14.7.2008 9:53 468224]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3.11.2006 19:19 13592]
S3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 6\DfSdkS.exe [11.7.2010 13:14 410976]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
2008-04-23 04:16 124928 ----a-w- c:\windows\system32\advpack.dll
.
Obsah adresáře 'Naplánované úlohy'

2010-07-12 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 08:04]

2010-08-13 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 14:50]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\ds\Data aplikací\Mozilla\Firefox\Profiles\ehza19vr.default\
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: browser.blink_allowed - true
FF - user.js: network.prefetch-next - true
FF - user.js: nglayout.initialpaint.delay - 50
FF - user.js: layout.spellcheckDefault - 1
FF - user.js: browser.urlbar.autoFill - false
FF - user.js: browser.search.openintab - false
FF - user.js: browser.tabs.closeButtons - 1
FF - user.js: browser.tabs.opentabfor.middleclick - true
FF - user.js: browser.tabs.tabMinWidth - 100
FF - user.js: browser.urlbar.hideGoButton - true
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v1.02.12c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKLM-Run-svchost - c:\windows\system32:svchost.exe
ActiveSetup-{0D0E2092-26AA-197F-AD04-42AAB7AA4C5F} - c:\windows\system32:svchost.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-13 15:16
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
svchost = c:\windows\system32:svchost.exe???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

skenování skrytých souborů ...


c:\windows\system32:svchost.exe 22495 bytes executable

sken byl úspešně dokončen
skryté soubory: 1

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(992)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\cscui.dll
c:\windows\system32\COMRes.dll

- - - - - - - > 'lsass.exe'(1048)
c:\windows\system32\setupapi.dll

- - - - - - - > 'explorer.exe'(5556)
c:\windows\system32\SHDOCVW.dll
c:\program files\extra\True Transparency\TrueTransparencyHook.dll
c:\program files\VisualTaskTips\VttHooks.dll
c:\windows\system32\COMRes.dll
c:\windows\System32\cscui.dll
c:\program files\Bonjour\mdnsNSP.dll
c:\windows\system32\msi.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\MSVCP60.dll
c:\program files\extra\ViOrb\StartHook.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\CTsvcCDA.exe
c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragActivityMonitor.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
.
**************************************************************************
.
Celkový čas: 2010-08-13 15:19:46 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-08-13 10:49

Před spuštěním: Volných bajtů: 31 823 826 944
Po spuštění: Volných bajtů: 31 788 601 344

- - End Of File - - 57A3914E84CF0D6D90281BAC870C46FC

ale robiim

[stell]

Vypnut obnovu systemu-restart-a znova zapnut
Zapni zobrazovanie skrytych a systemovych suborov.


Pri tejto akcii je nutné mať ComboFix na ploche.

Vypni>FIREWALL>Antivir>Antispyware>vsetko rezidentne.

Otvor Notepad (Poznámkový blok) a zkopíruj do neho celý zeleny tex:

Kód: Vybrat vše

KILLALL::
ADS::
c:\windows\system32
Registry::
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"svchost"=-
FCOPY::
c:\windows\ServicePackFiles\i386\winlogon.exe | c:\windows\system32\winlogon.exe
c:\windows\ServicePackFiles\i386\comctl32.dll | c:\windows\system32\comctl32.dll
c:\windows\ServicePackFiles\i386\ntoskrnl.exe | c:\windows\system32\ntoskrnl.exe
c:\windows\ServicePackFiles\i386\user32.dll | c:\windows\system32\user32.dll
c:\windows\ServicePackFiles\i386\explorer.exe | c:\windows\explorer.exe
c:\windows\ServicePackFiles\i386\sfcfiles.dll | c:\windows\system32\sfcfiles.dll
c:\windows\ServicePackFiles\i386\ctfmon.exe | c:\windows\system32\ctfmon.exe
c:\windows\ServicePackFiles\i386\mspmsnsv.dll | c:\windows\system32\mspmsnsv.dll
c:\windows\ServicePackFiles\i386\ntkrnlpa.exe | c:\windows\system32\ntkrnlpa.exe
ADS::

Potom klik na Subor -> Uložiť ako.. .. -> Ako je Názov souboru tak do toho riadku napiš:CFScript.txt
Typ súboru tak tam vyberies *všetky súbory
A ulož ho na plochu.> Pozor CFScript.txt>Neotvarat a nemoze byt ani>CFScript.txt.txt A Urobis Toto :


Po skonceni skenu vlož log čo ComboFix vytvorí

[wink624]

Uz je to v poriadku dakujem...a ako teraz odinstalujem Konzolu pre zotavenie (Recovery console)?

[stell]

Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

-Spusťte,pro potvrzení volby mačkejte klávesu A, Enter
-po použití prográmek vymažte.Pozor,antiviry ho mohou falešně označit za vir