VIRY.CZ

Zdravím, moc prosím o zkontrolování logu, Spywareterminator našel nějaký spyware (celkem 62 objektů), které jsem s ním smazal, dále jsem provedl kompletní scan systému po restartu free verzí Avastu, ten našel několik trojan-genů a smazal je...

Předem děkuji za kontrolu logu.

RSIT log:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Lukáš - Česal at 2010-08-29 20:57:02
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 149 GB (64%) free of 232 GB
Total RAM: 767 MB (42% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:57:24, on 29.8.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\FsUsbExService.Exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\system32\lxczcoms.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
C:\Program Files\ICQ7.0\ICQ.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\opera.exe
C:\Documents and Settings\Lukáš - Česal\Plocha\RSIT.exe
C:\Program Files\trend micro\Lukáš - Česal.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [lxczbmgr.exe] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.0\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Program Files\Opera\Program\Plugins\NPSWF32_FlashUtil.exe -p
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: IMVU.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Lukáš - Česal\Nabídka Start\Programy\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/G ... meHost.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: FsUsbExService - Teruten - C:\WINDOWS\system32\FsUsbExService.Exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: lxcz_device - - C:\WINDOWS\system32\lxczcoms.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

--
End of file - 8076 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-07 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-07 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-12-07 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\System32\NvCpl.dll [2007-06-29 8466432]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\System32\NvMcTray.dll [2007-06-29 81920]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-04-12 16132608]
"DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe [2005-12-10 133016]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-09 153136]
"FaxCenterServer"=C:\Program Files\Lexmark Fax Solutions\fm3032.exe [2007-02-09 295856]
"lxczbmgr.exe"=C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe [2007-02-09 74672]
"NPSStartup"= []
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-06-28 2837864]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2010-08-29 2176512]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-03-12 153136]
"SMSystemAnalyzer"=C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe [2006-05-03 556544]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]
"AutoStartNPSAgent"=C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [2009-10-08 107864]
"ICQ"=C:\Program Files\ICQ7.0\ICQ.exe [2010-08-22 133432]
"SpywareTerminatorUpdate"=C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2010-08-29 3037696]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"=C:\Program Files\Opera\Program\Plugins\NPSWF32_FlashUtil.exe [2010-01-27 256280]

C:\Documents and Settings\Lukáš - Česal\Nabídka Start\Programy\Po spuštění
IMVU.lnk - C:\Documents and Settings\Lukáš - Česal\Data aplikací\IMVUClient\IMVUQualityAgent.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe"="C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\Program Files\Return to Castle Wolfenstein\WolfMP.exe"="C:\Program Files\Return to Castle Wolfenstein\WolfMP.exe:*:Enabled:WolfMP"
"C:\Program Files\MotoGP2 Demo\motogp2_demo.exe"="C:\Program Files\MotoGP2 Demo\motogp2_demo.exe:*:Enabled:motogp2_demo"
"C:\Program Files\Rockstar Games\Midnight Club II Demo\mc2_demo.exe"="C:\Program Files\Rockstar Games\Midnight Club II Demo\mc2_demo.exe:*:Enabled:mc2_demo"
"C:\Program Files\THQ\Juiced\Juiced.exe"="C:\Program Files\THQ\Juiced\Juiced.exe:*:Enabled:Juiced"
"C:\WINDOWS\system32\lxczcoms.exe"="C:\WINDOWS\system32\lxczcoms.exe:*:Enabled:Lexmark Communications System"
"C:\Program Files\NovaLogic\Joint Operations Typhoon Rising\Jointops.exe"="C:\Program Files\NovaLogic\Joint Operations Typhoon Rising\Jointops.exe:*:Enabled:Jointops"
"C:\Program Files\ICQ6\ICQ.exe"="C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\ICQ7.0\ICQ.exe"="C:\Program Files\ICQ7.0\ICQ.exe:*:Enabled:ICQ7"
"C:\Program Files\ICQ7.0\aolload.exe"="C:\Program Files\ICQ7.0\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe"="C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe:*:Enabled:KTF MUSIC AoD Server"
"C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe"="C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe:*:Enabled:KTF MUSIC VoD Server"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7.0\ICQ.exe"="C:\Program Files\ICQ7.0\ICQ.exe:*:Enabled:ICQ7"
"C:\Program Files\ICQ7.0\aolload.exe"="C:\Program Files\ICQ7.0\aolload.exe:*:Enabled:aolload.exe"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-08-29 18:22:21 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2010-08-29 18:16:03 ----A---- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2010-08-29 18:16:00 ----D---- C:\Documents and Settings\Lukáš - Česal\Data aplikací\Spyware Terminator
2010-08-29 18:15:52 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2010-08-29 18:15:46 ----D---- C:\Program Files\Spyware Terminator
2010-08-29 18:02:17 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2010-08-29 18:02:17 ----A---- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2010-08-29 18:02:16 ----A---- C:\WINDOWS\system32\drivers\aswRdr.sys
2010-08-29 18:02:15 ----A---- C:\WINDOWS\system32\drivers\aswTdi.sys
2010-08-29 18:02:13 ----A---- C:\WINDOWS\system32\drivers\aswmon2.sys
2010-08-29 18:02:13 ----A---- C:\WINDOWS\system32\drivers\aswmon.sys
2010-08-29 18:02:13 ----A---- C:\WINDOWS\system32\drivers\aavmker4.sys
2010-08-29 18:02:07 ----SHD---- C:\Config.Msi
2010-08-29 18:01:57 ----A---- C:\WINDOWS\system32\aswBoot.exe
2010-08-29 17:50:21 ----A---- C:\WINDOWS\OEWABLog.txt
2010-08-29 17:49:19 ----D---- C:\WINDOWS\Prefetch
2010-08-29 17:43:57 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$
2010-08-29 17:43:09 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2010-08-29 17:42:18 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2010-08-29 17:41:31 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2010-08-29 17:40:40 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2010-08-29 17:39:49 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2010-08-29 17:38:58 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2010-08-29 17:38:07 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2010-08-29 17:37:14 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2010-08-29 17:36:22 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2010-08-29 17:35:30 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2010-08-29 17:34:39 ----HDC---- C:\WINDOWS\$NtUninstallKB2229593$
2010-08-29 17:32:37 ----A---- C:\WINDOWS\setuplog.txt
2010-08-29 17:31:35 ----N---- C:\WINDOWS\system32\msxml6r.dll
2010-08-29 17:31:34 ----N---- C:\WINDOWS\system32\msxml6.dll
2010-08-29 17:31:22 ----N---- C:\WINDOWS\system32\azroles.dll
2010-08-29 17:31:22 ----N---- C:\WINDOWS\system32\aaclient.dll
2010-08-29 17:31:21 ----N---- C:\WINDOWS\system32\dot3ui.dll
2010-08-29 17:31:21 ----N---- C:\WINDOWS\system32\dot3svc.dll
2010-08-29 17:31:21 ----N---- C:\WINDOWS\system32\dot3msm.dll
2010-08-29 17:31:21 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll
2010-08-29 17:31:21 ----N---- C:\WINDOWS\system32\dot3dlg.dll
2010-08-29 17:31:21 ----N---- C:\WINDOWS\system32\dot3cfg.dll
2010-08-29 17:31:21 ----N---- C:\WINDOWS\system32\dot3api.dll
2010-08-29 17:31:21 ----N---- C:\WINDOWS\system32\dimsroam.dll
2010-08-29 17:31:21 ----N---- C:\WINDOWS\system32\dimsntfy.dll
2010-08-29 17:31:21 ----N---- C:\WINDOWS\system32\dhcpqec.dll
2010-08-29 17:31:21 ----N---- C:\WINDOWS\system32\credssp.dll
2010-08-29 17:31:21 ----N---- C:\WINDOWS\system32\bitsprx4.dll
2010-08-29 17:31:20 ----N---- C:\WINDOWS\system32\eapsvc.dll
2010-08-29 17:31:20 ----N---- C:\WINDOWS\system32\eapqec.dll
2010-08-29 17:31:20 ----N---- C:\WINDOWS\system32\eappprxy.dll
2010-08-29 17:31:20 ----N---- C:\WINDOWS\system32\eapphost.dll
2010-08-29 17:31:20 ----N---- C:\WINDOWS\system32\eappgnui.dll
2010-08-29 17:31:20 ----N---- C:\WINDOWS\system32\eappcfg.dll
2010-08-29 17:31:20 ----N---- C:\WINDOWS\system32\eapp3hst.dll
2010-08-29 17:31:20 ----N---- C:\WINDOWS\system32\eapolqec.dll
2010-08-29 17:31:19 ----N---- C:\WINDOWS\system32\kbdnepr.dll
2010-08-29 17:31:19 ----N---- C:\WINDOWS\system32\kbdiultn.dll
2010-08-29 17:31:19 ----N---- C:\WINDOWS\system32\kbdbhc.dll
2010-08-29 17:31:18 ----N---- C:\WINDOWS\system32\mmcperf.exe
2010-08-29 17:31:18 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll
2010-08-29 17:31:18 ----N---- C:\WINDOWS\system32\mmcex.dll
2010-08-29 17:31:18 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll
2010-08-29 17:31:18 ----N---- C:\WINDOWS\system32\l2gpstore.dll
2010-08-29 17:31:18 ----N---- C:\WINDOWS\system32\kmsvc.dll
2010-08-29 17:31:18 ----N---- C:\WINDOWS\system32\kbdpash.dll
2010-08-29 17:31:17 ----N---- C:\WINDOWS\system32\onex.dll
2010-08-29 17:31:17 ----N---- C:\WINDOWS\system32\napstat.exe
2010-08-29 17:31:17 ----N---- C:\WINDOWS\system32\napmontr.dll
2010-08-29 17:31:17 ----N---- C:\WINDOWS\system32\napipsec.dll
2010-08-29 17:31:17 ----N---- C:\WINDOWS\system32\msshavmsg.dll
2010-08-29 17:31:17 ----N---- C:\WINDOWS\system32\mssha.dll
2010-08-29 17:31:16 ----N---- C:\WINDOWS\system32\setupn.exe
2010-08-29 17:31:16 ----N---- C:\WINDOWS\system32\rhttpaa.dll
2010-08-29 17:31:16 ----N---- C:\WINDOWS\system32\rasqec.dll
2010-08-29 17:31:16 ----N---- C:\WINDOWS\system32\qutil.dll
2010-08-29 17:31:16 ----N---- C:\WINDOWS\system32\qcliprov.dll
2010-08-29 17:31:16 ----N---- C:\WINDOWS\system32\qagentrt.dll
2010-08-29 17:31:16 ----N---- C:\WINDOWS\system32\qagent.dll
2010-08-29 17:31:16 ----N---- C:\WINDOWS\system32\photometadatahandler.dll
2010-08-29 17:31:15 ----N---- C:\WINDOWS\system32\tspkg.dll
2010-08-29 17:31:15 ----N---- C:\WINDOWS\system32\tsgqec.dll
2010-08-29 17:31:14 ----N---- C:\WINDOWS\system32\wmphoto.dll
2010-08-29 17:31:14 ----N---- C:\WINDOWS\system32\wlanapi.dll
2010-08-29 17:31:14 ----N---- C:\WINDOWS\system32\windowscodecsext.dll
2010-08-29 17:31:14 ----N---- C:\WINDOWS\system32\windowscodecs.dll
2010-08-29 17:31:14 ----N---- C:\WINDOWS\system32\verclsid.exe
2010-08-29 17:31:13 ----N---- C:\WINDOWS\system32\xmllite.dll
2010-08-29 17:31:12 ----D---- C:\WINDOWS\system32\cs-cz
2010-08-29 17:31:12 ----D---- C:\WINDOWS\l2schemas
2010-08-29 17:31:11 ----D---- C:\WINDOWS\system32\cs
2010-08-29 17:31:11 ----D---- C:\WINDOWS\system32\bits
2010-08-29 17:26:35 ----D---- C:\WINDOWS\network diagnostic
2010-08-29 17:26:32 ----N---- C:\WINDOWS\system32\drivers\sffp_mmc.sys
2010-08-29 17:25:40 ----A---- C:\WINDOWS\004941_.tmp
2010-08-29 17:04:33 ----D---- C:\Program Files\CCleaner
2010-07-30 12:01:07 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2010-07-30 12:00:53 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$

======List of files/folders modified in the last 1 months======

2010-08-29 20:57:14 ----D---- C:\Program Files\trend micro
2010-08-29 20:55:01 ----D---- C:\WINDOWS\Temp
2010-08-29 20:39:51 ----A---- C:\WINDOWS\NeroDigital.ini
2010-08-29 20:33:29 ----D---- C:\WINDOWS
2010-08-29 20:29:15 ----D---- C:\WINDOWS\system32
2010-08-29 18:28:45 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-08-29 18:28:43 ----D---- C:\WINDOWS\system32\CatRoot2
2010-08-29 18:28:31 ----A---- C:\WINDOWS\wincmd.ini
2010-08-29 18:27:20 ----RD---- C:\Program Files
2010-08-29 18:24:42 ----SHD---- C:\WINDOWS\Installer
2010-08-29 18:22:28 ----D---- C:\Program Files\Common Files\Adobe
2010-08-29 18:19:58 ----D---- C:\Program Files\Adobe
2010-08-29 18:16:04 ----D---- C:\WINDOWS\system32\drivers
2010-08-29 18:16:03 ----HD---- C:\WINDOWS\inf
2010-08-29 18:11:36 ----HD---- C:\WINDOWS\$hf_mig$
2010-08-29 18:02:10 ----D---- C:\WINDOWS\WinSxS
2010-08-29 17:51:07 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-08-29 17:50:07 ----D---- C:\WINDOWS\Debug
2010-08-29 17:48:54 ----D---- C:\WINDOWS\system32\Setup
2010-08-29 17:48:54 ----D---- C:\Program Files\Messenger
2010-08-29 17:48:53 ----D---- C:\WINDOWS\system32\wbem
2010-08-29 17:48:53 ----D---- C:\WINDOWS\AppPatch
2010-08-29 17:48:53 ----D---- C:\Program Files\Outlook Express
2010-08-29 17:48:53 ----D---- C:\Program Files\Common Files\System
2010-08-29 17:48:52 ----RSD---- C:\WINDOWS\Fonts
2010-08-29 17:48:12 ----D---- C:\WINDOWS\security
2010-08-29 17:44:24 ----D---- C:\WINDOWS\system32\CatRoot
2010-08-29 17:44:23 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-08-29 17:31:34 ----D---- C:\Program Files\Windows Media Player
2010-08-29 17:31:33 ----D---- C:\WINDOWS\Help
2010-08-29 17:31:24 ----D---- C:\WINDOWS\ime
2010-08-29 17:31:12 ----D---- C:\WINDOWS\system32\usmt
2010-08-29 17:31:12 ----D---- C:\Program Files\Internet Explorer
2010-08-29 17:31:11 ----D---- C:\WINDOWS\peernet
2010-08-29 17:31:11 ----D---- C:\Program Files\Movie Maker
2010-08-29 17:28:31 ----D---- C:\WINDOWS\system32\Restore
2010-08-29 17:28:31 ----D---- C:\WINDOWS\system32\npp
2010-08-29 17:28:29 ----D---- C:\WINDOWS\msagent
2010-08-29 17:28:28 ----D---- C:\WINDOWS\srchasst
2010-08-29 17:28:27 ----D---- C:\Program Files\NetMeeting
2010-08-29 17:28:26 ----D---- C:\WINDOWS\system32\Com
2010-08-29 17:28:23 ----D---- C:\Program Files\Windows NT
2010-08-29 17:28:03 ----D---- C:\WINDOWS\system32\oobe
2010-08-29 17:28:01 ----D---- C:\WINDOWS\system
2010-08-29 17:25:37 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-08-29 17:25:30 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2010-08-29 17:22:32 ----D---- C:\WINDOWS\EHome
2010-08-29 17:17:17 ----D---- C:\Program Files\WinRAR
2010-08-29 17:06:05 ----D---- C:\WINDOWS\Minidump
2010-08-29 16:37:48 ----D---- C:\Program Files\AIMP Classic
2010-08-29 16:37:09 ----D---- C:\Documents and Settings\Lukáš - Česal\Data aplikací\ICQ
2010-08-29 16:33:38 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-08-29 16:28:21 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2010-08-29 16:24:55 ----HD---- C:\Program Files\InstallShield Installation Information
2010-08-29 16:12:52 ----D---- C:\Documents and Settings\Lukáš - Česal\Data aplikací\Vso
2010-08-29 16:12:51 ----A---- C:\Documents and Settings\Lukáš - Česal\Data aplikací\inst.exe
2010-08-29 16:12:33 ----D---- C:\Program Files\AVS4YOU
2010-08-29 16:10:44 ----D---- C:\Program Files\Lavasoft
2010-08-29 16:10:44 ----D---- C:\Documents and Settings\All Users\Data aplikací\Lavasoft
2010-08-29 16:10:23 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-08-23 19:49:01 ----D---- C:\Program Files\ICQ7.0
2010-08-17 19:15:54 ----SD---- C:\WINDOWS\Tasks
2010-08-16 07:22:34 ----D---- C:\Program Files\Mozilla Firefox
2010-08-06 22:32:31 ----D---- C:\Documents and Settings\Lukáš - Česal\Data aplikací\Skype
2010-08-06 20:38:23 ----D---- C:\Documents and Settings\Lukáš - Česal\Data aplikací\skypePM
2010-08-04 22:27:44 ----A---- C:\WINDOWS\PhotoSnapViewer.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI Texas Instruments; C:\WINDOWS\System32\DRIVERS\ohci1394.sys [2008-04-14 61696]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2006-05-16 46080]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2007-07-28 642560]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-06-28 28880]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-06-28 165456]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-06-28 46672]
R1 FileDisk;FileDisk; C:\WINDOWS\system32\drivers\FileDisk.sys [2006-03-28 9341]
R1 fwdrv;Firewall Driver; C:\WINDOWS\system32\drivers\fwdrv.sys [2005-09-26 286720]
R1 khips;Kerio HIPS Driver; C:\WINDOWS\system32\drivers\khips.sys [2005-09-26 81920]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-06-28 17744]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-06-28 100176]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-06-28 23376]
R3 dtscsi;dtscsi; C:\WINDOWS\System32\Drivers\dtscsi.sys [2007-07-28 223128]
R3 FsUsbExDisk;FsUsbExDisk; \??\C:\WINDOWS\system32\FsUsbExDisk.SYS []
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\System32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-04-23 4402176]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2007-06-29 6807328]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2008-09-19 290432]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 ezplay;VSO Software ezplay; C:\WINDOWS\System32\Drivers\ezplay.sys [2007-08-03 94208]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632]
S3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2007-08-03 47360]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM); C:\WINDOWS\system32\DRIVERS\ss_bbus.sys [2009-03-20 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter); C:\WINDOWS\system32\DRIVERS\ss_bmdfl.sys [2009-03-20 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem; C:\WINDOWS\system32\DRIVERS\ss_bmdm.sys [2009-03-20 121856]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 vaxscsi;vaxscsi; C:\WINDOWS\System32\Drivers\vaxscsi.sys [2007-07-28 223128]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2004-08-11 18944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]
R2 FsUsbExService;FsUsbExService; C:\WINDOWS\system32\FsUsbExService.Exe [2009-10-08 238952]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-12-07 152984]
R2 KPF4;Kerio Personal Firewall 4; C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe [2005-10-10 1617920]
R2 lxcz_device;lxcz_device; C:\WINDOWS\system32\lxczcoms.exe [2007-02-09 537520]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\System32\nvsvc32.exe [2007-06-29 155716]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2010-08-29 488960]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
R2 yksvc;Marvell Yukon Service; ykx32mpcoinst,serviceStartProc []
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-06-28 40384]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-03-12 271920]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-15 774144]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592]

-----------------EOF-----------------

Zdravim a pekne rano preji

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Vložte do PC vsechny USB klice (flash disky, ext.disky apod.)
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte

Zdravím, měl jsem dnes trochu špatnej den, takže jsem se ktomu dostal až teď...

Při spuštění Combofixu mi vyběhlo malé okno bez textu s buttonen "OK", po odklepnutí widle vyhlásily něco ve smyslu runtime erroru a nemožnost přístupu do paměti + hexdec adresa 0xffblabla, následně proběhl scan, asi 20 minut.

Log je zde: http://leteckaposta.cz/981176888

neboť mi zde na foru nechtělo phpBB akceptovat jakoukoli příponu...

Zatím moc děkuji.

Ja sem log pro prehlednost vlozim (vynechavam cast SnapShot)

ComboFix 10-08-29.04 - Lukáš - Česal 30.08.2010 20:05:06.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.767.537 [GMT 2:00]
Spuštěný z: C:\Documents and Settings\Lukáš - Česal\Plocha\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Kerio Personal Firewall *disabled* {333BECA0-DED8-4139-A516-8D9E44E22669}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-07-28 do 2010-08-30 )))))))))))))))))))))))))))))))
.

2010-08-29 21:10:22 . 2010-08-29 21:15:14 -------- d-----w- C:\Program Files\ACD Systems
2010-08-29 21:10:22 . 2010-08-29 21:10:28 -------- d-----w- C:\Program Files\Common Files\ACD Systems
2010-08-29 21:09:15 . 2010-08-29 21:09:15 -------- d-----w- C:\WINDOWS\Downloaded Installations
2010-08-29 20:20:38 . 2010-08-29 20:20:38 -------- d-----w- C:\Program Files\GRETECH
2010-08-29 16:16:03 . 2010-08-29 16:16:03 142592 ----a-w- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2010-08-29 16:15:46 . 2010-08-29 16:27:17 -------- d-----w- C:\Program Files\Spyware Terminator
2010-08-29 16:13:04 . 2009-08-13 15:24:20 512000 -c----w- C:\WINDOWS\system32\dllcache\jscript.dll
2010-08-29 16:11:32 . 2010-06-21 15:27:11 354304 -c----w- C:\WINDOWS\system32\dllcache\srv.sys
2010-08-29 16:10:49 . 2010-04-28 18:15:40 2192128 -c----w- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2010-08-29 16:10:49 . 2010-04-28 05:45:38 2068992 -c----w- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2010-08-29 16:10:49 . 2010-04-28 05:45:31 2148352 -c----w- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2010-08-29 16:10:49 . 2010-04-28 05:45:30 2026496 -c----w- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2010-08-29 16:05:19 . 2008-10-15 16:38:26 337408 -c----w- C:\WINDOWS\system32\dllcache\netapi32.dll
2010-08-29 16:02:17 . 2010-06-28 20:37:30 165456 ----a-w- C:\WINDOWS\system32\drivers\aswSP.sys
2010-08-29 16:02:17 . 2010-06-28 20:32:33 17744 ----a-w- C:\WINDOWS\system32\drivers\aswFsBlk.sys
2010-08-29 16:02:16 . 2010-06-28 20:33:13 23376 ----a-w- C:\WINDOWS\system32\drivers\aswRdr.sys
2010-08-29 16:02:15 . 2010-06-28 20:37:52 46672 ----a-w- C:\WINDOWS\system32\drivers\aswTdi.sys
2010-08-29 16:02:13 . 2010-06-28 20:32:45 100176 ----a-w- C:\WINDOWS\system32\drivers\aswmon2.sys
2010-08-29 16:02:13 . 2010-06-28 20:32:42 94544 ----a-w- C:\WINDOWS\system32\drivers\aswmon.sys
2010-08-29 16:02:13 . 2010-06-28 20:32:16 28880 ----a-w- C:\WINDOWS\system32\drivers\aavmker4.sys
2010-08-29 16:01:57 . 2010-06-28 20:57:33 38848 ----a-w- C:\WINDOWS\avastSS.scr
2010-08-29 16:01:57 . 2010-06-28 20:57:12 165032 ----a-w- C:\WINDOWS\system32\aswBoot.exe
2010-08-29 15:28:19 . 2008-04-14 06:52:20 294912 -c----w- C:\WINDOWS\system32\dllcache\dlimport.exe
2010-08-29 15:26:32 . 2008-04-13 22:10:50 10240 ------w- C:\WINDOWS\system32\drivers\sffp_mmc.sys
2010-08-29 15:04:33 . 2010-08-29 15:04:34 -------- d-----w- C:\Program Files\CCleaner

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-30 17:51:54 . 2001-10-25 12:00:00 47206 ----a-w- C:\WINDOWS\system32\perfc005.dat
2010-08-30 17:51:54 . 2001-10-25 12:00:00 312970 ----a-w- C:\WINDOWS\system32\perfh005.dat
2010-08-29 20:44:07 . 2010-08-29 20:44:07 -------- d-----w- C:\Program Files\Realtek
2010-08-29 20:44:07 . 2007-07-28 19:24:11 -------- d--h--w- C:\Program Files\InstallShield Installation Information
2010-08-29 20:31:38 . 2008-12-07 18:57:55 -------- d-----w- C:\Program Files\DivX
2010-08-29 20:30:45 . 2007-07-28 19:52:00 -------- d-----w- C:\Program Files\BSplayer Pro
2010-08-29 18:57:14 . 2009-08-06 03:52:44 -------- d-----w- C:\Program Files\trend micro
2010-08-29 16:22:28 . 2007-07-28 20:08:52 -------- d-----w- C:\Program Files\Common Files\Adobe
2010-08-29 15:48:14 . 2007-07-28 19:47:48 96384 ----a-w- C:\WINDOWS\system32\drivers\sptd8349.sys
2010-08-29 15:33:27 . 2007-07-28 19:13:32 76487 ----a-w- C:\WINDOWS\PCHealth\HelpCtr\OfflineCache\index.dat
2010-08-29 15:33:27 . 2007-07-28 19:13:31 2982 ----a-w- C:\WINDOWS\PCHealth\HelpCtr\PackageStore\SkuStore.bin
2010-08-29 14:37:48 . 2007-08-03 18:11:45 -------- d-----w- C:\Program Files\AIMP Classic
2010-08-29 14:33:38 . 2007-07-28 19:50:33 -------- d-----w- C:\Program Files\Spybot - Search & Destroy
2010-08-29 14:12:33 . 2007-08-03 18:01:12 -------- d-----w- C:\Program Files\AVS4YOU
2010-08-29 14:10:44 . 2009-05-16 11:10:51 -------- d-----w- C:\Program Files\Lavasoft
2010-08-23 17:49:01 . 2010-03-04 18:00:31 -------- d-----w- C:\Program Files\ICQ7.0
2010-07-29 16:54:10 . 2010-07-29 16:54:10 -------- d-----w- C:\Program Files\MSXML 4.0
2010-07-29 08:10:32 . 2010-07-29 08:03:45 -------- d-----w- C:\Program Files\Samsung
2010-07-29 08:09:49 . 2010-07-29 08:08:30 -------- d-----w- C:\Program Files\DIFX
2010-07-29 08:09:36 . 2010-07-29 08:04:59 -------- d-----w- C:\Program Files\PC Connectivity Solution
2010-07-29 08:05:03 . 2010-07-29 08:05:03 -------- d-----w- C:\Program Files\MarkAny
2010-07-29 07:50:50 . 2007-07-28 20:02:50 -------- d-----w- C:\Program Files\Alwil Software
2010-07-28 16:27:58 . 2010-08-29 20:44:18 84584 ----a-w- C:\WINDOWS\SOUNDMAN.EXE
2010-07-28 16:27:58 . 2010-08-29 20:44:18 359016 ----a-w- C:\WINDOWS\vncutil.exe
2010-07-28 16:27:58 . 2010-08-29 20:44:18 1833576 ----a-w- C:\WINDOWS\SkyTel.exe
2010-07-28 16:27:48 . 2010-08-29 20:44:17 1489512 ----a-w- C:\WINDOWS\RtlUpd.exe
2010-07-28 16:27:48 . 2010-08-29 20:44:16 9721960 ----a-w- C:\WINDOWS\RTLCPL.EXE
2010-07-28 16:27:36 . 2010-08-29 20:44:16 6108776 ----a-w- C:\WINDOWS\system32\drivers\RtkHDAud.sys
2010-07-28 16:27:36 . 2010-08-29 20:44:15 53864 ----a-w- C:\WINDOWS\system32\RtkCoInstXP.dll
2010-07-28 16:27:24 . 2010-08-29 20:44:15 129640 ----a-w- C:\WINDOWS\RtkAudioService.exe
2010-07-28 16:27:24 . 2010-08-29 20:44:13 19557480 ----a-w- C:\WINDOWS\RTHDCPL.EXE
2010-07-28 16:27:12 . 2010-08-29 20:44:12 2180712 ----a-w- C:\WINDOWS\MicCal.exe
2010-07-28 16:27:02 . 2010-08-29 20:44:07 64104 ----a-w- C:\WINDOWS\ALCMTR.EXE
2010-07-28 16:27:02 . 2010-08-29 20:44:07 2815592 ----a-w- C:\WINDOWS\ALCWZRD.EXE
2010-07-27 11:54:00 . 2010-08-29 20:44:00 1251944 ----a-w- C:\WINDOWS\RtlExUpd.dll
2010-07-01 18:30:11 . 2010-07-01 18:30:06 -------- d-----r- C:\Program Files\Skype
2010-07-01 18:30:10 . 2010-07-01 18:30:10 -------- d-----w- C:\Program Files\Common Files\Skype
2010-06-30 12:33:04 . 2002-09-20 17:04:42 149504 ----a-w- C:\WINDOWS\system32\schannel.dll
2010-06-24 12:12:34 . 2002-09-20 17:05:00 668160 ----a-w- C:\WINDOWS\system32\wininet.dll
2010-06-24 12:12:33 . 2007-07-28 19:32:59 81920 ------w- C:\WINDOWS\system32\ieencode.dll
2010-06-24 09:02:48 . 2002-09-20 16:41:20 1851904 ----a-w- C:\WINDOWS\system32\win32k.sys
2010-06-21 15:27:11 . 2001-10-25 12:00:00 354304 ----a-w- C:\WINDOWS\system32\drivers\srv.sys
2010-06-17 14:03:52 . 2001-10-25 12:00:00 80384 ----a-w- C:\WINDOWS\system32\iccvid.dll
2010-06-14 14:31:20 . 2007-07-28 19:11:49 744448 ----a-w- C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpsvc.exe
2010-06-14 07:43:17 . 2002-09-20 17:04:32 1172480 ----a-w- C:\WINDOWS\system32\msxml3.dll
2006-05-31 05:39:02 . 2006-05-31 05:39:02 181745 ----a-w- C:\Program Files\JUN2006_XACT_x64.cab
2006-05-31 05:39:00 . 2006-05-31 05:39:00 41998 ----a-w- C:\Program Files\dxdllreg_x86.cab
2006-05-31 05:39:00 . 2006-05-31 05:39:00 134631 ----a-w- C:\Program Files\JUN2006_XACT_x86.cab
2006-05-31 05:25:40 . 2006-05-31 05:25:40 82190 ----a-w- C:\Program Files\dxupdate.cab
2006-05-31 05:24:34 . 2006-05-31 05:24:34 2248984 ----a-w- C:\Program Files\dsetup32.dll
2006-05-31 05:23:38 . 2006-05-31 05:23:38 484632 ----a-w- C:\Program Files\DXSETUP.exe
2006-05-31 05:22:50 . 2006-05-31 05:22:50 74520 ----a-w- C:\Program Files\DSETUP.dll
2006-03-31 11:56:54 . 2006-03-31 11:56:54 4163518 ------w- C:\Program Files\Apr2006_MDX1_x86_Archive.cab
2006-03-31 11:56:52 . 2006-03-31 11:56:52 917318 ------w- C:\Program Files\Apr2006_MDX1_x86.cab
2006-03-31 11:56:52 . 2006-03-31 11:56:52 1398718 ------w- C:\Program Files\Apr2006_d3dx9_30_x64.cab
2006-03-31 11:56:52 . 2006-03-31 11:56:52 1116109 ------w- C:\Program Files\Apr2006_d3dx9_30_x86.cab
2006-03-31 11:56:48 . 2006-03-31 11:56:48 180021 ------w- C:\Program Files\Apr2006_XACT_x64.cab
2006-03-31 11:56:46 . 2006-03-31 11:56:46 87989 ------w- C:\Program Files\Apr2006_xinput_x64.cab
2006-03-31 11:56:46 . 2006-03-31 11:56:46 46898 ------w- C:\Program Files\Apr2006_xinput_x86.cab
2006-03-31 11:56:44 . 2006-03-31 11:56:44 133991 ------w- C:\Program Files\Apr2006_XACT_x86.cab
2006-02-03 08:00:54 . 2006-02-03 08:00:54 1363684 ------w- C:\Program Files\Feb2006_d3dx9_29_x64.cab
2006-02-03 08:00:50 . 2006-02-03 08:00:50 1085608 ------w- C:\Program Files\Feb2006_d3dx9_29_x86.cab
2006-02-03 08:00:48 . 2006-02-03 08:00:48 179247 ------w- C:\Program Files\Feb2006_XACT_x64.cab
2006-02-03 08:00:48 . 2006-02-03 08:00:48 133297 ------w- C:\Program Files\Feb2006_XACT_x86.cab
2005-12-05 17:31:22 . 2005-12-05 17:31:22 1358864 ------w- C:\Program Files\Dec2005_d3dx9_28_x64.cab
2005-12-05 17:31:22 . 2005-12-05 17:31:22 1080344 ------w- C:\Program Files\Dec2005_d3dx9_28_x86.cab
2005-12-05 17:31:12 . 2005-12-05 17:31:12 86925 ------w- C:\Program Files\Oct2005_xinput_x64.cab
2005-12-05 17:31:12 . 2005-12-05 17:31:12 46247 ------w- C:\Program Files\Oct2005_xinput_x86.cab
2005-07-22 18:14:08 . 2005-07-22 18:14:08 1351430 ------w- C:\Program Files\Aug2005_d3dx9_27_x64.cab
2005-07-22 18:14:08 . 2005-07-22 18:14:08 1078532 ------w- C:\Program Files\Aug2005_d3dx9_27_x86.cab
2005-05-26 13:49:30 . 2005-05-26 13:49:30 1336890 ------w- C:\Program Files\Jun2005_d3dx9_26_x64.cab
2005-05-26 13:49:30 . 2005-05-26 13:49:30 1065813 ------w- C:\Program Files\Jun2005_d3dx9_26_x86.cab
2005-03-18 16:40:20 . 2005-03-18 16:40:20 1348242 ------w- C:\Program Files\Apr2005_d3dx9_25_x64.cab
2005-03-18 16:40:20 . 2005-03-18 16:40:20 1079850 ------w- C:\Program Files\Apr2005_d3dx9_25_x86.cab
2005-02-05 19:03:26 . 2005-02-05 19:03:26 1248387 ------w- C:\Program Files\Feb2005_d3dx9_24_x64.cab
2005-02-05 19:03:24 . 2005-02-05 19:03:24 1014113 ------w- C:\Program Files\Feb2005_d3dx9_24_x86.cab
2004-09-27 10:29:52 . 2004-09-27 10:29:52 13265040 ------w- C:\Program Files\dxnt.cab
2004-09-27 10:29:48 . 2004-09-27 10:29:48 15493481 ------w- C:\Program Files\DirectX.cab
2004-09-27 10:29:46 . 2004-09-27 10:29:46 976020 ------w- C:\Program Files\BDAXP.cab
2004-09-27 10:29:46 . 2004-09-27 10:29:46 703080 ------w- C:\Program Files\BDA.cab
2004-09-27 10:29:46 . 2004-09-27 10:29:46 1156363 ------w- C:\Program Files\BDANT.cab

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 11:49:26 153136]
"SMSystemAnalyzer"="C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe" [2006-05-03 14:29:56 556544]
"AutoStartNPSAgent"="C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-10-08 10:01:32 107864]
"ICQ"="C:\Program Files\ICQ7.0\ICQ.exe" [2010-08-22 11:02:26 133432]
"SpywareTerminatorUpdate"="C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-08-29 16:16:04 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2007-06-28 22:43:00 8466432]
"nwiz"="nwiz.exe" [2007-06-28 22:43:00 1626112]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2007-06-28 22:43:00 81920]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 14:57:19 133016]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 16:53:56 153136]
"FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2007-02-08 22:56:06 295856]
"lxczbmgr.exe"="C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe" [2007-02-08 22:52:51 74672]
"avast5"="C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 20:57:18 2837864]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2010-08-29 16:16:03 2176512]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 23:57:28 35760]
"Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 13:57:56 948672]
"RTHDCPL"="RTHDCPL.EXE" [2010-07-28 16:27:24 19557480]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 06:52:18 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"C:\\Program Files\\Return to Castle Wolfenstein\\WolfMP.exe"=
"C:\\Program Files\\THQ\\Juiced\\Juiced.exe"=
"C:\\WINDOWS\\system32\\lxczcoms.exe"=
"C:\\Program Files\\NovaLogic\\Joint Operations Typhoon Rising\\Jointops.exe"=
"C:\\Program Files\\ICQ7.0\\ICQ.exe"=
"C:\\Program Files\\ICQ7.0\\aolload.exe"=
"C:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"C:\\Program Files\\Samsung\\Samsung New PC Studio\\npsasvr.exe"=
"C:\\Program Files\\Samsung\\Samsung New PC Studio\\npsvsvr.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 aswSP;aswSP;C:\WINDOWS\system32\drivers\aswSP.sys [29.8.2010 18:02:17 165456]
R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [26.9.2005 11:05:06 286720]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [26.9.2005 11:05:06 81920]
R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [29.8.2010 18:16:03 142592]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\drivers\aswFsBlk.sys [29.8.2010 18:02:17 17744]
R2 FsUsbExService;FsUsbExService;C:\WINDOWS\system32\FsUsbExService.Exe [29.7.2010 10:08:17 238952]
R2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32mpcoinst,serviceStartProc --> RUNDLL32.EXE ykx32mpcoinst,serviceStartProc [?]
R3 FsUsbExDisk;FsUsbExDisk;C:\WINDOWS\system32\FsUsbExDisk.Sys [29.7.2010 10:08:17 36608]
S3 Ambfilt;Ambfilt;C:\WINDOWS\system32\drivers\Ambfilt.sys [29.8.2010 22:44:08 1691480]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);C:\WINDOWS\system32\drivers\ss_bbus.sys [29.7.2010 10:09:06 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);C:\WINDOWS\system32\drivers\ss_bmdfl.sys [29.7.2010 10:09:07 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;C:\WINDOWS\system32\drivers\ss_bmdm.sys [29.7.2010 10:09:07 121856]
S3 vaxscsi;vaxscsi;C:\WINDOWS\system32\drivers\vaxscsi.sys [28.7.2007 21:49:03 223128]
S4 sptd;sptd;C:\WINDOWS\system32\drivers\sptd.sys [28.7.2007 21:47:48 642560]
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
IE: E&xportovat do aplikace Microsoft Office Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Lukáš - Česal\Nabídka Start\Programy\IMVU\Run IMVU.lnk
FF - ProfilePath - C:\Documents and Settings\Lukáš - Česal\Data aplikací\Mozilla\Firefox\Profiles\873kat9c.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.6&q=

---- NASTAVENÍ FIREFOXU ----
C:\Program Files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKLM-Run-NPSStartup - (no file)

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  Registry::
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=-
  "ICQ"=-
  "SpywareTerminatorUpdate"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "DAEMON Tools"=-
  "NeroFilterCheck"=-
  "Adobe Reader Speed Launcher"=-
  "Adobe ARM"=-
  "SpywareTerminator"=-
  
  DDS::
  uStart Page = hxxp://start.icq.com/
  
  Firefox::
  FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=
  FF - prefs.js: browser.search.selectedEngine - ICQ Search
  FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/
  FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... 2.0.0.6&q=

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

Bohužel po skončení scanu následoval BSOD, ale log se ještě stihl vygenerovat...

log: http://leteckaposta.cz/704288486

Na tu BSOD kouknem - podivejte se sem C:\Windows\Minidump - mel by tam byt soubor *.dmp, zabalte a upnete - poprosim kolegu o rozbor...

Log z CF vypada OK

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) (viz muj podpis)

• Provedte aktualizaci - treti zalozka
• Provedte uplny sken - nic nemazte
• MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

Byly tam 2, nejspíš to padlo i při prvním scanu...

Tu je výpis paměti 2: http://leteckaposta.cz/670552012
1: http://leteckaposta.cz/355015347

do MBAMu se dám hned

Log budu vyhlizet a jdu zaukolovat kolegu

Žádné obavy, v obou případech se jedná o chybičku v ovladači catchme.sys, který patří Combofixu.
V některých případech se to hold projeví.

Dekuji kolegovi za pitvu minidumpu a nasledne vysvetleni-uklidneni

Ted pockam na log z MBAM a uvidime co se nam kde jeste skryva

2x svinstvo

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 4510

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

30.8.2010 23:10:27
mbam-log-2010-08-30 (23-10-27).txt

Typ skenu: Úplný sken (C:\|)
Skenované objekty: 239825
Uplynulý čas: 1 hodina(y), 1 minuta(y), 24 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 2

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\System Volume Information\_restore{017FDE6A-CAA4-44FF-9D65-C120F6DFC713}\RP125\A0030074.exe (Trojan.Agent) -> No action taken.
C:\System Volume Information\_restore{017FDE6A-CAA4-44FF-9D65-C120F6DFC713}\RP125\A0030112.exe (Malware.Packer.Gen) -> No action taken.

Svinstvo ale neaktivni - jen v bodech obnovy - muzete smazat

Jak se chova PC, avast stale krici

PC se chova IMHO jako po reinstalaci systemu, avast ani spywareterminator nic nehlasi, řekl bych, že vše šlape jak má.

Malvare smazán.



Všem vám děkuji za pomoc a přeji hezký zbytek dne.

Jeste mi neutikejte - nenecham Vam tam ty smrdute mazadla Pekne uklidime, navonime, zkontrolujem

MBAM muzete odinstalovat nebo nechat na obcasny sken - v pripade nalezu velmi doporucuji dat sem log na posouzeni, at si neodstrelite neco legitimniho

Odinstalujte Combofix

• Start - Spustit (nebo pouzijte klavesobou zkratku Win+R)
• Napiste ComboFix /Uninstall
• Stisknete Enter
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://sweb.cz/Marinus/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner (viz muj podpis), pri instalaci dejte fajfku pryc u yahoo toolbaru
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za 14 dni

Havet se usadila v bodech obnoveni - smazte je dle navodu kolegy riffa http://www.viry.cz/forum/viewtopic.php?f=11&t=47040

Vlozte novy log ze RSITu

Log zkontroluju az ale brzy rano, ted valim do rise snu - rano se jde makat Zatim dobrou