VIRY.CZ

Logfile of random's system information tool 1.06 (written by random/random)
Run by Risan at 2010-10-27 19:17:36
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 6 GB (18%) free of 31 GB
Total RAM: 1919 MB (81% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:17:37, on 27.10.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Risan\Nabídka Start\Programy\Po spuštění\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Risan\Plocha\ostatni blbosti\RSIT.exe
C:\Documents and Settings\Risan\Plocha\ostatni blbosti\Risan.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: ctfmon.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Update Service (gupdate1c9defbb2a8f1c6) (gupdate1c9defbb2a8f1c6) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 1878 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\Low Battery Alarm Program.job
C:\WINDOWS\tasks\WGASetup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bluetooth.lnk]
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTTray.exe [2007-02-06 589824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Risan^Nabídka Start^Programy^Po spuštění^ctfmon.exe]
C:\Documents and Settings\Risan\Nabídka Start\Programy\Po spuštění\ctfmon.exe [2006-06-27 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3
"odserv"=3
"idsvc"=3
"gupdate1c9defbb2a8f1c6"=2
"Ati HotKey Poller"=2

C:\Documents and Settings\Risan\Nabídka Start\Programy\Po spuštění
ctfmon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2007-12-18 122880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 239616]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"D:\Hry sdilene\Batl\BF1942.exe"="D:\Hry sdilene\Batl\BF1942.exe:*:Disabled:BF1942"
"C:\WINDOWS\Network Diagnostic\xpnetdiag.exe"="C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Disabled:Bonjour"
"C:\Program Files\Garena\Garena.exe"="C:\Program Files\Garena\Garena.exe:*:Disabled:Garena"
"C:\Documents and Settings\Risan\Plocha\ICQ6\ICQ.exe"="C:\Documents and Settings\Risan\Plocha\ICQ6\ICQ.exe:*:Disabled:ICQ6"
"C:\Documents and Settings\Risan\Plocha\ICQ6.5\ICQ.exe"="C:\Documents and Settings\Risan\Plocha\ICQ6.5\ICQ.exe:*:Disabled:ICQ6"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Disabled:Opera Internet Browser"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"D:\Hry sdilene\Warcraft III\Warcraft III.exe"="D:\Hry sdilene\Warcraft III\Warcraft III.exe:*:Disabled:Warcraft III"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{12ab4ad6-de0c-11df-96c4-001a738e476d}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
shell\Open(0)\command - H:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{239a3898-a2cc-11de-945c-001a4b6af28b}]
shell\AutoRun\command - G:\
shell\open\command - rundll32.exe .\desktop.dll,InstallM

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3624156e-9da3-11df-9631-001a738e476d}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
shell\Open(0)\command - H:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a531dc62-e7ec-11de-94cf-001a738e476d}]
shell\AutoRun\command - G:\
shell\open\command - rundll32.exe .\desktop.dll,InstallM

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bcaf3226-2e9a-11df-9540-a6b4f2cfe6d7}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
shell\Open(0)\command - G:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{de9a67f6-68de-11df-95bd-001a4b6af28b}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
shell\Open(0)\command - H:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f7908c98-d5cf-11dd-935a-001a4b6af28b}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
shell\Open(0)\command - G:\Recycled\ctfmon.exe

======List of files/folders created in the last 1 months======

2010-10-27 19:10:35 ----D---- C:\Sun

======List of files/folders modified in the last 1 months======

2010-10-27 19:17:32 ----D---- C:\WINDOWS\system32\drivers
2010-10-27 19:10:27 ----D---- C:\WINDOWS\Prefetch
2010-10-27 18:42:12 ----D---- C:\WINDOWS\system32
2010-10-27 18:42:12 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-10-27 18:38:03 ----D---- C:\WINDOWS\Temp
2010-10-27 18:37:49 ----D---- C:\WINDOWS
2010-10-27 18:37:35 ----A---- C:\WINDOWS\system32\wmdrtc32.dll
2010-10-27 18:21:30 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-10-26 08:34:49 ----D---- C:\WINDOWS\system32\CatRoot2
2010-10-21 13:16:45 ----SHD---- C:\WINDOWS\Installer

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 43008]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\System32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 irda;Protokol IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-14 88192]
R2 NdisFileServices32;NdisFileServices32; \??\C:\WINDOWS\system32\drivers\rpmlmn.sys []
R2 NwlnkIpx;Transportní protokol kompatibilní s NWLink IPX/SPX/NetBIOS; C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys [2008-04-14 88320]
R2 NwlnkNb;Služba NWLink pro rozhraní NetBIOS; C:\WINDOWS\System32\DRIVERS\nwlnknb.sys [2001-10-25 63232]
R2 NwlnkSpx;Protokol NWLink SPX/SPXII; C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys [2001-10-25 55936]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2008-02-05 281600]
R3 AEAudio;AE Audio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2007-07-13 94976]
R3 ati2mtag;ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2007-12-18 2849280]
R3 b57w2k;Broadcom 590x 10/100 Ethernet; C:\WINDOWS\System32\DRIVERS\b57xp32.sys [2006-12-15 160256]
R3 BCM43XX;Ovladač síťového adaptéru Broadcom 802.11; C:\WINDOWS\System32\DRIVERS\bcmwl5.sys [2008-11-15 1287552]
R3 BTKRNL;Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2007-02-14 868298]
R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2007-02-14 67960]
R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\System32\DRIVERS\CmBatt.sys [2008-04-14 13952]
R3 HBtnKey;HBtnKey; C:\WINDOWS\system32\DRIVERS\cpqbttn.sys [2008-04-28 9344]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\System32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-14 17152]
S1 f7c14890;f7c14890; C:\WINDOWS\System32\drivers\f7c14890.sys []
S3 a9voj0x0;a9voj0x0; C:\WINDOWS\system32\drivers\a9voj0x0.sys []
S3 abjjaz74;abjjaz74; C:\WINDOWS\system32\drivers\abjjaz74.sys []
S3 GarenaPEngine;GarenaPEngine; \??\C:\DOCUME~1\Risan\LOCALS~1\Temp\EHO578.tmp []
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 MREMP50;MREMP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS []
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS []
S3 MREMPR5;MREMPR5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS []
S3 MRENDIS5;MRENDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS []
S3 MRESP50;MRESP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS []
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS []
S3 restore;restore; \??\C:\WINDOWS\system32\drivers\restore.sys []
S3 STIrUsb;SigmaTel USB-IrDA Dongle; C:\WINDOWS\system32\DRIVERS\irstusb.sys [2001-08-17 26624]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 VM650FVM11;UMAX AstraSlim Scanner ProdID x0104; C:\WINDOWS\System32\Drivers\USB650C.sys [2001-05-24 10830]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2007-02-06 266295]
R2 Irmon;Sledování infračerveného přenosu; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 NwSapAgent;Agent SAP; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S2 gupdate1c9defbb2a8f1c6;Google Update Service (gupdate1c9defbb2a8f1c6); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-05-27 133104]
S2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 399360]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S4 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\System32\Ati2evxx.exe [2007-12-18 512000]
S4 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2006-05-02 163840]
S4 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S4 McciCMService;McciCMService; C:\Program Files\Common Files\Motive\McciCMService.exe [2007-10-15 331776]
S4 MyWebSearchService;My Web Search Service; C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe [2009-10-02 57344]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 SWIHPWMI;SWIHPWMI; C:\Program Files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe [2006-12-04 292384]

-----------------EOF-----------------

DÍKY!!!

Zdravim a pekny vecer preji

No je tam havet a ne jedna

Zapojte do PC vsechny USB klice (flashky, ext. disky apod.)

Stahne a ulozte na plochu UsbFix http://www.viry.cz/forum/viewtopic.php?f=24&t=102308
Spustte a kliknete na Deletion
Po dokonceni sem vlozte log, pokud na Vas nevyskoci, najdete jej zde C:\UsbFix.txt

stalo se, tady je log

predem dekuji!

############################## | UsbFix 7.014 | [Deletion]

User: Risan (Administrator) # RISANPC [ ]
Updated 24/06/10 by El Desaparecido / C_XX
Started at 18:05:58 | 30/10/2010
Website: http://pagesperso-orange.fr/NosTools/index.html
Contact: FindyKill.Contact@gmail.com

CPU: AMD Turion(tm) 64 X2 Mobile Technology TL-60
CPU 2: AMD Turion(tm) 64 X2 Mobile Technology TL-60
Systém Microsoft Windows XP Professional (5.1.2600 32-Bit) # Service Pack 3
Internet Explorer 6.0.2900.5512

Windows Firewall: Disabled /!\
RAM -> 1919 Mb
C:\ (%systemdrive%) -> Fixed drive # 30 Gb (5 Mb free - 17%) [] # NTFS
D:\ -> Fixed drive # 203 Gb (33 Mb free - 16%) [] # NTFS
E:\ -> CD-ROM
F:\ -> CD-ROM
G:\ -> CD-ROM

################## | Files # Infected Folders |

Deleted ! C:\Documents and Settings\Risan\Nabídka Start\Programy\Po spuštění\ctfmon.exe
Deleted ! C:\WINDOWS\system32\delself.bat
Deleted ! C:\WINDOWS\system32\msvcrt2.dll
Deleted ! C:\DOCUME~1\Risan\LOCALS~1\Temp\005.exe
Deleted ! C:\DOCUME~1\Risan\LOCALS~1\Temp\060.exe
Deleted ! C:\DOCUME~1\Risan\LOCALS~1\Temp\418.exe
Deleted ! C:\DOCUME~1\Risan\LOCALS~1\Temp\536.exe
Deleted ! C:\DOCUME~1\Risan\LOCALS~1\Temp\852.exe
Deleted ! C:\DOCUME~1\Risan\LOCALS~1\Temp\718631~1.exe
Deleted ! C:\Autorun.inf
Deleted ! D:\Autorun.inf

################## | Registry |

################## | Mountpoints2 |

Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{12ab4ad6-de0c-11df-96c4-001a738e476d}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{239a3898-a2cc-11de-945c-001a4b6af28b}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{a531dc62-e7ec-11de-94cf-001a738e476d}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{bcaf3226-2e9a-11df-9540-a6b4f2cfe6d7}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{de9a67f6-68de-11df-95bd-001a4b6af28b}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{f7908c98-d5cf-11dd-935a-001a4b6af28b}

################## | Listing |

[17/11/2008 - 20:01:58 | A | 2] C:\-997894210
[13/12/2009 - 21:51:18 | D ] C:\AstraSlim
[15/11/2008 - 14:33:07 | A | 0] C:\AUTOEXEC.BAT
[15/11/2008 - 17:59:02 | A | 86] C:\bcmwl5.log
[18/03/2010 - 12:56:37 | SH | 223] C:\boot.ini
[25/10/2001 - 16:00:00 | RASH | 4952] C:\Bootfont.bin
[27/09/2010 - 16:18:17 | SHD ] C:\Config.Msi
[15/11/2008 - 14:33:07 | A | 0] C:\CONFIG.SYS
[15/11/2008 - 20:01:52 | D ] C:\DAEMON Tools Lite
[15/11/2008 - 14:36:49 | D ] C:\Documents and Settings
[15/11/2008 - 14:33:07 | RASH | 0] C:\IO.SYS
[15/11/2008 - 14:33:07 | RASH | 0] C:\MSDOS.SYS
[15/11/2008 - 17:23:05 | RASH | 47564] C:\NTDETECT.COM
[19/09/2009 - 08:26:33 | RASH | 250576] C:\ntldr
[30/10/2010 - 17:02:14 | ASH | 2145386496] C:\pagefile.sys
[27/10/2010 - 19:22:44 | RD ] C:\Program Files
[13/03/2010 - 14:23:29 | RSHD ] C:\Recycled
[30/10/2010 - 18:10:01 | SHD ] C:\RECYCLER
[16/10/2009 - 02:12:42 | D ] C:\rsit
[27/10/2010 - 19:10:35 | D ] C:\Sun
[15/11/2008 - 18:00:19 | D ] C:\SWSetup
[15/11/2008 - 17:30:21 | SHD ] C:\System Volume Information
[30/10/2010 - 18:11:57 | D ] C:\UsbFix
[30/10/2010 - 18:12:01 | A | 1475] C:\UsbFix.txt
[15/11/2008 - 22:21:02 | A | 510678] C:\vcredist_x86.log
[30/10/2010 - 18:06:17 | D ] C:\WINDOWS
[16/08/2010 - 17:05:41 | D ] D:\2010-08-14,15 První Bikeove Slavnosti
[07/10/2010 - 13:43:11 | D ] D:\aa filmy z plochy
[17/03/2010 - 21:57:30 | D ] D:\aaa new filmy
[03/10/2010 - 19:03:59 | D ] D:\aaaa uplne nove
[17/05/2010 - 22:29:42 | D ] D:\Age of Empires II
[19/09/2009 - 21:47:05 | D ] D:\b87e60f11638167bb7
[15/11/2008 - 22:55:56 | D ] D:\Balgis
[15/08/2009 - 15:49:49 | D ] D:\CoD2
[19/06/2007 - 15:47:48 | A | 10050902] D:\Codecs6030_allin1.exe
[12/09/2010 - 09:47:43 | SHD ] D:\Config.Msi
[12/01/2009 - 12:33:51 | D ] D:\Godfather
[19/09/2009 - 03:05:36 | D ] D:\Hry sdilene
[12/01/2009 - 12:39:09 | D ] D:\INSTALL
[15/11/2008 - 22:20:19 | HD ] D:\msdownld.tmp
[30/10/2010 - 17:58:37 | D ] D:\nof serial
[17/05/2010 - 23:13:05 | D ] D:\Nová složka
[04/04/2010 - 15:25:11 | D ] D:\PFiles
[01/11/2009 - 20:43:22 | D ] D:\photoshop
[04/02/2010 - 15:55:22 | D ] D:\poker
[01/11/2009 - 20:39:29 | D ] D:\pphotoshop
[28/02/2010 - 06:07:18 | D ] D:\Program Files
[12/01/2009 - 12:42:43 | D ] D:\programy
[14/03/2010 - 14:34:51 | RSHD ] D:\Recycled
[30/10/2010 - 18:11:57 | SHD ] D:\RECYCLER
[04/12/2008 - 16:41:02 | A | 1467924480] D:\sex ve městě.avi
[04/11/2009 - 20:12:06 | D ] D:\soul plane
[23/07/2008 - 11:45:22 | A | 738799616] D:\Surfs.Up.2007.DVDRip.XviD.CZ.avi
[15/11/2008 - 17:30:21 | SHD ] D:\System Volume Information
[13/11/2008 - 09:41:15 | A | 1464578326] D:\umedobry-lmr.avi
[20/02/2009 - 00:06:49 | D ] D:\Videoklipy olld s
[18/12/2009 - 13:10:05 | D ] D:\Warcraft III
[26/12/2009 - 05:34:28 | D ] D:\Warcraft III hfkjhk
[07/10/2010 - 13:42:06 | D ] D:\weu files
[15/11/2008 - 16:14:47 | D ] D:\WUTemp

################## | Vaccin |

C:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)
D:\Autorun.inf -> Folder created by UsbFix (El Desaparecido & C_XX)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_RISANPC.zip
http://chiquitine.changelog.fr/Sample/Upload.php
Thank you for your contribution.

################## | E.O.F |

Nejak jste opomenula zapojit flash disky a to je potreba, jelikoz je na nich hoooodne haveti

Takze je zapojte a opakujte postup s USBFixem - log opet sem

Dobrý večer,

pokud jsem to pochopila správně, jde vám i o zavirované externí zařízení, ale žádná z věcí připojovaná přes USB poslední dobou není moje, pro přenos dat používám především domácí síť.

Jestli se mýlím, opravte mne, prosím

No takze budou zrejme zaliskane i ostatni PC v siti

Takze se doporucuji prozatim od domaci site odpojit, pripadne odpojit ty ostatni PC, pokud pres tu sit mate pripojeny internet. Na ty dalsi PC se pak podivame at se Vam to neprenasi mezi PC

Jdeme tedy s ostatni haveti zatocit

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Vložte do PC vsechny USB klice (flash disky, ext.disky apod.)
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

Povedlo se mi to dokončit až napodruhé, ntb se odmítl restartovat, po opětovném spuštění programu bylo vše OK.

ComboFix 10-10-30.01 - Risan 30.10.2010 20:39:04.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1919.1485 [GMT 2:00]
Spuštěný z: c:\documents and settings\Risan\Plocha\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Předchozí spuštění -------
.
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\1.bin\F3CJpeg.dll
c:\program files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
c:\program files\MyWebSearch\bar\1.bin\F3REGHK.DLL
c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
c:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\1.bin\M3AUXSTB.DLL
c:\program files\MyWebSearch\bar\1.bin\M3DLGHK.DLL
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE
c:\program files\MyWebSearch\bar\1.bin\M3HTML.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IDLE.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MEDINT.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MSg.dll
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSSVC.EXE
c:\program files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files\MyWebSearch\bar\Cache\0188848E.bin
c:\program files\MyWebSearch\bar\Cache\018D239A
c:\program files\MyWebSearch\bar\Cache\018D285D
c:\program files\MyWebSearch\bar\Cache\0261153B.bin
c:\program files\MyWebSearch\bar\Cache\0261172F.bin
c:\program files\MyWebSearch\bar\Cache\026118E4.bin
c:\program files\MyWebSearch\bar\Cache\02611A2D.bin
c:\program files\MyWebSearch\bar\Cache\02611BC3.bin
c:\program files\MyWebSearch\bar\Cache\files.ini
c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files\MyWebSearch\bar\Game\CHESS.F3S
c:\program files\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files\MyWebSearch\bar\History\search3
c:\program files\MyWebSearch\bar\icons\CM.ICO
c:\program files\MyWebSearch\bar\icons\MFC.ICO
c:\program files\MyWebSearch\bar\icons\PSS.ICO
c:\program files\MyWebSearch\bar\icons\SMILEY.ICO
c:\program files\MyWebSearch\bar\icons\WB.ICO
c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
c:\program files\MyWebSearch\bar\Message\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\DOG.F3S
c:\program files\MyWebSearch\bar\Notifier\FISH.F3S
c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\program files\MyWebSearch\bar\Notifier\MAID.F3S
c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
c:\program files\MyWebSearch\bar\Settings\prevcfg2.htm
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\recycled\Recycled
c:\windows\system32\drivers\rpmlmn.sys
c:\windows\system32\f3PSSavr.scr
c:\windows\system32\mstmdm.dll
c:\windows\system32\mswmpdat.tlb
c:\windows\system32\winview.ocx
c:\windows\system32\wmcache.nld
c:\windows\system32\wmdrtc32.dl_
c:\windows\system32\wmdrtc32.dll

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_icf
-------\Legacy_MYWEBSEARCHSERVICE
-------\Legacy_NDISFILESERVICES32
-------\Legacy_tdssserv.sys
-------\Service_MyWebSearchService
-------\Service_NdisFileServices32
-------\Service_restore
-------\Service_tdssserv.sys

((((((((((((((((((((((((( Soubory vytvořené od 2010-09-28 do 2010-10-30 )))))))))))))))))))))))))))))))
.

2010-10-30 16:05 . 2010-10-30 17:11 -------- d-----w- C:\UsbFix
2010-10-27 17:22 . 2010-10-27 17:22 -------- d-----w- c:\program files\trend micro
2010-10-27 17:10 . 2010-10-27 17:10 -------- d-----w- C:\Sun

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-30 17:11 . 2010-10-30 16:12 16250836 ----a-w- C:\UsbFix_Upload_Me_RISANPC.zip
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bluetooth.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Bluetooth.lnk
backup=c:\windows\pss\Bluetooth.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Risan^Nabídka Start^Programy^Po spuštění^ctfmon.exe]
path=c:\documents and settings\Risan\Nabídka Start\Programy\Po spuštění\ctfmon.exe
backup=c:\windows\pss\ctfmon.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"odserv"=3 (0x3)
"idsvc"=3 (0x3)
"gupdate1c9defbb2a8f1c6"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"d:\\Hry sdilene\\Batl\\BF1942.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\Documents and Settings\\Risan\\Plocha\\ICQ6.5\\ICQ.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"d:\\Hry sdilene\\Warcraft III\\Warcraft III.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [15.11.2008 19:27 691696]
S0 ati3dixx;ati3dixx;c:\windows\system32\Drivers\ati3dixx.sys --> c:\windows\system32\Drivers\ati3dixx.sys [?]
S1 f7c14890;f7c14890;c:\windows\system32\drivers\f7c14890.sys [17.11.2008 20:00 0]
S2 gupdate1c9defbb2a8f1c6;Google Update Service (gupdate1c9defbb2a8f1c6);c:\program files\Google\Update\GoogleUpdate.exe [27.5.2009 20:48 133104]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\Risan\LOCALS~1\Temp\EHO578.tmp --> c:\docume~1\Risan\LOCALS~1\Temp\EHO578.tmp [?]
S3 VM650FVM11;UMAX AstraSlim Scanner ProdID x0104;c:\windows\system32\drivers\USB650C.SYS [13.12.2009 21:51 10830]
S4 SWIHPWMI;SWIHPWMI;c:\program files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe [4.12.2006 17:13 292384]
.
Obsah adresáře 'Naplánované úlohy'

2010-08-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]

2010-10-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-27 18:48]

2010-10-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-27 18:48]

2010-10-30 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-09-19 20:18]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-Virtual DJ - Atomix Productions - g:\virtua~1\UNWISE.EXE

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-30 20:40
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\Risan\LOCALS~1\Temp\EHO578.tmp"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\:őwjY*]
"DisplayName"="???\17?\11\09"
"DeviceDesc"="???\17?\11\09"
"ProviderName"="???\11?\17?\11??"
"MFG"="???????"
"ReinstallString"=".10.1000.7"
"DeviceInstanceIds"=multi:"c:\\swsetup\\sp38780\\sbdrv\\smbus\\smbusati.inf\00"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(896)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2010-10-30 20:42:21
ComboFix-quarantined-files.txt 2010-10-30 18:42

Před spuštěním: 9 244 299 264
Po spuštění: 9 195 520 000

- - End Of File - - E1A5F840B17E2F2C9F0CDDCD605C0A84

Vy jste se dala na chov konicku trojskych a k tomu jeste stadecka rootkitu

V nasledujicim kroku bude ComboFix posilat havet na server k sUBSovi - autorovi ComboFixu - pro dalsi vyvoj utility, tak se neleknete, ze nekam neco posila - nejde o zadna osobni data - jen o vzorky haveti, aby se daji dale zkoumat

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

RegLock::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\:őwjY*]

RegNull::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\:őwjY*]

Registry::
[-HKLM\~\startupfolder\C:^Documents and Settings^Risan^Nabídka Start^Programy^Po spuštění^ctfmon.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

Collect::
c:\documents and settings\Risan\Nabídka Start\Programy\Po spuštění\ctfmon.exe
c:\windows\system32\drivers\f7c14890.sys

Driver::
f7c14890

File::
c:\windows\Tasks\AppleSoftwareUpdate.job
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

Combo fix se opět na delší dobu zasekl, po restartu a opětovném spuštění vše proběhlo dle instrukcí.

ComboFix 10-10-30.01 - Risan 30.10.2010 23:06:06.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1919.1534 [GMT 2:00]
Spuštěný z: c:\documents and settings\Risan\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Risan\Plocha\CFScript.txt.txt

FILE ::
"c:\windows\Tasks\AppleSoftwareUpdate.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"

file zipped: c:\windows\system32\drivers\f7c14890.sys
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\f7c14890.sys
c:\windows\system32\wmdrtc32.dl_
c:\windows\system32\wmdrtc32.dll
c:\windows\Tasks\AppleSoftwareUpdate.job
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_f7c14890

((((((((((((((((((((((((( Soubory vytvořené od 2010-09-28 do 2010-10-30 )))))))))))))))))))))))))))))))
.

2010-10-30 18:44 . 2010-10-30 18:44 5477 ----a-w- c:\windows\system32\drivers\rpmlmn.sys
2010-10-30 16:05 . 2010-10-30 17:11 -------- d-----w- C:\UsbFix
2010-10-27 17:22 . 2010-10-27 17:22 -------- d-----w- c:\program files\trend micro
2010-10-27 17:10 . 2010-10-27 17:10 -------- d-----w- C:\Sun

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-30 17:11 . 2010-10-30 16:12 16250836 ----a-w- C:\UsbFix_Upload_Me_RISANPC.zip
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Bluetooth.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Bluetooth.lnk
backup=c:\windows\pss\Bluetooth.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ose"=3 (0x3)
"odserv"=3 (0x3)
"idsvc"=3 (0x3)
"gupdate1c9defbb2a8f1c6"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Garena\\Garena.exe"=
"c:\\Documents and Settings\\Risan\\Plocha\\ICQ6.5\\ICQ.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"d:\\Hry sdilene\\Warcraft III\\Warcraft III.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [15.11.2008 19:27 691696]
S0 ati3dixx;ati3dixx;c:\windows\system32\Drivers\ati3dixx.sys --> c:\windows\system32\Drivers\ati3dixx.sys [?]
S2 gupdate1c9defbb2a8f1c6;Google Update Service (gupdate1c9defbb2a8f1c6);c:\program files\Google\Update\GoogleUpdate.exe [27.5.2009 20:48 133104]
S3 GarenaPEngine;GarenaPEngine;\??\c:\docume~1\Risan\LOCALS~1\Temp\EHO578.tmp --> c:\docume~1\Risan\LOCALS~1\Temp\EHO578.tmp [?]
S3 VM650FVM11;UMAX AstraSlim Scanner ProdID x0104;c:\windows\system32\drivers\USB650C.SYS [13.12.2009 21:51 10830]
S4 SWIHPWMI;SWIHPWMI;c:\program files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe [4.12.2006 17:13 292384]
.
Obsah adresáře 'Naplánované úlohy'

2010-10-30 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-09-19 20:18]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyOverride = *.local
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-30 23:13
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\docume~1\Risan\LOCALS~1\Temp\EHO578.tmp"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\:őwjY*]
"DisplayName"="???\17?\11\09"
"DeviceDesc"="???\17?\11\09"
"ProviderName"="???\11?\17?\11??"
"MFG"="???????"
"ReinstallString"=".10.1000.7"
"DeviceInstanceIds"=multi:"c:\\swsetup\\sp38780\\sbdrv\\smbus\\smbusati.inf\00"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(892)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\control.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Celkový čas: 2010-10-30 23:15:48 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-10-30 21:15
ComboFix2.txt 2010-10-30 18:42

Před spuštěním: 9 941 606 400
Po spuštění: 9 928 110 080

- - End Of File - - 3F84DEE1AF03DBDD70487D84DB68EC74
Nahr nˇ probŘhlo ŁspŘçnŘ

Tak tohle uz vypada ciste, jak se chova PC

Kolik PC mate zapojenych v siti

Dle meho na tom nebudou o moc lepe

Chová se o trochu líp, než předtím

Jinak v síti jsou 3 ntb a 1 PC, které na tom bude asi ještě hůř. Zkusím se s nimi nějak domluvit a kdyžtak pošlu logy z RSIT.

Díky za rady a pomoc

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) (viz muj podpis)

Provedte aktualizaci - treti zalozka
Provedte uplny sken - nic nemazte
MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

Ty logy bych doporucil si nechat zkontrolovat , normalne zalozte nove tema a dejte tam logy, nekdo se na ne podiva

VIRY.CZ

Prosím o kontrolu logu

Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu

Re: Prosím o kontrolu logu