VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

PC nakazeno nejspis spywarem

https://forum.viry.cz:443/viewtopic.php?t=109882

Stránka 1 z 1

PC nakazeno nejspis spywarem

Napsal: 27 úno 2011 19:21
od boutek
Zdravim. Vcera sem pri vstupu na imdb.com dostal do pocitace nakou havet. Projevuje se tim, ze mi to zmenilo pozadi na plose. Je tam ted velke varovani Warning a ze muj pc je nakazen spywarem. Take neustale naskakuji okna nejakeho spyware programu "antivirus-antispyware 2011", ktery me neustale hlasi 130 nakazenych souboru a nuti si ho koupit. A hlavne NIC nejde spustit. Ani internet prohlizec ani jedina aplikace. Taky sem si na jinym pocitaci stahl RSIT, dal na usb flash, ale na infikovanym PC to nespustim. Nespustim tam vlastne vubec nic. Nevim tudiz jak bych pro vas mohl vytvorit log a poslat ho sem. Nejaky jiny napad?

Re: PC nakazeno nejspis spywarem

Napsal: 27 úno 2011 19:23
od Rudy
Restartujte do nouz. režimu a dejte log z RSIT: http://www.viry.cz/forum/viewtopic.php?f=13&t=105895 .

Re: PC nakazeno nejspis spywarem

Napsal: 27 úno 2011 19:39
od boutek
Logfile of random's system information tool 1.08 (written by random/random)
Run by Administrator at 2011-02-27 18:34:24
Microsoft Windows 7 Home Premium
System drive C: has 92 GB (38%) free of 238 GB
Total RAM: 3958 MB (78% free)

HijackThis download failed

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\Explorer.EXE
ctfmon.exe
"J:\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4246815794-1745546178-596238576-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4246815794-1745546178-596238576-1000UA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4246815794-1745546178-596238576-500Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4246815794-1745546178-596238576-500UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2009-12-07 41368]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2009-11-13 16414824]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2009-08-31 8095776]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2009-10-15 1870120]
"ThpSrv"=C:\Windows\system32\thpsrv /logon []
"SmartFaceVWatcher"=C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [2009-10-19 238080]
"TosSENotify"=C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [2009-11-05 709976]
"HDMICtrlMan"=C:\Program Files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe [2009-10-23 1032536]
"TosWaitSrv"=C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [2009-10-30 707416]
"Toshiba Registration"=C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [2009-08-25 134032]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-21 136176]
"Ghihutunag"= C:\Users\Administrator\AppData\Local\Sypexioc.dll,Startup []
"SpywareTerminatorUpdate"=C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [2011-02-26 3318784]
"AntiVirus AntiSpyware 2011"=C:\Users\Administrator\AppData\Roaming\AntiVirus AntiSpyware 2011\AntiVirus AntiSpyware.exe /STARTUP []
"AntiVirus AntiSpyware 2011 Security"=C:\Users\Administrator\AppData\Roaming\AntiVirus AntiSpyware 2011\securitymanager.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"dLfOeAa06300"=C:\ProgramData\dLfOeAa06300\dLfOeAa06300 [2011-02-27 98]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe /background []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"=C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [2009-10-02 284696]
"HWSetup"=C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [2009-06-02 423936]
"KeNotify"=C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [2009-01-13 34088]
"TUSBSleepChargeSrv"=C:\Program Files (x86)\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe [2009-10-26 253312]
"TWebCamera"=C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2009-11-21 2454840]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-09-07 2838912]
"DivXUpdate"=C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [2010-06-03 1144104]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2010-09-08 421888]
"iTunesHelper"=C:\Program Files (x86)\iTunes\iTunesHelper.exe [2010-09-24 421160]
"SpywareTerminator"=C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2011-02-26 2557440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MpfService]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2011-02-27 18:34:24 ----D---- C:\rsit
2011-02-27 18:34:24 ----D---- C:\Program Files\trend micro
2011-02-27 18:32:20 ----A---- C:\Windows\ntbtlog.txt
2011-02-26 23:09:16 ----D---- C:\Users\Administrator\AppData\Roaming\AntiVirus AntiSpyware 2011
2011-02-26 22:20:21 ----D---- C:\Users\Administrator\AppData\Roaming\Spyware Terminator
2011-02-26 22:20:19 ----D---- C:\ProgramData\Spyware Terminator
2011-02-26 22:20:18 ----D---- C:\Program Files (x86)\Spyware Terminator
2011-02-26 21:28:47 ----D---- C:\ProgramData\dLfOeAa06300
2011-02-26 21:28:40 ----D---- C:\Windows\Sun
2011-02-23 23:41:16 ----A---- C:\Windows\SYSWOW64\wcncsvc.dll
2011-02-23 23:41:16 ----A---- C:\Windows\system32\wcncsvc.dll
2011-02-23 18:55:38 ----A---- C:\Windows\SYSWOW64\XpsPrint.dll
2011-02-23 18:55:38 ----A---- C:\Windows\system32\XpsPrint.dll
2011-02-23 18:55:38 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2011-02-23 18:55:37 ----A---- C:\Windows\SYSWOW64\XpsGdiConverter.dll
2011-02-19 20:58:59 ----SHD---- C:\Config.Msi
2011-02-19 20:30:52 ----D---- C:\Users\Administrator\AppData\Roaming\InstallShield
2011-02-15 21:46:41 ----D---- C:\Users\Administrator\AppData\Roaming\GetRightToGo
2011-02-10 17:19:07 ----D---- C:\Users\Administrator\AppData\Roaming\vlc
2011-02-09 22:17:48 ----D---- C:\Users\Administrator\AppData\Roaming\Azureus
2011-02-09 22:14:41 ----D---- C:\Users\Administrator\AppData\Roaming\WinRAR
2011-02-09 20:18:31 ----D---- C:\Users\Administrator\AppData\Roaming\Birdstep Technology
2011-02-09 08:38:21 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2011-02-09 08:38:21 ----A---- C:\Windows\system32\mshtml.dll
2011-02-09 08:38:16 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2011-02-09 08:38:16 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2011-02-09 08:38:16 ----A---- C:\Windows\system32\iedkcs32.dll
2011-02-09 08:38:15 ----A---- C:\Windows\SYSWOW64\mstime.dll
2011-02-09 08:38:15 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2011-02-09 08:38:15 ----A---- C:\Windows\SYSWOW64\msfeedssync.exe
2011-02-09 08:38:15 ----A---- C:\Windows\SYSWOW64\msfeedsbs.dll
2011-02-09 08:38:15 ----A---- C:\Windows\SYSWOW64\licmgr10.dll
2011-02-09 08:38:15 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2011-02-09 08:38:15 ----A---- C:\Windows\SYSWOW64\iepeers.dll
2011-02-09 08:38:15 ----A---- C:\Windows\system32\mstime.dll
2011-02-09 08:38:15 ----A---- C:\Windows\system32\mshtmled.dll
2011-02-09 08:38:15 ----A---- C:\Windows\system32\msfeedssync.exe
2011-02-09 08:38:15 ----A---- C:\Windows\system32\msfeedsbs.dll
2011-02-09 08:38:15 ----A---- C:\Windows\system32\msfeeds.dll
2011-02-09 08:38:15 ----A---- C:\Windows\system32\licmgr10.dll
2011-02-09 08:38:15 ----A---- C:\Windows\system32\iertutil.dll
2011-02-09 08:38:15 ----A---- C:\Windows\system32\iepeers.dll
2011-02-09 08:38:09 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2011-02-09 08:38:09 ----A---- C:\Windows\system32\kerberos.dll
2011-02-09 08:38:07 ----A---- C:\Windows\system32\win32k.sys
2011-02-09 08:38:05 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2011-02-09 08:38:05 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2011-02-09 08:38:05 ----A---- C:\Windows\system32\cdd.dll
2011-02-09 08:38:04 ----A---- C:\Windows\system32\winsrv.dll
2011-02-09 08:37:58 ----A---- C:\Windows\system32\msxml6.dll
2011-02-09 08:37:58 ----A---- C:\Windows\system32\msxml3.dll
2011-02-09 08:37:57 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2011-02-09 08:37:57 ----A---- C:\Windows\SYSWOW64\upnp.dll
2011-02-09 08:37:57 ----A---- C:\Windows\system32\urlmon.dll
2011-02-09 08:37:57 ----A---- C:\Windows\system32\upnp.dll
2011-02-09 08:37:56 ----A---- C:\Windows\SYSWOW64\wininet.dll
2011-02-09 08:37:56 ----A---- C:\Windows\SYSWOW64\msxml6.dll
2011-02-09 08:37:56 ----A---- C:\Windows\SYSWOW64\msxml3.dll
2011-02-09 08:37:56 ----A---- C:\Windows\system32\wininet.dll
2011-02-09 08:37:56 ----A---- C:\Windows\system32\winhttp.dll
2011-02-09 08:37:56 ----A---- C:\Windows\system32\WebClnt.dll
2011-02-09 08:37:55 ----A---- C:\Windows\SYSWOW64\wscapi.dll
2011-02-09 08:37:55 ----A---- C:\Windows\SYSWOW64\winhttp.dll
2011-02-09 08:37:55 ----A---- C:\Windows\SYSWOW64\WebClnt.dll
2011-02-09 08:37:55 ----A---- C:\Windows\SYSWOW64\slwga.dll
2011-02-09 08:37:55 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2011-02-09 08:37:55 ----A---- C:\Windows\SYSWOW64\davclnt.dll
2011-02-09 08:37:55 ----A---- C:\Windows\system32\wscsvc.dll
2011-02-09 08:37:55 ----A---- C:\Windows\system32\wscapi.dll
2011-02-09 08:37:55 ----A---- C:\Windows\system32\slwga.dll
2011-02-09 08:37:55 ----A---- C:\Windows\system32\ieframe.dll
2011-02-09 08:37:55 ----A---- C:\Windows\system32\davclnt.dll
2011-02-09 08:37:51 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2011-02-09 08:37:51 ----A---- C:\Windows\SYSWOW64\jscript.dll
2011-02-09 08:37:51 ----A---- C:\Windows\system32\vbscript.dll
2011-02-09 08:37:51 ----A---- C:\Windows\system32\jscript.dll
2011-02-09 08:37:44 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-02-09 08:37:43 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2011-02-09 08:37:43 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2011-02-09 08:37:43 ----A---- C:\Windows\system32\ntdll.dll
2011-02-09 08:37:42 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2011-02-09 08:37:41 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2011-02-09 08:37:41 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2011-02-09 08:37:41 ----A---- C:\Windows\system32\atmlib.dll
2011-02-09 08:37:41 ----A---- C:\Windows\system32\atmfd.dll
2011-02-05 21:46:24 ----D---- C:\perflogs
2011-02-05 16:12:53 ----D---- C:\Program Files (x86)\MediaMonkey

======List of files/folders modified in the last 1 months======

2011-02-27 18:34:24 ----RD---- C:\Program Files
2011-02-27 18:32:20 ----D---- C:\Windows
2011-02-27 18:24:48 ----D---- C:\Windows\Prefetch
2011-02-27 18:24:34 ----D---- C:\Windows\Temp
2011-02-27 18:24:12 ----D---- C:\Windows\tracing
2011-02-27 18:23:54 ----D---- C:\Windows\Minidump
2011-02-27 15:32:33 ----D---- C:\Windows\system32\config
2011-02-27 14:03:29 ----D---- C:\Windows\SysWOW64
2011-02-27 01:14:20 ----SHD---- C:\System Volume Information
2011-02-26 22:20:30 ----D---- C:\Windows\system32\drivers
2011-02-26 22:20:19 ----HD---- C:\ProgramData
2011-02-26 22:20:18 ----D---- C:\Program Files (x86)
2011-02-26 01:26:58 ----D---- C:\Windows\Logs
2011-02-23 23:41:18 ----D---- C:\Windows\System32
2011-02-23 23:41:17 ----D---- C:\Windows\system32\catroot
2011-02-23 23:41:16 ----D---- C:\Windows\winsxs
2011-02-23 18:54:43 ----D---- C:\Windows\system32\catroot2
2011-02-22 20:30:13 ----D---- C:\Windows\inf
2011-02-22 20:30:13 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-02-20 03:41:28 ----D---- C:\Program Files\TOSHIBA
2011-02-20 03:41:27 ----D---- C:\Program Files (x86)\TOSHIBA
2011-02-20 01:55:45 ----D---- C:\Windows\Microsoft.NET
2011-02-19 21:00:20 ----SHD---- C:\Windows\Installer
2011-02-19 20:59:40 ----RSD---- C:\Windows\assembly
2011-02-19 20:59:25 ----D---- C:\Program Files\Common Files\Microsoft Shared
2011-02-19 20:48:52 ----D---- C:\Windows\system32\DriverStore
2011-02-19 20:48:50 ----D---- C:\Program Files\Common Files
2011-02-19 20:48:07 ----D---- C:\Windows\system32\Tasks
2011-02-19 20:45:18 ----D---- C:\Windows\debug
2011-02-19 20:43:07 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2011-02-13 05:00:42 ----D---- C:\Users\Administrator\AppData\Roaming\Skype
2011-02-13 05:00:23 ----D---- C:\Users\Administrator\AppData\Roaming\Apple Computer
2011-02-13 00:19:49 ----D---- C:\Users\Administrator\AppData\Roaming\skypePM
2011-02-12 00:08:22 ----SD---- C:\Users\Administrator\AppData\Roaming\Microsoft
2011-02-11 00:43:04 ----D---- C:\ProgramData\McAfee
2011-02-10 21:14:21 ----D---- C:\Windows\Tasks
2011-02-10 20:40:52 ----SD---- C:\ProgramData\Microsoft
2011-02-09 20:18:31 ----D---- C:\Users\Administrator\AppData\Roaming\Adobe
2011-02-09 18:51:46 ----RD---- C:\Users
2011-02-09 13:09:32 ----D---- C:\Program Files\Internet Explorer
2011-02-09 13:09:32 ----D---- C:\Program Files (x86)\Internet Explorer
2011-02-09 11:12:25 ----A---- C:\Windows\system32\MRT.exe
2011-02-07 14:15:19 ----D---- C:\Windows\rescache
2011-02-06 18:17:24 ----D---- C:\Program Files\Windows Sidebar
2011-02-06 18:17:20 ----D---- C:\Program Files\Windows Media Player
2011-02-06 18:17:20 ----D---- C:\Program Files\DVD Maker
2011-02-06 18:17:19 ----D---- C:\Program Files (x86)\Windows Sidebar
2011-02-06 18:17:15 ----D---- C:\Windows\SYSWOW64\wbem
2011-02-06 18:17:15 ----D---- C:\Windows\SYSWOW64\en-US
2011-02-06 18:17:15 ----D---- C:\Windows\ShellNew
2011-02-06 18:17:14 ----D---- C:\Windows\system32\wbem
2011-02-06 18:17:14 ----D---- C:\Windows\system32\en-US
2011-02-06 18:17:14 ----D---- C:\Windows\PolicyDefinitions
2011-02-05 21:37:06 ----D---- C:\Program Files (x86)\PoselSmrti
2011-02-05 18:25:08 ----A---- C:\Windows\SYSWOW64\log.txt
2011-02-05 02:01:09 ----D---- C:\Windows\system32\wfp
2011-02-05 02:01:09 ----D---- C:\Windows\system32\CodeIntegrity
2011-02-05 02:01:08 ----D---- C:\Windows\AppCompat
2011-02-05 02:01:07 ----D---- C:\Windows\registration
2011-02-02 17:11:20 ----N---- C:\Windows\system32\MpSigStub.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2009-10-02 537112]
R0 LPCFilter;LPC Lower Filter Driver; C:\Windows\system32\DRIVERS\LPCFilter.sys [2009-07-30 44912]
R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R0 Thpdrv;TOSHIBA HDD Protection Driver; C:\Windows\system32\DRIVERS\thpdrv.sys [2009-06-29 34880]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver; C:\Windows\system32\DRIVERS\Thpevm.SYS [2009-06-29 14784]
R0 tos_sps64;TOSHIBA tos_sps64 Service; C:\Windows\system32\DRIVERS\tos_sps64.sys [2009-07-24 482384]
R0 TVALZ;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver; C:\Windows\system32\DRIVERS\TVALZ_O.SYS [2009-07-14 26840]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver; C:\Windows\system32\DRIVERS\TVALZFL.sys [2009-06-19 14472]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 34152]
R3 HECIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2009-10-15 307760]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver; C:\Windows\system32\DRIVERS\tdcmdpst.sys [2009-07-30 27784]
S0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-07-01 828912]
S1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2010-09-07 28752]
S1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2010-09-07 121936]
S1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2010-09-07 51280]
S1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 adfs;adfs; C:\Windows\system32\drivers\adfs.sys [2009-06-08 86584]
S2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2010-09-07 20048]
S2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2010-09-07 61008]
S2 mdvrmng;Mobile IP Route Manager; \??\C:\Windows\system32\drivers\mdvrmng.sys []
S2 sp_rsdrv2;Spyware Terminator Driver Filter; C:\Windows\system32\DRIVERS\stflt.sys [2010-07-07 50696]
S3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\agrsm64.sys [2009-06-10 1146880]
S3 ewusbnet;HUAWEI USB-NDIS miniport; C:\Windows\system32\DRIVERS\ewusbnet.sys [2009-07-23 132608]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [2009-07-23 116992]
S3 hwusbfake;Huawei DataCard USB Fake; C:\Windows\system32\DRIVERS\ewusbfake.sys [2009-07-23 113792]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2009-08-31 1992352]
S3 JMCR;JMCR; C:\Windows\system32\DRIVERS\jmcr.sys [2009-09-23 144496]
S3 massfilter;ZTE Mass Storage Filter Driver; C:\Windows\system32\drivers\massfilter.sys [2010-01-19 11776]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2009-08-21 84512]
S3 PGEffect;Pangu effect driver; C:\Windows\system32\DRIVERS\pgeffect.sys [2009-06-22 35008]
S3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-11-05 291328]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver; C:\Windows\system32\DRIVERS\rtl8192se.sys [2009-10-02 946688]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-07-13 109056]
S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys [2010-04-19 50688]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 40448]
S3 ZTEusbmdm6k;ZTE Proprietary USB Driver; C:\Windows\system32\DRIVERS\ZTEusbmdm6k.sys [2010-01-19 119680]
S3 ZTEusbnmea;ZTE NMEA Port; C:\Windows\system32\DRIVERS\ZTEusbnmea.sys [2010-01-19 119680]
S3 ZTEusbser6k;ZTE Diagnostic Port; C:\Windows\system32\DRIVERS\ZTEusbser6k.sys [2010-01-19 119680]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files (x86)\Spyware Terminator\sp_rsser.exe [2011-02-26 948775]
S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2010-09-24 932640]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-27 1255736]
S4 BecHelperService;BecHelperService; C:\Program Files (x86)\3 Mobile Broadband\3Connect\BecHelperService.exe [2010-01-28 1737464]
S4 cfWiMAXService;ConfigFree WiMAX Service; C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2009-10-27 252784]
S4 ConfigFree Service;ConfigFree Service; C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-03-10 46448]
S4 gupdate;Google Update Service (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-10-21 136176]
S4 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-10-02 13336]
S4 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2009-09-30 262144]
S4 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-11-13 219752]
S4 Thpsrv;TOSHIBA HDD Protection; C:\Windows\system32\ThpSrv.exe [2009-10-21 531520]
S4 TODDSrv;TOSHIBA Optical Disc Drive Service; C:\Windows\system32\TODDSrv.exe [2009-07-28 140632]
S4 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service; C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-11-05 137560]
S4 TPCHSrv;TPCH Service; C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [2009-10-30 824176]
S4 UNS;Intel(R) Management & Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2314240]

-----------------EOF-----------------

Re: PC nakazeno nejspis spywarem

Napsal: 27 úno 2011 20:15
od Rudy
Ještě poprosím o log z ComboFix.
Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

Re: PC nakazeno nejspis spywarem

Napsal: 27 úno 2011 20:44
od boutek
ComboFix 11-02-27.01 - Administrator 27/02/2011 19:28:55.1.4 - x64 MINIMAL
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.3958.3372 [GMT 0:00]
Running from: c:\users\Administrator\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! Antivirus *Enabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\dLfOeAa06300
c:\programdata\dLfOeAa06300\dLfOeAa06300
c:\programdata\dLfOeAa06300\dLfOeAa06300.exe
c:\programdata\xp
c:\programdata\xp\EBLib.dll
c:\programdata\xp\TPwSav.sys
c:\users\Administrator\AppData\Local\Sypexioc.dll
c:\users\Administrator\AppData\Roaming\AntiVirus AntiSpyware 2011
c:\users\Administrator\AppData\Roaming\AntiVirus AntiSpyware 2011\IcoActivate.ico
c:\users\Administrator\AppData\Roaming\AntiVirus AntiSpyware 2011\IcoHelp.ico
c:\users\Administrator\AppData\Roaming\AntiVirus AntiSpyware 2011\IcoUninstall.ico
c:\users\Administrator\AppData\Roaming\AntiVirus AntiSpyware 2011\securityhelper.exe
c:\users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\AntiVirus AntiSpyware 2011.lnk
c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AntiVirus AntiSpyware 2011
c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AntiVirus AntiSpyware 2011\AntiVirus AntiSpyware 2011.lnk
c:\windows\system32\kr_done1
c:\windows\SysWow64\kr_done1
M:\AUTORUN.INF

.
((((((((((((((((((((((((( Files Created from 2011-01-27 to 2011-02-27 )))))))))))))))))))))))))))))))
.

2011-02-27 19:21 . 2011-02-27 19:27 -------- d-----w- C:\32788R22FWJFW
2011-02-27 18:34 . 2011-02-27 18:34 -------- d-----w- C:\rsit
2011-02-27 18:34 . 2011-02-27 18:34 -------- d-----w- c:\program files\trend micro
2011-02-26 22:20 . 2011-02-27 19:19 -------- d-----w- c:\users\Administrator\AppData\Roaming\Spyware Terminator
2011-02-26 22:20 . 2011-02-27 01:14 -------- d-----w- c:\programdata\Spyware Terminator
2011-02-26 22:20 . 2011-02-27 17:46 -------- d-----w- c:\program files (x86)\Spyware Terminator
2011-02-26 21:28 . 2011-02-26 21:28 -------- d-----w- c:\windows\Sun
2011-02-25 23:16 . 2011-02-11 07:30 7947600 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F88E3849-5E71-4367-B3EC-A16045596F27}\mpengine.dll
2011-02-23 23:41 . 2010-09-14 06:45 367104 ----a-w- c:\windows\system32\wcncsvc.dll
2011-02-23 23:41 . 2010-09-14 06:07 276992 ----a-w- c:\windows\SysWow64\wcncsvc.dll
2011-02-23 18:55 . 2011-01-07 08:07 662528 ----a-w- c:\windows\system32\XpsPrint.dll
2011-02-23 18:55 . 2011-01-07 08:07 475648 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-02-23 18:55 . 2011-01-07 07:31 442880 ----a-w- c:\windows\SysWow64\XpsPrint.dll
2011-02-23 18:55 . 2011-01-07 07:31 288256 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
2011-02-19 20:30 . 2011-02-19 20:30 -------- d-----w- c:\users\Administrator\AppData\Roaming\InstallShield
2011-02-15 21:46 . 2011-02-15 21:47 -------- d-----w- c:\users\Administrator\AppData\Roaming\GetRightToGo
2011-02-13 05:00 . 2011-02-13 05:00 -------- d-----w- c:\users\Administrator\AppData\Local\Apple
2011-02-13 00:27 . 2011-02-13 00:27 -------- d-----w- c:\users\Administrator\AppData\Local\Apple Computer
2011-02-10 21:14 . 2011-02-10 21:15 -------- d-----w- c:\users\Administrator\AppData\Local\Google
2011-02-10 21:12 . 2011-02-10 21:12 -------- d-----w- c:\users\Administrator\AppData\Local\Mozilla
2011-02-10 17:19 . 2011-02-10 19:59 -------- d-----w- c:\users\Administrator\AppData\Roaming\vlc
2011-02-10 16:14 . 2011-02-15 16:10 -------- d-----w- c:\users\Administrator\AppData\Local\MediaMonkey
2011-02-09 22:17 . 2011-02-19 20:45 -------- d-----w- c:\users\Administrator\AppData\Roaming\Azureus
2011-02-09 20:19 . 2011-02-27 18:47 -------- d-----w- c:\users\Administrator\AppData\Local\ElevatedDiagnostics
2011-02-09 20:18 . 2011-02-09 20:18 -------- d-----w- c:\users\Administrator\AppData\Roaming\Birdstep Technology
2011-02-09 08:37 . 2010-12-21 06:13 2003968 ----a-w- c:\windows\system32\msxml6.dll
2011-02-05 21:46 . 2011-02-05 21:46 -------- d-----w- C:\perflogs
2011-02-05 16:12 . 2011-02-19 20:26 -------- d-----w- c:\users\pcw\AppData\Local\MediaMonkey
2011-02-05 16:12 . 2011-02-19 20:26 -------- d-----w- c:\program files (x86)\MediaMonkey

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-02 17:11 . 2010-06-26 17:39 270720 ------w- c:\windows\system32\MpSigStub.exe
2010-12-11 19:48 . 2010-12-11 19:48 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-10-21 136176]
"SpywareTerminatorUpdate"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe" [2011-02-26 3318784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2009-10-02 284696]
"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2009-06-02 423936]
"KeNotify"="c:\program files (x86)\TOSHIBA\Utilities\KeNotify.exe" [2009-01-13 34088]
"TWebCamera"="c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" [2009-11-21 2454840]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"SpywareTerminator"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorShield.exe" [2011-02-26 2557440]

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe [2009-9-1 481184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer4"=wdmaud.drv

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2009-07-23 132608]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [2009-07-23 113792]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2010-01-19 11776]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2010-04-19 50688]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-27 1255736]
R4 BecHelperService;BecHelperService;c:\program files (x86)\3 Mobile Broadband\3Connect\BecHelperService.exe [2010-01-28 1737464]
R4 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2009-10-27 252784]
R4 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-03-10 46448]
R4 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-21 136176]
R4 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-10-02 13336]
R4 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-11-05 137560]
R4 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2009-10-30 824176]
R4 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2314240]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-07-01 828912]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [2009-06-29 34880]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [2009-06-29 14784]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [2009-07-24 482384]
S1 aswSP;aswSP; [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 61008]
S2 sp_rsdrv2;Spyware Terminator Driver Filter;c:\windows\system32\DRIVERS\stflt.sys [2010-07-07 50696]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [2009-06-19 14472]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2009-09-23 144496]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2009-08-21 84512]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [2009-06-22 35008]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-11-05 291328]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2009-10-02 946688]

.
Contents of the 'Scheduled Tasks' folder

2011-02-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-10 15:18]

2011-02-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-10 15:18]

2011-02-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4246815794-1745546178-596238576-1000Core.job
- c:\users\pcw\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-26 17:35]

2011-02-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4246815794-1745546178-596238576-1000UA.job
- c:\users\pcw\AppData\Local\Google\Update\GoogleUpdate.exe [2010-06-26 17:35]

2011-02-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4246815794-1745546178-596238576-500Core.job
- c:\users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-10 15:18]

2011-02-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4246815794-1745546178-596238576-500UA.job
- c:\users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-10 15:18]
.

--------- x86-64 -----------


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-13 16414824]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-31 8095776]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-11-05 709976]
"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaReminder.exe" [2009-08-25 134032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEH&bmod=TSEH
IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
.
- - - - ORPHANS REMOVED - - - -

Wow6432Node-HKCU-Run-Ghihutunag - c:\users\Administrator\AppData\Local\Sypexioc.dll
Wow6432Node-HKCU-Run-AntiVirus AntiSpyware 2011 - c:\users\Administrator\AppData\Roaming\AntiVirus AntiSpyware 2011\AntiVirus AntiSpyware.exe
Wow6432Node-HKCU-Run-AntiVirus AntiSpyware 2011 Security - c:\users\Administrator\AppData\Roaming\AntiVirus AntiSpyware 2011\securitymanager.exe
Wow6432Node-HKLM-Run-TUSBSleepChargeSrv - %ProgramFiles(x86)%\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe
SafeBoot-mcmscsvc
SafeBoot-MCODS
WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file)
HKLM-Run-SynTPEnh - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-SmartFaceVWatcher - %ProgramFiles%\Toshiba\SmartFaceV\SmartFaceVWatcher.exe
HKLM-Run-HDMICtrlMan - %ProgramFiles%\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe
HKLM-Run-TosWaitSrv - %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe
AddRemove-AntiVirus AntiSpyware 2011 - c:\users\Administrator\AppData\Roaming\AntiVirus AntiSpyware 2011\securityhelper.exe


.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-4246815794-1745546178-596238576-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c8,81,20,cd,ee,ec,12,42,af,a7,24,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c8,81,20,cd,ee,ec,12,42,af,a7,24,\

[HKEY_USERS\S-1-5-21-4246815794-1745546178-596238576-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\UserChoice]
@Denied: (2) (Administrator)
"Progid"="VLC.avi"

[HKEY_USERS\S-1-5-21-4246815794-1745546178-596238576-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (Administrator)
"Progid"="ChromeHTML.Administrator"

[HKEY_USERS\S-1-5-21-4246815794-1745546178-596238576-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (Administrator)
"Progid"="ChromeHTML.Administrator"

[HKEY_USERS\S-1-5-21-4246815794-1745546178-596238576-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\UserChoice]
@Denied: (2) (Administrator)
"Progid"="VLC.mp4"

[HKEY_USERS\S-1-5-21-4246815794-1745546178-596238576-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\UserChoice]
@Denied: (2) (Administrator)
"Progid"="VLC.mpg"

[HKEY_USERS\S-1-5-21-4246815794-1745546178-596238576-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="ChromeHTML.Administrator"

[HKEY_USERS\S-1-5-21-4246815794-1745546178-596238576-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (Administrator)
"Progid"="ChromeHTML.Administrator"

[HKEY_USERS\S-1-5-21-4246815794-1745546178-596238576-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (Administrator)
"Progid"="ChromeHTML.Administrator"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9e.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.9"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9e.ocx, 1"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9e.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9e.ocx, 1"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil9e.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil9e.exe"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
c:\program files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
.
**************************************************************************
.
Completion time: 2011-02-27 19:40:05 - machine was rebooted
ComboFix-quarantined-files.txt 2011-02-27 19:40

Pre-Run: 96,114,139,136 bytes free
Post-Run: 95,919,263,744 bytes free

- - End Of File - - 474D83F1529D39B69F6832349765302F

Re: PC nakazeno nejspis spywarem

Napsal: 27 úno 2011 21:45
od Rudy
Několik infikovaných položek bylo smazáno, zbytek logu vypadá čistý. Nastala nějaká změna?

Re: PC nakazeno nejspis spywarem

Napsal: 27 úno 2011 23:47
od Nikola.G
Ano! Nastala zasadni zmena. Vsechno je ted v poradku a funguje tak jak ma. Dekuji.

Re: PC nakazeno nejspis spywarem

Napsal: 28 úno 2011 07:53
od cernohous13
Nikola.G píše:Ano! Nastala zasadni zmena. Vsechno je ted v poradku a funguje tak jak ma. Dekuji.
a ty jsi boutek :???:

Re: PC nakazeno nejspis spywarem

Napsal: 28 úno 2011 18:11
od Rudy
Nemáte zač!
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz