VIRY.CZ

Kontroloval jsem to prez MWAV 12.0.73

17 VI 2011 19:17:14 - **********************************************************17 VI 2011 19:17:14 - eScan AntiVirus & Spyware Toolkit Utility.17 VI 2011 19:17:14 - Copyright © MicroWorld Technologies17 VI 2011 19:17:14 - **********************************************************17 VI 2011 19:17:14 - Source: C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\Rar$EX80.288\MWAV12~1.73D\MWAV12~1.EXE17 VI 2011 19:17:14 - Version 12.0.145 (C:\DOCUMENTS AND SETTINGS\JIRKA.JIRKA-77C412237\LOCAL SETTINGS\TEMP\MEXETMP.EX~)17 VI 2011 19:17:14 - Log File: C:\Documents and Settings\jirka.JIRKA-77C412237\Local Settings\Temp\MWAV.LOG17 VI 2011 19:17:14 - MWAV Registered: TRUE17 VI 2011 19:17:14 - User Account: jirka (Administrator Mode)17 VI 2011 19:17:14 - OS Type: Windows Workstation17 VI 2011 19:17:14 - OS: Windows XP [OS Install Date: 01 Sep 2010 11:39:18]17 VI 2011 19:17:14 - Ver: Service Pack 2 (Build 2600)17 VI 2011 19:17:14 - System Up Time: 12 Hours, 43 Minutes, 2 Seconds17 VI 2011 19:17:14 - Windows Root Folder: C:\WINDOWS17 VI 2011 19:17:14 - Windows Sys32 Folder: C:\WINDOWS\system3217 VI 2011 19:17:15 - DHCP NameServer: 83.240.0.214 83.240.0.21517 VI 2011 19:17:15 - Interface0 DHCPNameServer: 83.240.0.214 83.240.0.21517 VI 2011 19:17:15 - Local Fixed Drives: c:\17 VI 2011 19:17:15 - MWAV Mode: Scan and Clean files (for viruses, adware and spyware)17 VI 2011 19:17:15 - [CREATED ZIP FILE: C:\Documents and Settings\jirka.JIRKA-77C412237\Local Settings\Temp\pinfect.zip] 17 VI 2011 19:17:15 - ****** Files/Folders created/modified during last fortnight in Windows and ROOT Folder ******17 VI 2011 19:17:16 - C:\WINDOWS\R.COM (147968), 17-Jun-2011, Microsoft Corporation, Microsoft® Windows® Operating System17 VI 2011 19:17:16 - C:\WINDOWS\system32\eEmpty.exe (34048), 17-Jun-2011, MicroWorld Technologies Inc., eScan For Windows17 VI 2011 19:17:16 - C:\WINDOWS\system32\MSINET.OCX (132880), 11-Jun-2011, Microsoft Corporation, Microsoft Internet Transfer Control17 VI 2011 19:17:16 - C:\WINDOWS\system32\pxyzhbo.dll (168509), 17-Aug-2004 [HSR] [Unable to Add C:\WINDOWS\system32\pxyzhbo.dll to ZIP FILE! ResultCode: 512]17 VI 2011 19:17:16 - C:\WINDOWS\system32\RICHED.DLL (240944), 11-Jun-2011, Microsoft Corporation, Microsoft® Windows(TM) Operating System17 VI 2011 19:17:16 - C:\WINDOWS\system32\RICHTX32.OCX (212240), 11-Jun-2011, Microsoft Corporation, RichText17 VI 2011 19:17:16 - C:\WINDOWS\system32\T.COM (137216), 17-Jun-2011, Microsoft Corporation, Microsoft(R) Windows (R) 2000 Operating System17 VI 2011 19:17:16 - C:\WINDOWS\system32\TASKMGR.COM (137216), 17-Jun-2011, Microsoft Corporation, Microsoft(R) Windows (R) 2000 Operating System17 VI 2011 19:17:16 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\BACKUP.40239551.mexe.com (2525768), 17-Jun-2011, MicroWorld Technologies Inc., MicroWorld AntiVirus Toolkit Utility (MWAV)17 VI 2011 19:17:16 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\bdc.exe (91904), 17-Jun-2011, MicroWorld Tech, eScan17 VI 2011 19:17:16 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\bdfltlib2k.dll (231944), 17-Jun-2011, MicroWorld Technologies Inc., eScan for Windows17 VI 2011 19:17:18 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\clean.bat (11), 17-Jun-2011 [Added C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\clean.bat to ZIP FILE]17 VI 2011 19:17:18 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\DEVCON.EXE (61184), 17-Jun-2011, Microsoft Corporation, Microsoft® Windows® Operating System17 VI 2011 19:17:18 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\eEmpty.exe (34048), 17-Jun-2011, MicroWorld Technologies Inc., eScan For Windows17 VI 2011 19:17:18 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\encdec.dll (163848), 17-Jun-2011, MicroWorld Technologies Inc., eScan/MailScan/eConceal17 VI 2011 19:17:18 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\erootdrv.sys (13832), 17-Jun-2011, MicroWorld Technologies Inc., eScan/MWAV17 VI 2011 19:17:18 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\mexe.com (2562632), 17-Jun-2011, MicroWorld Technologies Inc., MicroWorld AntiVirus Toolkit Utility (MWAV)17 VI 2011 19:17:18 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\msvclnt.dll (240136), 17-Jun-2011, MicroWorld Technologies Inc., MailScan17 VI 2011 19:17:18 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\mwavdwnl.exe (788488), 17-Jun-2011, MicroWorld Technologies Inc., eScan17 VI 2011 19:17:18 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\MWAVSCAN.COM (2525768), 17-Jun-2011, MicroWorld Technologies Inc., MicroWorld AntiVirus Toolkit Utility (MWAV)17 VI 2011 19:17:18 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugins.htm (4104), 17-Jun-2011 [Added C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugins.htm to ZIP FILE]17 VI 2011 19:17:20 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\red32.dll (10248), 17-Jun-2011, Microsoft Corporation, Microsoft® Windows® Operating System17 VI 2011 19:17:20 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\reload.exe (159240), 17-Jun-2011, MicroWorld Technologies Inc., eScan for Windows17 VI 2011 19:17:20 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\setpriv.exe (65544), 17-Jun-2011, MicroWorld Technologies Inc., eScan AntiVirus Toolkit Utility17 VI 2011 19:17:20 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\unregx.exe (76808), 17-Jun-2011, MicroWorld Technologies Inc., MicroWorld AntiVirus Toolkit Utility17 VI 2011 19:17:20 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\UPDLL10.DLL (898568), 13-Jun-2011, MicroWorld Technologies Inc., eScan/MailScan/MWAV17 VI 2011 19:17:20 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\ViewTCP.exe (1680904), 17-Jun-2011, MicroWorld Technologies Inc., ViewTCP 17 VI 2011 19:17:21 - C:\WINDOWS\$hf_mig$, 03-Sep-2008 [H] [Folder]17 VI 2011 19:17:21 - C:\WINDOWS\$MSI31Uninstall_KB893803v2$, 16-May-2011 [H] [Folder]17 VI 2011 19:17:21 - C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$, 23-Jun-2010 [H] [Folder]17 VI 2011 19:17:21 - C:\WINDOWS\Fonts, 01-Sep-2008 [SR] [Folder]17 VI 2011 19:17:21 - C:\WINDOWS\ftpcache, 03-Oct-2009 [HS] [Folder]17 VI 2011 19:17:21 - C:\WINDOWS\inf, 01-Sep-2008 [H] [Folder]17 VI 2011 19:17:21 - C:\WINDOWS\PIF, 28-Nov-2009 [H] [Folder]17 VI 2011 19:17:21 - C:\WINDOWS\ShellNew, 22-Sep-2008 [H] [Folder]17 VI 2011 19:17:21 - C:\WINDOWS\system32\dllcache, 01-Sep-2008 [HSR] [Folder]17 VI 2011 19:17:21 - C:\WINDOWS\system32\Microsoft, 01-Sep-2008 [S] [Folder]17 VI 2011 19:17:21 - C:\Config.Msi, 17-Sep-2009 [H] [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\AVCBack, 17-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\FtpTemp, 17-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\FtpTempF, 17-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\LOCK, 17-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\Log, 17-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugins, 17-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugtmp-438, 06-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugtmp-439, 07-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugtmp-440, 07-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugtmp-441, 11-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugtmp-442, 11-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugtmp-443, 11-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugtmp-444, 12-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugtmp-445, 12-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugtmp-446, 13-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugtmp-447, 14-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugtmp-448, 15-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugtmp-449, 15-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugtmp-450, 15-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugtmp-451, 15-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugtmp-452, 15-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\plugtmp-453, 17-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\Rar$DI74.288, 17-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\Rar$EX01.008, 17-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\Rar$EX80.288, 17-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\tmp00000816, 17-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\DOCUME~1\JIRKA~1.JIR\LOCALS~1\Temp\_avast_, 15-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\Documents and Settings\jirka.JIRKA-77C412237\Data aplikací\.minecraft, 05-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\Documents and Settings\jirka.JIRKA-77C412237\Data aplikací\Microsoft, 01-Sep-2010 [S] [Folder]17 VI 2011 19:17:21 - C:\Documents and Settings\jirka.JIRKA-77C412237\Data aplikací\..\Data aplikací, 01-Sep-2010 [HR] [Folder]17 VI 2011 19:17:21 - C:\Documents and Settings\jirka.JIRKA-77C412237\Data aplikací\..\Local Settings, 01-Sep-2010 [H] [Folder]17 VI 2011 19:17:21 - C:\Documents and Settings\jirka.JIRKA-77C412237\Data aplikací\..\Okolní síť, 01-Sep-2010 [H] [Folder]17 VI 2011 19:17:21 - C:\Documents and Settings\jirka.JIRKA-77C412237\Data aplikací\..\Okolní tiskárny, 01-Sep-2010 [H] [Folder]17 VI 2011 19:17:21 - C:\Documents and Settings\jirka.JIRKA-77C412237\Data aplikací\..\Recent, 01-Sep-2010 [HR] [Folder]17 VI 2011 19:17:21 - C:\Documents and Settings\jirka.JIRKA-77C412237\Data aplikací\..\SendTo, 01-Sep-2010 [HR] [Folder]17 VI 2011 19:17:21 - C:\Documents and Settings\jirka.JIRKA-77C412237\Data aplikací\..\UserData, 17-Sep-2010 [S] [Folder]17 VI 2011 19:17:21 - C:\Documents and Settings\jirka.JIRKA-77C412237\Data aplikací\..\Šablony, 01-Sep-2010 [H] [Folder]17 VI 2011 19:17:21 - C:\Documents and Settings\All Users.WINDOWS\Data aplikací\AVAST Software, 15-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\Documents and Settings\All Users.WINDOWS\Data aplikací\Microsoft, 01-Sep-2010 [S] [Folder]17 VI 2011 19:17:21 - C:\Documents and Settings\All Users.WINDOWS\Data aplikací\MicroWorld, 17-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\Documents and Settings\All Users.WINDOWS\Data aplikací\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}, 05-Oct-2010 [HS] [Folder]17 VI 2011 19:17:21 - C:\Documents and Settings\All Users.WINDOWS\Data aplikací\..\Data aplikací, 01-Sep-2010 [HR] [Folder]17 VI 2011 19:17:21 - C:\Documents and Settings\All Users.WINDOWS\Data aplikací\..\DRM, 01-Sep-2010 [HS] [Folder]17 VI 2011 19:17:21 - C:\Documents and Settings\All Users.WINDOWS\Data aplikací\..\Šablony, 01-Sep-2010 [H] [Folder]17 VI 2011 19:17:21 - C:\Program Files\AVAST Software, 15-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\Program Files\Metin2, 08-Jun-2011 [Folder]17 VI 2011 19:17:21 - C:\Program Files\WindowsUpdate, 01-Sep-2008 [H] [Folder]17 VI 2011 19:17:21 - C:\Program Files\Wizard101(UK), 08-Jun-2011 [Folder] 17 VI 2011 19:17:21 - ********************************************************************************************* 17 VI 2011 19:17:21 - Command Line Options Given: /xsign17 VI 2011 19:17:21 - Latest Date of files inside MWAV: Wed Oct 20 07:52:50 2010.17 VI 2011 19:17:21 - Plugins FileCount: 785 Sign Version: 7.3434317 VI 2011 19:17:21 - Loading/Creating FileScan Database C:\Documents and Settings\All Users.WINDOWS\Data aplikací\MicroWorld\MWAV\ESCANDBX.MDB [Log: C:\Documents and Settings\jirka.JIRKA-77C412237\Local Settings\Temp\ESCANDB.LOG]17 VI 2011 19:17:21 - Loaded/Created FileScan Database...17 VI 2011 19:17:21 - Loading AV Library [DB]...17 VI 2011 19:17:23 - AV Library Loaded [DB-DIRECT].17 VI 2011 19:17:23 - MWAV doing self scanning...17 VI 2011 19:17:23 - MWAV files are clean.
17 VI 2011 19:17:29 - Virus Database Date: 20 Oct 2010
17 VI 2011 19:17:29 - Virus Database Count: 6359864

17 VI 2011 19:18:12 - **********************************************************
17 VI 2011 19:18:12 - eScan AntiVirus & Spyware Toolkit Utility.
17 VI 2011 19:18:12 - Copyright © MicroWorld Technologies
17 VI 2011 19:18:12 -
17 VI 2011 19:18:12 - Support: support@escanav.com
17 VI 2011 19:18:12 - Web: http://www.escanav.com
17 VI 2011 19:18:12 - **********************************************************
17 VI 2011 19:18:12 - Version 12.0.145[DB] (C:\DOCUMENTS AND SETTINGS\JIRKA.JIRKA-77C412237\LOCAL SETTINGS\TEMP\MEXETMP.EX~)
17 VI 2011 19:18:12 - Log File: C:\Documents and Settings\jirka.JIRKA-77C412237\Local Settings\Temp\MWAV.LOG
17 VI 2011 19:18:12 - User Account: jirka (Administrator Mode)
17 VI 2011 19:18:12 - Windows Root Folder: C:\WINDOWS
17 VI 2011 19:18:12 - Windows Sys32 Folder: C:\WINDOWS\system32
17 VI 2011 19:18:12 - OS: Windows XP [OS Install Date: 01 Sep 2010 11:39:18]
17 VI 2011 19:18:12 - Ver: Service Pack 2 (Build 2600)
17 VI 2011 19:18:12 - Latest Date of files inside MWAV: Wed Oct 20 07:52:50 2010.
17 VI 2011 19:18:12 - Plugins FileCount: 785 Sign Version: 7.34343

17 VI 2011 19:18:12 - Options Selected by User:
17 VI 2011 19:18:12 - Memory Check: Enabled
17 VI 2011 19:18:12 - Registry Check: Enabled
17 VI 2011 19:18:12 - StartUp Folder Check: Enabled
17 VI 2011 19:18:12 - System Folder Check: Enabled
17 VI 2011 19:18:12 - Services Check: Enabled
17 VI 2011 19:18:12 - Scan Spyware: Disabled
17 VI 2011 19:18:12 - Drive Check Option Disabled
17 VI 2011 19:18:12 - Folder Check: Disabled
17 VI 2011 19:18:12 - SCAN: All_Files
17 VI 2011 19:18:12 - MWAV Mode: Scan and Clean files (for viruses, adware and spyware)


17 VI 2011 19:18:12 - ***** Scanning Memory Files *****

17 VI 2011 19:18:55 - ***** Scanning Registry Files *****
17 VI 2011 19:19:13 - Replacing Registry Value: ******** (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost/netsvcs) Previous Value: [utloqn], New Value: [NULL]

17 VI 2011 19:19:18 - ***** Scanning StartUp Folders *****
17 VI 2011 19:19:41 - INVALID ATTRIBUTES FOR FOLDER [C:\Documents and Settings\jirka.JIRKA-77C412237\Plocha\Písničky\programy\jadmaker\ridge_racer_drift 240x320 (??????? ??????)195231]. IGNORING.
17 VI 2011 19:19:41 - INVALID ATTRIBUTES FOR FOLDER [C:\Documents and Settings\jirka.JIRKA-77C412237\Plocha\Písničky\programy\jadmaker\ridge_racer_drift 240x320 (??????? ??????)195238]. IGNORING.
17 VI 2011 19:19:41 - INVALID ATTRIBUTES FOR FOLDER [C:\Documents and Settings\jirka.JIRKA-77C412237\Plocha\Písničky\programy\jadmaker\ridge_racer_drift 240x320 S40v3 (??????? ??????)195308]. IGNORING.
17 VI 2011 19:21:01 - ScanFile took 62.03 Secs [C:\Documents and Settings\jirka.JIRKA-77C412237\Plocha\Skola-G\Farma zvirat\Animal Farm (1954).avi]...

17 VI 2011 19:21:24 - ScanFile took 6.83 Secs [C:\Documents and Settings\jirka.JIRKA-77C412237\Plocha\Skola-G\Languages\Docx2Rtf.exe]...


17 VI 2011 19:21:49 - ***** Scanning Service Files *****
17 VI 2011 19:21:52 - ERROR(2)!!! Invalid Entry \??\C:\WINDOWS\system32\drivers\EagleNT.sys. Action Taken: Removing HKLM\SYSTEM\CurrentControlSet\Services\EagleNT.
17 VI 2011 19:22:02 - C:\WINDOWS\system32\Drivers\sptd.sys not Scanned. Possibly password protected...
17 VI 2011 19:22:04 - ERROR(2)!!! Invalid Entry C:\WINDOWS\system32\pxyzhbo.dll. Action Taken: Removing HKLM\SYSTEM\CurrentControlSet\Services\utloqn.

17 VI 2011 19:22:04 - ***** Scanning System32 Folders *****
17 VI 2011 19:26:23 - Scanning File C:\WINDOWS\system32\pxyzhbo.dll
17 VI 2011 19:26:23 - ScanFile took 6.38 Secs [C:\WINDOWS\system32\pxyzhbo.dll]...

17 VI 2011 19:26:25 - File C:\WINDOWS\system32\pxyzhbo.dll infected by "Win32.Worm.Downadup.Gen (DB)" Virus! Action Taken: File Deleted.




17 VI 2011 19:40:59 - ***** Checking for specific ITW Viruses *****

17 VI 2011 19:41:00 - ***** Scanning complete. *****

17 VI 2011 19:41:00 - Total Objects Scanned: 11395
17 VI 2011 19:41:00 - Total Critical Objects: 1
17 VI 2011 19:41:00 - Total Disinfected Objects: 0
17 VI 2011 19:41:00 - Total Objects Renamed: 0
17 VI 2011 19:41:00 - Total Deleted Objects: 1
17 VI 2011 19:41:00 - Total Errors: 2
17 VI 2011 19:41:00 - Time Elapsed: 00:14:01
17 VI 2011 19:41:00 - Virus Database Date: 20 Oct 2010
17 VI 2011 19:41:00 - Virus Database Count: 6359864

17 VI 2011 19:41:00 - Scan Completed.

PC vyčistěte CCleanerem: http://www.viry.cz/forum/viewtopic.php?f=46&t=7478 a dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

Tak jsem co vycistil CCleanerem
a tu mas LOG z ComboFix

ComboFix 11-06-17.04 - jirka 18.06.2011 18:25:18.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1015.683 [GMT 2:00]
Spuštěný z: c:\documents and settings\jirka.JIRKA-77C412237\Dokumenty\Stažené soubory\ComboFix.exe
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\jirka.JIRKA-77C412237\WINDOWS
C:\Install.exe
c:\windows\regedit.com
c:\windows\system32\taskmgr.com
c:\windows\XSxS
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-05-18 do 2011-06-18 )))))))))))))))))))))))))))))))
.
.
2011-06-18 16:14 . 2011-06-18 16:14 389632 ----a-w- c:\windows\system32\CF10783.exe
2011-06-17 17:12 . 2011-06-17 17:12 632064 ----a-w- c:\windows\system32\msvcr80.dll
2011-06-17 17:12 . 2011-06-17 17:12 554240 ----a-w- c:\windows\system32\msvcp80.dll
2011-06-17 17:12 . 2011-06-17 17:12 34048 ----a-w- c:\windows\system32\eEmpty.exe
2011-06-17 17:12 . 2004-08-17 13:49 147968 ----a-w- c:\windows\R.COM
2011-06-17 17:12 . 2004-08-17 13:49 137216 ----a-w- c:\windows\system32\T.COM
2011-06-15 12:39 . 2011-06-15 12:39 -------- d-----w- c:\program files\AVAST Software
2011-06-11 18:07 . 2011-06-11 18:07 -------- d-----w- c:\documents and settings\jirka.JIRKA-77C412237\Local Settings\Data aplikací\yBook
2011-06-11 18:07 . 2004-03-09 14:45 212240 ----a-w- c:\windows\system32\RICHTX32.OCX
2011-06-11 18:07 . 2004-03-09 14:45 132880 ----a-w- c:\windows\system32\MSINET.OCX
2011-06-11 18:07 . 1998-05-11 18:01 240944 ----a-w- c:\windows\system32\RICHED.DLL
2011-06-08 14:00 . 2011-06-08 14:34 -------- d-----w- c:\program files\Metin2
2011-06-08 08:05 . 2011-06-08 11:53 -------- d-----w- c:\program files\Wizard101(UK)
2011-06-07 10:35 . 2011-06-07 10:35 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2011-06-07 10:35 . 2011-06-07 10:35 103864 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
2011-06-05 15:40 . 2011-06-05 15:40 -------- d-----w- c:\documents and settings\jirka.JIRKA-77C412237\Data aplikací\.minecraft
2011-05-27 12:51 . 2011-05-27 13:43 -------- d-----w- c:\documents and settings\jirka.JIRKA-77C412237\Local Settings\Data aplikací\PMB Files
2011-05-27 12:51 . 2011-05-27 12:51 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Data aplikac
2011-05-27 12:49 . 2011-05-27 12:49 -------- d-----w- c:\program files\Pando Networks
2011-05-23 12:34 . 2011-05-23 12:34 -------- d-----w- c:\documents and settings\jirka.JIRKA-77C412237\Local Settings\Data aplikací\TEAM_ROOTS
2011-05-23 12:34 . 2011-05-23 12:34 -------- d-----w- c:\program files\TEAM ROOTS
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-04 05:42 . 2011-05-04 05:42 436792 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-05-07 05:28 . 2011-05-07 05:28 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{2c650b7d-aa32-4798-af1a-fd8ef806d89f}"= "c:\program files\Local_Strike\tbLoca.dll" [2009-05-20 2085400]
.
[HKEY_CLASSES_ROOT\clsid\{2c650b7d-aa32-4798-af1a-fd8ef806d89f}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2c650b7d-aa32-4798-af1a-fd8ef806d89f}]
2009-05-20 17:05 2085400 ----a-w- c:\program files\Local_Strike\tbLoca.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2c650b7d-aa32-4798-af1a-fd8ef806d89f}"= "c:\program files\Local_Strike\tbLoca.dll" [2009-05-20 2085400]
.
[HKEY_CLASSES_ROOT\clsid\{2c650b7d-aa32-4798-af1a-fd8ef806d89f}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{2C650B7D-AA32-4798-AF1A-FD8EF806D89F}"= "c:\program files\Local_Strike\tbLoca.dll" [2009-05-20 2085400]
.
[HKEY_CLASSES_ROOT\clsid\{2c650b7d-aa32-4798-af1a-fd8ef806d89f}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-04-16 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-04-16 155648]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-04-16 131072]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-16 16855552]
"SkyTel"="SkyTel.EXE" [2007-10-11 1826816]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
.
c:\documents and settings\All Users.WINDOWS\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Psygnosis\\Rollcage\\Direct3D\\Rollcage.exe"=
"c:\\Program Files\\ICQ7.5\\ICQ.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8004:TCP"= 8004:TCP:rwsllxdi
"58756:TCP"= 58756:TCP:Pando Media Booster
"58756:UDP"= 58756:UDP:Pando Media Booster
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4.5.2011 7:42 436792]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [1.9.2010 12:27 13696]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [17.8.2004 15:49 14336]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [17.9.2008 18:47 247608]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [19.10.2010 20:48 16512]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [19.10.2010 19:55 36608]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\drivers\ss_bbus.sys [19.10.2010 19:56 98432]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\drivers\ss_bmdfl.sys [19.10.2010 19:56 14848]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\drivers\ss_bmdm.sys [19.10.2010 19:56 123648]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 83.240.0.214 83.240.0.215
FF - ProfilePath - c:\documents and settings\jirka.JIRKA-77C412237\Data aplikací\Mozilla\Firefox\Profiles\hq226y0k.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1750559&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKCU-Run-PlayNC Launcher - (no file)
HKLM-Run-NPSStartup - (no file)
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-18 18:30
Windows 5.1.2600 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1202660629-1450960922-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1AD9BCFC-3D18-BCA1-FFBC-2C011F4A7B08}*]
"mahmkjiebhcccgepimcaopfjch"=hex:6f,61,6b,6f,6f,61,70,6f,63,61,6d,63,6b,68,6e,
70,6b,6a,6d,6e,6f,70,6e,63,69,6f,65,6b,65,67,00,00
.
Celkový čas: 2011-06-18 18:32:23
ComboFix-quarantined-files.txt 2011-06-18 16:32
.
Před spuštěním: Volných bajtů: 12 640 432 128
Po spuštění: Volných bajtů: 14 539 849 728
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - A506F197CD4B6B1A8A598714FA3A754E

Ještě dočistíme. Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:

Driver::
Akamai

Regnull::
[HKEY_USERS\S-1-5-21-1202660629-1450960922-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1AD9BCFC-3D18-BCA1-FFBC-2C011F4A7B08}*]

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Tak jsem to udelal a tu mas log



ComboFix 11-06-17.04 - jirka 18.06.2011 19:22:11.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1015.621 [GMT 2:00]
Spuštěný z: c:\documents and settings\jirka.JIRKA-77C412237\Dokumenty\Stažené soubory\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\jirka.JIRKA-77C412237\Plocha\CFScript.txt.txt
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-05-18 do 2011-06-18 )))))))))))))))))))))))))))))))
.
.
2011-06-18 16:14 . 2011-06-18 16:14 389632 ----a-w- c:\windows\system32\CF10783.exe
2011-06-17 17:12 . 2011-06-17 17:12 632064 ----a-w- c:\windows\system32\msvcr80.dll
2011-06-17 17:12 . 2011-06-17 17:12 554240 ----a-w- c:\windows\system32\msvcp80.dll
2011-06-17 17:12 . 2011-06-17 17:12 34048 ----a-w- c:\windows\system32\eEmpty.exe
2011-06-17 17:12 . 2004-08-17 13:49 147968 ----a-w- c:\windows\R.COM
2011-06-17 17:12 . 2004-08-17 13:49 137216 ----a-w- c:\windows\system32\T.COM
2011-06-15 12:39 . 2011-06-15 12:39 -------- d-----w- c:\program files\AVAST Software
2011-06-11 18:07 . 2011-06-11 18:07 -------- d-----w- c:\documents and settings\jirka.JIRKA-77C412237\Local Settings\Data aplikací\yBook
2011-06-11 18:07 . 2004-03-09 14:45 212240 ----a-w- c:\windows\system32\RICHTX32.OCX
2011-06-11 18:07 . 2004-03-09 14:45 132880 ----a-w- c:\windows\system32\MSINET.OCX
2011-06-11 18:07 . 1998-05-11 18:01 240944 ----a-w- c:\windows\system32\RICHED.DLL
2011-06-08 14:00 . 2011-06-08 14:34 -------- d-----w- c:\program files\Metin2
2011-06-08 08:05 . 2011-06-08 11:53 -------- d-----w- c:\program files\Wizard101(UK)
2011-06-07 10:35 . 2011-06-07 10:35 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2011-06-07 10:35 . 2011-06-07 10:35 103864 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
2011-06-05 15:40 . 2011-06-05 15:40 -------- d-----w- c:\documents and settings\jirka.JIRKA-77C412237\Data aplikací\.minecraft
2011-05-27 12:51 . 2011-05-27 13:43 -------- d-----w- c:\documents and settings\jirka.JIRKA-77C412237\Local Settings\Data aplikací\PMB Files
2011-05-27 12:51 . 2011-05-27 12:51 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Data aplikac
2011-05-27 12:49 . 2011-05-27 12:49 -------- d-----w- c:\program files\Pando Networks
2011-05-23 12:34 . 2011-05-23 12:34 -------- d-----w- c:\documents and settings\jirka.JIRKA-77C412237\Local Settings\Data aplikací\TEAM_ROOTS
2011-05-23 12:34 . 2011-05-23 12:34 -------- d-----w- c:\program files\TEAM ROOTS
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-04 05:42 . 2011-05-04 05:42 436792 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-05-07 05:28 . 2011-05-07 05:28 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{2c650b7d-aa32-4798-af1a-fd8ef806d89f}"= "c:\program files\Local_Strike\tbLoca.dll" [2009-05-20 2085400]
.
[HKEY_CLASSES_ROOT\clsid\{2c650b7d-aa32-4798-af1a-fd8ef806d89f}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2c650b7d-aa32-4798-af1a-fd8ef806d89f}]
2009-05-20 17:05 2085400 ----a-w- c:\program files\Local_Strike\tbLoca.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2c650b7d-aa32-4798-af1a-fd8ef806d89f}"= "c:\program files\Local_Strike\tbLoca.dll" [2009-05-20 2085400]
.
[HKEY_CLASSES_ROOT\clsid\{2c650b7d-aa32-4798-af1a-fd8ef806d89f}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{2C650B7D-AA32-4798-AF1A-FD8EF806D89F}"= "c:\program files\Local_Strike\tbLoca.dll" [2009-05-20 2085400]
.
[HKEY_CLASSES_ROOT\clsid\{2c650b7d-aa32-4798-af1a-fd8ef806d89f}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-04-16 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-04-16 155648]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-04-16 131072]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-16 16855552]
"SkyTel"="SkyTel.EXE" [2007-10-11 1826816]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
.
c:\documents and settings\All Users.WINDOWS\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Psygnosis\\Rollcage\\Direct3D\\Rollcage.exe"=
"c:\\Program Files\\ICQ7.5\\ICQ.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8004:TCP"= 8004:TCP:rwsllxdi
"58756:TCP"= 58756:TCP:Pando Media Booster
"58756:UDP"= 58756:UDP:Pando Media Booster
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4.5.2011 7:42 436792]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [1.9.2010 12:27 13696]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [17.8.2004 15:49 14336]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [17.9.2008 18:47 247608]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [19.10.2010 20:48 16512]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [19.10.2010 19:55 36608]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\drivers\ss_bbus.sys [19.10.2010 19:56 98432]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\drivers\ss_bmdfl.sys [19.10.2010 19:56 14848]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\drivers\ss_bmdm.sys [19.10.2010 19:56 123648]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 83.240.0.214 83.240.0.215
FF - ProfilePath - c:\documents and settings\jirka.JIRKA-77C412237\Data aplikací\Mozilla\Firefox\Profiles\hq226y0k.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1750559&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-18 19:29
Windows 5.1.2600 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-1202660629-1450960922-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1AD9BCFC-3D18-BCA1-FFBC-2C011F4A7B08}*]
"mahmkjiebhcccgepimcaopfjch"=hex:6f,61,6b,6f,6f,61,70,6f,63,61,6d,63,6b,68,6e,
70,6b,6a,6d,6e,6f,70,6e,63,69,6f,65,6b,65,67,00,00
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(3632)
c:\windows\system32\msi.dll
.
Celkový čas: 2011-06-18 19:30:48
ComboFix-quarantined-files.txt 2011-06-18 17:30
ComboFix2.txt 2011-06-18 16:32
.
Před spuštěním: Volných bajtů: 14 552 670 208
Po spuštění: Volných bajtů: 14 541 234 176
.
- - End Of File - - 02E5F046D65961062EFF2B5BD7EE477E

Akci budete muset zopakovat, nei nebylo smazaáno. Skript byl uložen chybně jako CFScript.txt.txt . Musí být CFScript.txt .

Tak jsem to zopakoval

ComboFix 11-06-19.0r1 - jirka 20.06.2011 15:59:33.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1015.683 [GMT 2:00]
Spuštěný z: c:\documents and settings\jirka.JIRKA-77C412237\Dokumenty\Stažené soubory\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\jirka.JIRKA-77C412237\Plocha\CFScript.txt.txt
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_AKAMAI
-------\Service_Akamai
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-05-20 do 2011-06-20 )))))))))))))))))))))))))))))))
.
.
2011-06-18 18:14 . 2011-06-18 18:14 -------- d-----w- c:\documents and settings\jirka.JIRKA-77C412237\Data aplikací\A4DeskPro
2011-06-18 16:14 . 2011-06-18 16:14 389632 ----a-w- c:\windows\system32\CF10783.exe
2011-06-17 17:12 . 2011-06-17 17:12 632064 ----a-w- c:\windows\system32\msvcr80.dll
2011-06-17 17:12 . 2011-06-17 17:12 554240 ----a-w- c:\windows\system32\msvcp80.dll
2011-06-17 17:12 . 2011-06-17 17:12 34048 ----a-w- c:\windows\system32\eEmpty.exe
2011-06-17 17:12 . 2004-08-17 13:49 147968 ----a-w- c:\windows\R.COM
2011-06-17 17:12 . 2004-08-17 13:49 137216 ----a-w- c:\windows\system32\T.COM
2011-06-15 12:39 . 2011-06-15 12:39 -------- d-----w- c:\program files\AVAST Software
2011-06-11 18:07 . 2011-06-11 18:07 -------- d-----w- c:\documents and settings\jirka.JIRKA-77C412237\Local Settings\Data aplikací\yBook
2011-06-11 18:07 . 2004-03-09 14:45 212240 ----a-w- c:\windows\system32\RICHTX32.OCX
2011-06-11 18:07 . 2004-03-09 14:45 132880 ----a-w- c:\windows\system32\MSINET.OCX
2011-06-11 18:07 . 1998-05-11 18:01 240944 ----a-w- c:\windows\system32\RICHED.DLL
2011-06-08 14:00 . 2011-06-18 18:57 -------- d-----w- c:\program files\Metin2
2011-06-08 08:05 . 2011-06-08 11:53 -------- d-----w- c:\program files\Wizard101(UK)
2011-06-07 10:35 . 2011-06-07 10:35 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2011-06-07 10:35 . 2011-06-07 10:35 103864 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
2011-06-05 15:40 . 2011-06-05 15:40 -------- d-----w- c:\documents and settings\jirka.JIRKA-77C412237\Data aplikací\.minecraft
2011-05-27 12:51 . 2011-05-27 13:43 -------- d-----w- c:\documents and settings\jirka.JIRKA-77C412237\Local Settings\Data aplikací\PMB Files
2011-05-27 12:51 . 2011-05-27 12:51 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Data aplikac
2011-05-27 12:49 . 2011-05-27 12:49 -------- d-----w- c:\program files\Pando Networks
2011-05-23 12:34 . 2011-05-23 12:34 -------- d-----w- c:\documents and settings\jirka.JIRKA-77C412237\Local Settings\Data aplikací\TEAM_ROOTS
2011-05-23 12:34 . 2011-05-23 12:34 -------- d-----w- c:\program files\TEAM ROOTS
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-04 05:42 . 2011-05-04 05:42 436792 ----a-w- c:\windows\system32\drivers\sptd.sys
2011-05-07 05:28 . 2011-05-07 05:28 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-06-18_16.30.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-06-20 14:08 . 2011-06-20 14:08 16384 c:\windows\Temp\Perflib_Perfdata_72c.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{2c650b7d-aa32-4798-af1a-fd8ef806d89f}"= "c:\program files\Local_Strike\tbLoca.dll" [2009-05-20 2085400]
.
[HKEY_CLASSES_ROOT\clsid\{2c650b7d-aa32-4798-af1a-fd8ef806d89f}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2c650b7d-aa32-4798-af1a-fd8ef806d89f}]
2009-05-20 17:05 2085400 ----a-w- c:\program files\Local_Strike\tbLoca.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2c650b7d-aa32-4798-af1a-fd8ef806d89f}"= "c:\program files\Local_Strike\tbLoca.dll" [2009-05-20 2085400]
.
[HKEY_CLASSES_ROOT\clsid\{2c650b7d-aa32-4798-af1a-fd8ef806d89f}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{2C650B7D-AA32-4798-AF1A-FD8EF806D89F}"= "c:\program files\Local_Strike\tbLoca.dll" [2009-05-20 2085400]
.
[HKEY_CLASSES_ROOT\clsid\{2c650b7d-aa32-4798-af1a-fd8ef806d89f}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-04-16 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-04-16 155648]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-04-16 131072]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-16 16855552]
"SkyTel"="SkyTel.EXE" [2007-10-11 1826816]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
.
c:\documents and settings\All Users.WINDOWS\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\TmNationsForever\\TmForever.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Psygnosis\\Rollcage\\Direct3D\\Rollcage.exe"=
"c:\\Program Files\\ICQ7.5\\ICQ.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8004:TCP"= 8004:TCP:rwsllxdi
"58756:TCP"= 58756:TCP:Pando Media Booster
"58756:UDP"= 58756:UDP:Pando Media Booster
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4.5.2011 7:42 436792]
R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [1.9.2010 12:27 13696]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [17.9.2008 18:47 247608]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [19.10.2010 20:48 16512]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [19.10.2010 19:55 36608]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\drivers\ss_bbus.sys [19.10.2010 19:56 98432]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\drivers\ss_bmdfl.sys [19.10.2010 19:56 14848]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\drivers\ss_bmdm.sys [19.10.2010 19:56 123648]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 83.240.0.214 83.240.0.215
FF - ProfilePath - c:\documents and settings\jirka.JIRKA-77C412237\Data aplikací\Mozilla\Firefox\Profiles\hq226y0k.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1750559&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-20 16:20
Windows 5.1.2600 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(2748)
c:\windows\system32\msi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxsrvc.exe
.
**************************************************************************
.
Celkový čas: 2011-06-20 16:23:52 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-06-20 14:23
ComboFix2.txt 2011-06-18 16:32
.
Před spuštěním: Volných bajtů: 16 317 612 032
Po spuštění: Volných bajtů: 16 260 161 536
.
- - End Of File - - 87259BCDC85FCC91C37C86BBFC16B50B

Položky nyní byly smazány. Log již vypadá čistý.