zase vir

[brankar]

Nazdar Rudy, vcera syn chytil zase nějakého šmejda na PC
udělal jsem scan ze SAS a poté jsem to smázl
Nějak jse mi to nezdálo tak jsem udělal scan combo fix ,hlavně mě nebij že jsem nedal až na doporučení rádce.
Nevím ale combo fix nejde odinstalovat vždy jse to zeptÁ jestli to má vyhodit do koše a pak se to zpustí a hce to stahovat aktualizace.
Prosím o kontolu díky předem


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/15/2011 at 03:48 PM

Application Version : 4.55.1000

Core Rules Database Version : 7411
Trace Rules Database Version: 5223

Scan type : Complete Scan
Total Scan Time : 00:27:09

Memory items scanned : 411
Memory threats detected : 0
Registry items scanned : 6643
Registry threats detected : 0
File items scanned : 14283
File threats detected : 2

Adware.Tracking Cookie
C:\Documents and Settings\user\Cookies\user@www.googleadservices[1].txt

Heuristic.Keygen/Dropper
C:\DOCUMENTS AND SETTINGS\USER\PLOCHA\RAR$EX83.832\AVIRA_SERIAL_KEY_GEN_BY_FUTURITY.EXE


ComboFix 11-07-15.01 - user 15.07.2011 17:50:41.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1022.532 [GMT 2:00]
Spuštěný z: c:\documents and settings\user\Plocha\ComboFix.exe
FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}
.
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-06-15 do 2011-07-15 )))))))))))))))))))))))))))))))
.
.
2011-07-15 14:44 . 2011-07-15 14:44 -------- d-----w- C:\$AVG
2011-07-15 14:30 . 2011-07-15 14:30 -------- d-sh--w- c:\documents and settings\UpdatusUser\IETldCache
2011-07-15 14:25 . 2011-07-15 14:25 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2011-07-15 13:16 . 2011-07-15 13:16 -------- d-----w- c:\documents and settings\user\Data aplikací\SUPERAntiSpyware.com
2011-07-15 13:16 . 2011-07-15 13:16 -------- d-----w- c:\documents and settings\All Users\Data aplikací\SUPERAntiSpyware.com
2011-07-15 13:16 . 2011-07-15 13:16 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-07-13 14:25 . 2011-07-13 14:27 -------- d-----w- c:\program files\18 WoS Extreme Trucker 2
2011-07-13 08:44 . 2007-03-05 09:51 360580 ----a-w- c:\windows\eSellerateEngine.dll
2011-07-13 08:44 . 2011-07-13 08:43 803161 ----a-w- c:\program files\Microsoft Games\Flight Simulator 9\unins000.exe
2011-07-13 07:49 . 2004-02-04 14:08 492032 ----a-w- c:\program files\Microsoft Games\Flight Simulator 9\uninstall_Wonderful Madeira.exe
2011-07-13 07:47 . 2004-02-04 15:08 492032 ----a-w- c:\program files\Microsoft Games\Flight Simulator 9\uninstall_sca1.exe
2011-07-13 00:43 . 2010-12-20 00:00 270336 ----a-w- c:\program files\Microsoft Games\Flight Simulator 9\aerosoft\German Airports 1\EDDS_SC\EDDSTraffic.exe
2011-07-13 00:40 . 2005-11-29 09:13 711168 ----a-w- c:\program files\Microsoft Games\Flight Simulator 9\aerosoft\EDDF_2005\AITraffic.exe
2011-07-13 00:24 . 2011-06-23 23:00 290816 ----a-w- c:\program files\Microsoft Games\Flight Simulator 9\aerosoft\Mega Airport Zurich 2012 SC\LSZHTraffic.exe
2011-07-13 00:24 . 2011-06-23 23:00 290816 ----a-w- c:\program files\Microsoft Games\Flight Simulator 9\aerosoft\Mega Airport Zurich 2012 SC\LSZHConfig.exe
2011-07-13 00:13 . 2008-11-10 00:00 425984 ----a-w- c:\program files\Microsoft Games\Flight Simulator 9\aerosoft\Mega Airport Paris CDG\LFPGTraffic.exe
2011-07-13 00:10 . 2011-07-13 00:10 -------- d-----w- c:\documents and settings\user\Data aplikací\InstallShield
2011-07-10 15:13 . 2011-07-10 15:13 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Trymedia
2011-07-08 16:27 . 2011-07-08 19:03 138160 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-07-08 16:27 . 2011-07-09 10:55 271200 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-07-08 16:27 . 2011-07-08 19:03 271200 ----a-w- c:\windows\system32\PnkBstrB.ex0
2011-07-08 16:27 . 2011-07-09 10:55 271200 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-07-08 16:27 . 2011-07-08 16:27 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
2011-07-08 16:27 . 2011-07-08 16:27 -------- d-----w- c:\documents and settings\user\Local Settings\Data aplikací\PunkBuster
2011-07-07 09:43 . 2011-07-07 09:43 -------- d-----w- c:\documents and settings\user\Local Settings\Data aplikací\Rockstar Games
2011-07-07 09:15 . 2011-07-07 09:15 -------- d--h--r- c:\documents and settings\user\Data aplikací\SecuROM
2011-07-07 09:08 . 2011-07-08 16:27 -------- d-----w- c:\windows\system32\LogFiles
2011-07-07 09:08 . 2011-07-07 09:08 -------- d-----w- c:\windows\system32\drivers\umdf
2011-07-06 14:47 . 2011-07-06 14:47 -------- d-----w- c:\program files\EA GAMES
2011-07-06 07:40 . 2011-07-06 07:41 -------- d-----w- c:\program files\EACOM
2011-07-02 16:10 . 2011-07-06 07:40 -------- d-----w- c:\program files\EA Sports
2011-06-29 16:49 . 2006-06-20 08:56 225280 ----a-w- c:\windows\system32\rewire.dll
2011-06-29 16:49 . 2009-09-15 09:14 1554944 ----a-w- c:\windows\system32\vorbis.acm
2011-06-29 16:48 . 2011-06-29 16:49 -------- d-----w- c:\program files\VstPlugins
2011-06-29 16:48 . 2011-06-29 16:48 -------- d-----w- c:\program files\Outsim
2011-06-29 16:45 . 2011-06-29 16:49 -------- d-----w- c:\program files\Image-Line
2011-06-29 13:23 . 2011-06-29 13:23 50624 ----a-w- c:\program files\Microsoft Games\Flight Simulator 9\Active Camera 2004 uninstall.exe
2011-06-28 17:26 . 2011-06-28 17:26 -------- d-----w- c:\program files\Realtek
2011-06-28 17:26 . 2011-05-27 15:58 1284712 ----a-w- c:\windows\RtlExUpd.dll
2011-06-28 17:26 . 2006-02-07 13:40 204800 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iuser.dll
2011-06-28 17:26 . 2006-02-07 13:40 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ctor.dll
2011-06-28 17:26 . 2006-02-07 13:40 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iscript.dll
2011-06-28 17:26 . 2006-02-07 13:39 32768 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\Objectps.dll
2011-06-28 17:26 . 2005-11-13 21:19 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe
2011-06-28 17:26 . 2006-02-07 13:45 757760 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iKernel.dll
2011-06-28 17:26 . 2011-06-28 17:26 200836 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iGdi.dll
2011-06-28 17:26 . 2011-06-28 17:26 331908 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\setup.dll
2011-06-28 17:04 . 2011-06-28 17:04 -------- d-----w- c:\program files\Driver-Soft
2011-06-28 15:47 . 2011-06-28 15:47 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2011-06-26 16:38 . 2011-06-26 16:38 -------- d-----r- c:\documents and settings\LocalService\Oblíbené položky
2011-06-20 12:46 . 2011-03-02 10:43 175616 ----a-w- c:\windows\system32\unrar.dll
2011-06-20 12:46 . 2011-03-19 19:00 151552 ----a-w- c:\windows\system32\ac3acm.acm
2011-06-20 12:46 . 2006-10-18 18:05 232448 ----a-w- c:\windows\system32\mp3fhg.acm
2011-06-20 12:46 . 2011-06-16 08:00 73216 ----a-w- c:\windows\system32\ff_vfw.dll
2011-06-20 12:46 . 2011-06-02 00:15 243200 ----a-w- c:\windows\system32\xvidvfw.dll
2011-06-20 12:46 . 2011-06-02 00:10 644608 ----a-w- c:\windows\system32\xvidcore.dll
2011-06-20 12:46 . 2010-11-03 18:08 237568 ----a-w- c:\windows\system32\yv12vfw.dll
2011-06-20 12:46 . 2011-06-20 12:47 -------- d-----w- c:\program files\K-Lite Codec Pack
2011-06-19 19:01 . 2008-11-10 09:41 32656 ----a-w- c:\windows\system32\msonpmon.dll
2011-06-19 19:01 . 2006-10-26 17:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2011-06-19 18:57 . 2011-06-20 10:47 -------- d-----w- c:\program files\Microsoft Works
2011-06-19 18:55 . 2011-06-19 18:55 -------- d-----w- c:\program files\Microsoft.NET
2011-06-19 18:53 . 2011-06-19 18:53 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2011-06-19 18:52 . 2011-06-19 18:56 -------- d-----w- c:\windows\SHELLNEW
2011-06-19 18:51 . 2011-06-19 18:51 -------- d-----r- C:\MSOCache
2011-06-19 09:44 . 2011-06-19 09:44 -------- d-----w- c:\documents and settings\Administrator
2011-06-19 04:47 . 2011-06-19 04:47 -------- d-----w- c:\program files\trend micro
2011-06-17 11:22 . 2011-06-17 12:21 -------- d-----w- c:\windows\SxsCaPendDel
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-14 17:38 . 2011-05-19 20:21 6359656 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys
2011-06-10 12:45 . 2011-05-21 00:38 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-06 11:35 . 2008-04-14 12:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-27 19:41 . 2011-05-20 23:06 86016 ----a-w- c:\windows\system32\OpenAL32.dll
2011-05-20 23:06 . 2011-05-20 23:06 445016 ----a-w- c:\windows\system32\wrap_oal.dll
2011-05-13 15:17 . 2011-05-19 20:21 59496 ----a-w- c:\windows\system32\RtkCoInstXP.dll
2011-05-12 12:10 . 2011-05-19 20:21 20053608 ----a-w- c:\windows\RTHDCPL.EXE
2011-05-02 15:32 . 2011-05-19 19:29 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25 . 2008-04-14 12:00 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19 . 2008-04-14 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-26 11:07 . 2008-04-14 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-04-26 11:07 . 2008-04-14 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-04-25 16:06 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 16:06 . 2008-04-14 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2011-04-25 16:06 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01 . 2008-04-14 12:00 385024 ------w- c:\windows\system32\html.iec
2011-04-21 13:37 . 2008-04-14 12:00 105472 ----a-w- c:\windows\system32\drivers\mup.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"NvMediaCenter"="NvMCTray.dll" [2011-04-07 111208]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-04-07 13891176]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"RTHDCPL"="RTHDCPL.EXE" [2011-05-12 20053608]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\user\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]
.
c:\documents and settings\user\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]
.
c:\documents and settings\user\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]
.
c:\documents and settings\user\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2011-02-24 00:57 1753192 ----a-w- c:\program files\NVIDIA Corporation\nView\nwiz.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft Games\\Flight Simulator 9\\fs9.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe"=
"c:\\install\\openarena-0.8.1\\openarena.exe"=
"c:\\Program Files\\Codemasters\\F1 2010\\F1_2010_game.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [12.7.2011 23:55 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12.7.2011 23:55 67664]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [28.5.2011 13:55 2218600]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [28.5.2011 14:21 136176]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [19.5.2011 22:21 1691480]
S3 MSI_MSIBIOS_010507;MSI_MSIBIOS_010507;\??\c:\program files\MSI\Live Update 5\msibios32_100507.sys --> c:\program files\MSI\Live Update 5\msibios32_100507.sys [?]
S3 NTIOLib_1_0_4;NTIOLib_1_0_4;\??\c:\program files\MSI\Live Update 5\NTIOLib.sys --> c:\program files\MSI\Live Update 5\NTIOLib.sys [?]
.
Obsah adresáře 'Naplánované úlohy'
.
2011-07-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-05-28 12:21]
.
2011-07-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-05-28 12:21]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: microsoft.com\www.update
TCP: Interfaces\{03E0E805-2D9E-4C5B-A476-D4BCCF85E0C7}: NameServer = 10.1.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKLM-Run-TaskTray - (no file)
AddRemove-PttM 1.00-1.04 Czech patch - c:\documents and settings\user\Dokumenty\18 WoS Pedal to the Metal\OdinstalovatCzech.exe
AddRemove-PttM 1.00-1.04 Slovak patch - c:\documents and settings\user\Dokumenty\18 WoS Pedal to the Metal\OdinstalovatSlovak.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-15 17:56
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-602162358-1292428093-1547161642-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-602162358-1292428093-1547161642-1004\Software\SecuROM\License information*]
"datasecu"=hex:01,02,77,ac,a0,93,16,12,8d,ce,0a,55,68,bf,f7,6c,24,ab,a0,45,34,
7f,c3,75,a9,69,55,22,77,ca,ed,d3,3c,a0,08,81,b7,4f,5c,67,a6,93,ab,13,41,41,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(792)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
- - - - - - - > 'explorer.exe'(3488)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2011-07-15 17:59:37
ComboFix-quarantined-files.txt 2011-07-15 15:59
.
Před spuštěním: Volných bajtů: 46 863 060 992
Po spuštění: Volných bajtů: 46 895 427 584
.
- - End Of File - - BE9E87DEA9BB2F9FB2B366FF9A8F7DC4

[Rudy]

Podle logu CF vypadá PC čistý. CF odinstalujte buď přes Start>spustit>(napsat) combofix /uninstall, nebo použijte T-Cleaner: http://www.edisk.cz/stahni/29485/T-Clea ... 8.5KB.html .

[brankar]

Díky Rudy

[Rudy]

Není zač!