Facebook vir aneb fated click story! Dik za pomoc :].

[Stephaeone]

Logfile of random's system information tool 1.09 (written by random/random)
Run by Stephaeone at 2011-07-26 23:46:11
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 17 GB (61%) free of 28 GB
Total RAM: 447 MB (11% free)


======Scheduled tasks folder======

C:\windows\tasks\MP Scheduled Scan.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Stephaeone\Data aplikací\Mozilla\Firefox\Profiles\ue637ff6.default

prefs.js - "browser.startup.homepage" - "http://partnerpage.google.com/upmedia.cz"
prefs.js - "extensions.enabledItems" - "plugin3@gameplaylabs.com:3.0, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.17"

"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@google.com/npPicasa3,version=3.0.0]
"Description"=Picasa3 plugin
"Path"=C:\Program Files\Google\Picasa3\npPicasa3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\plugins\
nppdf32.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Documents and Settings\Stephaeone\Data aplikací\Mozilla\Firefox\Profiles\ue637ff6.default\extensions\
plugin3@gameplaylabs.com

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DB66063-BB98-466A-AA0D-3E7ACF5ED853}]
WebTransBHO Class - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG9\avgssie.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-05-16 1164680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BFC32E1D-EE75-4A48-BC60-104E11EE2431} - WebTranslator - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
"D-Link AirPlus G"=C:\Program Files\D-Link\AirPlus G\AirGCFG.exe [2006-11-17 1552384]
"ANIWZCS2Service"=C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe [2006-06-29 49152]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2006-01-12 155648]
"HControl"=C:\WINDOWS\ATK0100\HControl.exe [2006-04-17 110592]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2006-04-27 344064]
"RTHDCPL"=C:\windows\RTHDCPL.EXE [2006-04-17 16143872]
"Alcmtr"=C:\windows\ALCMTR.EXE [2005-05-03 69632]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2010-12-09 74752]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2011-06-08 37296]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-03-30 937920]
"PAC7302_Monitor"=C:\WINDOWS\PixArt\PAC7302\Monitor.exe [2006-11-03 319488]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe -hide []
"wxpdrv"=C:\WINDOWS\services32.exe []
"tray_ico"= []
"tray_ico0"=C:\WINDOWS\update.tray-15-0\svchost.exe [2011-07-25 1185280]
"tray_ico1"=C:\WINDOWS\update.tray-9-0\svchost.exe [2011-07-25 1185280]
"tray_ico2"= []
"tray_ico3"= []
"tray_ico4"= []
"5365387.exe"=C:\WINDOWS\TEMP\5365387.exe [2011-07-25 247296]
"sysdriver32.exe"=C:\windows\sysdriver32.exe [2011-07-25 261632]
"sysdriver32_.exe"=C:\windows\sysdriver32_.exe [2011-07-25 256000]
"5286667.exe"=C:\WINDOWS\TEMP\5286667.exe [2011-07-25 495616]
"87084983-loader2.exe"=C:\WINDOWS\TEMP\87084983-loader2.exe [2011-07-25 247296]
"l1rezerv.exe"=C:\WINDOWS\l1rezerv.exe [2011-07-25 232960]
"systemup"=C:\WINDOWS\systemup.exe [2011-07-25 118784]
"796352.exe"=C:\WINDOWS\TEMP\796352.exe [2011-07-25 256000]
"w_distrib.exe"=C:\WINDOWS\update.3\svchost.exe [2011-07-25 278528]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"=cmd.exe /c start http://www.avg.com/ww.special-uninstall ... er=9.0.894 []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\windows\system32\ctfmon.exe [2004-08-17 15360]
"uTorrent"=C:\Program Files\uTorrent\uTorrent.exe [2011-04-02 399736]
"Samsung_AppInst"=F:\SamsungSoftware\AppInst.exe []
"Nektra OEAPI"= []
"OEXPRESS"= []

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

C:\Documents and Settings\Stephaeone\Nabídka Start\Programy\Po spuštění
Lingea Update Center.lnk - C:\Program Files\Common Files\Lingea Shared\luc.exe
Samsung Auto Backup Guage.lnk - C:\Program Files\Clarus\Samsung Auto Backup\ISFGuage.exe
Samsung Auto Backup Real-Time Daemon.lnk - C:\Program Files\Clarus\Samsung Auto Backup\ISFRealTimeD.exe
Samsung Auto Backup Scheduler.lnk - C:\Program Files\Clarus\Samsung Auto Backup\ISFTimerD.exe
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\windows\system32\Ati2evxx.dll [2006-04-27 61440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WINDOW~4\MpShHook.dll [2006-11-03 83224]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\wxpdrivers]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0
"EnableSecureUIAPaths"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Winamp\winamp.exe"="C:\Program Files\Winamp\winamp.exe:*:Enabled:Winamp"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"D:\Stažené soubory\Flash-Player.exe"="D:\Stažené soubory\Flash-Player.exe:*:Enabled:D:\Stažené soubory\Flash-Player.exe"
"C:\WINDOWS\update.1\svchost.exe"="C:\WINDOWS\update.1\svchost.exe:*:Enabled:C:\WINDOWS\update.1\svchost.exe"
"C:\WINDOWS\update.2\svchost.exe"="C:\WINDOWS\update.2\svchost.exe:*:Enabled:C:\WINDOWS\update.2\svchost.exe"
"C:\WINDOWS\update.3\svchost.exe"="C:\WINDOWS\update.3\svchost.exe:*:Enabled:C:\WINDOWS\update.3\svchost.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"VIDC.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"VIDC.YVYU"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=serwvdrv.dll
"MSVideo8"=VfWWDM32.dll
"wave3"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv

======List of files/folders created in the last 1 month======

2011-07-26 23:46:12 ----D---- C:\Program Files\trend micro
2011-07-26 23:46:11 ----D---- C:\rsit
2011-07-26 10:22:49 ----D---- C:\Program Files\AMD APP
2011-07-26 10:22:37 ----D---- C:\Program Files\ATI
2011-07-26 10:11:50 ----D---- C:\ATI
2011-07-26 10:04:18 ----D---- C:\windows\ufa
2011-07-26 10:04:18 ----D---- C:\windows\rpcminer
2011-07-26 10:04:18 ----D---- C:\windows\phoenix
2011-07-26 10:01:05 ----A---- C:\windows\btc_client_iplist.txt
2011-07-25 22:36:13 ----A---- C:\windows\w_distrib_iplist.txt
2011-07-25 22:35:43 ----HD---- C:\windows\update.3
2011-07-25 11:12:42 ----A---- C:\windows\ddh_iplist.txt
2011-07-25 11:12:17 ----A---- C:\windows\systemup.exe
2011-07-25 11:09:08 ----HD---- C:\windows\update.5.0
2011-07-25 11:06:56 ----HD---- C:\windows\update.tray-9-0-lnk
2011-07-25 11:06:56 ----HD---- C:\windows\update.tray-9-0
2011-07-25 11:01:43 ----A---- C:\windows\l1rezerv.exe
2011-07-25 10:57:24 ----A---- C:\windows\unrar.exe
2011-07-25 10:55:46 ----A---- C:\windows\iecheck_iplist.txt
2011-07-25 10:54:22 ----HD---- C:\windows\update.2
2011-07-25 10:51:40 ----D---- C:\windows\av_ico
2011-07-25 10:51:34 ----A---- C:\windows\sysdriver32_.exe
2011-07-25 10:51:25 ----A---- C:\windows\iplist.txt
2011-07-25 10:51:20 ----A---- C:\windows\sysdriver32.exe
2011-07-25 10:51:04 ----A---- C:\windows\front_ip_list.txt
2011-07-25 10:49:21 ----HD---- C:\windows\update.1
2011-07-25 10:49:15 ----HD---- C:\windows\update.tray-15-0-lnk
2011-07-25 10:49:15 ----HD---- C:\windows\update.tray-15-0
2011-07-25 10:39:30 ----A---- C:\windows\winlog-ids.txt
2011-07-25 10:39:30 ----A---- C:\windows\winlog-dirs.txt

======List of files/folders modified in the last 1 month======

2011-07-26 23:46:52 ----D---- C:\Documents and Settings\Stephaeone\Data aplikací\uTorrent
2011-07-26 23:46:12 ----RD---- C:\Program Files
2011-07-26 23:45:53 ----D---- C:\windows\Prefetch
2011-07-26 23:44:29 ----D---- C:\Documents and Settings\Stephaeone\Data aplikací\Skype
2011-07-26 23:16:48 ----D---- C:\windows\Temp
2011-07-26 23:15:54 ----D---- C:\windows\system32\drivers
2011-07-26 23:15:07 ----A---- C:\windows\SchedLgU.Txt
2011-07-26 10:22:51 ----SHD---- C:\windows\Installer
2011-07-26 10:22:51 ----SHD---- C:\Config.Msi
2011-07-26 10:22:49 ----D---- C:\windows\system32
2011-07-26 10:22:43 ----D---- C:\Program Files\ATI Technologies
2011-07-26 10:04:18 ----D---- C:\WINDOWS
2011-07-25 21:49:17 ----A---- C:\windows\NeroDigital.ini
2011-07-25 11:16:33 ----RSD---- C:\windows\assembly
2011-07-25 11:14:35 ----SHD---- C:\System Volume Information
2011-07-25 11:14:35 ----D---- C:\windows\system32\Restore
2011-07-25 10:54:41 ----D---- C:\windows\system32\drivers\etc
2011-07-25 10:49:20 ----D---- C:\Program Files\Windows Defender
2011-07-25 10:30:29 ----D---- C:\windows\system32\CatRoot2
2011-07-25 10:30:25 ----SD---- C:\windows\Tasks
2011-07-13 16:21:11 ----A---- C:\windows\system32\MRT.exe
2011-07-13 16:20:46 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2011-07-06 21:41:21 ----RD---- C:\Program Files\Skype
2011-07-06 21:41:02 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2011-07-06 21:36:57 ----D---- C:\Documents and Settings\Stephaeone\Data aplikací\skypePM
2011-06-29 16:59:11 ----HD---- C:\windows\inf
2011-06-28 18:25:21 ----D---- C:\Program Files\Mozilla Firefox
2011-06-27 15:05:53 ----A---- C:\windows\system32\PerfStringBackup.INI

[meteorolog]

zdravím

stáhni a nainstaluj Malwarebytes' Anti-Malware - http://www.slunecnice.cz/sw/malwarebytes-anti-malware/

program aktualizuj - toto určitě proveď, je to důležité

zavři všechny spuštěné aplikace, nech zaškrtnuté "Rychlá kontrola" a klikni na "Prohledat" - po skončení skenování (3 - 15 minut, někdy i déle) klikni na Zobrazit výsledky, nech zaškrtnutá všechna políčka a klikni na Odstranit vybrané, potom na OK a restartuj PC - znovu spusť Malwarebytes', otevři záložku Protokoly a vlož sem aktuální log

[Stephaeone]

Stahl jsem aplikaci Malwarebyte podle navodu, nainstaloval, ale kdyz spustim prohledat, tak aplikace za chvili spadne a pak uz se neda vubec otevrit [zkousel jsem nekolikrat znovu nainstalovat a vdy to same]!???

[meteorolog]

zeptám se, máte legální systém?

nouzový režim vám funguje?

[Stephaeone]

Windows mi instaloval kamarad a podle vseho pouzil original instalacku, doufam [uz je to davno]!

Nouzovy rezim funguje.

Pocitac jede az na to, ze strasne pomalu, to se tyka hlavne internetu [CPU vyuziti pameti je 100%, a to mam jen otevren prohlizec]. Nejde se vubec prihlasit na face [to mi ani moc neva, spis mam zle tuseni, ze se z mojeho profilu vir siri dal]. Antivirus vykazuje vsechny znaky popsane v clanku na viry.cz. Kdyz vypinam nebo restartuju pc vyskakuji okna s ukoncovanim uloh!?

[meteorolog]

musíme prověřit pravost systému, pokud je nelegální, léčení nemá smysl - stáhni a nainstaluj toto:

http://www.microsoft.com/download/en/de ... x?id=20888