VIRY.CZ

Dobry den příšla mi zpráva na FB a klikl sem na ni a oběvila se mi Stránka ala Youtube s mojím videem a plná příspěvků mých přátel.....Přišla mě zpráva Wanna Laugh? etc. s odkazem na "Youtube" samozřejmě jsem na odkaz kliknul, ale jak to chtělo nainstalovat flash tak mě blbnul net..... prosím o kontrolu logu....děkuju





Logfile of random's system information tool 1.09 (written by random/random)
Run by haufec at 2011-08-21 17:06:11
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 13 GB (35%) free of 38 GB
Total RAM: 502 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:06:22, on 21.8.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\update.7.1\svchostdriver.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nitro PDF\Reader\NitroPDFReaderDriverService.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\WINDOWS\update.5.0\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\update.2\svchost.exe
C:\WINDOWS\update.5.0\svchost.exe
C:\WINDOWS\sysdriver32.exe
C:\WINDOWS\update.1\svchost.exe
C:\WINDOWS\update.2\svchost.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Documents and Settings\haufec\Plocha\Bot.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\update.tray-12-0\svchost.exe
C:\WINDOWS\update.tray-7-0\svchost.exe
C:\WINDOWS\l1rezerv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\haufec\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
C:\Documents and Settings\haufec\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\haufec\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\haufec\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\haufec\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\haufec\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\WINDOWS\ufa\ufa.exe
C:\WINDOWS\update.7.1\svchostdriver.exe
C:\Documents and Settings\haufec\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Documents and Settings\haufec\Plocha\RSIT.exe
C:\Program Files\trend micro\haufec.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mirostart.com/?cfg=2-365-0-...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.myheritage.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=wbst&s={searchTerms}&f=4
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (file missing)
O2 - BHO: facemoods Helper - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files\facemoods.com\facemoods\1.4.17.8\bh\facemoods.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (file missing)
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: facemoods Toolbar - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files\facemoods.com\facemoods\1.4.17.8\facemoodsTlbr.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (file missing)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [facemoods] "C:\Program Files\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe" /md I
O4 - HKLM\..\Run: [Family Tree Builder Update] C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [wxpdrv] C:\WINDOWS\services32.exe
O4 - HKLM\..\Run: [tray_ico0] C:\WINDOWS\update.tray-12-0\svchost.exe
O4 - HKLM\..\Run: [tray_ico1] C:\WINDOWS\update.tray-7-0\svchost.exe
O4 - HKLM\..\Run: [7022009.exe] "C:\WINDOWS\TEMP\7022009.exe"
O4 - HKLM\..\Run: [sysdriver32.exe] "C:\WINDOWS\sysdriver32.exe" rezerv
O4 - HKLM\..\Run: [sysdriver32_.exe] "C:\WINDOWS\sysdriver32_.exe" rezerv
O4 - HKLM\..\Run: [95778441-loader2.exe] "C:\WINDOWS\TEMP\95778441-loader2.exe"
O4 - HKLM\..\Run: [3508980.exe] "C:\WINDOWS\TEMP\3508980.exe"
O4 - HKLM\..\Run: [l1rezerv.exe] "C:\WINDOWS\l1rezerv.exe"
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [5809939.exe] "C:\WINDOWS\TEMP\5809939.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\haufec\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: TL-WN321G Wireless Utility.lnk = C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout odkaz s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Stáhnout všechny odkazy s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 2596204310
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AVG Firewall (avgfws) - Unknown owner - C:\Program Files\AVG\AVG10\avgfws.exe (file missing)
O23 - Service: AVGIDSAgent - Unknown owner - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (file missing)
O23 - Service: AVG WatchDog (avgwd) - Unknown owner - C:\Program Files\AVG\AVG10\avgwdsvc.exe (file missing)
O23 - Service: ddservice - Unknown owner - C:\WINDOWS\update.7.1\svchostdriver.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NitroPDFReaderDriverCreatorReadSpool (NitroReaderDriverReadSpool) - Nitro PDF Software - C:\Program Files\Nitro PDF\Reader\NitroPDFReaderDriverService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: srvbtcclient - Unknown owner - C:\WINDOWS\update.5.0\svchost.exe
O23 - Service: srviecheck - Unknown owner - C:\WINDOWS\update.2\svchost.exe
O23 - Service: srvsysdriver32 - Unknown owner - C:\WINDOWS\sysdriver32.exe
O23 - Service: wxpdrivers - Unknown owner - C:\WINDOWS\update.1\svchost.exe

--
End of file - 10768 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AVG PC Tuneup 2011 Integrator Start On Windows Logon.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-1364589140-1644491937-1003Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-1364589140-1644491937-1003UA.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-1364589140-1644491937-1004Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-1364589140-1644491937-1004UA.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-1364589140-1644491937-1006Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-1364589140-1644491937-1006UA.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-1364589140-1644491937-1007Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-1364589140-1644491937-1007UA.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-1364589140-1644491937-1008Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-1364589140-1644491937-1008UA.job
C:\WINDOWS\tasks\Registry Reviver-admin-Startup.job
C:\WINDOWS\tasks\Registry Reviver-deti-Startup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}]
BitComet Helper - C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll [2011-04-11 767280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG10\avgssie.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64182481-4F71-486b-A045-B233BD0DA8FC}]
CescrtHlpr Object - C:\Program Files\facemoods.com\facemoods\1.4.17.8\bh\facemoods.dll [2011-04-14 265944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]
Bing Bar Helper - C:\Program Files\Microsoft\BingBar\BingExt.dll [2011-03-01 1089288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-07-21 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-07-21 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
SweetIM Toolbar Helper - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll [2011-02-01 1499440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EEE6C35B-6118-11DC-9C72-001320C79847} - SweetIM Toolbar for Internet Explorer - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll [2011-02-01 1499440]
{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - facemoods Toolbar - C:\Program Files\facemoods.com\facemoods\1.4.17.8\facemoodsTlbr.dll [2011-04-14 220888]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2011-04-21 1000768]
{8dcb7100-df86-4384-8842-8fa844297b3f} - Bing Bar - C:\Program Files\Microsoft\BingBar\BingExt.dll [2011-03-01 1089288]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2004-10-14 1404928]
"igfxtray"=C:\WINDOWS\system32\igfxtray.exe [2006-03-23 94208]
"igfxhkcmd"=C:\WINDOWS\system32\hkcmd.exe [2006-03-23 77824]
"igfxpers"=C:\WINDOWS\system32\igfxpers.exe [2006-03-23 118784]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-21 932288]
"SweetIM"=C:\Program Files\SweetIM\Messenger\SweetIM.exe [2010-12-20 111928]
"facemoods"=C:\Program Files\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe [2011-04-14 329432]
"Family Tree Builder Update"=C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe [2011-05-29 221184]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe /nogui []
"AVG_TRAY"=C:\Program Files\AVG\AVG10\avgtray.exe []
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-04-08 254696]
"wxpdrv"=C:\WINDOWS\services32.exe [2011-08-20 1216000]
"tray_ico"= []
"tray_ico0"=C:\WINDOWS\update.tray-12-0\svchost.exe [2011-08-20 1216000]
"tray_ico1"=C:\WINDOWS\update.tray-7-0\svchost.exe [2011-08-20 1216000]
"tray_ico2"= []
"tray_ico3"= []
"tray_ico4"= []
"7022009.exe"=C:\WINDOWS\TEMP\7022009.exe []
"sysdriver32.exe"=C:\WINDOWS\sysdriver32.exe [2011-08-20 258048]
"sysdriver32_.exe"=C:\WINDOWS\sysdriver32_.exe [2011-08-20 258048]
"95778441-loader2.exe"=C:\WINDOWS\TEMP\95778441-loader2.exe []
"3508980.exe"=C:\WINDOWS\TEMP\3508980.exe []
"l1rezerv.exe"=C:\WINDOWS\l1rezerv.exe [2011-08-20 232960]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe /nogui []
"5809939.exe"=C:\WINDOWS\TEMP\5809939.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Google Update"=C:\Documents and Settings\haufec\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2011-05-21 136176]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2011-07-29 17361032]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
TL-WN321G Wireless Utility.lnk - C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2007-12-19 208896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\wxpdrivers]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0
"EnableSecureUIAPaths"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\BitComet\BitComet.exe"="C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet.exe"
"C:\Program Files\AVG\AVG10\avgmfapx.exe"="C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:Instalátor AVG"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\AVG\AVG10\avgdiagex.exe"="C:\Program Files\AVG\AVG10\avgdiagex.exe:*:Enabled:AVG Diagnostika 2011"
"C:\Program Files\AVG\AVG10\avgnsx.exe"="C:\Program Files\AVG\AVG10\avgnsx.exe:*:Enabled:Webový štít"
"C:\Program Files\AVG\AVG10\avgam.exe"="C:\Program Files\AVG\AVG10\avgam.exe:*:Enabled:Správce událostí AVG"
"C:\Program Files\AVG\AVG10\avgemcx.exe"="C:\Program Files\AVG\AVG10\avgemcx.exe:*:Enabled:Obecná kontrola pošty"
"C:\Documents and Settings\haufec\Dokumenty\Downloads\Flash-Player.exe"="C:\Documents and Settings\haufec\Dokumenty\Downloads\Flash-Player.exe:*:Enabled:C:\Documents and Settings\haufec\Dokumenty\Downloads\Flash-Player.exe"
"C:\WINDOWS\update.1\svchost.exe"="C:\WINDOWS\update.1\svchost.exe:*:Enabled:C:\WINDOWS\update.1\svchost.exe"
"C:\WINDOWS\services32.exe"="C:\WINDOWS\services32.exe:*:Enabled:C:\WINDOWS\services32.exe"
"C:\WINDOWS\update.2\svchost.exe"="C:\WINDOWS\update.2\svchost.exe:*:Enabled:C:\WINDOWS\update.2\svchost.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"VIDC.FMVC"=fmcodec.dll
"msacm.divxa32"=msaud32_divx.acm
"msacm.vorbis"=vorbis.acm

======List of files/folders created in the last 1 month======

2011-08-21 17:06:11 ----D---- C:\rsit
2011-08-21 15:14:39 ----D---- C:\Documents and Settings\All Users\Data aplikací\Premium
2011-08-21 15:14:38 ----D---- C:\Documents and Settings\All Users\Data aplikací\InstallMate
2011-08-21 11:58:16 ----D---- C:\Program Files\trend micro
2011-08-21 11:47:09 ----A---- C:\WINDOWS\ntbtlog.txt
2011-08-20 22:28:14 ----HD---- C:\WINDOWS\update.tray-7-0-lnk
2011-08-20 22:28:14 ----HD---- C:\WINDOWS\update.tray-7-0
2011-08-20 22:24:20 ----A---- C:\WINDOWS\avastSS.scr
2011-08-20 22:10:58 ----A---- C:\WINDOWS\l1rezerv.exe
2011-08-20 22:09:38 ----D---- C:\WINDOWS\ufa
2011-08-20 22:09:38 ----D---- C:\WINDOWS\rpcminer
2011-08-20 22:09:38 ----D---- C:\WINDOWS\phoenix
2011-08-20 22:08:03 ----A---- C:\WINDOWS\btc_client_iplist.txt
2011-08-20 22:06:40 ----HD---- C:\WINDOWS\update.5.0
2011-08-20 22:06:01 ----A---- C:\WINDOWS\unrar.exe
2011-08-20 22:05:22 ----A---- C:\WINDOWS\iecheck_iplist.txt
2011-08-20 22:05:08 ----D---- C:\WINDOWS\av_ico
2011-08-20 22:04:51 ----HD---- C:\WINDOWS\update.2
2011-08-20 22:04:22 ----HD---- C:\WINDOWS\update.7.1
2011-08-20 22:03:43 ----A---- C:\WINDOWS\iplist.txt
2011-08-20 22:03:05 ----A---- C:\WINDOWS\sysdriver32_.exe
2011-08-20 22:02:51 ----A---- C:\WINDOWS\sysdriver32.exe
2011-08-20 22:02:33 ----A---- C:\WINDOWS\front_ip_list.txt
2011-08-20 22:01:08 ----HD---- C:\WINDOWS\update.1
2011-08-20 22:00:46 ----HD---- C:\WINDOWS\update.tray-12-0-lnk
2011-08-20 22:00:46 ----HD---- C:\WINDOWS\update.tray-12-0
2011-08-20 21:48:54 ----A---- C:\WINDOWS\winlog-ids.txt
2011-08-20 21:48:54 ----A---- C:\WINDOWS\winlog-dirs.txt
2011-08-20 21:48:24 ----A---- C:\WINDOWS\services32.exe
2011-08-11 19:08:02 ----HDC---- C:\WINDOWS\$NtUninstallKB2567680$
2011-08-11 19:07:53 ----HDC---- C:\WINDOWS\$NtUninstallKB2536276-v2$
2011-08-11 19:07:41 ----HDC---- C:\WINDOWS\$NtUninstallKB2570222$
2011-08-11 19:01:21 ----HDC---- C:\WINDOWS\$NtUninstallKB2566454$
2011-08-11 19:01:09 ----HDC---- C:\WINDOWS\$NtUninstallKB2562937$
2011-08-06 18:03:02 ----AT---- C:\WINDOWS\system32\SIntfNT.dll
2011-08-06 18:03:02 ----AT---- C:\WINDOWS\system32\SIntf32.dll
2011-08-06 18:03:01 ----AT---- C:\WINDOWS\system32\SIntf16.dll
2011-08-06 17:59:43 ----A---- C:\WINDOWS\DIIUnin.dat
2011-08-06 17:58:59 ----A---- C:\WINDOWS\DIIUnin.pif
2011-08-06 17:58:58 ----A---- C:\WINDOWS\DIIUnin.exe
2011-08-06 13:44:58 ----RD---- C:\Program Files\Skype
2011-08-06 13:41:08 ----A---- C:\WINDOWS\system32\javaws.exe
2011-08-06 13:41:07 ----A---- C:\WINDOWS\system32\javaw.exe
2011-08-06 13:41:07 ----A---- C:\WINDOWS\system32\java.exe
2011-07-28 09:21:28 ----D---- C:\Casino

======List of files/folders modified in the last 1 month======

2011-08-21 17:06:22 ----D---- C:\WINDOWS\Prefetch
2011-08-21 16:49:11 ----D---- C:\WINDOWS\Temp
2011-08-21 16:48:30 ----D---- C:\Documents and Settings\haufec\Data aplikací\Skype
2011-08-21 16:47:27 ----D---- C:\Program Files\Common Files\Akamai
2011-08-21 16:46:23 ----A---- C:\boot.ini
2011-08-21 16:44:43 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-08-21 16:40:43 ----SHD---- C:\WINDOWS\Installer
2011-08-21 16:40:40 ----D---- C:\WINDOWS\WinSxS
2011-08-21 16:40:01 ----RD---- C:\Program Files
2011-08-21 15:05:52 ----D---- C:\WINDOWS\Minidump
2011-08-21 14:54:00 ----SD---- C:\Documents and Settings\haufec\Data aplikací\Microsoft
2011-08-21 14:53:57 ----D---- C:\WINDOWS\system32\drivers
2011-08-21 14:53:57 ----D---- C:\WINDOWS\system32
2011-08-21 14:53:57 ----D---- C:\WINDOWS
2011-08-21 14:53:56 ----D---- C:\WINDOWS\system
2011-08-21 14:30:49 ----D---- C:\Program Files\DAEMON Tools Toolbar
2011-08-20 22:13:27 ----SHD---- C:\System Volume Information
2011-08-20 22:13:27 ----D---- C:\WINDOWS\system32\Restore
2011-08-20 22:12:12 ----D---- C:\Documents and Settings\All Users\Data aplikací\MFAData
2011-08-20 22:05:21 ----D---- C:\WINDOWS\system32\drivers\etc
2011-08-20 21:58:57 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2011-08-20 18:28:28 ----D---- C:\WINDOWS\system32\CatRoot2
2011-08-20 14:04:16 ----D---- C:\WINDOWS\system32\drivers\AVG
2011-08-20 10:36:59 ----D---- C:\Program Files\Diablo II
2011-08-20 10:36:36 ----D---- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
2011-08-15 14:07:53 ----HD---- C:\WINDOWS\inf
2011-08-14 22:36:00 ----D---- C:\Documents and Settings\haufec\Data aplikací\Nitro PDF
2011-08-13 10:16:41 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-08-11 19:07:58 ----A---- C:\WINDOWS\imsins.BAK
2011-08-11 19:07:51 ----HD---- C:\WINDOWS\$hf_mig$
2011-08-11 19:04:04 ----A---- C:\WINDOWS\system32\MRT.exe
2011-08-11 19:02:30 ----D---- C:\Program Files\Internet Explorer
2011-08-11 19:02:16 ----D---- C:\WINDOWS\ie8updates
2011-08-06 17:51:09 ----D---- C:\Downloads
2011-08-06 17:10:10 ----D---- C:\Documents and Settings\haufec\Data aplikací\BitComet
2011-08-06 13:44:55 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2011-08-06 13:42:25 ----D---- C:\Program Files\Common Files\Java
2011-08-06 13:40:56 ----D---- C:\Program Files\Java
2011-08-06 13:09:07 ----D---- C:\Documents and Settings\haufec\Data aplikací\PCF-VLC
2011-07-29 14:43:44 ----HD---- C:\WINDOWS\msdownld.tmp
2011-07-29 14:42:38 ----D---- C:\WINDOWS\system32\DirectX
2011-07-28 20:23:19 ----A---- C:\WINDOWS\MyHeritage.INI
2011-07-27 22:55:37 ----D---- C:\Program Files\DsNET Corp
2011-07-25 17:08:54 ----A---- C:\WINDOWS\system32\mshtml.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSEH;AVGIDSEH; C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys [2011-02-22 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver; C:\WINDOWS\system32\DRIVERS\avgrkx86.sys [2011-03-16 32592]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2005-08-10 50688]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2005-05-16 6656]
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x); C:\WINDOWS\System32\drivers\sfvfs02.sys [2005-11-03 63488]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2011-05-10 431672]
R1 Avgldx86;AVG AVI Loader Driver; C:\WINDOWS\system32\DRIVERS\avgldx86.sys [2011-01-07 248656]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield; C:\WINDOWS\system32\DRIVERS\avgmfx86.sys [2011-03-01 34896]
R1 Avgtdix;AVG TDI Driver; C:\WINDOWS\system32\DRIVERS\avgtdix.sys [2011-04-05 297168]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2011-06-30 20747]
R3 Avgfwdx;Avgfwdx; C:\WINDOWS\system32\DRIVERS\avgfwdx.sys [2010-07-12 30432]
R3 AVGIDSDriver;AVGIDSDriver; C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys [2011-04-14 134480]
R3 AVGIDSFilter;AVGIDSFilter; C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys [2011-02-10 24144]
R3 AVGIDSShim;AVGIDSShim; C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys [2011-02-10 27216]
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2006-05-10 156160]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2006-03-23 1166972]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2008-04-14 12160]
R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2004-09-17 732928]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2005-01-27 260352]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S2 npkcrypt;npkcrypt; \??\C:\Program Files\Lineage II\system\npkcrypt.sys []
S3 Avgfwfd;AVG network filter service; C:\WINDOWS\system32\DRIVERS\avgfwdx.sys [2010-07-12 30432]
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 NPFW;NPFW; \??\C:\WINDOWS\system32\NPFW.SYS []
S3 NPFWFLT;NPFWFLT; \??\C:\WINDOWS\system32\NPFWFLT.SYS []
S3 NPIDS;NPIDS; \??\C:\WINDOWS\system32\NPIDS.SYS []
S3 npkcusb;npkcusb; \??\C:\Program Files\Lineage II\system\npkcusb.sys []
S3 RT73;TL-WN321G USB Wireless Adapter; C:\WINDOWS\system32\DRIVERS\rt73.sys [2006-01-12 252928]
S3 TKFsAvM;TKFsAvM; \??\C:\WINDOWS\system32\TKFsAv.sys []
S3 TkFsFtM;MiniFilter Driver; C:\WINDOWS\system32\TKFsFt.sys []
S3 TKPcFt;TKPcFt; \??\C:\WINDOWS\system32\TKPcFtHk.sys []
S3 TKTool;TKTool; \??\C:\WINDOWS\system32\TKTool2k.sys []
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2008-04-14 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Akamai;Akamai NetSession Interface; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 ddservice;ddservice; C:\WINDOWS\update.7.1\svchostdriver.exe [2011-08-20 382464]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-05-04 153376]
R2 NitroReaderDriverReadSpool;NitroPDFReaderDriverCreatorReadSpool; C:\Program Files\Nitro PDF\Reader\NitroPDFReaderDriverService.exe [2011-01-14 196912]
R2 SeaPort;SeaPort; C:\Program Files\Microsoft\BingBar\SeaPort.EXE [2011-02-25 249648]
R2 srvbtcclient;srvbtcclient; C:\WINDOWS\update.5.0\svchost.exe [2011-08-20 348672]
R2 srviecheck;srviecheck; C:\WINDOWS\update.2\svchost.exe [2011-08-21 634880]
R2 srvsysdriver32;srvsysdriver32; C:\WINDOWS\sysdriver32.exe [2011-08-20 258048]
R2 wxpdrivers;wxpdrivers; C:\WINDOWS\update.1\svchost.exe [2011-08-20 1216000]
S2 avgfws;AVG Firewall; C:\Program Files\AVG\AVG10\avgfws.exe []
S2 AVGIDSAgent;AVGIDSAgent; C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe []
S2 avgwd;AVG WatchDog; C:\Program Files\AVG\AVG10\avgwdsvc.exe []
S3 BBSvc;Bing Bar Update Service; C:\Program Files\Microsoft\BingBar\BBSvc.EXE [2011-03-01 183560]
S3 npggsvc;nProtect GameGuard Service; C:\WINDOWS\system32\GameMon.des [2010-11-03 4045280]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\wmpnetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

-----------------EOF-----------------

Zdravím!
Nejprve proveďte sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

Malwarebytes' Anti-Malware
www.malwarebytes.org

Verze databáze:

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

21.8.2011 21:54:08
mbam-log-2011-08-21 (21-54-01).txt

Typ: Rychlá kontrola
Kontrolované objekty: 230177
Uplynulý čas: 12 minut, 18 sekund

Infikované procesy v paměti: 5
Infikované moduly v paměti: 0
Infikované klíče v registru: 6
Infikované hodnoty v registru: 4
Infikované datové položky v registru: 3
Infikované složky: 0
Infikované soubory: 14

Infikované procesy v paměti:
c:\WINDOWS\update.1\svchost.exe (Trojan.Dropper) -> 1604 -> No action taken.
c:\WINDOWS\update.tray-12-0\svchost.exe (Trojan.Dropper) -> 292 -> No action taken.
c:\WINDOWS\update.tray-7-0\svchost.exe (Trojan.Dropper) -> 308 -> No action taken.
c:\WINDOWS\update.2\svchost.exe (Backdoor.Agent) -> 2064 -> No action taken.
c:\WINDOWS\update.5.0\svchost.exe (Trojan.Downloader) -> 592 -> No action taken.

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpdrivers (Trojan.Dropper) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Casino King (Adware.Casino) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Casino King (Adware.Casino) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SRVSYSDRIVER32 (Trojan.Agent) -> No action taken.

Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tray_ico0 (Trojan.Dropper) -> Value: tray_ico0 -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tray_ico1 (Trojan.Dropper) -> Value: tray_ico1 -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wxpdrv (Trojan.Dropper) -> Value: wxpdrv -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpDrivers\ImagePath (Trojan.Agent) -> Value: ImagePath -> No action taken.

Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
c:\WINDOWS\update.1\svchost.exe (Trojan.Dropper) -> No action taken.
c:\WINDOWS\update.tray-12-0\svchost.exe (Trojan.Dropper) -> No action taken.
c:\WINDOWS\update.tray-7-0\svchost.exe (Trojan.Dropper) -> No action taken.
c:\WINDOWS\services32.exe (Trojan.Dropper) -> No action taken.
c:\documents and settings\haufec\dokumenty\downloads\flash-player.exe (Trojan.Dropper) -> No action taken.
c:\documents and settings\Pavlica\dokumenty\downloads\setupcasino_533ebd (1).exe (PUP.Casino) -> No action taken.
c:\documents and settings\Pavlica\dokumenty\downloads\setupcasino_533ebd.exe (PUP.Casino) -> No action taken.
c:\documents and settings\Pavlica\dokumenty\downloads\setupcasino_9f18cf.exe (PUP.Casino) -> No action taken.
c:\documents and settings\all users\Plocha\mp3 downloader.lnk (Rogue.Link) -> No action taken.
c:\WINDOWS\l1rezerv.exe (Trojan.Agent) -> No action taken.
c:\WINDOWS\sysdriver32.exe (Trojan.Delf) -> No action taken.
c:\WINDOWS\sysdriver32_.exe (Trojan.Delf) -> No action taken.
c:\WINDOWS\update.2\svchost.exe (Backdoor.Agent) -> No action taken.
c:\WINDOWS\update.5.0\svchost.exe (Trojan.Downloader) -> No action taken.

Smažte vše, co MBAM nalezl. Pak restartujte PC a na dočištění dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

ComboFix 11-08-21.01 - haufec 21.08.2011 22:38:12.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.502.138 [GMT 2:00]
Spuštěný z: c:\documents and settings\haufec\Plocha\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\program files\facemoods.com
c:\program files\facemoods.com\facemoods\1.4.17.8\bh\facemoods.dll
c:\program files\facemoods.com\facemoods\1.4.17.8\facemoods.crx
c:\program files\facemoods.com\facemoods\1.4.17.8\facemoods.png
c:\program files\facemoods.com\facemoods\1.4.17.8\facemoodsApp.dll
c:\program files\facemoods.com\facemoods\1.4.17.8\facemoodsEng.dll
c:\program files\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe
c:\program files\facemoods.com\facemoods\1.4.17.8\facemoodsTlbr.dll
c:\program files\facemoods.com\facemoods\1.4.17.8\uninstall.exe
c:\program files\facemoods.com\sqlite3.dll
c:\program files\rnamfler
c:\program files\rnamfler\manual.htm
c:\program files\rnamfler\radhslib.dll
c:\program files\rnamfler\radprlib.dll
c:\program files\rnamfler\tray.jpg
c:\windows\phoenix
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\__init__.pyc
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\rpcminer
c:\windows\rpcminer\bitcoinminercuda_10.cubin
c:\windows\rpcminer\bitcoinminercuda_11.cubin
c:\windows\rpcminer\bitcoinminercuda_20.cubin
c:\windows\rpcminer\bitcoinmineropencl.cl
c:\windows\rpcminer\cudart32_32_16.dll
c:\windows\rpcminer\curllib.dll
c:\windows\rpcminer\libeay32.dll
c:\windows\rpcminer\libsasl.dll
c:\windows\rpcminer\openldap.dll
c:\windows\rpcminer\rpcminer-4way.exe
c:\windows\rpcminer\rpcminer-cpu.exe
c:\windows\rpcminer\rpcminer-cuda.exe
c:\windows\rpcminer\rpcminer-opencl.exe
c:\windows\rpcminer\ssleay32.dll
c:\windows\update.1
c:\windows\update.2
c:\windows\update.5.0
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SRVBTCCLIENT
-------\Legacy_WXPDRIVERS
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-21 do 2011-08-21 )))))))))))))))))))))))))))))))
.
.
2011-08-21 19:37 . 2011-08-21 19:37 -------- d-----w- c:\documents and settings\haufec\Data aplikací\Malwarebytes
2011-08-21 19:37 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-21 19:37 . 2011-08-21 19:37 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-08-21 19:37 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-21 19:37 . 2011-08-21 19:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-21 16:22 . 2011-08-21 16:22 -------- d-----w- c:\program files\ESET
2011-08-21 15:06 . 2011-08-21 15:06 -------- d-----w- C:\rsit
2011-08-21 13:14 . 2011-08-21 13:14 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Premium
2011-08-21 13:14 . 2011-08-21 13:14 -------- d-----w- c:\documents and settings\All Users\Data aplikacÝ
2011-08-21 13:14 . 2011-08-21 13:14 -------- d-----w- c:\documents and settings\All Users\Data aplikací\InstallMate
2011-08-21 10:16 . 2011-08-21 10:16 512 ----a-w- C:\PhysicalMBR.bin
2011-08-21 09:58 . 2011-08-21 15:06 -------- d-----w- c:\program files\trend micro
2011-08-20 20:28 . 2011-08-21 20:18 -------- d--h--w- c:\windows\update.tray-7-0
2011-08-20 20:28 . 2011-08-20 20:28 -------- d--h--w- c:\windows\update.tray-7-0-lnk
2011-08-20 20:24 . 2010-12-30 18:09 38848 ----a-w- c:\windows\avastSS.scr
2011-08-20 20:09 . 2011-08-20 20:09 -------- d-----w- c:\windows\ufa
2011-08-20 20:06 . 2011-08-20 20:09 246272 ----a-w- c:\windows\unrar.exe
2011-08-20 20:05 . 2011-08-21 09:52 -------- d-----w- c:\windows\av_ico
2011-08-20 20:04 . 2011-08-21 19:31 -------- d--h--w- c:\windows\update.7.1
2011-08-20 20:00 . 2011-08-21 20:18 -------- d--h--w- c:\windows\update.tray-12-0
2011-08-20 20:00 . 2011-08-20 20:00 -------- d--h--w- c:\windows\update.tray-12-0-lnk
2011-08-20 19:48 . 2011-08-20 19:48 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2011-08-15 09:06 . 2011-08-15 09:08 -------- d-----w- c:\documents and settings\Pavlica\Data aplikací\DAEMON Tools Lite
2011-08-13 12:25 . 2011-08-13 12:25 -------- d-----w- c:\documents and settings\vondris.DDMT1\Data aplikací\DAEMON Tools Lite
2011-08-08 14:18 . 2011-08-08 14:18 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-06 18:53 . 2011-08-06 18:53 -------- d-----w- c:\documents and settings\haufec\Local Settings\Data aplikací\PackageAware
2011-08-06 17:41 . 2011-08-06 17:41 -------- d-----w- c:\documents and settings\Pavlica\Local Settings\Data aplikací\OpenCandy
2011-08-06 17:39 . 2011-08-06 17:39 -------- d-----w- c:\documents and settings\Pavlica\Data aplikací\OpenCandy
2011-08-06 16:03 . 2011-08-06 18:53 21840 ----atw- c:\windows\system32\SIntfNT.dll
2011-08-06 16:03 . 2011-08-06 18:53 17212 ----atw- c:\windows\system32\SIntf32.dll
2011-08-06 16:03 . 2011-08-06 18:53 12067 ----atw- c:\windows\system32\SIntf16.dll
2011-08-06 15:58 . 2011-08-06 15:58 2829 ----a-w- c:\windows\DIIUnin.pif
2011-08-06 15:58 . 2011-08-06 15:58 94208 ----a-w- c:\windows\DIIUnin.exe
2011-08-06 11:44 . 2011-08-06 11:45 -------- d-----r- c:\program files\Skype
2011-07-29 12:47 . 2011-08-21 12:53 -------- d-----w- c:\documents and settings\LocalService\Plocha
2011-07-29 12:43 . 2011-07-29 12:43 -------- d-----w- c:\documents and settings\Pavlica\Data aplikací\Realm of the Titans
2011-07-28 07:21 . 2011-07-28 07:21 -------- d-----w- C:\Casino
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-15 13:29 . 2008-04-14 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2008-04-14 12:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-30 09:18 . 2011-06-30 09:18 20747 ----a-w- c:\windows\system32\drivers\AegisP.sys
2011-06-24 14:10 . 2010-12-17 13:28 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:31 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:31 . 2008-04-14 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2011-06-23 18:31 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2008-04-14 12:00 385024 ------w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2008-04-14 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-06 11:35 . 2008-04-14 12:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-29 16:36 . 2011-05-29 16:36 387600 ----a-w- c:\windows\system32\FTBSaver.scr
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2011-02-01 141616]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2011-02-01 14:58 1499440 ----a-w- c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2011-02-01 1499440]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2011-02-01 1499440]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-07-29 17361032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2010-12-20 111928]
"Family Tree Builder Update"="c:\program files\MyHeritage\Bin\FTBCheckUpdates.exe" [2011-05-29 221184]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
TL-WN321G Wireless Utility.lnk - c:\program files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe [2011-6-30 622592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8953:TCP"= 8953:TCP:BitComet 8953 TCP
"8953:UDP"= 8953:UDP:BitComet 8953 UDP
"24028:TCP"= 24028:TCP:BitComet 24028 TCP
"24028:UDP"= 24028:UDP:BitComet 24028 UDP
"8428:TCP"= 8428:TCP:BitComet 8428 TCP
"8428:UDP"= 8428:UDP:BitComet 8428 UDP
"1031:TCP"= 1031:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [13.9.2010 16:27 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [7.9.2010 3:48 32592]
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [7.9.2010 3:48 248656]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [7.9.2010 3:49 297168]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [14.4.2008 14:00 14336]
R2 NitroReaderDriverReadSpool;NitroPDFReaderDriverCreatorReadSpool;c:\program files\Nitro PDF\Reader\NitroPDFReaderDriverService.exe [14.1.2011 14:35 196912]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [12.7.2010 4:33 30432]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [19.8.2010 21:42 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [19.8.2010 21:42 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [19.8.2010 21:42 27216]
S2 avgfws;AVG Firewall;"c:\program files\AVG\AVG10\avgfws.exe" --> c:\program files\AVG\AVG10\avgfws.exe [?]
S2 AVGIDSAgent;AVGIDSAgent;"c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe" --> c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [?]
S2 avgwd;AVG WatchDog;"c:\program files\AVG\AVG10\avgwdsvc.exe" --> c:\program files\AVG\AVG10\avgwdsvc.exe [?]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [12.7.2010 4:33 30432]
S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [1.3.2011 21:23 183560]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [21.8.2011 21:37 41272]
S3 NPFW;NPFW;\??\c:\windows\system32\NPFW.SYS --> c:\windows\system32\NPFW.SYS [?]
S3 NPFWFLT;NPFWFLT;\??\c:\windows\system32\NPFWFLT.SYS --> c:\windows\system32\NPFWFLT.SYS [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 NPIDS;NPIDS;\??\c:\windows\system32\NPIDS.SYS --> c:\windows\system32\NPIDS.SYS [?]
S3 TKFsAvM;TKFsAvM;\??\c:\windows\system32\TKFsAv.sys --> c:\windows\system32\TKFsAv.sys [?]
S3 TkFsFtM;MiniFilter Driver;c:\windows\system32\TKFsFt.sys --> c:\windows\system32\TKFsFt.sys [?]
S3 TKPcFt;TKPcFt;\??\c:\windows\system32\TKPcFtHk.sys --> c:\windows\system32\TKPcFtHk.sys [?]
S3 TKTool;TKTool;\??\c:\windows\system32\TKTool2k.sys --> c:\windows\system32\TKTool2k.sys [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://mirostart.com/?cfg=2-365-0-...
mStart Page = hxxp://search.myheritage.com
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Stáhnout odkaz s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Stáhnout všechny odkazy s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
TCP: DhcpNameServer = 192.168.1.1 192.168.2.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - c:\program files\Alwil Software\Avast5\ashShell.dll
HKLM-Run-facemoods - c:\program files\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe
HKLM-Run-avast - c:\program files\AVAST Software\Avast\avastUI.exe
HKLM-Run-AVG_TRAY - c:\program files\AVG\AVG10\avgtray.exe
HKLM-Run-tray_ico - (no file)
HKLM-Run-tray_ico2 - (no file)
HKLM-Run-tray_ico3 - (no file)
HKLM-Run-tray_ico4 - (no file)
AddRemove-avast5 - c:\program files\Alwil Software\Avast5\aswRunDll.exe
AddRemove-AVG - c:\program files\AVG\AVG10\avgmfapx.exe
AddRemove-facemoods - c:\program files\facemoods.com\facemoods\1.4.17.8\uninstall.exe
AddRemove-Realm Of The Titans - c:\documents and settings\Pavlica\Plocha\RealmOfTheTitans\Uninst.exe
AddRemove-{50316C0A-CC2A-460A-9EA5-F486E54AC17D}_is1 - c:\program files\AVG\AVG PC Tuneup 2011\unins000.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-21 22:50
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-2052111302-1364589140-1644491937-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(3200)
c:\program files\SweetIM\Messenger\mgAdaptersProxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft\BingBar\SeaPort.EXE
.
**************************************************************************
.
Celkový čas: 2011-08-21 22:54:22 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-21 20:54
.
Před spuštěním: Volných bajtů: 13 793 705 984
Po spuštění: Volných bajtů: 14 111 993 856
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=AlwaysOff /fastdetect
.
- - End Of File - - 7AA3DB684002CD7D6ACB570858498F66

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Collect::
c:\windows\unrar.exe

Folder::
c:\windows\update.tray-7-0
c:\windows\update.tray-7-0-lnk
c:\windows\ufa
c:\windows\av_ico
c:\windows\update.7.1
c:\windows\update.tray-12-0
c:\windows\update.tray-12-0-lnk

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1031:TCP"=-
"5000:UDP"=-

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

ale ja tam mam problem....me to tam ukazuje ze mam vypnout stity z AVG ale AVG nikde v PC najit nemuzu:((

Podívejte se do Taskmanageru (Ctrl>Alt>Del). Pokud tam najdete běžící proces AVG, zastavte jej. Je ale možné, že je AVG poškozen virem, pak hlášku ignorujte.

ComboFix 11-08-21.01 - haufec 26.08.2011 19:33:43.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.502.116 [GMT 2:00]
Spuštěný z: c:\documents and settings\haufec\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\haufec\Plocha\CFScript.txt
AV: AVG Internet Security 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *Enabled* {8decf618-9569-4340-b34a-d78d28969b66}
.
- REŽIM S OMEZENOU FUNKČNOSTÍ -
.
file zipped: c:\windows\unrar.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\av_ico
c:\windows\av_ico\ico_avast_desktop.ico
c:\windows\av_ico\ico_avast_start.ico
c:\windows\btc_client_iplist.txt
c:\windows\front_ip_list.txt
c:\windows\geoiplist
c:\windows\geoiplist.rar
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\iun6002.exe
c:\windows\loader2.exe_ok
c:\windows\phoenix.rar
c:\windows\proc_list1.log
c:\windows\rpcminer.rar
c:\windows\system32\drivers\etc\HSTS~1
c:\windows\ufa
c:\windows\ufa.rar
c:\windows\ufa\ufa.exe
c:\windows\unrar.exe
c:\windows\update.7.1
c:\windows\update.7.1\svchostdriver.exe
c:\windows\update.tray-12-0-lnk
c:\windows\update.tray-12-0-lnk\svchost.exe
c:\windows\update.tray-12-0
c:\windows\update.tray-7-0-lnk
c:\windows\update.tray-7-0-lnk\svchost.exe
c:\windows\update.tray-7-0
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
c:\windows\winsetupapi.log
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-26 do 2011-08-26 )))))))))))))))))))))))))))))))
.
.
2011-08-21 19:37 . 2011-08-21 19:37 -------- d-----w- c:\documents and settings\haufec\Data aplikací\Malwarebytes
2011-08-21 19:37 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-21 19:37 . 2011-08-21 19:37 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-08-21 19:37 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-21 19:37 . 2011-08-21 19:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-21 16:22 . 2011-08-21 16:22 -------- d-----w- c:\program files\ESET
2011-08-21 15:06 . 2011-08-21 15:06 -------- d-----w- C:\rsit
2011-08-21 13:14 . 2011-08-21 13:14 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Premium
2011-08-21 13:14 . 2011-08-21 13:14 -------- d-----w- c:\documents and settings\All Users\Data aplikacÝ
2011-08-21 13:14 . 2011-08-21 13:14 -------- d-----w- c:\documents and settings\All Users\Data aplikací\InstallMate
2011-08-21 10:16 . 2011-08-21 10:16 512 ----a-w- C:\PhysicalMBR.bin
2011-08-21 09:58 . 2011-08-21 15:06 -------- d-----w- c:\program files\trend micro
2011-08-20 20:24 . 2010-12-30 18:09 38848 ----a-w- c:\windows\avastSS.scr
2011-08-20 19:48 . 2011-08-20 19:48 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2011-08-15 09:06 . 2011-08-15 09:08 -------- d-----w- c:\documents and settings\Pavlica\Data aplikací\DAEMON Tools Lite
2011-08-13 12:25 . 2011-08-13 12:25 -------- d-----w- c:\documents and settings\vondris.DDMT1\Data aplikací\DAEMON Tools Lite
2011-08-08 14:18 . 2011-08-08 14:18 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-06 18:53 . 2011-08-06 18:53 -------- d-----w- c:\documents and settings\haufec\Local Settings\Data aplikací\PackageAware
2011-08-06 17:41 . 2011-08-06 17:41 -------- d-----w- c:\documents and settings\Pavlica\Local Settings\Data aplikací\OpenCandy
2011-08-06 17:39 . 2011-08-06 17:39 -------- d-----w- c:\documents and settings\Pavlica\Data aplikací\OpenCandy
2011-08-06 16:03 . 2011-08-06 18:53 21840 ----atw- c:\windows\system32\SIntfNT.dll
2011-08-06 16:03 . 2011-08-06 18:53 17212 ----atw- c:\windows\system32\SIntf32.dll
2011-08-06 16:03 . 2011-08-06 18:53 12067 ----atw- c:\windows\system32\SIntf16.dll
2011-08-06 15:58 . 2011-08-06 15:58 2829 ----a-w- c:\windows\DIIUnin.pif
2011-08-06 15:58 . 2011-08-06 15:58 94208 ----a-w- c:\windows\DIIUnin.exe
2011-08-06 11:44 . 2011-08-06 11:45 -------- d-----r- c:\program files\Skype
2011-07-29 12:47 . 2011-08-21 12:53 -------- d-----w- c:\documents and settings\LocalService\Plocha
2011-07-29 12:43 . 2011-07-29 12:43 -------- d-----w- c:\documents and settings\Pavlica\Data aplikací\Realm of the Titans
2011-07-28 07:21 . 2011-07-28 07:21 -------- d-----w- C:\Casino
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-15 13:29 . 2008-04-14 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2008-04-14 12:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-30 09:18 . 2011-06-30 09:18 20747 ----a-w- c:\windows\system32\drivers\AegisP.sys
2011-06-24 14:10 . 2010-12-17 13:28 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:31 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:31 . 2008-04-14 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2011-06-23 18:31 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2008-04-14 12:00 385024 ------w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2008-04-14 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-06 11:35 . 2008-04-14 12:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-29 16:36 . 2011-05-29 16:36 387600 ----a-w- c:\windows\system32\FTBSaver.scr
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-21_20.50.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-26 17:36 . 2011-08-26 17:36 16384 c:\windows\Temp\Perflib_Perfdata_6fc.dat
+ 2011-08-26 17:36 . 2011-08-26 17:36 16384 c:\windows\Temp\Perflib_Perfdata_6dc.dat
+ 2008-04-14 12:00 . 2011-07-08 13:49 46080 c:\windows\system32\tzchange.exe
- 2008-04-14 12:00 . 2010-11-03 13:12 46080 c:\windows\system32\tzchange.exe
+ 2011-06-10 15:20 . 2010-07-05 13:13 18296 c:\windows\system32\spmsg.dll
- 2011-06-10 15:20 . 2010-02-22 14:20 18296 c:\windows\system32\spmsg.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2011-02-01 141616]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2011-02-01 14:58 1499440 ----a-w- c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2011-02-01 1499440]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2011-02-01 1499440]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-07-29 17361032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2010-12-20 111928]
"Family Tree Builder Update"="c:\program files\MyHeritage\Bin\FTBCheckUpdates.exe" [2011-05-29 221184]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
TL-WN321G Wireless Utility.lnk - c:\program files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe [2011-6-30 622592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8953:TCP"= 8953:TCP:BitComet 8953 TCP
"8953:UDP"= 8953:UDP:BitComet 8953 UDP
"24028:TCP"= 24028:TCP:BitComet 24028 TCP
"24028:UDP"= 24028:UDP:BitComet 24028 UDP
"8428:TCP"= 8428:TCP:BitComet 8428 TCP
"8428:UDP"= 8428:UDP:BitComet 8428 UDP
"1052:TCP"= 1052:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [13.9.2010 16:27 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [7.9.2010 3:48 32592]
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [7.9.2010 3:48 248656]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [7.9.2010 3:49 297168]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [14.4.2008 14:00 14336]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [12.7.2010 4:33 30432]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [19.8.2010 21:42 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [19.8.2010 21:42 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [19.8.2010 21:42 27216]
S2 avgfws;AVG Firewall;"c:\program files\AVG\AVG10\avgfws.exe" --> c:\program files\AVG\AVG10\avgfws.exe [?]
S2 AVGIDSAgent;AVGIDSAgent;"c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe" --> c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [?]
S2 avgwd;AVG WatchDog;"c:\program files\AVG\AVG10\avgwdsvc.exe" --> c:\program files\AVG\AVG10\avgwdsvc.exe [?]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [12.7.2010 4:33 30432]
S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [1.3.2011 21:23 183560]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [21.8.2011 21:37 41272]
S3 NPFW;NPFW;\??\c:\windows\system32\NPFW.SYS --> c:\windows\system32\NPFW.SYS [?]
S3 NPFWFLT;NPFWFLT;\??\c:\windows\system32\NPFWFLT.SYS --> c:\windows\system32\NPFWFLT.SYS [?]
S3 NPIDS;NPIDS;\??\c:\windows\system32\NPIDS.SYS --> c:\windows\system32\NPIDS.SYS [?]
S3 TKFsAvM;TKFsAvM;\??\c:\windows\system32\TKFsAv.sys --> c:\windows\system32\TKFsAv.sys [?]
S3 TkFsFtM;MiniFilter Driver;c:\windows\system32\TKFsFt.sys --> c:\windows\system32\TKFsFt.sys [?]
S3 TKPcFt;TKPcFt;\??\c:\windows\system32\TKPcFtHk.sys --> c:\windows\system32\TKPcFtHk.sys [?]
S3 TKTool;TKTool;\??\c:\windows\system32\TKTool2k.sys --> c:\windows\system32\TKTool2k.sys [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://mirostart.com/?cfg=2-365-0-...
mStart Page = hxxp://search.myheritage.com
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Stáhnout odkaz s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Stáhnout všechny odkazy s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
TCP: DhcpNameServer = 192.168.1.1 192.168.2.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-Cool's_Codec_pack_4.12 - c:\windows\iun6002.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-26 19:37
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-2052111302-1364589140-1644491937-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(1872)
c:\program files\SweetIM\Messenger\mgAdaptersProxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Nitro PDF\Reader\NitroPDFReaderDriverService.exe
c:\program files\Microsoft\BingBar\SeaPort.EXE
.
**************************************************************************
.
Celkový čas: 2011-08-26 19:46:04 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-26 17:45
ComboFix2.txt 2011-08-21 20:54
.
Před spuštěním: Volných bajtů: 14 029 688 832
Po spuštění: Volných bajtů: 14 014 599 168
.
- - End Of File - - 45AFE029BACC8A2D5E974B0F8C5544A6
Nahr nˇ probŘhlo ŁspŘçnŘ

a co tet?

1. Stáhněte nový ComboFix ze stejného odkazu, stávajícímu vypršela expirace.

2. Nový CF spusťte skriptem:

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1052:TCP"=-
"5000:UDP"=-

Driver::
Akamai

Pak dejte nový log z CF.

ComboFix 11-08-26.04 - haufec 26.08.2011 21:36:00.3.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.502.339 [GMT 2:00]
Spuštěný z: c:\documents and settings\haufec\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\haufec\Plocha\CFScript.txt
AV: AVG Internet Security 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall *Enabled* {8decf618-9569-4340-b34a-d78d28969b66}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_AKAMAI
-------\Legacy_DDSERVICE
-------\Service_Akamai
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-26 do 2011-08-26 )))))))))))))))))))))))))))))))
.
.
2011-08-26 18:06 . 2011-08-26 18:06 -------- d-----w- C:\hesla
2011-08-21 19:37 . 2011-08-21 19:37 -------- d-----w- c:\documents and settings\haufec\Data aplikací\Malwarebytes
2011-08-21 19:37 . 2011-08-21 19:37 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-08-21 16:22 . 2011-08-21 16:22 -------- d-----w- c:\program files\ESET
2011-08-21 15:06 . 2011-08-21 15:06 -------- d-----w- C:\rsit
2011-08-21 13:14 . 2011-08-21 13:14 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Premium
2011-08-21 13:14 . 2011-08-21 13:14 -------- d-----w- c:\documents and settings\All Users\Data aplikacÝ
2011-08-21 13:14 . 2011-08-21 13:14 -------- d-----w- c:\documents and settings\All Users\Data aplikací\InstallMate
2011-08-21 10:16 . 2011-08-21 10:16 512 ----a-w- C:\PhysicalMBR.bin
2011-08-21 09:58 . 2011-08-21 15:06 -------- d-----w- c:\program files\trend micro
2011-08-20 20:24 . 2010-12-30 18:09 38848 ----a-w- c:\windows\avastSS.scr
2011-08-20 19:48 . 2011-08-20 19:48 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2011-08-15 09:06 . 2011-08-15 09:08 -------- d-----w- c:\documents and settings\Pavlica\Data aplikací\DAEMON Tools Lite
2011-08-13 12:25 . 2011-08-13 12:25 -------- d-----w- c:\documents and settings\vondris.DDMT1\Data aplikací\DAEMON Tools Lite
2011-08-08 14:18 . 2011-08-08 14:18 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-06 18:53 . 2011-08-06 18:53 -------- d-----w- c:\documents and settings\haufec\Local Settings\Data aplikací\PackageAware
2011-08-06 17:41 . 2011-08-06 17:41 -------- d-----w- c:\documents and settings\Pavlica\Local Settings\Data aplikací\OpenCandy
2011-08-06 17:39 . 2011-08-06 17:39 -------- d-----w- c:\documents and settings\Pavlica\Data aplikací\OpenCandy
2011-08-06 16:03 . 2011-08-06 18:53 21840 ----atw- c:\windows\system32\SIntfNT.dll
2011-08-06 16:03 . 2011-08-06 18:53 17212 ----atw- c:\windows\system32\SIntf32.dll
2011-08-06 16:03 . 2011-08-06 18:53 12067 ----atw- c:\windows\system32\SIntf16.dll
2011-08-06 15:58 . 2011-08-06 15:58 2829 ----a-w- c:\windows\DIIUnin.pif
2011-08-06 15:58 . 2011-08-06 15:58 94208 ----a-w- c:\windows\DIIUnin.exe
2011-08-06 11:44 . 2011-08-06 11:45 -------- d-----r- c:\program files\Skype
2011-07-29 12:47 . 2011-08-21 12:53 -------- d-----w- c:\documents and settings\LocalService\Plocha
2011-07-29 12:43 . 2011-07-29 12:43 -------- d-----w- c:\documents and settings\Pavlica\Data aplikací\Realm of the Titans
2011-07-28 07:21 . 2011-07-28 07:21 -------- d-----w- C:\Casino
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-15 13:29 . 2008-04-14 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2008-04-14 12:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-30 09:18 . 2011-06-30 09:18 20747 ----a-w- c:\windows\system32\drivers\AegisP.sys
2011-06-24 14:10 . 2010-12-17 13:28 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:31 . 2008-04-14 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:31 . 2008-04-14 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2011-06-23 18:31 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2008-04-14 12:00 385024 ------w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2008-04-14 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-06 11:35 . 2008-04-14 12:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-29 16:36 . 2011-05-29 16:36 387600 ----a-w- c:\windows\system32\FTBSaver.scr
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-21_20.50.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-26 19:47 . 2011-08-26 19:47 16384 c:\windows\Temp\Perflib_Perfdata_6fc.dat
+ 2008-04-14 12:00 . 2011-07-08 13:49 46080 c:\windows\system32\tzchange.exe
- 2008-04-14 12:00 . 2010-11-03 13:12 46080 c:\windows\system32\tzchange.exe
+ 2011-06-10 15:20 . 2010-07-05 13:13 18296 c:\windows\system32\spmsg.dll
- 2011-06-10 15:20 . 2010-02-22 14:20 18296 c:\windows\system32\spmsg.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2011-02-01 141616]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2011-02-01 14:58 1499440 ----a-w- c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2011-02-01 1499440]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2011-02-01 1499440]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-07-29 17361032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2010-12-20 111928]
"Family Tree Builder Update"="c:\program files\MyHeritage\Bin\FTBCheckUpdates.exe" [2011-05-29 221184]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
TL-WN321G Wireless Utility.lnk - c:\program files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe [2011-6-30 622592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8953:TCP"= 8953:TCP:BitComet 8953 TCP
"8953:UDP"= 8953:UDP:BitComet 8953 UDP
"24028:TCP"= 24028:TCP:BitComet 24028 TCP
"24028:UDP"= 24028:UDP:BitComet 24028 UDP
"8428:TCP"= 8428:TCP:BitComet 8428 TCP
"8428:UDP"= 8428:UDP:BitComet 8428 UDP
"4042:TCP"= 4042:TCP:Akamai NetSession Interface
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [13.9.2010 16:27 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [7.9.2010 3:48 32592]
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [7.9.2010 3:48 248656]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [7.9.2010 3:49 297168]
R2 NitroReaderDriverReadSpool;NitroPDFReaderDriverCreatorReadSpool;c:\program files\Nitro PDF\Reader\NitroPDFReaderDriverService.exe [14.1.2011 14:35 196912]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [12.7.2010 4:33 30432]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [19.8.2010 21:42 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [19.8.2010 21:42 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [19.8.2010 21:42 27216]
S2 avgfws;AVG Firewall;"c:\program files\AVG\AVG10\avgfws.exe" --> c:\program files\AVG\AVG10\avgfws.exe [?]
S2 AVGIDSAgent;AVGIDSAgent;"c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe" --> c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [?]
S2 avgwd;AVG WatchDog;"c:\program files\AVG\AVG10\avgwdsvc.exe" --> c:\program files\AVG\AVG10\avgwdsvc.exe [?]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [12.7.2010 4:33 30432]
S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [1.3.2011 21:23 183560]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 NPFW;NPFW;\??\c:\windows\system32\NPFW.SYS --> c:\windows\system32\NPFW.SYS [?]
S3 NPFWFLT;NPFWFLT;\??\c:\windows\system32\NPFWFLT.SYS --> c:\windows\system32\NPFWFLT.SYS [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 NPIDS;NPIDS;\??\c:\windows\system32\NPIDS.SYS --> c:\windows\system32\NPIDS.SYS [?]
S3 TKFsAvM;TKFsAvM;\??\c:\windows\system32\TKFsAv.sys --> c:\windows\system32\TKFsAv.sys [?]
S3 TkFsFtM;MiniFilter Driver;c:\windows\system32\TKFsFt.sys --> c:\windows\system32\TKFsFt.sys [?]
S3 TKPcFt;TKPcFt;\??\c:\windows\system32\TKPcFtHk.sys --> c:\windows\system32\TKPcFtHk.sys [?]
S3 TKTool;TKTool;\??\c:\windows\system32\TKTool2k.sys --> c:\windows\system32\TKTool2k.sys [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://mirostart.com/?cfg=2-365-0-...
mStart Page = hxxp://search.myheritage.com
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Stáhnout odkaz s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Stáhnout všechny odkazy s použitím BitCometu - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
TCP: DhcpNameServer = 192.168.1.1 192.168.2.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-26 21:49
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-2052111302-1364589140-1644491937-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'explorer.exe'(4052)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft\BingBar\SeaPort.EXE
.
**************************************************************************
.
Celkový čas: 2011-08-26 21:52:56 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-26 19:52
ComboFix2.txt 2011-08-26 17:46
ComboFix3.txt 2011-08-21 20:54
.
Před spuštěním: Volných bajtů: 13 960 998 912
Po spuštění: Volných bajtů: 13 953 953 792
.
- - End Of File - - B4FAB9847BFF6C0F26B594017E5B2A7A

Log již vypadá čistý. Přesvědčte se,zda funguje antivir, pokud ne reinstalujte. nakonec oédinstalujte ComboFix: Start>spustit>(napsat) combofix /uninstall>OK.