VIRY.CZ

Logfile of random's system information tool 1.09 (written by random/random)
Run by Rukia at 2011-08-21 17:29:13
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 13 GB (25%) free of 52 GB
Total RAM: 3325 MB (83% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:29:23, on 21.8.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
C:\WINDOWS\update.7.1\svchostdriver.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\update.7.1\svchostdriver.exe
c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\update.5.0\svchost.exe
C:\WINDOWS\update.2\svchost.exe
C:\WINDOWS\update.5.0\svchost.exe
C:\WINDOWS\sysdriver32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\update.1\svchost.exe
C:\Documents and Settings\Rukia\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Rukia\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\WINDOWS\update.2\svchost.exe
C:\Documents and Settings\Rukia\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Rukia\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
D:\Download\RSIT.exe
C:\Program Files\trend micro\Rukia.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.macromedia.com/software/flas ... irect.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [BCU] "C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [4483063.exe] "C:\WINDOWS\TEMP\4483063.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Rukia\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Browser Configuration Utility Service (BCUService) - DeviceVM, Inc. - C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
O23 - Service: ddservice - Unknown owner - C:\WINDOWS\update.7.1\svchostdriver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: srvbtcclient - Unknown owner - C:\WINDOWS\update.5.0\svchost.exe
O23 - Service: srviecheck - Unknown owner - C:\WINDOWS\update.2\svchost.exe
O23 - Service: srvsysdriver32 - Unknown owner - C:\WINDOWS\sysdriver32.exe
O23 - Service: wxpdrivers - Unknown owner - C:\WINDOWS\update.1\svchost.exe

--
End of file - 6363 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-1979792683-839522115-1004Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-1979792683-839522115-1004UA.job

=========Mozilla firefox=========

ProfilePath - C:\Documents and Settings\Rukia\Data aplikací\Mozilla\Firefox\Profiles\99m8h3ua.default

prefs.js - "browser.startup.homepage" - "www.google.cz"

"{20a82645-c095-46ed-80e3-08825760534b}"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 10.1 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@pandonetworks.com/PandoWebPlugin]
"Description"=This plugin detects and launches Pando Media Booster
"Path"=C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69]
"Description"=RealPlayer(tm) LiveConnect-Enabled Plug-In
"Path"=C:\Program Files\Media Convert Master\codec\real\browser\plugins\nppl3260.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69]
"Description"=6.0.12.69
"Path"=C:\Program Files\Media Convert Master\codec\real\browser\plugins\nprpjplug.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=]
"Description"=
"Path"=

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nppl3260.xpt
nsIQTScriptablePlugin.xpt
nsJSRealPlayerPlugin.xpt

C:\Program Files\Mozilla Firefox\searchplugins\
crawlersrch.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Documents and Settings\Rukia\Data aplikací\Mozilla\Firefox\Profiles\99m8h3ua.default\extensions\
DTToolbar@toolbarnet.com

C:\Documents and Settings\Rukia\Data aplikací\Mozilla\Firefox\Profiles\99m8h3ua.default\searchplugins\
daemon-search.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2011-04-21 1000768]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"BCU"=C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe [2009-10-15 375000]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-05-24 98304]
"4483063.exe"=C:\WINDOWS\TEMP\4483063.exe [2011-08-21 634880]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Google Update"=C:\Documents and Settings\Rukia\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2011-05-28 136176]
"ccleaner"=C:\Program Files\CCleaner\CCleaner.exe [2010-07-23 1755960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2011-05-25 188416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2009-01-30 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\wxpdrivers]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0
"EnableSecureUIAPaths"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\WINDOWS\update.1\svchost.exe"="C:\WINDOWS\update.1\svchost.exe:*:Enabled:C:\WINDOWS\update.1\svchost.exe"
"C:\WINDOWS\services32.exe"="C:\WINDOWS\services32.exe:*:Enabled:C:\WINDOWS\services32.exe"
"C:\WINDOWS\update.tray-7-0\svchost.exe"="C:\WINDOWS\update.tray-7-0\svchost.exe:*:Enabled:C:\WINDOWS\update.tray-7-0\svchost.exe"
"C:\WINDOWS\update.tray-7-0-lnk\svchost.exe"="C:\WINDOWS\update.tray-7-0-lnk\svchost.exe:*:Enabled:C:\WINDOWS\update.tray-7-0-lnk\svchost.exe"
"C:\WINDOWS\update.2\svchost.exe"="C:\WINDOWS\update.2\svchost.exe:*:Enabled:C:\WINDOWS\update.2\svchost.exe"
"C:\Program Files\CyberLink\PowerDirector\PDR9.exe"="C:\Program Files\CyberLink\PowerDirector\PDR9.exe:*:Disabled:CyberLink PowerDirector"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Disabled:Skype Extras Manager"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"vidc.VP60"=C:\WINDOWS\system32\vp6vfw.dll
"vidc.VP61"=C:\WINDOWS\system32\vp6vfw.dll
"msacm.l3codecp"=l3codecp.acm
"VIDC.FFDS"=ff_vfw.dll

======List of files/folders created in the last 1 month======

2011-08-21 17:29:13 ----D---- C:\rsit
2011-08-21 17:29:13 ----D---- C:\Program Files\trend micro
2011-08-21 17:22:38 ----D---- C:\WINDOWS\ufa
2011-08-20 15:36:52 ----HDC---- C:\WINDOWS\$NtUninstallKB2467659$
2011-08-20 15:36:34 ----D---- C:\WINDOWS\ie8updates
2011-08-20 15:36:19 ----D---- C:\WINDOWS\WBEM
2011-08-20 15:35:23 ----HDC---- C:\WINDOWS\ie8
2011-08-20 15:31:10 ----HDC---- C:\WINDOWS\$NtUninstallKB978601$
2011-08-20 15:27:16 ----D---- C:\WINDOWS\Prefetch
2011-08-20 15:19:36 ----D---- C:\WINDOWS\system32\cs
2011-08-20 15:19:36 ----D---- C:\WINDOWS\system32\bits
2011-08-20 15:19:36 ----D---- C:\WINDOWS\l2schemas
2011-08-20 15:17:24 ----D---- C:\WINDOWS\network diagnostic
2011-08-20 15:15:50 ----N---- C:\WINDOWS\system32\browserchoice.exe
2011-08-20 15:14:59 ----D---- C:\WINDOWS\EHome
2011-08-20 15:07:40 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2_0$
2011-08-20 15:07:14 ----HDC---- C:\WINDOWS\$NtUninstallKB960859_0$
2011-08-20 15:05:50 ----HDC---- C:\WINDOWS\$NtUninstallKB971468_0$
2011-08-20 15:05:33 ----HDC---- C:\WINDOWS\$NtUninstallKB958869$
2011-08-20 15:05:31 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2011-08-20 15:05:11 ----HDC---- C:\WINDOWS\$NtUninstallKB981350$
2011-08-20 15:01:29 ----HDC---- C:\WINDOWS\$NtUninstallKB975713_0$
2011-08-20 15:01:24 ----HDC---- C:\WINDOWS\$NtUninstallKB971657_0$
2011-08-20 14:58:39 ----HDC---- C:\WINDOWS\$NtUninstallKB974112_0$
2011-08-20 14:57:15 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9L$
2011-08-20 14:55:36 ----A---- C:\WINDOWS\system32\MRT.exe
2011-08-20 14:55:20 ----HDC---- C:\WINDOWS\$NtUninstallKB885884$
2011-08-20 14:55:02 ----D---- C:\WINDOWS\ServicePackFiles
2011-08-20 14:54:51 ----HDC---- C:\WINDOWS\$NtUninstallKB960803_0$
2011-08-20 14:46:35 ----D---- C:\Program Files\MSXML 4.0
2011-08-20 14:08:55 ----N---- C:\WINDOWS\system32\drivers\watv10nt.sys
2011-08-20 14:08:55 ----N---- C:\WINDOWS\system32\drivers\watv06nt.sys
2011-08-20 14:08:55 ----N---- C:\WINDOWS\system32\drivers\wadv11nt.sys
2011-08-20 14:08:55 ----N---- C:\WINDOWS\system32\drivers\wadv09nt.sys
2011-08-20 14:08:55 ----N---- C:\WINDOWS\system32\drivers\wadv08nt.sys
2011-08-20 14:08:55 ----N---- C:\WINDOWS\system32\drivers\wadv07nt.sys
2011-08-20 14:08:54 ----N---- C:\WINDOWS\system32\drivers\slwdmsup.sys
2011-08-20 14:08:54 ----N---- C:\WINDOWS\system32\drivers\slnthal.sys
2011-08-20 14:08:54 ----N---- C:\WINDOWS\system32\drivers\slntamr.sys
2011-08-20 14:08:53 ----N---- C:\WINDOWS\system32\drivers\slnt7554.sys
2011-08-20 14:08:53 ----N---- C:\WINDOWS\system32\drivers\s3gnbm.sys
2011-08-20 14:08:53 ----N---- C:\WINDOWS\system32\drivers\recagent.sys
2011-08-20 14:08:53 ----N---- C:\WINDOWS\system32\drivers\nv4_mini.sys
2011-08-20 14:08:53 ----N---- C:\WINDOWS\system32\drivers\ntmtlfax.sys
2011-08-20 14:08:53 ----N---- C:\WINDOWS\system32\drivers\mtxparhm.sys
2011-08-20 14:08:53 ----N---- C:\WINDOWS\system32\drivers\mtlstrm.sys
2011-08-20 14:08:53 ----N---- C:\WINDOWS\system32\drivers\mtlmnt5.sys
2011-08-20 14:08:52 ----N---- C:\WINDOWS\system32\drivers\mdmxsdk.sys
2011-08-20 14:08:51 ----N---- C:\WINDOWS\system32\drivers\hsfdpsp2.sys
2011-08-20 14:08:51 ----N---- C:\WINDOWS\system32\drivers\hsfcxts2.sys
2011-08-20 14:08:51 ----N---- C:\WINDOWS\system32\drivers\hsfbs2s2.sys
2011-08-20 14:07:49 ----N---- C:\WINDOWS\system32\drivers\atinxsxx.sys
2011-08-20 14:07:49 ----N---- C:\WINDOWS\system32\drivers\atinxbxx.sys
2011-08-20 14:07:49 ----N---- C:\WINDOWS\system32\drivers\atintuxx.sys
2011-08-20 14:07:49 ----N---- C:\WINDOWS\system32\drivers\atinttxx.sys
2011-08-20 14:07:49 ----N---- C:\WINDOWS\system32\drivers\atinsnxx.sys
2011-08-20 14:07:49 ----N---- C:\WINDOWS\system32\drivers\atinrvxx.sys
2011-08-20 14:07:49 ----N---- C:\WINDOWS\system32\drivers\atinraxx.sys
2011-08-20 14:07:49 ----N---- C:\WINDOWS\system32\drivers\atinpdxx.sys
2011-08-20 14:07:49 ----N---- C:\WINDOWS\system32\drivers\atinmdxx.sys
2011-08-20 14:07:48 ----N---- C:\WINDOWS\system32\drivers\atinbtxx.sys
2011-08-20 14:07:48 ----N---- C:\WINDOWS\system32\drivers\ati2mtaa.sys
2011-08-20 14:07:48 ----N---- C:\WINDOWS\system32\drivers\ati1xsxx.sys
2011-08-20 14:07:48 ----N---- C:\WINDOWS\system32\drivers\ati1xbxx.sys
2011-08-20 14:07:48 ----N---- C:\WINDOWS\system32\drivers\ati1tuxx.sys
2011-08-20 14:07:48 ----N---- C:\WINDOWS\system32\drivers\ati1ttxx.sys
2011-08-20 14:07:48 ----N---- C:\WINDOWS\system32\drivers\ati1snxx.sys
2011-08-20 14:07:48 ----N---- C:\WINDOWS\system32\drivers\ati1rvxx.sys
2011-08-20 14:07:48 ----N---- C:\WINDOWS\system32\drivers\ati1raxx.sys
2011-08-20 14:07:48 ----N---- C:\WINDOWS\system32\drivers\ati1pdxx.sys
2011-08-20 14:07:48 ----N---- C:\WINDOWS\system32\drivers\ati1mdxx.sys
2011-08-20 14:07:48 ----N---- C:\WINDOWS\system32\drivers\ati1btxx.sys
2011-08-20 13:18:11 ----N---- C:\WINDOWS\system32\drivers\bthport.sys
2011-08-20 13:02:53 ----N---- C:\WINDOWS\system32\tzchange.exe
2011-08-20 12:45:22 ----N---- C:\WINDOWS\system32\spmsg.dll
2011-08-20 12:45:22 ----D---- C:\WINDOWS\system32\PreInstall
2011-08-20 12:45:21 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2011-08-20 12:41:23 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2011-08-19 23:19:27 ----D---- C:\WINDOWS\pss
2011-08-19 22:30:54 ----D---- C:\Documents and Settings\All Users\Data aplikací\ATI
2011-08-19 22:29:48 ----D---- C:\Program Files\AMD APP
2011-08-19 22:15:07 ----A---- C:\WINDOWS\system32\ativvamv.dll
2011-08-19 22:04:07 ----D---- C:\ATI
2011-08-19 14:28:01 ----D---- C:\TuneUp_Portable_8.0.2000_En
2011-08-19 14:25:07 ----D---- C:\Documents and Settings\Rukia\Data aplikací\TuneUp Software
2011-08-19 14:25:07 ----D---- C:\Documents and Settings\All Users\Data aplikací\TuneUp Software
2011-08-19 13:58:40 ----D---- C:\WINDOWS\rpcminer
2011-08-19 13:58:40 ----D---- C:\WINDOWS\phoenix
2011-08-19 13:57:45 ----A---- C:\WINDOWS\l1rezerv.exe
2011-08-19 13:57:06 ----A---- C:\WINDOWS\btc_client_iplist.txt
2011-08-19 13:56:39 ----HD---- C:\WINDOWS\update.5.0
2011-08-19 13:56:03 ----A---- C:\WINDOWS\iecheck_iplist.txt
2011-08-19 13:55:34 ----HD---- C:\WINDOWS\update.2
2011-08-19 13:55:07 ----A---- C:\WINDOWS\unrar.exe
2011-08-19 13:55:00 ----HD---- C:\WINDOWS\update.7.1
2011-08-19 13:51:47 ----A---- C:\WINDOWS\iplist.txt
2011-08-19 13:51:09 ----A---- C:\WINDOWS\sysdriver32.exe
2011-08-19 13:48:53 ----A---- C:\WINDOWS\front_ip_list.txt
2011-08-19 13:48:49 ----D---- C:\WINDOWS\av_ico
2011-08-19 11:39:32 ----HD---- C:\WINDOWS\update.1
2011-08-19 11:39:24 ----HD---- C:\WINDOWS\update.tray-7-0-lnk
2011-08-19 11:39:24 ----HD---- C:\WINDOWS\update.tray-7-0
2011-08-19 11:28:28 ----A---- C:\WINDOWS\winlog-ids.txt
2011-08-19 11:28:28 ----A---- C:\WINDOWS\winlog-dirs.txt
2011-08-19 11:28:24 ----A---- C:\WINDOWS\services32.exe
2011-08-02 01:01:49 ----D---- C:\Documents and Settings\All Users\Data aplikací\Nexon
2011-08-02 00:31:27 ----D---- C:\Program Files\Common Files\DirectX
2011-08-02 00:25:17 ----A---- C:\WINDOWS\system32\npptNT2.sys
2011-08-02 00:24:14 ----D---- C:\Program Files\Common Files\INCA Shared
2011-08-01 21:42:17 ----A---- C:\WINDOWS\iPlayer.INI
2011-08-01 21:39:09 ----D---- C:\Program Files\InterActual
2011-08-01 20:45:44 ----D---- C:\gPotato.eu

======List of files/folders modified in the last 1 month======

2011-08-21 17:29:13 ----RD---- C:\Program Files
2011-08-21 17:24:37 ----D---- C:\WINDOWS\system32
2011-08-21 17:24:37 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2011-08-21 17:22:38 ----D---- C:\WINDOWS
2011-08-21 17:21:21 ----D---- C:\WINDOWS\Temp
2011-08-21 17:19:28 ----N---- C:\WINDOWS\SchedLgU.Txt
2011-08-21 16:36:02 ----D---- C:\WINDOWS\system32\config
2011-08-21 16:32:14 ----D---- C:\WINDOWS\system32\drivers
2011-08-21 16:28:02 ----SHD---- C:\System Volume Information
2011-08-21 16:28:02 ----D---- C:\WINDOWS\system32\Restore
2011-08-21 15:25:33 ----D---- C:\WINDOWS\system32\CatRoot2
2011-08-20 21:47:03 ----D---- C:\WINDOWS\Debug
2011-08-20 21:46:56 ----HD---- C:\WINDOWS\inf
2011-08-20 21:46:18 ----D---- C:\WINDOWS\system32\cs-CZ
2011-08-20 21:46:17 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-08-20 21:46:17 ----D---- C:\WINDOWS\Help
2011-08-20 21:46:17 ----D---- C:\Program Files\Internet Explorer
2011-08-20 19:38:50 ----D---- C:\WINDOWS\Microsoft.NET
2011-08-20 19:38:29 ----RSD---- C:\WINDOWS\assembly
2011-08-20 15:37:06 ----HD---- C:\WINDOWS\$hf_mig$
2011-08-20 15:36:13 ----D---- C:\WINDOWS\Media
2011-08-20 15:29:11 ----SHD---- C:\WINDOWS\Installer
2011-08-20 15:26:56 ----D---- C:\WINDOWS\system32\wbem
2011-08-20 15:26:56 ----D---- C:\WINDOWS\system32\Setup
2011-08-20 15:26:56 ----D---- C:\WINDOWS\AppPatch
2011-08-20 15:26:55 ----RSD---- C:\WINDOWS\Fonts
2011-08-20 15:25:41 ----D---- C:\WINDOWS\system32\CatRoot
2011-08-20 15:19:46 ----D---- C:\WINDOWS\WinSxS
2011-08-20 15:19:42 ----D---- C:\WINDOWS\ime
2011-08-20 15:19:36 ----D---- C:\WINDOWS\system32\usmt
2011-08-20 15:19:36 ----D---- C:\WINDOWS\PeerNet
2011-08-20 15:19:36 ----D---- C:\Program Files\Movie Maker
2011-08-20 15:18:36 ----D---- C:\WINDOWS\system32\npp
2011-08-20 15:18:35 ----D---- C:\WINDOWS\msagent
2011-08-20 15:18:34 ----D---- C:\WINDOWS\srchasst
2011-08-20 15:18:34 ----D---- C:\Program Files\NetMeeting
2011-08-20 15:18:33 ----D---- C:\WINDOWS\system32\Com
2011-08-20 15:18:32 ----D---- C:\Program Files\Windows Media Player
2011-08-20 15:18:31 ----D---- C:\Program Files\Windows NT
2011-08-20 15:18:31 ----D---- C:\Program Files\Outlook Express
2011-08-20 15:18:29 ----D---- C:\Program Files\Common Files\System
2011-08-20 15:18:18 ----D---- C:\WINDOWS\system32\oobe
2011-08-20 15:18:17 ----D---- C:\WINDOWS\system
2011-08-20 15:16:41 ----D---- C:\WINDOWS\security
2011-08-20 12:47:09 ----SD---- C:\Documents and Settings\Rukia\Data aplikací\Microsoft
2011-08-20 12:41:31 ----D---- C:\WINDOWS\SoftwareDistribution
2011-08-19 23:23:56 ----D---- C:\WINDOWS\Registration
2011-08-19 22:58:21 ----RD---- C:\Program Files\Skype
2011-08-19 22:15:07 ----DC---- C:\WINDOWS\system32\DRVSTORE
2011-08-19 14:51:44 ----D---- C:\Program Files\Gigabyte
2011-08-19 14:41:40 ----HD---- C:\Program Files\InstallShield Installation Information
2011-08-19 14:29:33 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2011-08-19 14:29:33 ----HDC---- C:\WINDOWS\$NtUninstallWIC$
2011-08-19 14:29:33 ----HDC---- C:\WINDOWS\$NtUninstallKB888111WXPSP2$
2011-08-19 14:10:15 ----D---- C:\Documents and Settings\Rukia\Data aplikací\go
2011-08-19 13:57:43 ----SD---- C:\WINDOWS\Tasks
2011-08-19 13:47:55 ----A---- C:\boot.ini
2011-08-19 11:27:58 ----D---- C:\Documents and Settings\Rukia\Data aplikací\uTorrent
2011-08-18 23:02:05 ----A---- C:\WINDOWS\NeroDigital.ini
2011-08-17 11:48:46 ----D---- C:\Documents and Settings\All Users\Data aplikací\PMB Files
2011-08-13 13:54:48 ----D---- C:\Documents and Settings\Rukia\Data aplikací\Skype
2011-08-13 13:54:06 ----D---- C:\Documents and Settings\All Users\Data aplikací\Easybits GO
2011-08-08 23:58:50 ----SD---- C:\Documents and Settings\All Users\Data aplikací\Microsoft
2011-08-03 18:47:30 ----D---- C:\Documents and Settings\All Users\Data aplikací\CyberLink
2011-08-03 18:47:29 ----D---- C:\Documents and Settings\Rukia\Data aplikací\CyberLink
2011-08-02 00:31:27 ----D---- C:\Program Files\Common Files
2011-07-25 17:08:54 ----A---- C:\WINDOWS\system32\mshtml.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI Texas Instruments; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2011-05-17 717296]
R1 AmdPPM;Ovladač procesoru HwPState AMD; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2009-11-12 5504]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2011-05-25 6554624]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2010-07-28 6108776]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 RTHDMIAzAudService;Service for HDMI; C:\WINDOWS\system32\drivers\RtKHDMI.sys [2010-05-24 4003008]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2010-05-03 225232]
S3 a823oe5h;a823oe5h; C:\WINDOWS\system32\drivers\a823oe5h.sys []
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2009-11-18 1691480]
S3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys []
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2009-11-18 1395800]
S3 nocashio;nocashio; C:\WINDOWS\system32\drivers\nocashio.sys [2011-06-14 4096]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2011-05-25 643072]
R2 BCUService;Browser Configuration Utility Service; C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-15 223464]
R2 ddservice;ddservice; C:\WINDOWS\update.7.1\svchostdriver.exe [2011-08-19 382464]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2007-09-20 853288]
R2 NMSAccess;NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2010-03-04 71096]
R2 PSI_SVC_2;Protexis Licensing V2; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2007-07-24 185632]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared files\RichVideo.exe [2010-08-19 247152]
R2 srvbtcclient;srvbtcclient; C:\WINDOWS\update.5.0\svchost.exe [2011-08-19 348672]
R2 srviecheck;srviecheck; C:\WINDOWS\update.2\svchost.exe [2011-08-21 634880]
R2 srvsysdriver32;srvsysdriver32; C:\WINDOWS\sysdriver32.exe [2011-08-19 258048]
R2 wxpdrivers;wxpdrivers; C:\WINDOWS\update.1\svchost.exe [2011-08-19 1215488]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2007-09-20 382248]
S3 npggsvc;nProtect GameGuard Service; C:\WINDOWS\system32\GameMon.des [2011-05-03 4092408]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\wmpnetwk.exe [2009-01-30 913408]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php ä dejte log. Předem nic nemažte.

Dakujem za zaujem tuna posielam pozadovany log s malwarebyte


Malwarebytes' Anti-Malware
www.malwarebytes.org

Verze databáze:

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

21.8.2011 19:13:19
mbam-log-2011-08-21 (19-13-13).txt

Typ: Rychlá kontrola
Kontrolované objekty: 146044
Uplynulý čas: 1 minut, 38 sekund

Infikované procesy v paměti: 6
Infikované moduly v paměti: 0
Infikované klíče v registru: 7
Infikované hodnoty v registru: 1
Infikované datové položky v registru: 1
Infikované složky: 0
Infikované soubory: 6

Infikované procesy v paměti:
c:\WINDOWS\update.1\svchost.exe (Trojan.Dropper) -> 748 -> No action taken.
c:\WINDOWS\sysdriver32.exe (Trojan.Delf) -> 2024 -> No action taken.
c:\WINDOWS\update.2\svchost.exe (Backdoor.Agent) -> 1472 -> No action taken.
c:\WINDOWS\update.2\svchost.exe (Backdoor.Agent) -> 3100 -> No action taken.
c:\WINDOWS\update.5.0\svchost.exe (Trojan.Downloader) -> 1264 -> No action taken.
c:\WINDOWS\update.5.0\svchost.exe (Trojan.Downloader) -> 132 -> No action taken.

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpdrivers (Trojan.Dropper) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvsysdriver32 (Trojan.Delf) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srviecheck (Backdoor.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvbtcclient (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SRVSYSDRIVER32 (Trojan.Agent) -> No action taken.

Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpDrivers\ImagePath (Trojan.Agent) -> Value: ImagePath -> No action taken.

Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
c:\WINDOWS\update.1\svchost.exe (Trojan.Dropper) -> No action taken.
c:\WINDOWS\services32.exe (Trojan.Dropper) -> No action taken.
c:\WINDOWS\l1rezerv.exe (Trojan.Agent) -> No action taken.
c:\WINDOWS\sysdriver32.exe (Trojan.Delf) -> No action taken.
c:\WINDOWS\update.2\svchost.exe (Backdoor.Agent) -> No action taken.
c:\WINDOWS\update.5.0\svchost.exe (Trojan.Downloader) -> No action taken.

Vše, co MBAM nalezl, smažte. Pak restartujte PC a dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

Heh nestihol som ani na wc nejak rychlo to slo no tak toto mi vyhodil combofix


ComboFix 11-08-21.01 - Rukia 21.08.2011 19:56:19.1.3 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.3325.2799 [GMT 2:00]
Spuštěný z: d:\download\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\btc_client_iplist.txt
c:\windows\front_ip_list.txt
c:\windows\geoiplist
c:\windows\geoiplist.rar
c:\windows\iecheck_iplist.txt
c:\windows\info1
c:\windows\iplist.txt
c:\windows\iun6002.exe
c:\windows\loader2.exe_ok
c:\windows\phoenix
c:\windows\phoenix.rar
c:\windows\phoenix\kernels\phatk\__init__.py
c:\windows\phoenix\kernels\phatk\__init__.pyc
c:\windows\phoenix\kernels\phatk\088dd017c9719900f796c2e17f165eab.elf
c:\windows\phoenix\kernels\phatk\80a30e670303ef135dc9963717c06d5c.elf
c:\windows\phoenix\kernels\phatk\83af55b0f5f60b2c6565411218f87ca5.elf
c:\windows\phoenix\kernels\phatk\be84a70eed029683c4d0bc2ee669d053.elf
c:\windows\phoenix\kernels\phatk\BFIPatcher.py
c:\windows\phoenix\kernels\phatk\BFIPatcher.pyc
c:\windows\phoenix\kernels\phatk\c321c6508739063881babf2ec29bf439.elf
c:\windows\phoenix\kernels\phatk\kernel.cl
c:\windows\phoenix\kernels\poclbm\__init__.py
c:\windows\phoenix\kernels\poclbm\__init__.pyc
c:\windows\phoenix\kernels\poclbm\0dae18ee18a7c8aecdcbcb533bc82077.elf
c:\windows\phoenix\kernels\poclbm\10d43db262f4a33ba81bbf850581938e.elf
c:\windows\phoenix\kernels\poclbm\170ce2f6f3d9e2f68315ceb85c368b7c.elf
c:\windows\phoenix\kernels\poclbm\28a9ced71315bac4ab8323c41d9b3382.elf
c:\windows\phoenix\kernels\poclbm\b777edba36f935832bf799471f494431.elf
c:\windows\phoenix\kernels\poclbm\BFIPatcher.py
c:\windows\phoenix\kernels\poclbm\BFIPatcher.pyc
c:\windows\phoenix\kernels\poclbm\kernel.cl
c:\windows\phoenix\phoenix.exe
c:\windows\rpcminer
c:\windows\rpcminer.rar
c:\windows\rpcminer\bitcoinminercuda_10.cubin
c:\windows\rpcminer\bitcoinminercuda_11.cubin
c:\windows\rpcminer\bitcoinminercuda_20.cubin
c:\windows\rpcminer\bitcoinmineropencl.cl
c:\windows\rpcminer\cudart32_32_16.dll
c:\windows\rpcminer\curllib.dll
c:\windows\rpcminer\libeay32.dll
c:\windows\rpcminer\libsasl.dll
c:\windows\rpcminer\openldap.dll
c:\windows\rpcminer\rpcminer-4way.exe
c:\windows\rpcminer\rpcminer-cpu.exe
c:\windows\rpcminer\rpcminer-cuda.exe
c:\windows\rpcminer\rpcminer-opencl.exe
c:\windows\rpcminer\ssleay32.dll
c:\windows\system32\drivers\etc\HSTS~1
c:\windows\ufa.rar
c:\windows\update.1
c:\windows\update.2
c:\windows\update.5.0
c:\windows\winlog-dirs.txt
c:\windows\winlog-ids.txt
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SRVBTCCLIENT
-------\Legacy_SRVIECHECK
-------\Legacy_WXPDRIVERS
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-21 do 2011-08-21 )))))))))))))))))))))))))))))))
.
.
2011-08-21 17:10 . 2011-08-21 17:10 -------- d-----w- c:\documents and settings\Rukia\Data aplikací\Malwarebytes
2011-08-21 17:10 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-21 17:10 . 2011-08-21 17:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-08-21 17:10 . 2011-08-21 17:13 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-21 17:10 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-21 15:29 . 2011-08-21 15:29 -------- d-----w- C:\rsit
2011-08-21 15:29 . 2011-08-21 15:29 -------- d-----w- c:\program files\trend micro
2011-08-21 15:22 . 2011-08-21 15:22 -------- d-----w- c:\windows\ufa
2011-08-21 13:58 . 2011-08-21 13:58 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
2011-08-20 19:50 . 2011-08-20 19:50 -------- d-----r- c:\documents and settings\LocalService\Oblíbené položky
2011-08-20 19:49 . 2011-08-20 19:49 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2011-08-20 19:47 . 2011-08-20 19:47 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2011-08-20 19:46 . 2011-08-20 19:46 -------- d-sh--w- c:\documents and settings\Rukia\IETldCache
2011-08-20 13:36 . 2010-10-18 11:10 7680 -c----w- c:\windows\system32\dllcache\iecompat.dll
2011-08-20 13:36 . 2011-06-23 18:31 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2011-08-20 13:36 . 2011-06-23 18:31 602112 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2011-08-20 13:36 . 2011-06-23 18:31 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2011-08-20 13:36 . 2011-06-23 18:31 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2011-08-20 13:36 . 2011-06-23 18:31 1991680 -c----w- c:\windows\system32\dllcache\iertutil.dll
2011-08-20 13:36 . 2011-06-23 18:31 11081728 -c----w- c:\windows\system32\dllcache\ieframe.dll
2011-08-20 13:36 . 2011-06-23 18:31 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2011-08-20 13:35 . 2011-08-20 13:36 -------- dc-h--w- c:\windows\ie8
2011-08-20 13:19 . 2011-08-20 13:19 -------- d-----w- c:\windows\system32\cs
2011-08-20 13:19 . 2011-08-20 13:19 -------- d-----w- c:\windows\system32\bits
2011-08-20 13:19 . 2011-08-20 13:19 -------- d-----w- c:\windows\l2schemas
2011-08-20 13:15 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2011-08-20 13:14 . 2011-08-20 13:14 -------- d-----w- c:\windows\EHome
2011-08-20 13:12 . 2008-04-21 21:15 216576 -c----w- c:\windows\system32\dllcache\wordpad.exe
2011-08-20 12:55 . 2011-08-20 13:18 -------- d-----w- c:\windows\ServicePackFiles
2011-08-20 12:46 . 2011-08-20 12:46 -------- d-----w- c:\program files\MSXML 4.0
2011-08-20 12:07 . 2004-08-03 20:29 73216 ------w- c:\windows\system32\drivers\atintuxx.sys
2011-08-20 11:27 . 2008-08-14 10:04 138496 -c----w- c:\windows\system32\dllcache\afd.sys
2011-08-20 11:27 . 2009-12-31 16:50 353792 -c----w- c:\windows\system32\dllcache\srv.sys
2011-08-20 11:25 . 2010-02-24 13:11 455680 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2011-08-20 11:25 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2011-08-20 11:24 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2011-08-20 11:18 . 2008-06-14 17:35 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2011-08-20 11:18 . 2008-06-14 17:35 272128 ------w- c:\windows\system32\drivers\bthport.sys
2011-08-20 10:51 . 2008-10-15 16:38 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2011-08-20 10:47 . 2011-08-20 10:47 -------- d-----w- c:\documents and settings\Rukia\Local Settings\Data aplikací\Identities
2011-08-20 10:38 . 2011-08-20 10:38 -------- d-s---w- c:\documents and settings\Rukia\UserData
2011-08-19 21:23 . 2011-08-19 21:23 -------- d-----w- c:\windows\system32\wbem\Repository
2011-08-19 20:30 . 2011-08-19 20:30 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ATI
2011-08-19 20:29 . 2011-08-19 20:29 -------- d-----w- c:\program files\AMD APP
2011-08-19 20:15 . 2011-05-25 03:07 956160 ----a-w- c:\windows\system32\ativvamv.dll
2011-08-19 20:15 . 2011-08-19 20:15 -------- d-----w- c:\documents and settings\Default User\Local Settings\Data aplikací\ATI
2011-08-19 20:15 . 2011-08-19 20:15 -------- d-----w- c:\documents and settings\Default User\Data aplikací\ATI
2011-08-19 20:04 . 2011-08-19 20:04 -------- d-----w- C:\ATI
2011-08-19 12:28 . 2011-08-19 12:28 -------- d-----w- C:\TuneUp_Portable_8.0.2000_En
2011-08-19 12:25 . 2011-08-19 12:25 -------- d-----w- c:\documents and settings\Rukia\Data aplikací\TuneUp Software
2011-08-19 12:25 . 2011-08-19 12:25 -------- d-----w- c:\documents and settings\All Users\Data aplikací\TuneUp Software
2011-08-19 11:55 . 2011-08-21 15:22 246272 ----a-w- c:\windows\unrar.exe
2011-08-19 11:55 . 2011-08-19 11:55 -------- d--h--w- c:\windows\update.7.1
2011-08-19 11:48 . 2011-08-19 11:48 -------- d-----w- c:\windows\av_ico
2011-08-19 09:39 . 2011-08-19 09:39 -------- d--h--w- c:\windows\update.tray-7-0
2011-08-19 09:39 . 2011-08-19 09:39 -------- d--h--w- c:\windows\update.tray-7-0-lnk
2011-08-19 09:28 . 2011-08-19 09:28 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2011-08-01 23:01 . 2011-08-01 23:01 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Nexon
2011-08-01 22:31 . 2011-08-01 22:31 -------- d-----w- c:\program files\Common Files\DirectX
2011-08-01 22:31 . 2011-05-03 20:18 4092408 ----a-w- c:\windows\system32\GameMon.des
2011-08-01 22:25 . 2005-01-03 15:43 4682 ----a-w- c:\windows\system32\npptNT2.sys
2011-08-01 22:25 . 2003-07-20 00:17 5174 ----a-w- c:\windows\system32\nppt9x.vxd
2011-08-01 22:24 . 2011-08-01 22:24 -------- d-----w- c:\program files\Common Files\INCA Shared
2011-08-01 19:39 . 2011-08-01 19:45 -------- d-----w- c:\program files\InterActual
2011-08-01 18:45 . 2011-08-01 18:45 -------- d-----w- C:\gPotato.eu
2011-07-28 10:49 . 2011-08-09 21:50 -------- d-----w- c:\documents and settings\Rukia\riotsGamesLogs
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-19 21:17 . 2011-05-17 16:53 17488 ----a-w- c:\windows\gdrv.sys
2011-06-23 18:31 . 2006-03-02 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:31 . 2006-03-02 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2011-06-23 18:31 . 2006-03-02 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2006-03-02 12:00 385024 ------w- c:\windows\system32\html.iec
2011-06-14 17:42 . 2011-06-14 17:42 4096 ----a-w- c:\windows\system32\drivers\nocashio.sys
2011-06-08 10:43 . 2011-05-31 20:32 2516 --sha-w- c:\documents and settings\All Users\Data aplikací\KGyGaAvL.sys
2011-05-31 20:32 . 2011-05-31 20:32 8 --sh--r- c:\documents and settings\All Users\Data aplikací\842E9CC9B3.sys
2011-05-25 04:21 . 2011-05-17 13:41 6554624 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2011-05-25 04:15 . 2011-05-17 13:41 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2011-05-25 03:53 . 2011-05-17 13:41 57344 ----a-w- c:\windows\system32\aticalrt.dll
2011-05-25 03:53 . 2011-05-17 13:41 53248 ----a-w- c:\windows\system32\aticalcl.dll
2011-05-25 03:47 . 2011-05-17 13:41 17989632 ----a-w- c:\windows\system32\atioglxx.dll
2011-05-25 03:42 . 2011-05-17 13:41 5922816 ----a-w- c:\windows\system32\aticaldd.dll
2011-05-25 03:14 . 2011-05-17 13:41 4059328 ----a-w- c:\windows\system32\ati3duag.dll
2011-05-25 03:05 . 2011-05-17 13:41 503808 ----a-w- c:\windows\system32\atiok3x2.dll
2011-05-25 02:58 . 2011-05-17 13:41 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2011-05-25 02:56 . 2011-05-17 13:41 462848 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-05-25 02:55 . 2011-05-17 13:41 302592 ----a-w- c:\windows\system32\ati2dvag.dll
2011-05-25 02:54 . 2011-05-17 13:41 3152384 ----a-w- c:\windows\system32\ativvaxx.dll
2011-05-25 02:39 . 2011-05-17 13:41 212992 ----a-w- c:\windows\system32\atipdlxx.dll
2011-05-25 02:39 . 2011-05-17 13:41 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2011-05-25 02:39 . 2011-05-17 13:41 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2011-05-25 02:39 . 2011-05-17 13:41 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2011-05-25 02:38 . 2011-05-17 13:41 64512 ----a-w- c:\windows\system32\atimpc32.dll
2011-05-25 02:38 . 2011-05-17 13:41 64512 ----a-w- c:\windows\system32\amdpcom32.dll
2011-05-25 02:38 . 2011-05-17 13:41 188416 ----a-w- c:\windows\system32\ati2evxx.dll
2011-05-25 02:37 . 2011-05-17 13:41 643072 ----a-w- c:\windows\system32\ati2evxx.exe
2011-05-25 02:36 . 2011-05-17 13:41 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2011-05-25 02:34 . 2011-05-17 13:41 151552 ----a-w- c:\windows\system32\atiapfxx.exe
2011-05-25 02:31 . 2011-05-17 13:41 651264 ----a-w- c:\windows\system32\atikvmag.dll
2011-05-25 02:27 . 2011-05-17 13:41 200704 ----a-w- c:\windows\system32\atiadlxx.dll
2011-05-25 02:27 . 2011-05-17 13:41 17408 ----a-w- c:\windows\system32\atitvo32.dll
2011-05-25 02:22 . 2011-05-17 13:41 856064 ----a-w- c:\windows\system32\ati2cqag.dll
2011-05-24 21:44 . 2011-05-24 21:44 59904 ----a-w- c:\windows\system32\OVDecode.dll
2011-05-24 21:44 . 2011-05-24 21:44 51712 ----a-w- c:\windows\system32\OpenCL.dll
2011-05-24 21:43 . 2011-05-24 21:43 12798976 ----a-w- c:\windows\system32\amdocl.dll
2011-05-20 14:37 . 2011-05-17 14:24 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2010-07-23 1755960]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCU"="c:\program files\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-15 375000]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-05-24 98304]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\H:\0autocheck autochk *
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"sysdriver32.exe"="c:\windows\sysdriver32.exe" rezerv
"tray_ico0"=c:\windows\update.tray-7-0\svchost.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\update.tray-7-0\\svchost.exe"=
"c:\\WINDOWS\\update.tray-7-0-lnk\\svchost.exe"=
"c:\\Program Files\\CyberLink\\PowerDirector\\PDR9.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57574:TCP"= 57574:TCP:Pando Media Booster
"57574:UDP"= 57574:UDP:Pando Media Booster
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [17.5.2011 19:51 717296]
R2 BCUService;Browser Configuration Utility Service;c:\program files\DeviceVM\Browser Configuration Utility\BCUService.exe [15.10.2009 14:06 223464]
R2 ddservice;ddservice;c:\windows\update.7.1\svchostdriver.exe srv --> c:\windows\update.7.1\svchostdriver.exe srv [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [17.5.2011 15:22 1691480]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [21.8.2011 19:10 41272]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = hxxp://www.macromedia.com/software/flash/about ... irect.html
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.97.134.1
FF - ProfilePath - c:\documents and settings\Rukia\Data aplikací\Mozilla\Firefox\Profiles\99m8h3ua.default\
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - www.google.cz
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-Cool's_Codec_pack_4.12 - c:\windows\iun6002.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-21 19:59
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b0,a0,31,b9,89,dc,49,46,9a,0d,60,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b0,a0,31,b9,89,dc,49,46,9a,0d,60,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1004)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'explorer.exe'(572)
c:\windows\system32\webcheck.dll
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\1029\owci10.dll
c:\windows\system32\msls31.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\update.7.1\svchostdriver.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\update.7.1\svchostdriver.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2011-08-21 20:01:28 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-21 18:01
.
Před spuštěním: Volných bajtů: 13 636 030 464
Po spuštění: Volných bajtů: 13 538 811 904
.
WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=AlwaysOff /fastdetect /usepmtimer
.
- - End Of File - - E6EB7A69D078D3B08F7BFF84664C03E6

Ještě dočistíme. Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:

Collect::
c:\windows\unrar.exe

Folder::
c:\windows\ufa
c:\windows\update.7.1
c:\windows\av_ico
c:\windows\update.tray-7-0
c:\windows\update.tray-7-0-lnk

Uložte na plochu jako CFScxript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. Cf se spustí a vykoná příkazy ze skriptu.

tak vsetko som spravil ... tuna je vypis s posledneho logu s combofixu ... akurat ste mal vtom scripte preklep v nazve zbytocne x tam bolo... este nieco bude treba stym robit ???


ComboFix 11-08-21.01 - Rukia 21.08.2011 21:05:41.2.3 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.3325.2686 [GMT 2:00]
Spuštěný z: c:\documents and settings\Rukia\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Rukia\Plocha\CFScript.txt
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Vytvořen nový Bod Obnovení
.
file zipped: c:\windows\unrar.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\av_ico
c:\windows\av_ico\ico_avast_desktop.ico
c:\windows\av_ico\ico_avast_start.ico
c:\windows\front_ip_list.txt
c:\windows\proc_list1.log
c:\windows\ufa
c:\windows\ufa\ufa.exe
c:\windows\unrar.exe
c:\windows\update.7.1
c:\windows\update.7.1\svchostdriver.exe
c:\windows\update.tray-7-0-lnk
c:\windows\update.tray-7-0-lnk\svchost.exe
c:\windows\update.tray-7-0
c:\windows\update.tray-7-0\svchost.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ddservice
-------\Legacy_ddservice
-------\Service_ddservice
-------\Service_ddservice
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-07-21 do 2011-08-21 )))))))))))))))))))))))))))))))
.
.
2011-08-21 17:10 . 2011-08-21 17:10 -------- d-----w- c:\documents and settings\Rukia\Data aplikací\Malwarebytes
2011-08-21 17:10 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-21 17:10 . 2011-08-21 17:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-08-21 17:10 . 2011-08-21 17:13 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-21 17:10 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-21 15:29 . 2011-08-21 15:29 -------- d-----w- C:\rsit
2011-08-21 15:29 . 2011-08-21 15:29 -------- d-----w- c:\program files\trend micro
2011-08-21 13:58 . 2011-08-21 13:58 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
2011-08-20 19:50 . 2011-08-20 19:50 -------- d-----r- c:\documents and settings\LocalService\Oblíbené položky
2011-08-20 19:49 . 2011-08-20 19:49 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2011-08-20 19:47 . 2011-08-20 19:47 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2011-08-20 19:46 . 2011-08-20 19:46 -------- d-sh--w- c:\documents and settings\Rukia\IETldCache
2011-08-20 13:36 . 2010-10-18 11:10 7680 -c----w- c:\windows\system32\dllcache\iecompat.dll
2011-08-20 13:36 . 2011-06-23 18:31 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2011-08-20 13:36 . 2011-06-23 18:31 602112 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2011-08-20 13:36 . 2011-06-23 18:31 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2011-08-20 13:36 . 2011-06-23 18:31 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2011-08-20 13:36 . 2011-06-23 18:31 1991680 -c----w- c:\windows\system32\dllcache\iertutil.dll
2011-08-20 13:36 . 2011-06-23 18:31 11081728 -c----w- c:\windows\system32\dllcache\ieframe.dll
2011-08-20 13:36 . 2011-06-23 18:31 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2011-08-20 13:35 . 2011-08-20 13:36 -------- dc-h--w- c:\windows\ie8
2011-08-20 13:19 . 2011-08-20 13:19 -------- d-----w- c:\windows\system32\cs
2011-08-20 13:19 . 2011-08-20 13:19 -------- d-----w- c:\windows\system32\bits
2011-08-20 13:19 . 2011-08-20 13:19 -------- d-----w- c:\windows\l2schemas
2011-08-20 13:15 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2011-08-20 13:14 . 2011-08-20 13:14 -------- d-----w- c:\windows\EHome
2011-08-20 13:12 . 2008-04-21 21:15 216576 -c----w- c:\windows\system32\dllcache\wordpad.exe
2011-08-20 12:55 . 2011-08-20 13:18 -------- d-----w- c:\windows\ServicePackFiles
2011-08-20 12:46 . 2011-08-20 12:46 -------- d-----w- c:\program files\MSXML 4.0
2011-08-20 12:07 . 2004-08-03 20:29 73216 ------w- c:\windows\system32\drivers\atintuxx.sys
2011-08-20 11:27 . 2008-08-14 10:04 138496 -c----w- c:\windows\system32\dllcache\afd.sys
2011-08-20 11:27 . 2009-12-31 16:50 353792 -c----w- c:\windows\system32\dllcache\srv.sys
2011-08-20 11:25 . 2010-02-24 13:11 455680 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2011-08-20 11:25 . 2009-11-21 16:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2011-08-20 11:24 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2011-08-20 11:18 . 2008-06-14 17:35 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2011-08-20 11:18 . 2008-06-14 17:35 272128 ------w- c:\windows\system32\drivers\bthport.sys
2011-08-20 10:51 . 2008-10-15 16:38 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2011-08-20 10:47 . 2011-08-20 10:47 -------- d-----w- c:\documents and settings\Rukia\Local Settings\Data aplikací\Identities
2011-08-20 10:38 . 2011-08-20 10:38 -------- d-s---w- c:\documents and settings\Rukia\UserData
2011-08-19 21:23 . 2011-08-19 21:23 -------- d-----w- c:\windows\system32\wbem\Repository
2011-08-19 20:30 . 2011-08-19 20:30 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ATI
2011-08-19 20:29 . 2011-08-19 20:29 -------- d-----w- c:\program files\AMD APP
2011-08-19 20:15 . 2011-05-25 03:07 956160 ----a-w- c:\windows\system32\ativvamv.dll
2011-08-19 20:15 . 2011-08-19 20:15 -------- d-----w- c:\documents and settings\Default User\Local Settings\Data aplikací\ATI
2011-08-19 20:15 . 2011-08-19 20:15 -------- d-----w- c:\documents and settings\Default User\Data aplikací\ATI
2011-08-19 20:04 . 2011-08-19 20:04 -------- d-----w- C:\ATI
2011-08-19 12:28 . 2011-08-19 12:28 -------- d-----w- C:\TuneUp_Portable_8.0.2000_En
2011-08-19 12:25 . 2011-08-19 12:25 -------- d-----w- c:\documents and settings\Rukia\Data aplikací\TuneUp Software
2011-08-19 12:25 . 2011-08-19 12:25 -------- d-----w- c:\documents and settings\All Users\Data aplikací\TuneUp Software
2011-08-19 09:28 . 2011-08-19 09:28 -------- d-----w- c:\documents and settings\LocalService\Nabídka Start
2011-08-01 23:01 . 2011-08-01 23:01 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Nexon
2011-08-01 22:31 . 2011-08-01 22:31 -------- d-----w- c:\program files\Common Files\DirectX
2011-08-01 22:31 . 2011-05-03 20:18 4092408 ----a-w- c:\windows\system32\GameMon.des
2011-08-01 22:25 . 2005-01-03 15:43 4682 ----a-w- c:\windows\system32\npptNT2.sys
2011-08-01 22:25 . 2003-07-20 00:17 5174 ----a-w- c:\windows\system32\nppt9x.vxd
2011-08-01 22:24 . 2011-08-01 22:24 -------- d-----w- c:\program files\Common Files\INCA Shared
2011-08-01 19:39 . 2011-08-01 19:45 -------- d-----w- c:\program files\InterActual
2011-08-01 18:45 . 2011-08-01 18:45 -------- d-----w- C:\gPotato.eu
2011-07-28 10:49 . 2011-08-09 21:50 -------- d-----w- c:\documents and settings\Rukia\riotsGamesLogs
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-19 21:17 . 2011-05-17 16:53 17488 ----a-w- c:\windows\gdrv.sys
2011-06-23 18:31 . 2006-03-02 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:31 . 2006-03-02 12:00 43520 ------w- c:\windows\system32\licmgr10.dll
2011-06-23 18:31 . 2006-03-02 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2006-03-02 12:00 385024 ------w- c:\windows\system32\html.iec
2011-06-14 17:42 . 2011-06-14 17:42 4096 ----a-w- c:\windows\system32\drivers\nocashio.sys
2011-06-08 10:43 . 2011-05-31 20:32 2516 --sha-w- c:\documents and settings\All Users\Data aplikací\KGyGaAvL.sys
2011-05-31 20:32 . 2011-05-31 20:32 8 --sh--r- c:\documents and settings\All Users\Data aplikací\842E9CC9B3.sys
2011-05-25 04:21 . 2011-05-17 13:41 6554624 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2011-05-25 04:15 . 2011-05-17 13:41 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2011-05-25 03:53 . 2011-05-17 13:41 57344 ----a-w- c:\windows\system32\aticalrt.dll
2011-05-25 03:53 . 2011-05-17 13:41 53248 ----a-w- c:\windows\system32\aticalcl.dll
2011-05-25 03:47 . 2011-05-17 13:41 17989632 ----a-w- c:\windows\system32\atioglxx.dll
2011-05-25 03:42 . 2011-05-17 13:41 5922816 ----a-w- c:\windows\system32\aticaldd.dll
2011-05-25 03:14 . 2011-05-17 13:41 4059328 ----a-w- c:\windows\system32\ati3duag.dll
2011-05-25 03:05 . 2011-05-17 13:41 503808 ----a-w- c:\windows\system32\atiok3x2.dll
2011-05-25 02:58 . 2011-05-17 13:41 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2011-05-25 02:56 . 2011-05-17 13:41 462848 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-05-25 02:55 . 2011-05-17 13:41 302592 ----a-w- c:\windows\system32\ati2dvag.dll
2011-05-25 02:54 . 2011-05-17 13:41 3152384 ----a-w- c:\windows\system32\ativvaxx.dll
2011-05-25 02:39 . 2011-05-17 13:41 212992 ----a-w- c:\windows\system32\atipdlxx.dll
2011-05-25 02:39 . 2011-05-17 13:41 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2011-05-25 02:39 . 2011-05-17 13:41 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2011-05-25 02:39 . 2011-05-17 13:41 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2011-05-25 02:38 . 2011-05-17 13:41 64512 ----a-w- c:\windows\system32\atimpc32.dll
2011-05-25 02:38 . 2011-05-17 13:41 64512 ----a-w- c:\windows\system32\amdpcom32.dll
2011-05-25 02:38 . 2011-05-17 13:41 188416 ----a-w- c:\windows\system32\ati2evxx.dll
2011-05-25 02:37 . 2011-05-17 13:41 643072 ----a-w- c:\windows\system32\ati2evxx.exe
2011-05-25 02:36 . 2011-05-17 13:41 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2011-05-25 02:34 . 2011-05-17 13:41 151552 ----a-w- c:\windows\system32\atiapfxx.exe
2011-05-25 02:31 . 2011-05-17 13:41 651264 ----a-w- c:\windows\system32\atikvmag.dll
2011-05-25 02:27 . 2011-05-17 13:41 200704 ----a-w- c:\windows\system32\atiadlxx.dll
2011-05-25 02:27 . 2011-05-17 13:41 17408 ----a-w- c:\windows\system32\atitvo32.dll
2011-05-25 02:22 . 2011-05-17 13:41 856064 ----a-w- c:\windows\system32\ati2cqag.dll
2011-05-24 21:44 . 2011-05-24 21:44 59904 ----a-w- c:\windows\system32\OVDecode.dll
2011-05-24 21:44 . 2011-05-24 21:44 51712 ----a-w- c:\windows\system32\OpenCL.dll
2011-05-24 21:43 . 2011-05-24 21:43 12798976 ----a-w- c:\windows\system32\amdocl.dll
2011-05-20 14:37 . 2011-05-17 14:24 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-21_17.59.22 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-21 19:04 . 2011-08-21 19:04 16384 c:\windows\temp\Perflib_Perfdata_628.dat
- 2006-03-02 12:00 . 2011-08-21 17:55 83734 c:\windows\system32\perfc009.dat
+ 2006-03-02 12:00 . 2011-08-21 18:03 83734 c:\windows\system32\perfc009.dat
- 2006-03-02 12:00 . 2011-08-21 17:55 97580 c:\windows\system32\perfc005.dat
+ 2006-03-02 12:00 . 2011-08-21 18:03 97580 c:\windows\system32\perfc005.dat
+ 2006-03-02 12:00 . 2011-08-21 18:03 493190 c:\windows\system32\perfh009.dat
- 2006-03-02 12:00 . 2011-08-21 17:55 493190 c:\windows\system32\perfh009.dat
- 2006-03-02 12:00 . 2011-08-21 17:55 488134 c:\windows\system32\perfh005.dat
+ 2006-03-02 12:00 . 2011-08-21 18:03 488134 c:\windows\system32\perfh005.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2010-07-23 1755960]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCU"="c:\program files\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-10-15 375000]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-05-24 98304]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableSecureUIAPaths"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\H:\0autocheck autochk *
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"sysdriver32.exe"="c:\windows\sysdriver32.exe" rezerv
"tray_ico0"=c:\windows\update.tray-7-0\svchost.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"DisableThumbnailCache"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\CyberLink\\PowerDirector\\PDR9.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57574:TCP"= 57574:TCP:Pando Media Booster
"57574:UDP"= 57574:UDP:Pando Media Booster
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [17.5.2011 19:51 717296]
R2 BCUService;Browser Configuration Utility Service;c:\program files\DeviceVM\Browser Configuration Utility\BCUService.exe [15.10.2009 14:06 223464]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [17.5.2011 15:22 1691480]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [21.8.2011 19:10 41272]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = hxxp://www.macromedia.com/software/flash/about ... irect.html
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 10.97.134.1
FF - ProfilePath - c:\documents and settings\Rukia\Data aplikací\Mozilla\Firefox\Profiles\99m8h3ua.default\
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - www.google.cz
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-21 21:09
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b0,a0,31,b9,89,dc,49,46,9a,0d,60,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b0,a0,31,b9,89,dc,49,46,9a,0d,60,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1004)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
c:\windows\system32\COMRes.dll
.
- - - - - - - > 'explorer.exe'(2108)
c:\windows\system32\webcheck.dll
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\1029\owci10.dll
c:\windows\system32\msls31.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2011-08-21 21:11:03 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-08-21 19:11
ComboFix2.txt 2011-08-21 18:01
.
Před spuštěním: Volných bajtů: 13 412 352 000
Po spuštění: Volných bajtů: 13 395 509 248
.
- - End Of File - - 3CC5E0DAB96F6DE5753A551FE3F27560
Nahr nˇ probŘhlo ŁspŘçnŘ

Akurat som este zistil ze v pc mala avast a akosik uz tam neni je mozne ze by ho to zmazalo ??? pretoze zevraj nejak nesiel pred tym ze pri kliknuti na avast len vyskocilo okno ze pracuje v enchanced protection mode ... a nic viac ...

Log již vypadá čistý. Antivir musíte přeinstalovat, virus ho poškodil.

Hmm oki ale antivir neni ani v zozname odstranit programy a pod ... a este ze pouziva externy disk je mozne ze by snim nieco bolo ? asi jo sak ... a to ma to pc len 2 bo 3 mesiace A ste fakt machry ked sa v tych logoch vyznate

Nejdříve použijte odinstalátor Avastu: http://www.avast.com/cs-cz/uninstall-utility a pak proveďte novou instalaci. Po instalaci a updatu jím proveďte test ext. disku.

Ok dakujem moc bez vas by ten pocitac siel do kytek dakujem za pomoc vazne ked tak mate u mna minimalne pivko
a myslym ze sa moze tato tema uzavriet ... vazne prijemna skusenost s vasim forkom urcite dam vediet znamym ... zatial nech sa dari

Děkuji za přání a vy nemáte zač!