VIRY.CZ

Logfile of random's system information tool 1.09 (written by random/random)
Run by Lama007 at 2011-08-21 22:58:37
Microsoft Windows 7 Home Premium
System drive C: has 13 GB (24%) free of 55 GB
Total RAM: 510 MB (22% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:59:10, on 21.8.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16839)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\ICQ7.5\ICQ.exe
C:\Program Files (x86)\BitTorrent\BitTorrent.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Windows\update.1\svchost.exe
C:\Windows\l1rezerv.exe
C:\Users\Lama007\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Lama007\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Lama007\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Lama007\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Lama007\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Lama007\Downloads\RSIT.exe
C:\Program Files (x86)\trend micro\Lama007.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = my.daemon-search.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [wxpdrv] C:\Windows\update.1\svchost.exe
O4 - HKLM\..\Run: [1735126.exe] "C:\Users\Lama007\AppData\Local\Temp\1735126.exe"
O4 - HKLM\..\Run: [sysdriver32.exe] "C:\Windows\sysdriver32.exe" rezerv
O4 - HKLM\..\Run: [sysdriver32_.exe] "C:\Windows\sysdriver32_.exe" rezerv
O4 - HKLM\..\Run: [7904555.exe] "C:\Users\Lama007\AppData\Local\Temp\7904555.exe"
O4 - HKLM\..\Run: [6476207.exe] "C:\Windows\Temp\6476207.exe"
O4 - HKLM\..\Run: [41426550-loader2.exe] "C:\Windows\Temp\41426550-loader2.exe"
O4 - HKLM\..\Run: [2167450.exe] "C:\Windows\Temp\2167450.exe"
O4 - HKLM\..\Run: [l1rezerv.exe] "C:\Windows\l1rezerv.exe"
O4 - HKLM\..\Run: [9000240.exe] "C:\Windows\Temp\9000240.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Lama007\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [ICQ] "C:\Program Files (x86)\ICQ7.5\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files (x86)\BitTorrent\BitTorrent.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: ddservice - Unknown owner - C:\Windows\update.7.1\svchostdriver.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: ICQ Service - Unknown owner - C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: srvbtcclient - Unknown owner - C:\Windows\update.5.0\svchost.exe
O23 - Service: srviecheck - Unknown owner - C:\Windows\update.2\svchost.exe
O23 - Service: srvsysdriver32 - Unknown owner - C:\Windows\sysdriver32.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: wxpdrivers - Unknown owner - C:\Windows\update.1\svchost.exe

--
End of file - 8565 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2745775999-3844643945-3293349407-1001Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2745775999-3844643945-3293349407-1001UA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Lama007\AppData\Roaming\Mozilla\Firefox\Profiles\51ardstb.default

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@garmin.com/GpsControl]
"Description"=Garmin GPS Control for Firefox
"Path"=C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0]
"Description"=
"Path"=c:\Program Files (x86)\Sony\Media Go\npmediago.dll

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-05-16 1164680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-07-31 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll [2010-11-21 1054520]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll [2011-04-21 1000768]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2010-03-17 421888]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2011-04-08 254696]
"wxpdrv"=C:\Windows\update.1\svchost.exe [2011-08-20 1216000]
"1735126.exe"=C:\Users\Lama007\AppData\Local\Temp\1735126.exe [2011-08-20 258048]
"sysdriver32.exe"=C:\Windows\sysdriver32.exe [2011-08-20 258048]
"sysdriver32_.exe"=C:\Windows\sysdriver32_.exe [2011-08-20 258048]
"7904555.exe"=C:\Users\Lama007\AppData\Local\Temp\7904555.exe [2011-08-20 258048]
"6476207.exe"=C:\Windows\Temp\6476207.exe [2011-08-20 258048]
"41426550-loader2.exe"=C:\Windows\Temp\41426550-loader2.exe [2011-08-20 258048]
"2167450.exe"=C:\Windows\Temp\2167450.exe [2011-08-20 258048]
"l1rezerv.exe"=C:\Windows\l1rezerv.exe [2011-08-20 232960]
"9000240.exe"=C:\Windows\Temp\9000240.exe [2011-08-21 634880]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\Lama007\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-12 136176]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1475072]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2011-06-15 15141768]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]
"ICQ"=C:\Program Files (x86)\ICQ7.5\ICQ.exe [2011-08-01 124480]
"BitTorrent"=C:\Program Files (x86)\BitTorrent\BitTorrent.exe [2011-08-18 402808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\wxpdrivers]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableSecureUIAPaths"=0
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\SysWOW64\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.FMVC"=fmcodec.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2011-08-21 22:58:54 ----D---- C:\Program Files (x86)\trend micro
2011-08-21 22:58:37 ----D---- C:\rsit
2011-08-21 10:18:42 ----D---- C:\Program Files (x86)\Mozilla Firefox
2011-08-20 22:49:42 ----D---- C:\Windows\ufa
2011-08-20 22:49:42 ----D---- C:\Windows\rpcminer
2011-08-20 22:49:42 ----D---- C:\Windows\phoenix
2011-08-20 22:49:34 ----A---- C:\Windows\l1rezerv.exe
2011-08-20 22:47:28 ----A---- C:\Windows\btc_client_iplist.txt
2011-08-20 22:46:31 ----A---- C:\Windows\iecheck_iplist.txt
2011-08-20 22:46:18 ----HD---- C:\Windows\update.5.0
2011-08-20 22:45:55 ----HD---- C:\Windows\update.2
2011-08-20 22:45:41 ----HD---- C:\Windows\update.7.1
2011-08-20 22:44:25 ----A---- C:\Windows\unrar.exe
2011-08-20 22:41:53 ----A---- C:\Windows\iplist.txt
2011-08-20 22:41:07 ----A---- C:\Windows\sysdriver32_.exe
2011-08-20 22:40:53 ----A---- C:\Windows\sysdriver32.exe
2011-08-20 22:40:38 ----A---- C:\Windows\front_ip_list.txt
2011-08-20 22:40:22 ----A---- C:\Windows\services32.exe
2011-08-20 22:40:19 ----HD---- C:\Windows\update.1
2011-08-18 10:20:47 ----D---- C:\Program Files (x86)\BitTorrent
2011-08-18 10:20:09 ----D---- C:\Users\Lama007\AppData\Roaming\BitTorrent
2011-08-16 22:14:35 ----D---- C:\Program Files (x86)\DsNET Corp
2011-08-15 00:09:36 ----D---- C:\ProgramData\GARMIN
2011-08-15 00:04:39 ----D---- C:\Users\Lama007\AppData\Roaming\GARMIN
2011-08-15 00:03:41 ----D---- C:\Program Files (x86)\Garmin GPS Plugin
2011-08-15 00:03:31 ----D---- C:\Program Files (x86)\Garmin
2011-08-10 10:37:13 ----A---- C:\Windows\SysWOW64\xmllite.dll
2011-08-10 10:37:01 ----A---- C:\Windows\SysWOW64\odbctrac.dll
2011-08-10 10:37:01 ----A---- C:\Windows\SysWOW64\odbcjt32.dll
2011-08-10 10:37:01 ----A---- C:\Windows\SysWOW64\odbccu32.dll
2011-08-10 10:37:01 ----A---- C:\Windows\SysWOW64\odbccr32.dll
2011-08-10 10:37:01 ----A---- C:\Windows\SysWOW64\odbccp32.dll
2011-08-10 10:35:07 ----A---- C:\Windows\SysWOW64\setup16.exe
2011-08-10 10:35:06 ----A---- C:\Windows\SysWOW64\ntvdm64.dll
2011-08-10 10:35:05 ----A---- C:\Windows\SysWOW64\wow32.dll
2011-08-10 10:35:05 ----A---- C:\Windows\SysWOW64\KernelBase.dll
2011-08-10 10:35:05 ----A---- C:\Windows\SysWOW64\kernel32.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2011-08-10 10:35:04 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2011-08-10 10:35:03 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2011-08-10 10:35:03 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2011-08-10 10:35:02 ----AH---- C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2011-08-10 10:35:02 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2011-08-10 10:35:02 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2011-08-10 10:35:01 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2011-08-10 10:35:01 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2011-08-10 10:35:00 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2011-08-10 10:35:00 ----AH---- C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2011-08-10 10:34:59 ----A---- C:\Windows\SysWOW64\user.exe
2011-08-10 10:34:59 ----A---- C:\Windows\SysWOW64\instnm.exe
2011-08-10 10:34:25 ----A---- C:\Windows\SysWOW64\iertutil.dll
2011-08-10 10:34:21 ----A---- C:\Windows\SysWOW64\ieframe.dll
2011-08-10 10:34:19 ----A---- C:\Windows\SysWOW64\mshtml.dll
2011-08-10 10:34:15 ----A---- C:\Windows\SysWOW64\urlmon.dll
2011-08-10 10:34:10 ----A---- C:\Windows\SysWOW64\wininet.dll
2011-08-10 10:34:10 ----A---- C:\Windows\SysWOW64\msfeeds.dll
2011-08-10 10:34:09 ----A---- C:\Windows\SysWOW64\iedkcs32.dll
2011-08-10 10:34:08 ----A---- C:\Windows\SysWOW64\msfeedsbs.dll
2011-08-10 10:34:07 ----A---- C:\Windows\SysWOW64\mstime.dll
2011-08-10 10:34:06 ----A---- C:\Windows\SysWOW64\url.dll
2011-08-10 10:34:06 ----A---- C:\Windows\SysWOW64\mshtmled.dll
2011-08-10 10:34:06 ----A---- C:\Windows\SysWOW64\ieui.dll
2011-08-10 10:34:06 ----A---- C:\Windows\SysWOW64\iepeers.dll
2011-08-10 10:34:05 ----A---- C:\Windows\SysWOW64\licmgr10.dll
2011-08-10 10:34:05 ----A---- C:\Windows\SysWOW64\jsproxy.dll
2011-08-10 10:34:04 ----A---- C:\Windows\SysWOW64\msfeedssync.exe
2011-08-10 10:33:46 ----A---- C:\Windows\SysWOW64\ntkrnlpa.exe
2011-08-10 10:33:43 ----A---- C:\Windows\SysWOW64\ntoskrnl.exe
2011-07-31 20:59:26 ----D---- C:\9e658e08d37da0ed3cba5a41c9ec40
2011-07-31 20:22:39 ----D---- C:\Program Files (x86)\DAEMON Tools Toolbar
2011-07-31 20:22:04 ----D---- C:\Program Files (x86)\DAEMON Tools Lite
2011-07-31 20:21:52 ----D---- C:\Users\Lama007\AppData\Roaming\DAEMON Tools Lite
2011-07-31 20:21:52 ----D---- C:\ProgramData\DAEMON Tools Lite
2011-07-31 20:20:36 ----D---- C:\ubuntu
2011-07-31 19:53:30 ----D---- C:\Windows\SysWOW64\Wat
2011-07-31 17:21:54 ----A---- C:\Windows\SysWOW64\wcncsvc.dll
2011-07-31 17:09:53 ----A---- C:\Windows\SysWOW64\msv1_0.dll
2011-07-31 16:59:10 ----A---- C:\Windows\SysWOW64\PresentationHostProxy.dll
2011-07-31 16:59:10 ----A---- C:\Windows\SysWOW64\PresentationHost.exe
2011-07-31 16:59:10 ----A---- C:\Windows\SysWOW64\netfxperf.dll
2011-07-31 16:59:10 ----A---- C:\Windows\SysWOW64\mscoree.dll
2011-07-31 16:59:10 ----A---- C:\Windows\SysWOW64\dfshim.dll
2011-07-31 16:31:24 ----D---- C:\ProgramData\Sun
2011-07-31 16:31:22 ----D---- C:\Program Files (x86)\Common Files\Java
2011-07-31 16:30:27 ----A---- C:\Windows\SysWOW64\javaws.exe
2011-07-31 16:30:27 ----A---- C:\Windows\SysWOW64\deployJava1.dll
2011-07-31 16:30:26 ----A---- C:\Windows\SysWOW64\javaw.exe
2011-07-31 16:30:26 ----A---- C:\Windows\SysWOW64\java.exe
2011-07-31 16:29:38 ----D---- C:\Program Files (x86)\Java
2011-07-31 16:22:13 ----D---- C:\Users\Lama007\AppData\Roaming\.minecraft
2011-07-31 16:22:13 ----A---- C:\Users\Lama007\AppData\Roaming\Uninstal.exe
2011-07-31 16:20:52 ----D---- C:\Users\Lama007\AppData\Roaming\WinRAR
2011-07-31 16:20:15 ----D---- C:\Program Files (x86)\WinRAR
2011-07-31 15:52:53 ----A---- C:\Windows\SysWOW64\esent.dll
2011-07-31 15:52:52 ----A---- C:\Windows\SysWOW64\fsutil.exe
2011-07-30 18:06:44 ----A---- C:\Windows\SysWOW64\d2d1.dll
2011-07-30 18:06:43 ----A---- C:\Windows\SysWOW64\DWrite.dll
2011-07-29 09:58:13 ----A---- C:\Windows\SysWOW64\PnkBstrB.exe
2011-07-29 09:58:00 ----A---- C:\Windows\SysWOW64\PnkBstrA.exe
2011-07-29 09:44:12 ----D---- C:\Program Files (x86)\EA Games
2011-07-29 09:43:58 ----AH---- C:\ProgramData\ezsidmv.dat
2011-07-29 09:43:40 ----D---- C:\Users\Lama007\AppData\Roaming\skypePM
2011-07-29 09:43:31 ----D---- C:\ProgramData\Skype Extras
2011-07-29 09:41:24 ----D---- C:\Users\Lama007\AppData\Roaming\Skype
2011-07-29 09:39:42 ----RD---- C:\Program Files (x86)\Skype
2011-07-29 09:38:59 ----D---- C:\ProgramData\Skype

======List of files/folders modified in the last 1 month======

2011-08-21 22:59:10 ----D---- C:\Windows\Prefetch
2011-08-21 22:58:54 ----RD---- C:\Program Files (x86)
2011-08-21 22:58:32 ----D---- C:\Windows\Temp
2011-08-21 22:50:25 ----SHD---- C:\System Volume Information
2011-08-21 21:28:35 ----D---- C:\Users\Lama007\AppData\Roaming\ICQ
2011-08-21 10:20:36 ----D---- C:\Users\Lama007\AppData\Roaming\Mozilla
2011-08-20 22:49:42 ----D---- C:\Windows
2011-08-18 09:21:00 ----D---- C:\Windows\System32
2011-08-18 09:20:59 ----D---- C:\Windows\inf
2011-08-16 22:15:27 ----D---- C:\Windows\SysWOW64
2011-08-15 00:10:12 ----SHD---- C:\Windows\Installer
2011-08-15 00:10:05 ----D---- C:\Windows\winsxs
2011-08-15 00:09:36 ----HD---- C:\ProgramData
2011-08-15 00:03:38 ----RD---- C:\Program Files
2011-08-14 20:24:55 ----D---- C:\Windows\rescache
2011-08-14 01:57:50 ----D---- C:\Program Files (x86)\Windows Media Player
2011-08-14 01:57:49 ----D---- C:\Windows\SysWOW64\winrm
2011-08-14 01:57:49 ----D---- C:\Windows\SysWOW64\slmgr
2011-08-14 01:57:49 ----D---- C:\Windows\SysWOW64\en-US
2011-08-14 01:57:49 ----D---- C:\Windows\SysWOW64\en
2011-08-14 01:57:49 ----D---- C:\Windows\SysWOW64\drivers\en-US
2011-08-14 01:57:49 ----D---- C:\Windows\SysWOW64\drivers
2011-08-14 01:57:49 ----D---- C:\Windows\servicing
2011-08-14 01:57:49 ----D---- C:\Windows\ehome
2011-08-14 01:57:49 ----D---- C:\Program Files (x86)\Windows Defender
2011-08-14 01:57:49 ----D---- C:\Program Files (x86)\Common Files\System
2011-08-14 01:57:43 ----D---- C:\Windows\SysWOW64\sl-SI
2011-08-14 01:57:40 ----D---- C:\Windows\SysWOW64\wbem
2011-08-14 01:57:40 ----D---- C:\Windows\SysWOW64\Printing_Admin_Scripts
2011-08-14 01:57:40 ----D---- C:\Windows\SysWOW64\DriverStore
2011-08-14 01:57:40 ----D---- C:\Windows\SysWOW64\Dism
2011-08-14 01:57:39 ----D---- C:\Windows\en-US
2011-08-13 19:16:00 ----D---- C:\Windows\SysWOW64\WCN
2011-08-13 19:15:56 ----D---- C:\Windows\PolicyDefinitions
2011-08-13 19:13:50 ----D---- C:\Program Files (x86)\Windows Sidebar
2011-08-13 19:13:50 ----D---- C:\Program Files (x86)\Windows Photo Viewer
2011-08-13 19:13:50 ----D---- C:\Program Files (x86)\Windows Mail
2011-08-13 19:13:50 ----D---- C:\Program Files (x86)\Internet Explorer
2011-08-13 19:13:49 ----D---- C:\Windows\SysWOW64\sk-SK
2011-08-13 19:13:49 ----D---- C:\Windows\SysWOW64\migwiz
2011-08-12 21:18:40 ----D---- C:\Program Files (x86)\ICQ7.5
2011-08-12 09:44:56 ----D---- C:\Windows\Microsoft.NET
2011-08-12 09:44:30 ----RSD---- C:\Windows\assembly
2011-08-10 21:06:29 ----D---- C:\Windows\AppPatch
2011-08-10 21:06:28 ----D---- C:\Windows\SysWOW64\migration
2011-07-31 19:53:49 ----D---- C:\Windows\SysWOW64\cs-CZ
2011-07-31 19:53:41 ----RSD---- C:\Windows\Fonts
2011-07-31 16:31:22 ----D---- C:\Program Files (x86)\Common Files
2011-07-31 15:38:08 ----D---- C:\Windows\SysWOW64\ro-RO
2011-07-31 15:37:50 ----D---- C:\Windows\SysWOW64\lv-LV
2011-07-31 15:37:31 ----D---- C:\Windows\SysWOW64\lt-LT
2011-07-31 15:37:10 ----D---- C:\Windows\SysWOW64\hr-HR
2011-07-31 15:36:46 ----D---- C:\Windows\SysWOW64\et-EE
2011-07-31 15:36:21 ----D---- C:\Windows\SysWOW64\bg-BG
2011-07-31 15:35:09 ----D---- C:\Windows\Speech
2011-07-31 01:19:58 ----D---- C:\Windows\Logs

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys []
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys []
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys []
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys []
R3 athr;Atheros – ovladač pro zařízení pro rozšiřitelnou bezdrátovou síť LAN; C:\Windows\system32\DRIVERS\athrx.sys []
R3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver; C:\Windows\system32\DRIVERS\Rtnic64.sys []
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys []
R3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL6.SYS []
R3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV6.SYS []
R3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT6.SYS []
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys []
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys []
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys []
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys []
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys []
S3 WinUSB;Sony Ericsson USB Device sa0101 Driver; C:\Windows\system32\DRIVERS\WinUSB.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ddservice;ddservice; C:\Windows\update.7.1\svchostdriver.exe [2011-08-20 382464]
R2 ICQ Service;ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [2010-11-21 247608]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2011-07-29 75136]
R2 PnkBstrB;PnkBstrB; C:\Windows\system32\PnkBstrB.exe [2011-07-30 189248]
R2 srvbtcclient;srvbtcclient; C:\Windows\update.5.0\svchost.exe [2011-08-21 355840]
R2 srviecheck;srviecheck; C:\Windows\update.2\svchost.exe [2011-08-21 634880]
R2 srvsysdriver32;srvsysdriver32; C:\Windows\sysdriver32.exe [2011-08-20 258048]
R2 wxpdrivers;wxpdrivers; C:\Windows\update.1\svchost.exe [2011-08-20 1216000]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe []

-----------------EOF-----------------

Zdravím, chvilku strpení a jdeme na ně

Tohle fixni v HJT :

R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [wxpdrv] C:\Windows\update.1\svchost.exe
O4 - HKLM\..\Run: [1735126.exe] "C:\Users\Lama007\AppData\Local\Temp\1735126.exe"
O4 - HKLM\..\Run: [sysdriver32.exe] "C:\Windows\sysdriver32.exe" rezerv
O4 - HKLM\..\Run: [sysdriver32_.exe] "C:\Windows\sysdriver32_.exe" rezerv
O4 - HKLM\..\Run: [7904555.exe] "C:\Users\Lama007\AppData\Local\Temp\7904555.exe"
O4 - HKLM\..\Run: [6476207.exe] "C:\Windows\Temp\6476207.exe"
O4 - HKLM\..\Run: [41426550-loader2.exe] "C:\Windows\Temp\41426550-loader2.exe"
O4 - HKLM\..\Run: [2167450.exe] "C:\Windows\Temp\2167450.exe"
O4 - HKLM\..\Run: [l1rezerv.exe] "C:\Windows\l1rezerv.exe"
O4 - HKLM\..\Run: [9000240.exe] "C:\Windows\Temp\9000240.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Lama007\AppData\Local\Google\Update\GoogleUpdate.exe" /c

HJT najdeš zde :

C:\Program Files (x86)\trend micro\Lama007.exe

Fix znamená že spustíš HJT jako admin

v okně které se ti otevře klikneš na Do a system scan only

v dalším okně najdeš řádky které jsem ti vypsal,

vedle nich je čtvereček do kterého uděláš zatržítko,

pak klikneš na Fix checked které je vlevo dole,

program se ti zeptá zda opravdu ANO s tím samozřejmě souhlasíš a je hotovo.


Přes Start >> Všechny programy >> Příslušenství >> Spustit >> napiš - services.msc >> Enter. Najdi službu :

ddservice

ICQ Service

srvbtcclient

srviecheck

srvsysdriver32

wxpdrivers

klikni na ni pravým myšítkem, zvol vlastnosti, na další kartě nejprve službu zastav tlačítkem Zastavit a u položky Typ spouštění zvol Zakázáno.


Přes Odebrat programy odinstaluj ICQ6Toolbar


Pak použij Mbam z mého podpisu a dej mi sem z něj log, předem nic nemazat !!!

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Verze databáze: 7529

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

21.8.2011 23:53:58
mbam-log-2011-08-21 (23-53-22).txt

Typ kontroly: Rychlý test
Testované objekty: 171308
Uplynulý čas: 18 minut, 42 sekund

Infikované procesy v paměti: 2
Infikované moduly v paměti: 0
Infikované klíče v registru: 9
Infikované hodnoty v registru: 2
Infikované datové položky v registru: 3
Infikované složky: 1
Infikované soubory: 41

Infikované procesy v paměti:
c:\Windows\update.2\svchost.exe (Backdoor.Agent) -> 2944 -> No action taken.
c:\Windows\update.5.0\svchost.exe (Trojan.Downloader) -> 1860 -> No action taken.

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvsysdriver32 (Trojan.Delf) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srviecheck (Backdoor.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvbtcclient (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpdrivers (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\sysdriver32.exe (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\systeminfog (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\SERVICES32.EXE (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wxpdrivers (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\wxpdrivers (Trojan.Agent) -> No action taken.

Infikované hodnoty v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Services32.exe\close (Trojan.Agent) -> Value: close -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpDrivers\ImagePath (Trojan.Agent) -> Value: ImagePath -> No action taken.

Infikované datové položky v registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infikované složky:
c:\Windows\rpcminer (Trojan.BCMiner) -> No action taken.

Infikované soubory:
c:\Windows\Temp\1377973.exe (Trojan.Agent.H) -> No action taken.
c:\Windows\Temp\183071.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\20544442.exe (Trojan.Downloader) -> No action taken.
c:\Windows\Temp\2500965.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\93561_myunrar2.exe (Trojan.Dropper) -> No action taken.
c:\Users\Lama007\AppData\Local\Temp\1735126.exe (Trojan.Agent) -> No action taken.
c:\Users\Lama007\AppData\Local\Temp\7904555.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\2167450.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\3809646.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\4388244.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\4698116.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\5526730.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\5924820.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\6476207.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\7339337.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\8428382.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\9000240.exe (Trojan.Agent) -> No action taken.
c:\Windows\Temp\41426550-loader2.exe (Trojan.Agent) -> No action taken.
c:\Users\Public\Desktop\mp3 downloader.lnk (Rogue.Link) -> No action taken.
c:\Windows\Temp\319523884.exe (Trojan.FakeAlert.Gen) -> No action taken.
c:\Windows\l1rezerv.exe (Trojan.Agent) -> No action taken.
c:\Windows\sysdriver32.exe (Trojan.Delf) -> No action taken.
c:\Windows\sysdriver32_.exe (Trojan.Delf) -> No action taken.
c:\Windows\update.2\svchost.exe (Backdoor.Agent) -> No action taken.
c:\Windows\update.5.0\svchost.exe (Trojan.Downloader) -> No action taken.
c:\Windows\update.1\svchost.exe (Trojan.Agent) -> No action taken.
c:\Windows\services32.exe (Trojan.Agent) -> No action taken.
c:\Windows\rpcminer\bitcoinmineropencl.cl (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\bitcoinminercuda_10.cubin (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\bitcoinminercuda_11.cubin (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\bitcoinminercuda_20.cubin (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\cudart32_32_16.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\curllib.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\libeay32.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\libsasl.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\openldap.dll (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-4way.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-cpu.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-cuda.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\rpcminer-opencl.exe (Trojan.BCMiner) -> No action taken.
c:\Windows\rpcminer\ssleay32.dll (Trojan.BCMiner) -> No action taken.

Vše co Mbam našel nech smazat.


Nyní použijeme větší kalibr tak že pozorně čti, protože tenhle softík netoleruje chyby.

Stáhni a ulož na plochu ComboFix,

spusť aplikaci jako Administrátor a povol instalaci Konzole pro zotavení - Recovery Console.

Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,

pak ještě jednou klik na ANO a už to jede.

Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.

Při skenovaní může být PC i restartováno nelekat se.

Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,

protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.

Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na C:/Combofix.txt

(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.


V případě nejasností je ZDE obrázkový návod.