Nejde mi příkaz PING

[blai]

Ahoj.

V PC se moc nevyznám, ale včera jsem našel škodlivý ping.exe, který mi vytěžoval pc.
Povedlo se mi ho ručně odstranit, a vysypat v koši, ale teď mi v příkazové řádce nejde příkaz ping.Jde to nějak opravit?

Moc vám děkuji za všechny rady

[vyosek]

Zdravim

jak vite ze ten ping.exe byl skodlivy

Dejte prosim log z RSIT http://www.viry.cz/forum/viewtopic.php?f=13&t=105895

[blai]

Zdravim

jak vite ze ten ping.exe byl skodlivy

Dejte prosim log z RSIT http://www.viry.cz/forum/viewtopic.php?f=13&t=105895

Otec ho má též na počítači a maximálně mu vytěžuje program.Problém je, že si stím nevědí rady ani na AVG podpoře...

ps: log se mi ještě nenačetl.Zamrzlo to u konce. :/

[blai]

Pardon.

Už to mám :

Logfile of random's system information tool 1.09 (written by random/random)
Run by ondra at 2012-02-08 14:51:20
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 32 GB (45%) free of 71 GB
Total RAM: 2046 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:51:33, on 8.2.2012
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.19088)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\ehome\ehmsas.exe
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\system32\conime.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\PROGRA~1\SEARCH~1\Datamngr\DATAMN~1.EXE
C:\Windows\system32\rundll32.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\ondra\Downloads\RSIT.exe
C:\Program Files\trend micro\ondra.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchcore.net/426
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://cs.intl.acer.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - *{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - *{855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: MyPlayCity Toolbar - {4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac} - C:\Program Files\MyPlayCity\tbMyPl.dll
O2 - BHO: DataMngr - {7DA17D5A-5718-4130-A605-FC316C827836} - C:\PROGRA~1\SEARCH~1\Datamngr\BROWSE~1.DLL
O2 - BHO: Searchcore Toolbar - {af6ac4f2-9825-4fb6-a600-92bc5361f209} - C:\PROGRA~1\SEARCH~1\Datamngr\ToolBar\searchcoredtx.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (file missing)
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: MyPlayCity Toolbar - {4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac} - C:\Program Files\MyPlayCity\tbMyPl.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: Searchcore Toolbar - {af6ac4f2-9825-4fb6-a600-92bc5361f209} - C:\PROGRA~1\SEARCH~1\Datamngr\ToolBar\searchcoredtx.dll
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~1\SEARCH~1\Datamngr\DATAMN~1.EXE
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ICQ] "C:\Users\ondra\Desktop\ICQ6.5\ICQ.exe" silent
O4 - HKCU\..\RunOnce: [!SearchcoreDSCR] C:\Windows\system32\RUNDLL32.EXE C:\Users\ondra\AppData\Local\Temp\SRASSE~1.DLL,_SetChromeAssets http://dts.search-results.com/sr?src=cr ... ms},Search Results,r,
O4 - HKCU\..\RunOnce: [!SearchcoreCRHP] C:\Windows\system32\RUNDLL32.EXE C:\Users\ondra\AppData\Local\Temp\INSTAL~1.DLL,_SetChromeHP http://www.searchcore.net/426,
O4 - HKUS\S-1-5-18\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'Default user')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
O9 - Extra button: (no name) - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallBrain Updater Service (InstallBrainService) - Unknown owner - C:\Program Files\InstallBrainService\InstallBrainService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9669 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\PC Performer_DEFAULT.job
C:\Windows\tasks\PC Performer_UPDATES.job
C:\Windows\tasks\User_Feed_Synchronization-{AA07CD0E-5B9A-485F-AE2D-12EF9BED0280}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055FD26D-3A88-4e15-963D-DC8493744B1D}]
XTTBPos00 Class - C:\PROGRA~1\ICQTOO~1\toolbaru.dll [2006-12-25 701952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}]
MyPlayCity Toolbar - C:\Program Files\MyPlayCity\tbMyPl.dll [2008-03-04 1470488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DA17D5A-5718-4130-A605-FC316C827836}]
DataMngr - C:\PROGRA~1\SEARCH~1\Datamngr\BROWSE~1.DLL [2011-12-22 101272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{af6ac4f2-9825-4fb6-a600-92bc5361f209}]
Searchcore Toolbar - C:\PROGRA~1\SEARCH~1\Datamngr\ToolBar\searchcoredtx.dll [2011-12-22 87488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2010-05-26 1385864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\Windows\system32\eDStoolbar.dll [2007-04-25 151552]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Ask Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2010-05-26 1385864]
{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac} - MyPlayCity Toolbar - C:\Program Files\MyPlayCity\tbMyPl.dll [2008-03-04 1470488]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-11-21 1054520]
{af6ac4f2-9825-4fb6-a600-92bc5361f209} - Searchcore Toolbar - C:\PROGRA~1\SEARCH~1\Datamngr\ToolBar\searchcoredtx.dll [2011-12-22 87488]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"eDataSecurity Loader"=C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [2007-04-25 457216]
"eAudio"=C:\Acer\Empowering Technology\eAudio\eAudio.exe [2007-06-11 1286144]
"LManager"=C:\PROGRA~1\LAUNCH~1\LManager.exe [2007-06-27 752136]
"PlayMovie"=C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe [2007-05-03 206952]
"WarReg_PopUp"=C:\Acer\WR_PopUp\WarReg_PopUp.exe [2006-11-05 57344]
"Apoint"=C:\Program Files\Apoint2K\Apoint.exe [2007-06-06 159744]
"Acer Tour Reminder"=C:\Acer\AcerTour\Reminder.exe [2007-05-22 151552]
"Symantec PIF AlertEng"=C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
"NvSvc"=C:\Windows\system32\nvsvc.dll [2007-06-06 86016]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2007-06-06 8433664]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2007-06-06 81920]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]
"DATAMNGR"=C:\PROGRA~1\SEARCH~1\Datamngr\DATAMN~1.EXE [2011-12-22 1693120]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"ICQ"=C:\Users\ondra\Desktop\ICQ6.5\ICQ.exe silent []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"!SearchcoreDSCR"=C:\Users\ondra\AppData\Local\Temp\SRASSE~1.DLL [2011-08-25 1085952]
"!SearchcoreCRHP"=C:\Users\ondra\AppData\Local\Temp\INSTAL~1.DLL [2011-11-27 1508352]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe

C:\Users\ondra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\PROGRA~1\SEARCH~1\Datamngr\datamngr.dll C:\PROGRA~1\SEARCH~1\Datamngr\IEBHO.dll "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\78443707.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\95726315.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\78443707.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\95726315.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"msacm.mkdmp3enc"=C:\PROGRA~1\ACERAR~1\DVWIZA~1\Kernel\Burner\MKDMP3Enc.ACM
"MSVideo8"=VfWWDM32.dll
"VIDC.FFDS"=ff_vfw.dll
"vidc.XVID"=xvidvfw.dll
"msacm.ac3filter"=ac3filter.acm
"msacm.avis"=ff_acm.acm
"vidc.DIVX"=DivX.dll
"vidc.yv12"=DivX.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2012-02-08 14:51:20 ----D---- C:\rsit
2012-02-08 14:51:20 ----D---- C:\Program Files\trend micro
2012-02-08 14:20:42 ----D---- C:\Program Files\Searchcore Toolbar
2012-02-08 14:20:26 ----D---- C:\Users\ondra\AppData\Roaming\PerformerSoft
2012-02-08 14:20:08 ----A---- C:\Windows\system32\roboot.exe
2012-02-08 14:19:59 ----D---- C:\Program Files\PC Performer
2012-02-08 14:19:33 ----D---- C:\Program Files\InstallBrainService
2012-02-08 12:45:35 ----D---- C:\Program Files\GetData
2012-02-08 03:12:00 ----SD---- C:\ComboFix
2012-02-08 02:51:49 ----A---- C:\TDSSKiller.2.7.10.0_08.02.2012_02.51.49_log.txt
2012-02-08 02:14:08 ----A---- C:\TDSSKiller.2.7.10.0_08.02.2012_02.14.08_log.txt
2012-02-08 01:49:03 ----A---- C:\TDSSKiller.2.7.10.0_08.02.2012_01.49.03_log.txt
2012-02-08 01:35:40 ----D---- C:\TDSSKiller_Quarantine
2012-02-08 01:34:03 ----A---- C:\TDSSKiller.2.7.10.0_08.02.2012_01.34.03_log.txt
2012-02-07 22:56:01 ----D---- C:\Windows\temp
2012-02-07 22:47:58 ----SHD---- C:\$RECYCLE.BIN
2012-02-07 22:06:34 ----A---- C:\Windows\zip.exe
2012-02-07 22:06:34 ----A---- C:\Windows\SWSC.exe
2012-02-07 22:06:34 ----A---- C:\Windows\SWREG.exe
2012-02-07 22:06:34 ----A---- C:\Windows\sed.exe
2012-02-07 22:06:34 ----A---- C:\Windows\PEV.exe
2012-02-07 22:06:34 ----A---- C:\Windows\NIRCMD.exe
2012-02-07 22:06:34 ----A---- C:\Windows\MBR.exe
2012-02-07 22:06:34 ----A---- C:\Windows\grep.exe
2012-02-07 22:06:14 ----D---- C:\Windows\ERDNT
2012-02-07 22:06:05 ----D---- C:\Qoobox
2012-02-07 15:55:30 ----A---- C:\Windows\system32\www.zpovednice.txt
2012-02-07 15:54:47 ----A---- C:\Windows\system32\zpovednice.txt
2012-02-05 23:07:18 ----D---- C:\Program Files\CCleaner
2012-02-05 16:45:13 ----D---- C:\Python27
2012-01-30 18:53:17 ----D---- C:\ProgramData\Sun
2012-01-30 18:51:12 ----A---- C:\Windows\system32\deployJava1.dll
2012-01-30 15:46:57 ----D---- C:\winnt
2012-01-30 15:46:57 ----D---- C:\phptriad
2012-01-30 15:45:49 ----D---- C:\apache
2012-01-29 00:20:12 ----D---- C:\Users\ondra\AppData\Roaming\TrojanHunter
2012-01-28 22:29:20 ----R---- C:\Windows\system32\streamhlp.dll
2012-01-28 11:59:21 ----D---- C:\Windows\system32\ondra
2012-01-27 15:59:54 ----D---- C:\Dev-Cpp

======List of files/folders modified in the last 1 month======

2012-02-08 14:51:20 ----RD---- C:\Program Files
2012-02-08 14:29:00 ----SHD---- C:\System Volume Information
2012-02-08 14:21:15 ----D---- C:\ProgramData
2012-02-08 14:20:56 ----D---- C:\Windows\Tasks
2012-02-08 14:20:56 ----D---- C:\Windows\system32\Tasks
2012-02-08 14:20:08 ----D---- C:\Windows\System32
2012-02-08 12:33:23 ----D---- C:\Windows\inf
2012-02-08 12:33:23 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-02-08 12:22:20 ----SHD---- C:\Windows\Installer
2012-02-08 11:51:04 ----D---- C:\Windows
2012-02-08 03:32:34 ----D---- C:\Windows\system32\drivers
2012-02-08 03:32:33 ----D---- C:\Windows\AppPatch
2012-02-08 03:32:24 ----D---- C:\Program Files\Common Files
2012-02-08 03:30:27 ----D---- C:\Users\ondra\AppData\Roaming\ICQ
2012-02-08 03:15:15 ----D---- C:\Program Files\Microsoft Office
2012-02-08 02:41:48 ----SD---- C:\ProgramData\Microsoft
2012-02-08 01:59:01 ----D---- C:\Windows\SoftwareDistribution
2012-02-08 01:58:45 ----D---- C:\Users\ondra\AppData\Roaming\uTorrent
2012-02-07 22:39:41 ----A---- C:\Windows\system.ini
2012-02-07 22:39:11 ----D---- C:\Windows\system32\drivers\etc
2012-02-07 12:23:38 ----D---- C:\Windows\system32\catroot2
2012-02-06 01:00:03 ----D---- C:\ProgramData\Microsoft Help
2012-02-06 01:00:00 ----D---- C:\Windows\ShellNew
2012-02-06 00:57:50 ----D---- C:\Program Files\Common Files\microsoft shared
2012-02-05 23:17:22 ----D---- C:\Users\ondra\AppData\Roaming\Media Player Classic
2012-02-05 23:16:31 ----D---- C:\Windows\Panther
2012-02-05 23:16:28 ----D---- C:\Windows\Debug
2012-02-05 17:15:50 ----D---- C:\Windows\winsxs
2012-02-04 16:31:38 ----HD---- C:\Program Files\InstallShield Installation Information
2012-02-01 18:11:59 ----RSD---- C:\Windows\assembly
2012-02-01 18:11:59 ----D---- C:\Windows\Microsoft.NET
2012-01-31 11:33:20 ----D---- C:\Windows\Prefetch
2012-01-30 21:05:27 ----D---- C:\Windows\Logs
2012-01-30 20:51:48 ----D---- C:\Program Files\Google
2012-01-30 20:51:21 ----D---- C:\Program Files\Common Files\PX Storage Engine
2012-01-30 19:12:13 ----D---- C:\Windows\Minidump
2012-01-27 00:21:24 ----N---- C:\Windows\system32\MpSigStub.exe
2012-01-12 09:02:19 ----A---- C:\Windows\system32\mrt.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PSDFilter;PSDFilter; C:\Windows\system32\DRIVERS\psdfilter.sys [2007-04-25 20776]
R0 PSDNServ;PSDNSERVER; C:\Windows\system32\drivers\PSDNServ.sys [2007-04-25 16680]
R0 psdvdisk;psdvdisk; C:\Windows\system32\drivers\psdvdisk.sys [2007-04-25 60712]
R0 PxHelp20;PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [2008-11-20 43872]
R1 DritekPortIO;Dritek General Port I/O; \??\C:\PROGRA~1\LAUNCH~1\DPortIO.sys [2006-11-02 20112]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; \??\C:\Program Files\Acer Arcade Deluxe\Play Movie\000.fcl [2006-11-02 13560]
R2 int15;int15; \??\C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 76584]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2007-05-17 12672]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2007-02-24 39936]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-01-23 42496]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-03-21 37376]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-05-17 8192]
R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\Windows\system32\DRIVERS\Apfiltr.sys [2007-06-14 154624]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2007-05-30 735232]
R3 Cam5607;Acer Crystal Eye webcam; C:\Windows\System32\Drivers\BisonC07.sys [2007-05-28 767664]
R3 DKbFltr;Dritek Keyboard Filter Driver; C:\Windows\system32\DRIVERS\DKbFltr.sys [2006-11-02 21264]
R3 enecir;ENE CIR Receiver; C:\Windows\system32\DRIVERS\enecir.sys [2007-05-16 32256]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-05-17 985600]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-05-17 207360]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2011-10-18 3546664]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2007-05-17 1059112]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2007-06-06 7120768]
R3 nvsmu;nvsmu; C:\Windows\system32\DRIVERS\nvsmu.sys [2007-05-17 12032]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-01-19 88576]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-05-17 659968]
S0 78443707;78443707; C:\Windows\system32\drivers\57764368.sys []
S0 95726315;95726315; C:\Windows\system32\drivers\83472297.sys []
S0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys []
S3 catchme;catchme; \??\C:\Users\ondra\AppData\Local\Temp\catchme.sys []
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys []
S3 WSVD;WSVD; \??\C:\Windows\system32\drivers\WSVD.sys [2006-09-19 80744]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S4 UIUSys;Conexant Setup API; C:\Windows\system32\DRIVERS\UIUSYS.SYS []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-12 554352]
R2 eDataSecurity Service;eDSService.exe; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [2007-04-25 457512]
R2 eLockService;eLock Service; C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe [2007-03-14 24576]
R2 eNet Service;eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [2007-05-22 135168]
R2 eRecoveryService;eRecovery Service; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [2007-02-13 53248]
R2 eSettingsService;eSettings Service; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2007-05-10 24576]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-11-21 247608]
R2 InstallBrainService;InstallBrain Updater Service; C:\Program Files\InstallBrainService\InstallBrainService.exe [2012-02-08 273912]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440]
R2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
R2 MobilityService;MobilityService; C:\Acer\Mobility Center\MobilityService.exe [2006-11-24 107008]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2006-07-19 262247]
R2 WMIService;ePower Service; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [2007-05-16 163840]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-05-17 386560]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 CLTNetCnService;Symantec Lic NetConnect service; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-09-28 135664]
S2 LiveUpdate Notice Ex;LiveUpdate Notice Service Ex; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2011-09-28 135664]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-09-12 2999664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

[vyosek]

Jaky program mu to vytezuje

Ze neco vytezuje procesor jeste neznamena, ze je to havet

Trvate na tom avg? U nas neni moc obliben - vysoka zatez, slabsi detekce

vy umite pracovat s TDSSKillerem a ComboFixem

[blai]

Jaky program mu to vytezuje

Ze neco vytezuje procesor jeste neznamena, ze je to havet

Trvate na tom avg? U nas neni moc obliben - vysoka zatez, slabsi detekce

vy umite pracovat s TDSSKillerem a ComboFixem

Máte pravdu.Já AVG nenávidím, proto ho vůbec nepoužívám.Otec (bohužel) ano a nedá na něj dopustit, přestože za sedm let, prakticky nevyřešil žádné potíže...

Combofix a Killer jsem včera instaloval na odstranění ping.exe
Moc sním neumím, ale počítač jsem několikrát proskenoval.Nakonec jsem ping.exe odstranil ručně...

[vyosek]

Log z TDSSKilleru je treba umet cist a s ComboFixem je to jeste slozitejsi

Nebezpeci CFka

• Je urcen primarne pro radce - jeho svevolnym pouzitim ztracite narok na podporu
• Maze stopy po haveti, takze v logu z RSIT neni nic videt
• Jeho log je treba dolustit, jelikoz neumi smazat vse - to ovsem tezko zvladnete pokud k tomu nejste vyskolen
• CF muze mit bug = sunda Vam system, pokud nevite kam co uklada, jak co obnovit, mate system v kytkam a ceka Vas reinstal
• CF taky bohuzel prozatim nekontroluje nektere dulezite knihovny (napr. hal.dll) - ty treba mazou nektere typy haveti (napr. angela) - smaze Vam po restartu hal.dll = nenajede Vam system a jste o radek vyse = reinstal

zabalte nize uvedene logy a uploadnete mi je sem http://vyosek.ic.cz/havet/uploader.php

• C:\TDSSKiller.2.7.10.0_08.02.2012_01.34.03_log.txt
• C:\TDSSKiller.2.7.10.0_08.02.2012_02.51.49_log.txt
• C:\TDSSKiller.2.7.10.0_08.02.2012_02.14.08_log.txt
• C:\TDSSKiller.2.7.10.0_08.02.2012_01.49.03_log.txt
• Celou slozku C:\Qoobox

Dle meho je ping.exe legitimni soucast windows

Stahnete SytemLook http://jpshortstuff.247fixes.com/SystemLook.exe a ulozte jej na plochu

• Do okna vlozte skript nize

• Kód: Vybrat vše

  :filefind
  ping.exe

• Kliknete na Look
• Tlacitko Look se zmeni na Scanning a zsedne
• Pockejte pokud se tlacitko Scanning opet nezmeni na Look - tak poznate ze SystemLook dokoncil svou praci
• Vyskoci na Vas log s nazvem SystemLook (pripadne bude ulozen na plose), jeho obsah mi sem vlozte

[blai]

SystemLook 30.07.11 by jpshortstuff
Log created at 15:33 on 08/02/2012 by ondra
Administrator - Elevation successful

========== filefind ==========

Searching for "ping.exe"
C:\Windows\winsxs\x86_microsoft-windows-ping-utilities_31bf3856ad364e35_6.0.6000.16386_none_a6fae30b92efb781\PING.EXE --a---- 15360 bytes [08:58 02/11/2006] [09:45 02/11/2006] 44152CC1B2570729CB7D10EE82AD6255
C:\Windows\winsxs\x86_microsoft-windows-ping-utilities_31bf3856ad364e35_6.0.6001.18000_none_a931a5078fdac855\PING.EXE --a---- 15360 bytes [10:56 04/06/2008] [07:33 19/01/2008] 015E1F472A5633520903353375F7E69D

-= EOF =-

[vyosek]

Pockam na logy z TDSSKilleru a Qoobox, jak jsem psal do PMky

[vyosek]

Jste si TDSSKillerem smazal dva legitimni ovladace - to je tak kdyz nekdo pouziva neco cemu s prominutim prd rozumi

Stahnete TDSSQlookhttp://www.techsupportforum.com/forums/ ... SQlook.exe

• Ulozte na plochu a spustte
• Zvolte moznost A a potvrdte Enterem
• Po chvili se zobrazi log, ten sem vlozte

[blai]

TDSSKiller Quarantine Information log
Version 1.0.0.4
***** START SCAN st 08.02.2012 16:36:13,04 *****

---------- TDSSKiller logs ----------

TDSSKiller.2.7.10.0_08.02.2012_01.34.03_log.txt
TDSSKiller.2.7.10.0_08.02.2012_01.49.03_log.txt
TDSSKiller.2.7.10.0_08.02.2012_02.14.08_log.txt
TDSSKiller.2.7.10.0_08.02.2012_02.51.49_log.txt

---------- TDSSStarter logs ----------


---------- DIR LIST ----------

C:\TDSSKiller_Quarantine\08.02.2012_01.49.03
C:\TDSSKiller_Quarantine\08.02.2012_01.34.04
C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0001
C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0000
C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0000\object.ini
C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0000\svc0000
C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0000\svc0000\tsk0000.dta
C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0000\svc0000\object.ini
C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0000\svc0000\tsk0000.ini
C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0001\object.ini
C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0001\svc0000
C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0001\svc0000\object.ini
C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0001\svc0000\tsk0000.ini
C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0001\svc0000\tsk0000.dta
C:\TDSSKiller_Quarantine\08.02.2012_01.49.03\susp0000
C:\TDSSKiller_Quarantine\08.02.2012_01.49.03\susp0000\object.ini
C:\TDSSKiller_Quarantine\08.02.2012_01.49.03\susp0000\svc0000
C:\TDSSKiller_Quarantine\08.02.2012_01.49.03\susp0000\svc0000\tsk0000.dta
C:\TDSSKiller_Quarantine\08.02.2012_01.49.03\susp0000\svc0000\object.ini
C:\TDSSKiller_Quarantine\08.02.2012_01.49.03\susp0000\svc0000\tsk0000.ini

---------- INI FILES ----------

=== C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0000\object.ini

[InfectedObject]
Verdict: LockedFile.Multi.Generic


=== C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0000\svc0000\object.ini

[InfectedObject]
Type: Service
Name: sptd
Type: Kernel driver (0x1)
Start: Boot (0x0)
ImagePath: System32\Drivers\sptd.sys
Suspicious states: Locked file;


=== C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0000\svc0000\tsk0000.ini

[InfectedFile]
Type: Raw image
Src: C:\Windows\system32\Drivers\sptd.sys
md5: 71e276f6d189413266ea22171806597b


=== C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0001\object.ini

[InfectedObject]
Verdict: LockedFile.Multi.Generic


=== C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0001\svc0000\object.ini

[InfectedObject]
Type: Service
Name: sptd
Type: Kernel driver (0x1)
Start: Boot (0x0)
ImagePath: System32\Drivers\sptd.sys
Suspicious states: Locked file;


=== C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0001\svc0000\tsk0000.ini

[InfectedFile]
Type: Raw image
Src: C:\Windows\system32\Drivers\sptd.sys
md5: 71e276f6d189413266ea22171806597b


=== C:\TDSSKiller_Quarantine\08.02.2012_01.49.03\susp0000\object.ini

[InfectedObject]
Verdict: UnsignedFile.Multi.Generic


=== C:\TDSSKiller_Quarantine\08.02.2012_01.49.03\susp0000\svc0000\object.ini

[InfectedObject]
Type: Service
Name: NTIDrvr
Type: Kernel driver (0x1)
Start: Demand (0x3)
ImagePath: system32\DRIVERS\NTIDrvr.sys


=== C:\TDSSKiller_Quarantine\08.02.2012_01.49.03\susp0000\svc0000\tsk0000.ini

[InfectedFile]
Type: Raw image
Src: C:\Windows\system32\DRIVERS\NTIDrvr.sys
md5: 7f1c1f78d709c4a54cbb46ede7e0b48d

[vyosek]

Spustte znovu TDSS Qlook

• Zvolte moznost B Fix a odenterujte
• Otevre se poznamkovy blok, vlozte do nej skript nize

• Kód: Vybrat vše

  REN "C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0000\svc0000\tsk0000.dta" sptd.sys
  COPY "C:\TDSSKiller_Quarantine\08.02.2012_01.34.04\susp0000\svc0000\sptd.sys" C:\Windows\System32\Drivers\
  REN "C:\TDSSKiller_Quarantine\08.02.2012_01.49.03\susp0000\svc0000\tsk0000.dta" NTIDrvr.sys
  COPY "C:\TDSSKiller_Quarantine\08.02.2012_01.49.03\susp0000\svc0000\NTIDrvr.sys" C:\Windows\system32\DRIVERS

• Dejte ulozit a poznamkovy blok zavrete

Smazte stary TDSSKiller.exe pokud jej tam jeste nekde mate

Stahnete si TDSSKiller http://support.kaspersky.com/downloads/ ... killer.exe

• Kliknete na volbu Change parametrs
• V obou oknech (Objects to scan i Additional Option) zakliknete vsechny moznosti - ve vsech ctvereccich musi mit fajecka
• Kliknete na OK
• Utilite prikazte, at skenuje - klik na Start Scan
• Po dokonceni skenu se objevi okno, zkontrolujte, zda-li je vsude moznost Skip
• Pokud moznost Skip nebude primarne nastavena, prekliknete ji na Skip
• Pokud mate vsude Skip, kliknete na Continue
• Na disku, kde mate Windows (obvykle c:\) ve tvaru TDSSKiller.nejaka cisilka _log.txt bude log - jeho obsah sem vlozte

[blai]

Omlouvám se...

Jedinné, co jsem našel po dokončení skanu, je:


17:12:15.0014 6108 TDSS rootkit removing tool 2.7.10.0 Feb 7 2012 15:14:46
17:12:15.0183 6108 ============================================================
17:12:15.0184 6108 Current date / time: 2012/02/08 17:12:15.0183
17:12:15.0184 6108 SystemInfo:
17:12:15.0184 6108
17:12:15.0185 6108 OS Version: 6.0.6001 ServicePack: 1.0
17:12:15.0185 6108 Product type: Workstation
17:12:15.0185 6108 ComputerName: ONDRA-PC
17:12:15.0187 6108 UserName: ondra
17:12:15.0187 6108 Windows directory: C:\Windows
17:12:15.0187 6108 System windows directory: C:\Windows
17:12:15.0187 6108 Processor architecture: Intel x86
17:12:15.0187 6108 Number of processors: 2
17:12:15.0188 6108 Page size: 0x1000
17:12:15.0188 6108 Boot type: Normal boot
17:12:15.0188 6108 ============================================================
17:12:17.0532 6108 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
17:12:17.0540 6108 \Device\Harddisk0\DR0:
17:12:17.0541 6108 MBR used
17:12:17.0541 6108 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x6, StartLBA 0x1385000, BlocksNum 0x8B8C000
17:12:17.0541 6108 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x9F11000, BlocksNum 0x8B08000
17:12:17.0650 6108 Initialize success
17:12:17.0651 6108 ============================================================

[vyosek]

Dobra, pujdem dal

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

[blai]

Docela to trvalo ale mám to : ¨

ComboFix 12-02-08.01 - ondra 08.02.2012 17:29:50.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1250.420.1029.18.2046.934 [GMT 1:00]
Spuštěný z: c:\users\ondra\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\roboot.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-01-08 do 2012-02-08 )))))))))))))))))))))))))))))))
.
.
2012-02-08 16:55 . 2012-02-08 16:55 -------- d-----w- c:\users\Guest\AppData\Local\temp
2012-02-08 16:55 . 2012-02-08 16:55 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-02-08 13:51 . 2012-02-08 13:51 -------- d-----w- C:\rsit
2012-02-08 13:51 . 2012-02-08 13:51 -------- d-----w- c:\program files\trend micro
2012-02-08 13:20 . 2012-02-08 13:21 -------- d-----w- c:\program files\Searchcore Toolbar
2012-02-08 13:20 . 2012-02-08 14:01 -------- d-----w- c:\users\ondra\AppData\Roaming\PerformerSoft
2012-02-08 13:19 . 2012-02-08 13:20 -------- d-----w- c:\program files\PC Performer
2012-02-08 13:19 . 2012-02-08 13:19 -------- d-----w- c:\program files\InstallBrainService
2012-02-08 11:45 . 2012-02-08 11:45 -------- d-----w- c:\program files\GetData
2012-02-08 11:01 . 2012-01-06 04:19 6557240 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D44DEDA0-7DBC-4F6A-B686-E4D71F7F4B3F}\mpengine.dll
2012-02-08 00:35 . 2012-02-08 00:51 -------- d-----w- C:\TDSSKiller_Quarantine
2012-02-06 00:30 . 2012-02-06 00:31 -------- d-----w- c:\users\ondra\.idlerc
2012-02-06 00:09 . 2012-02-06 00:09 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-05 22:07 . 2012-02-05 22:07 -------- d-----w- c:\program files\CCleaner
2012-02-05 15:45 . 2012-02-07 23:14 -------- d-----w- C:\Python27
2012-01-30 17:51 . 2012-01-30 17:50 423656 ----a-w- c:\windows\system32\deployJava1.dll
2012-01-30 14:46 . 2012-01-30 17:25 -------- d-----w- C:\phptriad
2012-01-30 14:46 . 2012-01-30 14:46 -------- d-----w- C:\winnt
2012-01-30 14:45 . 2012-01-30 14:46 -------- d-----w- C:\apache
2012-01-28 23:20 . 2012-01-28 23:20 -------- d-----w- c:\users\ondra\AppData\Roaming\TrojanHunter
2012-01-28 10:59 . 2012-01-28 10:59 -------- d-----w- c:\windows\system32\ondra
2012-01-28 00:46 . 2012-01-28 00:46 -------- d-----w- c:\users\ondra\slozka
2012-01-27 14:59 . 2012-01-27 15:00 -------- d-----w- C:\Dev-Cpp
2012-01-24 01:17 . 2012-01-24 01:17 -------- d-----w- c:\users\ondra\složka
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-26 23:21 . 2009-10-03 08:48 237072 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}]
2008-03-04 11:44 1470488 ----a-w- c:\program files\MyPlayCity\tbMyPl.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7DA17D5A-5718-4130-A605-FC316C827836}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{af6ac4f2-9825-4fb6-a600-92bc5361f209}]
2011-12-22 07:44 87488 ----a-w- c:\progra~1\SEARCH~1\Datamngr\ToolBar\searchcoredtx.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-26 13:23 1385864 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]
"{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}"= "c:\program files\MyPlayCity\tbMyPl.dll" [2008-03-04 1470488]
"{af6ac4f2-9825-4fb6-a600-92bc5361f209}"= "c:\progra~1\SEARCH~1\Datamngr\ToolBar\searchcoredtx.dll" [2011-12-22 87488]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}]
.
[HKEY_CLASSES_ROOT\clsid\{af6ac4f2-9825-4fb6-a600-92bc5361f209}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]
"{4724C5D8-DFA7-417A-A2F5-1EABFEE9B4AC}"= "c:\program files\MyPlayCity\tbMyPl.dll" [2008-03-04 1470488]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 457216]
"eAudio"="c:\acer\Empowering Technology\eAudio\eAudio.exe" [2007-06-11 1286144]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2007-06-27 752136]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-03 206952]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-06-06 159744]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-05-22 151552]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-06-06 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-06 8433664]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-06 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-05-22 151552]
.
c:\users\ondra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-6-28 535336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\SEARCH~1\Datamngr\datamngr.dll c:\progra~1\SEARCH~1\Datamngr\IEBHO.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R0 78443707;78443707;c:\windows\system32\drivers\57764368.sys [x]
R0 95726315;95726315;c:\windows\system32\drivers\83472297.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - 06643714
*NewlyCreated* - 70704453
*NewlyCreated* - 77236065
*Deregistered* - 06643714
*Deregistered* - 70704453
*Deregistered* - 77236065
.
Obsah adresáře 'Naplánované úlohy'
.
2012-02-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-28 21:24]
.
2012-02-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-09-28 21:24]
.
2012-02-08 c:\windows\Tasks\PC Performer_DEFAULT.job
- c:\program files\PC Performer\PCPerformer.exe [2012-02-08 18:11]
.
2012-02-08 c:\windows\Tasks\PC Performer_UPDATES.job
- c:\program files\PC Performer\PCPerformer.exe [2012-02-08 18:11]
.
2011-03-21 c:\windows\Tasks\User_Feed_Synchronization-{AA07CD0E-5B9A-485F-AE2D-12EF9BED0280}.job
- c:\windows\system32\msfeedssync.exe [2011-06-17 04:32]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.searchcore.net/426
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://cs.intl.acer.yahoo.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 10.0.18.234 88.86.107.86
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-10 - (no file)
HKCU-Run-ICQ - c:\users\ondra\Desktop\ICQ6.5\ICQ.exe
SafeBoot-78443707.sys
SafeBoot-95726315.sys
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-02-08 17:56
Windows 6.0.6001 Service Pack 1 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\Play Movie\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2012-02-08 18:03:48
ComboFix-quarantined-files.txt 2012-02-08 17:03
ComboFix2.txt 2012-02-07 21:47
.
Před spuštěním: Volných bajtů: 33 716 600 832
Po spuštění: Volných bajtů: 33 706 553 344
.
- - End Of File - - B03C3DB2A6E31DA53223119FC7DEE067