VIRY.CZ

dobry vecer, dostal se mi od sestry na opravu notebook , ktery ma v sobe zvlastni vir.
Vir prejmenoval skoro vse na plose a v dokumentech.
Uvedu priklad: puvodni soubor ja.JPG prejmenoval na locked-ja.JPG.wtvs
Jenomze po prejmenovani na puvodni nazev ja.JPG se obrazek nezobrazi, jako by byla nejak prepsana i struktura obrazku. To samy je i u pripon PDF, DOC, XLS a taky i nektere EXE soubory jsou prepsany a znefunkcneny.

Vir tam pry dostala pomoci emailu. Pry klikla na nejaky nemecky email a nic se nedelo.
Po naslednem vypnuti a zapnuti NTB pry se misto zobrazeni prihlasovaciho jmena s heslem zobrazilo pres celou obrazovku nejake okno s nemecky psanym textem ze to okno je antivir a ze ma v PC viry a ze za cca 100E ji to vylecijou.

Nevedeli co s tim, tak pomoci nouzoveho rezimu s funkce obnoveni systemu se vratili o dva dny zpet. Vir tam jiz nenabehl, ale zanechal po sobe spoust, kterou jsem vyse popsal.

Nejhorsi na tom vsem je to, ze tento NTB mel pred sebou uz jen cca tyden provozu, neb segra si koupila novy notebook a do nej chtela pak si dat vsechny data z tohoto NTB, a tento nasledne zformatovat a dat jej me neteri (jeji dceri). To se ale ted udelat nemuze, nebot veskere dokumenty jsou nefunkcni a snad se je podari (za vasi pomoci) nejak je vratit zpet do puvodniho stavu.
Tolik asi vse pro zacatek a nyni prikladam LOG:

A jeste neco:
Predem vam dekuji za vas cas co se mnou stravite.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Logfile of random's system information tool 1.09 (written by random/random)
Run by Veronika at 2012-05-14 20:49:56
Microsoft Windows 7 Home Premium
System drive C: has 93 GB (56%) free of 167 GB
Total RAM: 3001 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:50:57, on 14.5.2012
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\ProgramData\GameXN\GameXNGO.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Veronika\Downloads\RSIT.exe
C:\Program Files\trend micro\Veronika.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [GameXN (update)] "C:\ProgramData\GameXN\GameXNGO.exe" /u
O4 - HKCU\..\Run: [GameXN (news)] "C:\ProgramData\GameXN\GameXNGO.exe" /n
O4 - HKCU\..\Run: [GameXN] "C:\ProgramData\GameXN\GameXNGO.exe" /silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

--
End of file - 6403 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Veronika\AppData\Roaming\Mozilla\Firefox\Profiles\usxyriic.default

prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "extensions.enabledItems" - "{972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.3"

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-01-03 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2012-03-17 192112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-04-22 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2012-03-17 192112]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2009-09-17 1565992]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"Windows Mobile Device Center"=C:\Windows\WindowsMobile\wmdc.exe [2007-05-31 648072]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2010-08-25 136216]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2010-08-25 171032]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2012-01-03 37296]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-01-02 843712]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2012-03-26 931200]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2010-02-22 26101032]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2010-04-21 39408]
"GameXN (update)"=C:\ProgramData\GameXN\GameXNGO.exe [2011-08-30 347008]
"GameXN (news)"=C:\ProgramData\GameXN\GameXNGO.exe [2011-08-30 347008]
"GameXN"=C:\ProgramData\GameXN\GameXNGO.exe [2011-08-30 347008]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GameXN]
C:\ProgramData\GameXN\GameXNGO.exe [2011-08-30 347008]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GameXN (news)]
C:\ProgramData\GameXN\GameXNGO.exe [2011-08-30 347008]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GameXN (update)]
C:\ProgramData\GameXN\GameXNGO.exe [2011-08-30 347008]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
C:\Windows\system32\igfxpers.exe [2010-08-25 170520]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2010-04-21 39408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE []

C:\Users\Veronika\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2010-08-25 228864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2012-05-14 20:49:57 ----D---- C:\Program Files\trend micro
2012-05-14 20:49:56 ----D---- C:\rsit
2012-05-14 20:14:18 ----D---- C:\ProgramData\Mozilla
2012-05-14 20:14:18 ----D---- C:\Program Files\Mozilla Maintenance Service
2012-05-12 05:34:02 ----SHD---- C:\Windows\system32\%APPDATA%
2012-05-10 11:21:44 ----A---- C:\Windows\system32\drivers\tcpip.sys
2012-05-10 11:21:19 ----A---- C:\Windows\system32\ntoskrnl.exe
2012-05-10 11:21:19 ----A---- C:\Windows\system32\ntkrnlpa.exe
2012-05-10 11:21:18 ----A---- C:\Windows\system32\win32k.sys
2012-05-10 11:21:17 ----A---- C:\Windows\system32\drivers\partmgr.sys
2012-05-10 11:21:16 ----A---- C:\Windows\system32\DWrite.dll
2012-05-10 11:21:15 ----A---- C:\Windows\system32\d3d10warp.dll
2012-05-10 11:21:15 ----A---- C:\Windows\system32\d3d10_1core.dll
2012-05-10 11:21:15 ----A---- C:\Windows\system32\d3d10_1.dll
2012-05-10 11:21:15 ----A---- C:\Windows\system32\d2d1.dll
2012-05-02 16:03:19 ----D---- C:\Program Files\Foxit Software
2012-05-02 10:23:36 ----D---- C:\Zaloha Outlock
2012-05-01 11:37:13 ----D---- C:\Windows\pss
2012-05-01 11:35:42 ----D---- C:\Program Files\CCleaner

======List of files/folders modified in the last 1 month======

2012-05-14 20:50:11 ----D---- C:\Windows\Prefetch
2012-05-14 20:49:57 ----RD---- C:\Program Files
2012-05-14 20:49:46 ----D---- C:\Windows\Temp
2012-05-14 20:44:46 ----D---- C:\ProgramData\GameXN
2012-05-14 20:43:41 ----D---- C:\Users\Veronika\AppData\Roaming\Skype
2012-05-14 20:14:18 ----HD---- C:\ProgramData
2012-05-14 20:14:15 ----D---- C:\Program Files\Mozilla Firefox
2012-05-14 20:06:03 ----D---- C:\Windows\System32
2012-05-14 20:06:03 ----D---- C:\Windows\inf
2012-05-14 20:06:03 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-05-14 19:37:56 ----D---- C:\Windows\system32\config
2012-05-14 19:25:21 ----D---- C:\Users\Veronika\AppData\Roaming\skypePM
2012-05-14 19:24:46 ----D---- C:\Users\Veronika\AppData\Roaming\go
2012-05-14 14:21:01 ----SHD---- C:\Windows\Installer
2012-05-14 14:21:00 ----RD---- C:\Program Files\Skype
2012-05-14 14:20:38 ----SHD---- C:\System Volume Information
2012-05-14 14:19:33 ----D---- C:\Program Files\Common Files
2012-05-14 14:18:32 ----D---- C:\Program Files\Adobe
2012-05-14 14:18:31 ----D---- C:\Program Files\Common Files\Adobe
2012-05-12 19:51:35 ----D---- C:\Windows\system32\NDF
2012-05-12 06:27:46 ----D---- C:\Windows\Microsoft.NET
2012-05-12 06:25:13 ----RSD---- C:\Windows\assembly
2012-05-12 06:21:36 ----D---- C:\Windows\winsxs
2012-05-12 06:19:43 ----D---- C:\Program Files\Microsoft Silverlight
2012-05-12 06:18:52 ----D---- C:\Windows\system32\drivers
2012-05-12 06:18:52 ----D---- C:\Program Files\Windows Journal
2012-05-12 05:47:10 ----D---- C:\ProgramData\Microsoft Help
2012-05-12 05:35:59 ----D---- C:\Windows\system32\catroot
2012-05-10 11:17:06 ----D---- C:\Windows\system32\catroot2
2012-05-02 13:45:24 ----D---- C:\Windows\system32\drivers\etc
2012-05-01 11:37:13 ----D---- C:\Windows
2012-05-01 11:35:29 ----D---- C:\Program Files\Spybot - Search & Destroy
2012-05-01 11:23:43 ----D---- C:\Windows\system32\wbem
2012-05-01 11:22:51 ----D---- C:\Windows\Tasks
2012-05-01 11:22:51 ----D---- C:\Windows\system32\wfp
2012-05-01 11:22:51 ----D---- C:\Windows\system32\Tasks
2012-05-01 11:22:51 ----D---- C:\Windows\system32\DriverStore
2012-05-01 11:22:44 ----D---- C:\totalcmd
2012-05-01 11:22:44 ----D---- C:\ProgramData\Spybot - Search & Destroy
2012-05-01 11:22:32 ----D---- C:\Windows\registration
2012-05-01 11:22:18 ----D---- C:\Users\Veronika\AppData\Roaming\Zoner
2012-05-01 11:21:14 ----D---- C:\ProgramData\Google
2012-04-26 08:31:36 ----D---- C:\Program Files\Microsoft Security Client
2012-04-18 22:57:49 ----SD---- C:\Users\Veronika\AppData\Roaming\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2012-03-20 171064]
R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2010-08-25 9024512]
R3 netr28;Ralink 802.11n – bezdrátový ovladač pro systém Windows Vista; C:\Windows\system32\DRIVERS\netr28.sys [2009-07-14 530944]
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt86win7.sys [2009-07-14 139776]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2009-09-17 229040]
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-14 229888]
S3 KMWDFILTERx86;HIDServiceDesc; C:\Windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]
S3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 74112]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2009-07-14 15872]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 WinUsb;Ovladač WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\MsMpEng.exe [2012-03-26 11552]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-04-21 135664]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-04-21 135664]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-04-21 182768]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-21 129976]
S3 NisSrv;@C:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-03-26 214952]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-05-28 1343400]

-----------------EOF-----------------

Zdravím!
Poprosím o log ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

zde je:

ComboFix 12-05-14.03 - Veronika 14.05.2012 22:22:30.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.3001.1795 [GMT 2:00]
Spuštěný z: c:\users\Veronika\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-04-14 do 2012-05-14 )))))))))))))))))))))))))))))))
.
.
2012-05-14 20:28 . 2012-05-14 20:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-05-14 18:49 . 2012-05-14 18:50 -------- d-----w- c:\program files\trend micro
2012-05-14 18:49 . 2012-05-14 18:50 -------- d-----w- C:\rsit
2012-05-14 18:14 . 2012-05-14 18:14 -------- d-----w- c:\program files\Mozilla Maintenance Service
2012-05-14 18:14 . 2012-04-21 01:18 97208 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2012-05-14 18:14 . 2012-04-21 01:15 626688 ----a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2012-05-14 18:14 . 2012-04-21 01:15 548864 ----a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2012-05-14 18:14 . 2012-04-21 01:15 479232 ----a-w- c:\program files\Mozilla Firefox\msvcm80.dll
2012-05-14 18:14 . 2012-04-21 01:16 43960 ----a-w- c:\program files\Mozilla Firefox\mozglue.dll
2012-05-14 18:14 . 2012-04-21 01:16 157352 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-05-14 18:14 . 2012-04-21 01:16 129976 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-05-14 18:14 . 2012-04-21 01:16 588728 ----a-w- c:\program files\Mozilla Firefox\gkmedias.dll
2012-05-12 03:34 . 2012-05-12 03:34 -------- d-sh--w- c:\windows\system32\%APPDATA%
2012-05-02 14:03 . 2012-05-02 14:03 -------- d-----w- c:\program files\Foxit Software
2012-05-02 08:23 . 2012-05-14 18:08 -------- d-----w- C:\Zaloha Outlock
2012-05-01 09:35 . 2012-05-01 09:35 -------- d-----w- c:\program files\CCleaner
2012-04-18 21:00 . 2012-04-18 21:00 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2012-04-18 20:59 . 2012-04-18 20:59 484176 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-01 05:53 . 2012-04-13 04:13 19312 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-03-01 05:49 . 2012-04-13 04:13 172544 ----a-w- c:\windows\system32\wintrust.dll
2012-03-01 05:45 . 2012-04-13 04:13 158720 ----a-w- c:\windows\system32\imagehlp.dll
2012-03-01 05:40 . 2012-04-13 04:13 5120 ----a-w- c:\windows\system32\wmi.dll
2012-02-28 01:18 . 2012-04-13 04:18 1799168 ----a-w- c:\windows\system32\jscript9.dll
2012-02-28 01:11 . 2012-04-13 04:18 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2012-02-28 01:11 . 2012-04-13 04:18 1127424 ----a-w- c:\windows\system32\wininet.dll
2012-02-28 01:03 . 2012-04-13 04:18 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-02-26 05:48 . 2012-02-26 05:48 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-02-26 05:48 . 2012-02-26 05:48 161792 ----a-w- c:\windows\system32\msls31.dll
2012-02-26 05:48 . 2012-02-26 05:48 86528 ----a-w- c:\windows\system32\iesysprep.dll
2012-02-26 05:48 . 2012-02-26 05:48 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-02-26 05:48 . 2012-02-26 05:48 74752 ----a-w- c:\windows\system32\iesetup.dll
2012-02-26 05:48 . 2012-02-26 05:48 63488 ----a-w- c:\windows\system32\tdc.ocx
2012-02-26 05:48 . 2012-02-26 05:48 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-02-26 05:48 . 2012-02-26 05:48 367104 ----a-w- c:\windows\system32\html.iec
2012-02-26 05:48 . 2012-02-26 05:48 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-02-26 05:48 . 2012-02-26 05:48 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-02-26 05:48 . 2012-02-26 05:48 23552 ----a-w- c:\windows\system32\licmgr10.dll
2012-02-26 05:48 . 2012-02-26 05:48 152064 ----a-w- c:\windows\system32\wextract.exe
2012-02-26 05:48 . 2012-02-26 05:48 150528 ----a-w- c:\windows\system32\iexpress.exe
2012-02-26 05:48 . 2012-02-26 05:48 35840 ----a-w- c:\windows\system32\imgutil.dll
2012-02-26 05:48 . 2012-02-26 05:48 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-02-26 05:48 . 2012-02-26 05:48 11776 ----a-w- c:\windows\system32\mshta.exe
2012-02-26 05:48 . 2012-02-26 05:48 101888 ----a-w- c:\windows\system32\admparse.dll
2012-02-15 05:44 . 2012-03-14 05:29 826368 ----a-w- c:\windows\system32\rdpcore.dll
2012-02-15 04:22 . 2012-03-14 05:29 177152 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-02-15 04:22 . 2012-03-14 05:29 24064 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-04-21 01:18 . 2012-05-14 18:14 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-02-22 26101032]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-04-21 39408]
"GameXN (update)"="c:\programdata\GameXN\GameXNGO.exe" [2011-08-30 347008]
"GameXN (news)"="c:\programdata\GameXN\GameXNGO.exe" [2011-08-30 347008]
"GameXN"="c:\programdata\GameXN\GameXNGO.exe" [2011-08-30 347008]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-09-17 1565992]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 136216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 171032]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
.
c:\users\Veronika\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GameXN]
2011-08-30 18:52 347008 ----a-w- c:\programdata\GameXN\GameXNGO.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GameXN (news)]
2011-08-30 18:52 347008 ----a-w- c:\programdata\GameXN\GameXNGO.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GameXN (update)]
2011-08-30 18:52 347008 ----a-w- c:\programdata\GameXN\GameXNGO.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2010-08-25 18:45 170520 ----a-w- c:\windows\System32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2010-04-21 19:39 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-21 135664]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-21 135664]
R3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-21 129976]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-28 1343400]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S3 netr28;Ralink 802.11n – bezdrátový ovladač pro systém Windows Vista;c:\windows\system32\DRIVERS\netr28.sys [2009-07-13 530944]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Obsah adresáře 'Naplánované úlohy'
.
2012-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-21 19:39]
.
2012-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-21 19:39]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: homecredit.cz\partner
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Veronika\AppData\Roaming\Mozilla\Firefox\Profiles\usxyriic.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2012-05-14 22:30:34
ComboFix-quarantined-files.txt 2012-05-14 20:30
.
Před spuštěním: Volných bajtů: 97 197 318 144
Po spuštění: Volných bajtů: 97 148 706 816
.
- - End Of File - - 2C52ED925B0D1B55679564877DA989B1

Rudy, omlouvám se za vstup.

Ten email už asi nemáte, že?

ano, mam, "zachranil" jsem z kose v outlooku ...
ted koukam ze tam je priloha:
Lieferschein.exe
Nejspise ten exe pustila
Komu jej poslat?

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Folder::
c:\program files\Google\GoogleToolbarNotifier

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Uložte na plochu jako CFScript.txt. pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Tak bude v příloze spustitelný soubor, můžete ho dát do raru? Pošlete mi ho na email, mám ho v podpise . Zkusím se domluvit s někým s kolegů, at na to mrkne.

Zdravím,
nechci vám moc narušovat diskuzi s "opravářem", ale jen mě zajímá následující: klikněte pravým tlačítkem myši na soubor (např:locked-ja.JPG.wtvs) -> otevřít (nebo otevřít v programu) -> zvolte "vybrat program ze seznamu nainstalovaných programů" -> a vyberte "Windows Prohlížeč fotografií". Zobrazí se vám fotografie????

Pokud ano, tak vám vir udělal jen to, že vám náhodně vygeneroval a doplnil koncovky u vybraných souborů (jpg, gif, pdf, ...), takže nemusíte mít strach, že jsou soubory poškozeny nebo jste o ně přišel.

SeFF píše:Zdravím,
nechci vám moc narušovat diskuzi s "opravářem", ale jen mě zajímá následující: klikněte pravým tlačítkem myši na soubor (např:locked-ja.JPG.wtvs) -> otevřít (nebo otevřít v programu) -> zvolte "vybrat program ze seznamu nainstalovaných programů" -> a vyberte "Windows Prohlížeč fotografií". Zobrazí se vám fotografie????

Pokud ano, tak vám vir udělal jen to, že vám náhodně vygeneroval a doplnil koncovky u vybraných souborů (jpg, gif, pdf, ...), takže nemusíte mít strach, že jsou soubory poškozeny nebo jste o ně přišel.

To asi nebude tento případ, soubor bude zašifrovaný

Ten exe soubor dejte do raru, at ho hlavně nespustíte a pošlete mi ho emailem.
Také ho otestujte na www.virustotal.com a dejte sem prosím odkaz na výsledek

novy log:

ComboFix 12-05-14.03 - Veronika 14.05.2012 22:43:03.2.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.3001.1895 [GMT 2:00]
Spuštěný z: c:\users\Veronika\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Veronika\Desktop\CFScript.txt.txt
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Google\GoogleToolbarNotifier
c:\program files\Google\GoogleToolbarNotifier\5.7.7227.1100\gth.dll
c:\program files\Google\GoogleToolbarNotifier\5.7.7227.1100\gtn.dll
c:\program files\Google\GoogleToolbarNotifier\5.7.7227.1100\Readme.url
c:\program files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-04-14 do 2012-05-14 )))))))))))))))))))))))))))))))
.
.
2012-05-14 18:49 . 2012-05-14 18:50 -------- d-----w- c:\program files\trend micro
2012-05-14 18:49 . 2012-05-14 18:50 -------- d-----w- C:\rsit
2012-05-14 18:14 . 2012-05-14 18:14 -------- d-----w- c:\program files\Mozilla Maintenance Service
2012-05-14 18:14 . 2012-04-21 01:18 97208 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2012-05-14 18:14 . 2012-04-21 01:15 626688 ----a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2012-05-14 18:14 . 2012-04-21 01:15 548864 ----a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2012-05-14 18:14 . 2012-04-21 01:15 479232 ----a-w- c:\program files\Mozilla Firefox\msvcm80.dll
2012-05-14 18:14 . 2012-04-21 01:16 43960 ----a-w- c:\program files\Mozilla Firefox\mozglue.dll
2012-05-14 18:14 . 2012-04-21 01:16 157352 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-05-14 18:14 . 2012-04-21 01:16 129976 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-05-14 18:14 . 2012-04-21 01:16 588728 ----a-w- c:\program files\Mozilla Firefox\gkmedias.dll
2012-05-12 03:34 . 2012-05-12 03:34 -------- d-sh--w- c:\windows\system32\%APPDATA%
2012-05-02 14:03 . 2012-05-02 14:03 -------- d-----w- c:\program files\Foxit Software
2012-05-02 08:23 . 2012-05-14 20:39 -------- d-----w- C:\Zaloha Outlock
2012-05-01 09:35 . 2012-05-01 09:35 -------- d-----w- c:\program files\CCleaner
2012-04-18 21:00 . 2012-04-18 21:00 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2012-04-18 20:59 . 2012-04-18 20:59 484176 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-01 05:53 . 2012-04-13 04:13 19312 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-03-01 05:49 . 2012-04-13 04:13 172544 ----a-w- c:\windows\system32\wintrust.dll
2012-03-01 05:45 . 2012-04-13 04:13 158720 ----a-w- c:\windows\system32\imagehlp.dll
2012-03-01 05:40 . 2012-04-13 04:13 5120 ----a-w- c:\windows\system32\wmi.dll
2012-02-28 01:18 . 2012-04-13 04:18 1799168 ----a-w- c:\windows\system32\jscript9.dll
2012-02-28 01:11 . 2012-04-13 04:18 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2012-02-28 01:11 . 2012-04-13 04:18 1127424 ----a-w- c:\windows\system32\wininet.dll
2012-02-28 01:03 . 2012-04-13 04:18 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-02-26 05:48 . 2012-02-26 05:48 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-02-26 05:48 . 2012-02-26 05:48 161792 ----a-w- c:\windows\system32\msls31.dll
2012-02-26 05:48 . 2012-02-26 05:48 86528 ----a-w- c:\windows\system32\iesysprep.dll
2012-02-26 05:48 . 2012-02-26 05:48 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-02-26 05:48 . 2012-02-26 05:48 74752 ----a-w- c:\windows\system32\iesetup.dll
2012-02-26 05:48 . 2012-02-26 05:48 63488 ----a-w- c:\windows\system32\tdc.ocx
2012-02-26 05:48 . 2012-02-26 05:48 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-02-26 05:48 . 2012-02-26 05:48 367104 ----a-w- c:\windows\system32\html.iec
2012-02-26 05:48 . 2012-02-26 05:48 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-02-26 05:48 . 2012-02-26 05:48 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-02-26 05:48 . 2012-02-26 05:48 23552 ----a-w- c:\windows\system32\licmgr10.dll
2012-02-26 05:48 . 2012-02-26 05:48 152064 ----a-w- c:\windows\system32\wextract.exe
2012-02-26 05:48 . 2012-02-26 05:48 150528 ----a-w- c:\windows\system32\iexpress.exe
2012-02-26 05:48 . 2012-02-26 05:48 35840 ----a-w- c:\windows\system32\imgutil.dll
2012-02-26 05:48 . 2012-02-26 05:48 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-02-26 05:48 . 2012-02-26 05:48 11776 ----a-w- c:\windows\system32\mshta.exe
2012-02-26 05:48 . 2012-02-26 05:48 101888 ----a-w- c:\windows\system32\admparse.dll
2012-02-15 05:44 . 2012-03-14 05:29 826368 ----a-w- c:\windows\system32\rdpcore.dll
2012-02-15 04:22 . 2012-03-14 05:29 177152 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-02-15 04:22 . 2012-03-14 05:29 24064 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-04-21 01:18 . 2012-05-14 18:14 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-02-22 26101032]
"GameXN (update)"="c:\programdata\GameXN\GameXNGO.exe" [2011-08-30 347008]
"GameXN (news)"="c:\programdata\GameXN\GameXNGO.exe" [2011-08-30 347008]
"GameXN"="c:\programdata\GameXN\GameXNGO.exe" [2011-08-30 347008]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-09-17 1565992]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 136216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 171032]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
.
c:\users\Veronika\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GameXN]
2011-08-30 18:52 347008 ----a-w- c:\programdata\GameXN\GameXNGO.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GameXN (news)]
2011-08-30 18:52 347008 ----a-w- c:\programdata\GameXN\GameXNGO.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GameXN (update)]
2011-08-30 18:52 347008 ----a-w- c:\programdata\GameXN\GameXNGO.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2010-08-25 18:45 170520 ----a-w- c:\windows\System32\igfxpers.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-21 135664]
R3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-21 135664]
R3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-21 129976]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-28 1343400]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S3 netr28;Ralink 802.11n – bezdrátový ovladač pro systém Windows Vista;c:\windows\system32\DRIVERS\netr28.sys [2009-07-13 530944]
S3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Obsah adresáře 'Naplánované úlohy'
.
2012-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-21 19:39]
.
2012-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-21 19:39]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: homecredit.cz\partner
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Veronika\AppData\Roaming\Mozilla\Firefox\Profiles\usxyriic.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\taskhost.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\conhost.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Celkový čas: 2012-05-14 22:54:39 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-05-14 20:54
ComboFix2.txt 2012-05-14 20:30
.
Před spuštěním: Volných bajtů: 97 214 590 976
Po spuštění: Volných bajtů: 97 149 812 736
.
- - End Of File - - 125257F9CFDDB2D450E7A938F955EED2

SeFF píše:Zdravím,
nechci vám moc narušovat diskuzi s "opravářem", ale jen mě zajímá následující: klikněte pravým tlačítkem myši na soubor (např:locked-ja.JPG.wtvs) -> otevřít (nebo otevřít v programu) -> zvolte "vybrat program ze seznamu nainstalovaných programů" -> a vyberte "Windows Prohlížeč fotografií". Zobrazí se vám fotografie????

Pokud ano, tak vám vir udělal jen to, že vám náhodně vygeneroval a doplnil koncovky u vybraných souborů (jpg, gif, pdf, ...), takže nemusíte mít strach, že jsou soubory poškozeny nebo jste o ně přišel.

vysledek u fotografie:
Program windows prohlizec fotografii nemuze otevrit tento obrazek, protoze tento format souboru neni podporovan.


Nyni jdu odeslat email.

Hlavně dejte ten exe soubor do raru, nerada bych si zavirovala pc .
A hned to testněte na www.virustotal.com
Sice jsem našla co je to za vir, ale zatím žádný návod k rozšifrování, zkusím zítra kolegy

ano v raru byl odeslan...
vysledek:

SHA256: bef69e83b46b630f3cc955d3b607fafab9945c512724317ecfe3f8c5f77b4ea1
SHA1: 48edafb041eab1ef104492713ab6d8e96094bdd0
MD5: 1073659ceefca910ad0627c99b8b37da
File size: 38.8 KB ( 39765 bytes )
File name: Lieferschein.zip
File type: ZIP
Detection ratio: 36 / 42
Analysis date: 2012-05-08 05:58:00 UTC ( 6 dnů, 15 hodin ago )

radeji jsem na www.virustotal.com odeslal k analyze pouze exe soubor. a vysledek:

SHA256: 45b89fbba8c48c16650e33d5298d0ed56efe1df5028ef895116372dd8590d3eb
SHA1: 8507340f986b7479c4f0bce26b6d6c79bf99e03b
MD5: 6236e95caabb9604e39d372fff147cfc
File size: 53.5 KB ( 54784 bytes )
File name: 944ED2CC4C939D69780F.exe
File type: Win32 EXE
Detection ratio: 37 / 42
Analysis date: 2012-05-13 18:47:01 UTC ( 1 den, 2 hodiny ago )