VIRY.CZ

Dobrý den, chtěl jsem sem dát LOG jenže mi nejde nainstalovat program HJackThis v PC. Mám OS Windows XP a nejde mi na něm nic otevřít jelikož se mi tam nainstaloval Live Security Platinum. Děkuji za pomoc

Zdravím! Restartujte do nouz. režimu a udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware) 1.62.0.1300
www.malwarebytes.org

Verze databáze: v2012.07.03.05

Windows XP Service Pack 2 x86 FAT32 (Safe Mode)
Internet Explorer 6.0.2900.2180
Administrator :: HP66811255121 [administrátor]

Ochrana: Zakázána

9.9.2012 18:37:11
mbam-log-2012-09-09 (19-08-35).txt

Typ: Úplná kontrola (C:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 225509
Uplynulý čas: 18 minut, 10 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 1
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Live Security Platinum (Rogue.LiveSecurityPlatinum) -> Žádná instrukce nebyla provedena.

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 4
C:\Documents and Settings\Administrator\Dokumenty\Downloads\sindicate\client.bin (RiskWare.Tool.CK) -> Žádná instrukce nebyla provedena.
C:\Documents and Settings\Administrator\Dokumenty\Downloads\sindicate\sindicate\client.bin (RiskWare.Tool.CK) -> Žádná instrukce nebyla provedena.
C:\Program Files\Sindicate\client.bin (RiskWare.Tool.CK) -> Žádná instrukce nebyla provedena.
C:\Documents and Settings\Administrator\Plocha\Live Security Platinum.lnk (Rogue.LiveSecurityPlatinum) -> Žádná instrukce nebyla provedena.

(konec)

Vše, co MBAM nalezl, smažte. Restartujte do normálního režimu a dejte nejprve log RSIT: http://forum.viry.cz/viewtopic.php?f=13&t=105895 .

Jenze kdyz to dam do puvodniho stavu tak se mi stale nic nejde otevrit. Porad tam je ten program.

Udělejte sken opět v nouz. režimu.

Logfile of random's system information tool 1.09 (written by random/random)
Run by Administrator at 2012-09-09 20:25:26
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 52 GB (68%) free of 76 GB
Total RAM: 1527 MB (73% free)

HijackThis download failed

======Scheduled tasks folder======

C:\WINDOWS\tasks\Adobe Flash Player Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-600682357-420316650-2637938586-500Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-600682357-420316650-2637938586-500UA.job
C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2012-08-31 449512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
Ask Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2012-06-06 1519304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2012-08-31 157672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2012-03-20 1056320]
{D4027C7F-154A-4066-A1AD-4243D8127440} - Ask Toolbar - C:\Program Files\Ask.com\GenericAskToolbar.dll [2012-06-06 1519304]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2005-04-05 94208]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2005-04-05 77824]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2005-04-05 114688]
"Zástupce stránky vlastností sběrnice High Definition Audio"=C:\WINDOWS\system32\HDAShCut.exe [2005-01-07 61952]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2005-03-08 13924864]
"PTHOSTTR"=C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE [2005-10-04 86016]
"SetRefresh"=C:\Program Files\Compaq\SetRefresh\SetRefresh.exe [2003-11-20 525824]
"LayoutM"=C:\WINDOWS\KLayMgr.exe [2004-08-16 45056]
"MobileConnect"=C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe [2009-09-18 2412032]
"Guard.Mail.ru.gui"=C:\Program Files\Guard-ICQ\GuardICQ.exe [2012-08-31 1564368]
""= []
"ApnUpdater"=C:\Program Files\Ask.com\Updater\Updater.exe [2012-06-06 1564872]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-07-03 252848]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2012-07-03 462920]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-18 15360]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2012-07-13 17420464]
"Google Update"=C:\Documents and Settings\Administrator\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe [2012-08-31 116648]
"ICQ"=C:\Program Files\ICQ7M\ICQ.exe [2012-08-31 127040]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2012-04-17 3671872]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"036E18D42B17D97971BF924EE56C3425"=C:\Documents and Settings\All Users\Data aplikací\036E18D42B17D97971BF924EE56C3425\036E18D42B17D97971BF924EE56C3425 [2012-09-09 1872]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Sonic CinePlayer Quick Launch.lnk - C:\Program Files\Common Files\Sonic Shared\CineTray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2005-04-05 131072]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\ICQ7M\ICQ.exe"="C:\Program Files\ICQ7M\ICQ.exe:*:Enabled:ICQ7M"
"C:\Program Files\Counter-Strike 1.6 Non-Steam\hl.exe"="C:\Program Files\Counter-Strike 1.6 Non-Steam\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"C:\Documents and Settings\Administrator\Dokumenty\Downloads\sindicate\client.bin"="C:\Documents and Settings\Administrator\Dokumenty\Downloads\sindicate\client.bin:*:Enabled:client"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ7M\ICQ.exe"="C:\Program Files\ICQ7M\ICQ.exe:*:Enabled:ICQ7M"
"C:\Program Files\Pando Networks\Media Booster\PMB.exe"="C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.FMVC"=fmcodec.dll

======List of files/folders created in the last 1 month======

2012-09-09 20:24:39 ----D---- C:\Program Files\trend micro
2012-09-09 20:07:41 ----D---- C:\rsit
2012-09-09 18:29:54 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Malwarebytes
2012-09-09 18:29:41 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2012-09-09 18:29:39 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2012-09-09 18:29:39 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2012-09-09 18:27:59 ----A---- C:\WINDOWS\ntbtlog.txt
2012-09-09 16:12:34 ----A---- C:\hijackthis.exe
2012-09-09 13:05:37 ----D---- C:\Documents and Settings\All Users\Data aplikací\036E18D42B17D97971BF924EE56C3425
2012-09-08 20:30:39 ----D---- C:\Program Files\Sindicate
2012-09-07 23:06:42 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Media Player Classic
2012-09-07 18:40:23 ----D---- C:\Documents and Settings\Administrator\Data aplikací\LolClient
2012-09-07 17:52:19 ----D---- C:\Riot Games
2012-09-07 15:44:37 ----D---- C:\Program Files\Rockstar Games
2012-09-07 15:43:11 ----RASH---- C:\MSDOS.SYS
2012-09-07 15:43:11 ----RASH---- C:\IO.SYS
2012-09-06 20:06:59 ----A---- C:\WINDOWS\system32\XAudio2_7.dll
2012-09-06 20:06:59 ----A---- C:\WINDOWS\system32\XAPOFX1_5.dll
2012-09-06 20:06:59 ----A---- C:\WINDOWS\system32\xactengine3_7.dll
2012-09-06 20:06:59 ----A---- C:\WINDOWS\system32\d3dcsx_43.dll
2012-09-06 20:06:59 ----A---- C:\WINDOWS\system32\D3DCompiler_43.dll
2012-09-06 20:06:58 ----A---- C:\WINDOWS\system32\XAudio2_6.dll
2012-09-06 20:06:58 ----A---- C:\WINDOWS\system32\XAPOFX1_4.dll
2012-09-06 20:06:58 ----A---- C:\WINDOWS\system32\D3DX9_43.dll
2012-09-06 20:06:58 ----A---- C:\WINDOWS\system32\d3dx11_43.dll
2012-09-06 20:06:58 ----A---- C:\WINDOWS\system32\d3dx10_43.dll
2012-09-06 20:06:57 ----A---- C:\WINDOWS\system32\XAudio2_5.dll
2012-09-06 20:06:57 ----A---- C:\WINDOWS\system32\xactengine3_6.dll
2012-09-06 20:06:57 ----A---- C:\WINDOWS\system32\xactengine3_5.dll
2012-09-06 20:06:57 ----A---- C:\WINDOWS\system32\X3DAudio1_7.dll
2012-09-06 20:06:56 ----A---- C:\WINDOWS\system32\d3dx11_42.dll
2012-09-06 20:06:56 ----A---- C:\WINDOWS\system32\d3dcsx_42.dll
2012-09-06 20:06:56 ----A---- C:\WINDOWS\system32\D3DCompiler_42.dll
2012-09-06 20:06:55 ----A---- C:\WINDOWS\system32\D3DX9_42.dll
2012-09-06 20:06:55 ----A---- C:\WINDOWS\system32\d3dx10_42.dll
2012-09-06 20:06:54 ----A---- C:\WINDOWS\system32\XAudio2_4.dll
2012-09-06 20:06:54 ----A---- C:\WINDOWS\system32\XAPOFX1_3.dll
2012-09-06 20:06:54 ----A---- C:\WINDOWS\system32\D3DX9_41.dll
2012-09-06 20:06:54 ----A---- C:\WINDOWS\system32\d3dx10_41.dll
2012-09-06 20:06:54 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll
2012-09-06 20:06:53 ----A---- C:\WINDOWS\system32\xactengine3_4.dll
2012-09-06 20:06:53 ----A---- C:\WINDOWS\system32\X3DAudio1_6.dll
2012-09-06 20:06:53 ----A---- C:\WINDOWS\system32\D3DX9_40.dll
2012-09-06 20:06:53 ----A---- C:\WINDOWS\system32\d3dx10_40.dll
2012-09-06 20:06:53 ----A---- C:\WINDOWS\system32\D3DCompiler_40.dll
2012-09-06 20:06:52 ----A---- C:\WINDOWS\system32\XAudio2_3.dll
2012-09-06 20:06:52 ----A---- C:\WINDOWS\system32\XAudio2_2.dll
2012-09-06 20:06:52 ----A---- C:\WINDOWS\system32\XAPOFX1_2.dll
2012-09-06 20:06:52 ----A---- C:\WINDOWS\system32\XAPOFX1_1.dll
2012-09-06 20:06:52 ----A---- C:\WINDOWS\system32\xactengine3_3.dll
2012-09-06 20:06:52 ----A---- C:\WINDOWS\system32\X3DAudio1_5.dll
2012-09-06 20:06:51 ----A---- C:\WINDOWS\system32\xactengine3_2.dll
2012-09-06 20:06:51 ----A---- C:\WINDOWS\system32\D3DX9_39.dll
2012-09-06 20:06:51 ----A---- C:\WINDOWS\system32\d3dx10_39.dll
2012-09-06 20:06:51 ----A---- C:\WINDOWS\system32\D3DCompiler_39.dll
2012-09-06 20:06:50 ----A---- C:\WINDOWS\system32\XAudio2_1.dll
2012-09-06 20:06:50 ----A---- C:\WINDOWS\system32\XAPOFX1_0.dll
2012-09-06 20:06:50 ----A---- C:\WINDOWS\system32\xactengine3_1.dll
2012-09-06 20:06:50 ----A---- C:\WINDOWS\system32\X3DAudio1_4.dll
2012-09-06 20:06:49 ----A---- C:\WINDOWS\system32\XAudio2_0.dll
2012-09-06 20:06:49 ----A---- C:\WINDOWS\system32\D3DX9_38.dll
2012-09-06 20:06:49 ----A---- C:\WINDOWS\system32\d3dx10_38.dll
2012-09-06 20:06:49 ----A---- C:\WINDOWS\system32\D3DCompiler_38.dll
2012-09-06 20:06:48 ----A---- C:\WINDOWS\system32\xactengine3_0.dll
2012-09-06 20:06:48 ----A---- C:\WINDOWS\system32\X3DAudio1_3.dll
2012-09-06 20:06:48 ----A---- C:\WINDOWS\system32\d3dx10_37.dll
2012-09-06 20:06:48 ----A---- C:\WINDOWS\system32\D3DCompiler_37.dll
2012-09-06 20:06:47 ----A---- C:\WINDOWS\system32\xactengine2_10.dll
2012-09-06 20:06:47 ----A---- C:\WINDOWS\system32\D3DX9_37.dll
2012-09-06 20:06:47 ----A---- C:\WINDOWS\system32\d3dx10_36.dll
2012-09-06 20:06:47 ----A---- C:\WINDOWS\system32\D3DCompiler_36.dll
2012-09-06 20:06:46 ----A---- C:\WINDOWS\system32\xactengine2_9.dll
2012-09-06 20:06:46 ----A---- C:\WINDOWS\system32\d3dx9_36.dll
2012-09-06 20:06:45 ----A---- C:\WINDOWS\system32\xactengine2_8.dll
2012-09-06 20:06:45 ----A---- C:\WINDOWS\system32\X3DAudio1_2.dll
2012-09-06 20:06:45 ----A---- C:\WINDOWS\system32\d3dx9_35.dll
2012-09-06 20:06:45 ----A---- C:\WINDOWS\system32\d3dx10_35.dll
2012-09-06 20:06:45 ----A---- C:\WINDOWS\system32\D3DCompiler_35.dll
2012-09-06 20:06:44 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2012-09-06 20:06:44 ----A---- C:\WINDOWS\system32\d3dx9_34.dll
2012-09-06 20:06:44 ----A---- C:\WINDOWS\system32\d3dx10_34.dll
2012-09-06 20:06:44 ----A---- C:\WINDOWS\system32\D3DCompiler_34.dll
2012-09-06 20:06:43 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
2012-09-06 20:06:43 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
2012-09-06 20:06:43 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
2012-09-06 20:06:42 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
2012-09-06 20:06:42 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2012-09-06 20:06:42 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
2012-09-06 20:06:42 ----A---- C:\WINDOWS\system32\d3dx9_32.dll
2012-09-06 20:06:41 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2012-09-06 20:06:41 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2012-09-06 20:06:41 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2012-09-06 20:06:41 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2012-09-06 20:06:41 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2012-09-06 20:06:41 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2012-09-06 20:06:40 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2012-09-06 20:06:40 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2012-09-06 20:06:39 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2012-09-06 20:06:38 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2012-09-06 20:06:38 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2012-09-06 20:06:38 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2012-09-06 20:06:38 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2012-09-06 20:06:38 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2012-09-06 20:06:37 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2012-09-06 20:06:37 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2012-09-06 20:06:37 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2012-09-06 20:04:58 ----HD---- C:\WINDOWS\msdownld.tmp
2012-09-06 20:04:56 ----D---- C:\WINDOWS\Logs
2012-09-03 11:41:40 ----D---- C:\CFLog
2012-09-03 11:35:16 ----D---- C:\SG Interactive
2012-09-03 11:16:39 ----D---- C:\Documents and Settings\All Users\Data aplikací\PMB Files
2012-09-03 11:16:08 ----D---- C:\Program Files\Pando Networks
2012-08-31 21:49:22 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Unity
2012-08-31 21:32:00 ----D---- C:\WINDOWS\Sun
2012-08-31 18:58:15 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Macromedia
2012-08-31 16:17:27 ----A---- C:\WINDOWS\system32\drivers\dtsoftbus01.sys
2012-08-31 16:17:15 ----D---- C:\Program Files\DAEMON Tools Lite
2012-08-31 16:15:04 ----D---- C:\Documents and Settings\Administrator\Data aplikací\.minecraft
2012-08-31 16:13:53 ----D---- C:\Documents and Settings\All Users\Data aplikací\Sun
2012-08-31 16:13:45 ----A---- C:\WINDOWS\system32\npDeployJava1.dll
2012-08-31 16:13:45 ----A---- C:\WINDOWS\system32\javaws.exe
2012-08-31 16:13:45 ----A---- C:\WINDOWS\system32\deployJava1.dll
2012-08-31 16:13:31 ----A---- C:\WINDOWS\system32\WindowsAccessBridge.dll
2012-08-31 16:10:57 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Sun
2012-08-31 16:00:28 ----D---- C:\Documents and Settings\Administrator\Data aplikací\DAEMON Tools Lite
2012-08-31 15:59:22 ----D---- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
2012-08-31 13:21:34 ----D---- C:\Program Files\uTorrent
2012-08-31 13:20:37 ----D---- C:\Documents and Settings\Administrator\Data aplikací\uTorrent
2012-08-31 12:54:44 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Adobe
2012-08-31 12:36:15 ----D---- C:\Program Files\Counter-Strike 1.6 Non-Steam
2012-08-31 11:39:33 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2012-08-31 11:13:48 ----SHD---- C:\RECYCLER
2012-08-31 11:11:28 ----D---- C:\Program Files\Microsoft Silverlight
2012-08-31 11:10:55 ----D---- C:\Documents and Settings\Administrator\Data aplikací\OpenCandy
2012-08-31 11:10:51 ----D---- C:\Program Files\Ask.com
2012-08-31 11:10:36 ----D---- C:\Program Files\DsNET Corp
2012-08-31 11:09:06 ----D---- C:\Documents and Settings\All Users\Data aplikací\Ask
2012-08-31 11:04:27 ----D---- C:\Documents and Settings\Administrator\Data aplikací\ICQ Search
2012-08-31 11:04:20 ----D---- C:\Program Files\ICQ6Toolbar
2012-08-31 11:04:19 ----D---- C:\Program Files\Guard-ICQ
2012-08-31 11:04:18 ----D---- C:\Documents and Settings\All Users\Data aplikací\ICQ
2012-08-31 11:04:18 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Mozilla
2012-08-31 11:04:07 ----D---- C:\Documents and Settings\Administrator\Data aplikací\ICQ
2012-08-31 11:04:00 ----D---- C:\Program Files\ICQ7M
2012-08-31 11:02:17 ----D---- C:\Documents and Settings\Administrator\Data aplikací\PhotoScape
2012-08-31 11:02:08 ----D---- C:\Program Files\PhotoScape
2012-08-31 10:56:28 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Skype
2012-08-31 10:56:23 ----RD---- C:\Program Files\Skype
2012-08-31 10:56:23 ----D---- C:\Program Files\Common Files\Skype
2012-08-31 10:56:17 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype

======List of files/folders modified in the last 1 month======

2012-09-09 20:24:39 ----RD---- C:\Program Files
2012-09-09 20:24:32 ----D---- C:\WINDOWS\system32\drivers
2012-09-09 20:13:12 ----D---- C:\WINDOWS\system32
2012-09-09 20:13:10 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2012-09-09 20:08:10 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-09-09 20:07:40 ----D---- C:\WINDOWS\Temp
2012-09-09 18:27:59 ----D---- C:\WINDOWS
2012-09-09 16:12:06 ----D---- C:\WINDOWS\system32\CatRoot2
2012-09-09 13:02:51 ----SHD---- C:\WINDOWS\Installer
2012-09-08 15:20:27 ----HD---- C:\WINDOWS\inf
2012-09-07 17:56:02 ----D---- C:\WINDOWS\system32\DirectX
2012-09-07 17:52:18 ----HD---- C:\Program Files\InstallShield Installation Information
2012-09-07 13:00:19 ----D---- C:\WINDOWS\SoftwareDistribution
2012-09-06 20:06:40 ----RSD---- C:\WINDOWS\assembly
2012-09-02 17:08:27 ----RSD---- C:\WINDOWS\Fonts
2012-08-31 16:13:53 ----D---- C:\Program Files\Common Files\Java
2012-08-31 16:13:21 ----A---- C:\WINDOWS\system32\javaw.exe
2012-08-31 16:13:21 ----A---- C:\WINDOWS\system32\java.exe
2012-08-31 16:13:17 ----D---- C:\Program Files\Java
2012-08-31 11:39:37 ----SD---- C:\WINDOWS\Downloaded Program Files
2012-08-31 11:39:34 ----SD---- C:\WINDOWS\Tasks
2012-08-31 10:54:36 ----SD---- C:\Documents and Settings\Administrator\Data aplikací\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2005-04-25 20640]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-17 14848]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2004-08-04 8832]
R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\system32\DRIVERS\dtsoftbus01.sys [2012-08-31 242240]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
S1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-18 39936]
S1 P3;Ovladač procesoru Intel PentiumIII; C:\WINDOWS\system32\DRIVERS\p3.sys [2006-03-02 46336]
S3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2005-04-08 132352]
S3 Blfp;Broadcom Advanced Server Program Driver; C:\WINDOWS\system32\DRIVERS\baspxp32.sys [2005-03-04 65664]
S3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-10-24 117760]
S3 ewusbnet;HUAWEI USB-NDIS miniport; C:\WINDOWS\system32\DRIVERS\ewusbnet.sys [2009-07-23 112640]
S3 HdAudAddService;Ovladač funkcí Microsoft UAA pro služby sběrnice High Definition Audio; C:\WINDOWS\system32\drivers\HdAudio.sys [2005-01-07 145920]
S3 HPKBCCID;HP Keyboard Smart Card Driver; C:\WINDOWS\system32\DRIVERS\HPKBCCID.sys [2005-08-04 48512]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys [2009-07-23 102528]
S3 i81x;i81x; C:\WINDOWS\system32\DRIVERS\i81xnt5.sys [2004-08-04 161020]
S3 iAimFP0;iAimFP0; C:\WINDOWS\system32\DRIVERS\wADV01nt.sys [2004-08-04 12415]
S3 iAimFP1;iAimFP1; C:\WINDOWS\system32\DRIVERS\wADV02NT.sys [2004-08-04 12127]
S3 iAimFP2;iAimFP2; C:\WINDOWS\system32\DRIVERS\wADV05NT.sys [2004-08-04 11775]
S3 iAimFP3;iAimFP3; C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys [2004-08-04 12063]
S3 iAimFP4;iAimFP4; C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys [2004-08-04 19455]
S3 iAimFP5;iAimFP5; C:\WINDOWS\system32\DRIVERS\wADV07nt.sys [2004-08-04 11807]
S3 iAimFP6;iAimFP6; C:\WINDOWS\system32\DRIVERS\wADV08nt.sys [2004-08-04 11295]
S3 iAimFP7;iAimFP7; C:\WINDOWS\system32\DRIVERS\wADV09nt.sys [2004-08-04 11871]
S3 iAimTV0;iAimTV0; C:\WINDOWS\system32\DRIVERS\wATV01nt.sys [2004-08-04 29311]
S3 iAimTV1;iAimTV1; C:\WINDOWS\system32\DRIVERS\wATV02NT.sys [2004-08-04 19551]
S3 iAimTV3;iAimTV3; C:\WINDOWS\system32\DRIVERS\wATV04nt.sys [2004-08-04 33599]
S3 iAimTV4;iAimTV4; C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys [2004-08-04 23615]
S3 iAimTV5;iAimTV5; C:\WINDOWS\system32\DRIVERS\wATV10nt.sys [2004-08-04 25471]
S3 iAimTV6;iAimTV6; C:\WINDOWS\system32\DRIVERS\wATV06nt.sys [2004-08-04 22271]
S3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-04-05 830684]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-03-05 2538624]
S3 MBAMProtector;MBAMProtector; \??\C:\WINDOWS\system32\drivers\mbam.sys []
S3 XDva399;XDva399; \??\C:\WINDOWS\system32\XDva399.sys []
S4 adpu320;adpu320; C:\WINDOWS\system32\DRIVERS\adpu320.sys [2002-05-09 105472]
S4 Symmpi;Symmpi; C:\WINDOWS\system32\DRIVERS\symmpi.sys [2002-04-04 28416]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 Guard.Mail.ru;Guard.Mail.ru; C:\Program Files\Guard-ICQ\GuardICQ.exe [2012-08-31 1564368]
S2 ICQ Service;ICQ Service; C:\PROGRA~1\ICQ6TO~1\ICQSER~1.EXE [2012-03-20 247872]
S2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre7\bin\jqs.exe [2012-08-31 161768]
S2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-07-13 160944]
S2 VMCService;Vodafone Mobile Connect Service; C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2009-09-18 9216]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-31 250568]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 hpqwmi;HP WMI Interface; C:\Program Files\HPQ\Shared\hpqwmi.exe [2005-10-04 94208]

-----------------EOF-----------------

Je toho tam víc. Dejte log ComboFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

ComboFix 12-09-09.02 - Administrator 09.09.2012 20:52:00.1.2 - x86 MINIMAL
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1527.1009 [GMT 2:00]
Spuštěný z: E:\ComboFix.exe
.
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\CFLog
c:\documents and settings\All Users\Data aplikací\036E18D42B17D97971BF924EE56C3425\036E18D42B17D97971BF924EE56C3425.exe
c:\windows\IsUn0405.exe
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-08-09 do 2012-09-09 )))))))))))))))))))))))))))))))
.
.
2012-09-09 18:24 . 2012-09-09 18:24 -------- d-----w- c:\program files\trend micro
2012-09-09 18:07 . 2012-09-09 18:24 -------- d-----w- C:\rsit
2012-09-09 16:29 . 2012-09-09 16:29 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Malwarebytes
2012-09-09 16:29 . 2012-09-09 16:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-09-09 16:29 . 2012-07-03 11:46 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-09-09 14:12 . 2012-09-09 14:08 388608 ----a-w- C:\hijackthis.exe
2012-09-08 18:30 . 2012-09-08 19:51 -------- d-----w- c:\program files\Sindicate
2012-09-07 21:06 . 2012-09-07 21:06 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Media Player Classic
2012-09-07 16:40 . 2012-09-07 16:40 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\LolClient
2012-09-07 15:52 . 2012-09-07 15:52 -------- d-----w- C:\Riot Games
2012-09-07 13:44 . 2012-09-07 13:44 -------- d-----w- c:\program files\Rockstar Games
2012-09-06 18:04 . 2012-09-07 11:44 -------- d--h--w- c:\windows\msdownld.tmp
2012-09-06 18:04 . 2012-09-06 18:04 -------- d-----w- c:\windows\Logs
2012-09-03 12:26 . 2012-09-03 12:26 -------- d-----w- c:\documents and settings\Administrator\kbpki
2012-09-03 09:35 . 2012-09-03 09:35 -------- d-----w- C:\SG Interactive
2012-09-03 09:16 . 2012-09-08 16:48 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\PMB Files
2012-09-03 09:16 . 2012-09-03 09:16 -------- d-----w- c:\documents and settings\All Users\Data aplikac
2012-09-03 09:16 . 2012-09-03 09:16 -------- d-----w- c:\program files\Pando Networks
2012-08-31 19:49 . 2012-08-31 19:49 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Unity
2012-08-31 19:32 . 2012-08-31 19:32 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Unity
2012-08-31 19:32 . 2012-08-31 19:32 -------- d-----w- c:\windows\Sun
2012-08-31 16:08 . 2012-08-31 16:08 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Sun
2012-08-31 14:17 . 2012-08-31 14:17 242240 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-08-31 14:17 . 2012-08-31 14:17 -------- d-----w- c:\program files\DAEMON Tools Lite
2012-08-31 14:15 . 2012-08-31 14:15 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\.minecraft
2012-08-31 14:13 . 2012-08-31 14:13 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-08-31 14:13 . 2012-08-31 14:13 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-08-31 14:13 . 2012-08-31 14:13 143872 ----a-w- c:\windows\system32\javacpl.cpl
2012-08-31 14:13 . 2012-08-31 14:13 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-08-31 14:00 . 2012-09-07 21:12 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\DAEMON Tools Lite
2012-08-31 11:21 . 2012-08-31 11:21 -------- d-----w- c:\program files\uTorrent
2012-08-31 11:20 . 2012-09-06 19:39 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\uTorrent
2012-08-31 10:36 . 2012-09-08 19:40 -------- d-----w- c:\program files\Counter-Strike 1.6 Non-Steam
2012-08-31 09:39 . 2012-08-31 09:39 73416 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-31 09:39 . 2012-08-31 09:39 696520 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-31 09:11 . 2012-08-31 09:11 -------- d-----w- c:\program files\Microsoft Silverlight
2012-08-31 09:10 . 2012-08-31 09:10 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\OpenCandy
2012-08-31 09:10 . 2012-08-31 09:10 -------- d-----w- c:\program files\Ask.com
2012-08-31 09:10 . 2012-08-31 09:13 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\AskToolbar
2012-08-31 09:10 . 2012-08-31 09:10 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\APN
2012-08-31 09:10 . 2012-08-31 09:10 -------- d-----w- c:\program files\DsNET Corp
2012-08-31 09:04 . 2012-08-31 09:04 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\ICQ Search
2012-08-31 09:04 . 2012-08-31 09:04 -------- d-----w- c:\program files\ICQ6Toolbar
2012-08-31 09:04 . 2012-08-31 09:04 -------- d-----w- c:\documents and settings\LocalService\Data aplikací\{DCD48218-E972-4d0c-9E5F-43462BC13E3B}
2012-08-31 09:04 . 2012-08-31 09:04 -------- d-----w- c:\program files\Guard-ICQ
2012-08-31 09:04 . 2012-08-31 09:38 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\ICQ
2012-08-31 09:04 . 2012-08-31 09:38 -------- d-----w- c:\program files\ICQ7M
2012-08-31 09:02 . 2012-08-31 09:02 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\PhotoScape
2012-08-31 09:02 . 2012-08-31 09:02 -------- d-----w- c:\program files\PhotoScape
2012-08-31 08:58 . 2012-08-31 08:59 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Google
2012-08-31 08:57 . 2012-08-31 08:58 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Deployment
2012-08-31 08:57 . 2012-08-31 08:57 -------- d-s---w- c:\documents and settings\Administrator\UserData
2012-08-31 08:56 . 2012-09-09 10:56 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Skype
2012-08-31 08:56 . 2012-08-31 08:56 -------- d-----r- c:\program files\Skype
2012-08-31 08:56 . 2012-08-31 08:56 -------- d-----w- c:\program files\Common Files\Skype
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-06-06 1519304]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-06-06 19:33 1519304 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-06-06 1519304]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-06-06 1519304]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-07-13 17420464]
"ICQ"="c:\program files\ICQ7M\ICQ.exe" [2012-08-31 127040]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2012-04-17 3671872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-04-05 94208]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-04-05 77824]
"Persistence"="c:\windows\system32\igfxpers.exe" [2005-04-05 114688]
"Zástupce stránky vlastností sběrnice High Definition Audio"="HDAShCut.exe" [2005-01-07 61952]
"RTHDCPL"="RTHDCPL.EXE" [2005-03-08 13924864]
"PTHOSTTR"="c:\program files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2005-10-04 86016]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"LayoutM"="KLayMgr.exe" [2004-08-16 45056]
"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2009-09-18 2412032]
"Guard.Mail.ru.gui"="c:\program files\Guard-ICQ\GuardICQ.exe" [2012-08-31 1564368]
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2012-06-06 1564872]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
.
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Sonic CinePlayer Quick Launch.lnk - c:\program files\Common Files\Sonic Shared\CineTray.exe [2005-10-15 114688]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\ICQ7M\\ICQ.exe"=
"c:\\Program Files\\Counter-Strike 1.6 Non-Steam\\hl.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57858:TCP"= 57858:TCP:Pando Media Booster
"57858:UDP"= 57858:UDP:Pando Media Booster
.
R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [31.8.2012 16:17 242240]
S2 Guard.Mail.ru;Guard.Mail.ru;c:\program files\Guard-ICQ\GuardICQ.exe [31.8.2012 11:04 1564368]
S2 ICQ Service;ICQ Service;c:\progra~1\ICQ6TO~1\ICQSER~1.EXE [31.8.2012 11:04 247872]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [9.9.2012 18:29 655944]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [13.7.2012 13:29 160944]
S2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [18.9.2009 17:48 9216]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [31.8.2012 11:39 250568]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [27.6.2012 11:34 112640]
S3 HPKBCCID;HP Keyboard Smart Card Driver;c:\windows\system32\drivers\HPKBCCID.sys [2.2.2012 22:40 48512]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [9.9.2012 18:29 22344]
S3 XDva399;XDva399;\??\c:\windows\system32\XDva399.sys --> c:\windows\system32\XDva399.sys [?]
.
Obsah adresáře 'Naplánované úlohy'
.
2012-09-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-31 09:39]
.
2012-09-09 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2012-06-06 19:33]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://eu.ask.com/?l=dis&o=14672
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files\ICQ7M\ICQ.exe
TCP: DhcpNameServer = 192.168.0.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-Software Setup - c:\windows\IsUn0405.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-09-09 20:57
Windows 5.1.2600 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Celkový čas: 2012-09-09 20:58:56
ComboFix-quarantined-files.txt 2012-09-09 18:58
.
Před spuštěním: Volných bajtů: 54 647 087 104
Po spuštění: Volných bajtů: 54 802 395 136
.
- - End Of File - - 816E4F60E9A05537FC117A184DDF31DC

Ještě dočistíme. Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Folder::
c:\program files\Ask.com

Collect::
c:\windows\system32\XDva399.sys
c:\windows\Tasks\Scheduled Update for Ask Toolbar.job

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ApnUpdater"=-
[-HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

Driver::
XDva399

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

Reboot::

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

Jak to tu vypadá?

//edit

Pro neaktivitu uzamknuto, viz pravidla
http://forum.viry.cz/viewtopic.php?f=12&t=123975


Pokud chcete topic odemknout, kontaktujte mě nebo někoho z moderátorů na email.