Stránka 1 z 3

Skype vir

Napsal: 12 pro 2012 21:32
od lokem22
Dobrý den, stala se mi taková nemylá situace, kterou už sem tu jednou řešil..odkaz: http://forum.viry.cz/viewtopic.php?f=13&t=124676 . Stalo se to náhodou..omylem sem na to zase kliknul, když mi to poslal kámoš. Zrovna sem něco řešil a když mi to poslal, tak sem ani nekouk, co to je..jinak bych to už neotevřel. Je to nějakej vir přes skype..tentokrát to píše : haha se podíváte blázen v obrázku hxxp://xrl.us/bn54hv?foto=jiri.rojkovic. Byl bych moc rád, kdyby mi zase někdo pomohl. Děkuju

Re: Skype vir

Napsal: 12 pro 2012 21:41
od vyosek

Re: Skype vir

Napsal: 12 pro 2012 21:47
od lokem22
Také zdravim.. :)


Logfile of random's system information tool 1.09 (written by random/random)
Run by Martin at 2012-12-12 21:44:09
Microsoft Windows 7 Ultimate
System drive C: has 24 GB (35%) free of 70 GB
Total RAM: 3071 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:44:31, on 12.12.2012
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\GIGABYTE\GHOST\Tilt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Windows\system32\taskhost.exe
D:\Hry\Steam\Steam.exe
C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Users\Martin\Desktop\RSIT.exe
C:\Users\Martin\AppData\Roaming\4026.exe
C:\Program Files\trend micro\Martin.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [Tilt] C:\Program Files\GIGABYTE\GHOST\Tilt.exe
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7M\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [Klrory] C:\Users\Martin\AppData\Roaming\Klrory.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files\ICQ7M\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files\ICQ7M\ICQ.exe
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: AfterFLICS v3 - Unknown owner - C:\Program Files\AFLICS\AfterFLICS.exe
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: mental ray 3.7 Satellite for Autodesk 3ds Max 2010 32-bit 32-bit (mi-raysat_3dsmax2010_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe
O23 - Service: mental ray 3.10 Satellite for Autodesk 3ds Max 2013 32-bit (mi-raysat_3dsmax2013_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2013\NVIDIA\raysat_3dsmax2013_32server.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PandoraService (PanService) - Pandora.TV - C:\Program Files\PANDORA.TV\PanService\PandoraService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

--
End of file - 7180 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\0wym3m74.default

prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "keyword.URL" - ""

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.5.502.135 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.9.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Windows\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}

C:\Program Files\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nsIQTScriptablePlugin.xpt

C:\Program Files\Mozilla Firefox\searchplugins\
google.xml
heureka-cz.xml
jyxo-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\0wym3m74.default\extensions\
2020Player_IKEA@2020Technologies.com
{ea614400-e918-4741-9a97-7a972ff7c30b}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-27 63944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2011-02-11 4220304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2012-11-22 449512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-12-21 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2012-11-22 155384]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast!"=C:\Program Files\Alwil Software\Avast4\ashDisp.exe [2008-07-19 78008]
"Tilt"=C:\Program Files\GIGABYTE\GHOST\Tilt.exe [2009-06-26 724992]
"BCSSync"=C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2010-03-13 91520]
"APSDaemon"=C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [2012-10-11 59280]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2012-10-25 421888]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-07-03 252848]
"itype"=c:\Program Files\Microsoft IntelliType Pro\itype.exe [2011-08-10 1313640]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"=C:\Program Files\uTorrent\uTorrent.exe [2012-08-20 896400]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2012-08-28 3671904]
"ICQ"=C:\Program Files\ICQ7M\ICQ.exe [2012-11-18 127040]
"Klrory"=C:\Users\Martin\AppData\Roaming\Klrory.exe [2012-12-12 130560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\system32\webcheck.dll [2009-07-14 229376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2011-02-11 4220304]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"vidc.tscc"=tsccvid.dll
"msacm.l3codec"=l3codecp.acm

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2012-12-12 21:44:10 ----A---- C:\Users\Martin\AppData\Roaming\4026.exe
2012-12-12 21:44:09 ----D---- C:\rsit
2012-12-12 21:44:08 ----A---- C:\Users\Martin\AppData\Roaming\Klrory.exe
2012-12-12 21:40:48 ----A---- C:\Users\Martin\AppData\Roaming\2767.exe
2012-12-12 21:37:02 ----A---- C:\Users\Martin\AppData\Roaming\B6F8.exe
2012-12-12 21:33:38 ----A---- C:\Users\Martin\AppData\Roaming\9A05.exe
2012-12-12 21:29:53 ----A---- C:\Users\Martin\AppData\Roaming\2909.exe
2012-12-12 21:26:30 ----A---- C:\Users\Martin\AppData\Roaming\11C1.exe
2012-12-12 21:23:07 ----A---- C:\Users\Martin\AppData\Roaming\FA79.exe
2012-12-12 21:19:22 ----A---- C:\Users\Martin\AppData\Roaming\8A96.exe
2012-12-12 21:15:59 ----A---- C:\Users\Martin\AppData\Roaming\72A2.exe
2012-12-12 21:12:36 ----A---- C:\Users\Martin\AppData\Roaming\5947.exe
2012-12-12 21:09:14 ----A---- C:\Users\Martin\AppData\Roaming\42BA.exe
2012-12-12 21:05:50 ----A---- C:\Users\Martin\AppData\Roaming\27AB.exe
2012-12-12 21:02:05 ----A---- C:\Users\Martin\AppData\Roaming\B6FD.exe
2012-12-12 20:58:17 ----A---- C:\Users\Martin\AppData\Roaming\3B29.exe
2012-12-12 20:54:34 ----A---- C:\Users\Martin\AppData\Roaming\D499.exe
2012-12-12 20:51:13 ----A---- C:\Users\Martin\AppData\Roaming\C4A0.exe
2012-12-12 20:47:53 ----A---- C:\Users\Martin\AppData\Roaming\B5FF.exe
2012-12-12 20:44:10 ----A---- C:\Users\Martin\AppData\Roaming\4E85.exe
2012-12-12 20:40:27 ----A---- C:\Users\Martin\AppData\Roaming\E778.exe
2012-12-12 20:36:43 ----A---- C:\Users\Martin\AppData\Roaming\7C66.exe
2012-12-12 20:33:21 ----A---- C:\Users\Martin\AppData\Roaming\68B6.exe
2012-12-12 20:29:59 ----A---- C:\Users\Martin\AppData\Roaming\51AC.exe
2012-12-12 20:26:11 ----A---- C:\Users\Martin\AppData\Roaming\DA4B.exe
2012-12-12 20:22:27 ----A---- C:\Users\Martin\AppData\Roaming\6F57.exe
2012-12-12 20:19:06 ----A---- C:\Users\Martin\AppData\Roaming\5B98.exe
2012-12-12 20:15:43 ----A---- C:\Users\Martin\AppData\Roaming\45A7.exe
2012-12-12 20:12:20 ----A---- C:\Users\Martin\AppData\Roaming\2B33.exe
2012-12-12 20:08:37 ----A---- C:\Users\Martin\AppData\Roaming\C36B.exe
2012-12-12 20:04:54 ----A---- C:\Users\Martin\AppData\Roaming\5C20.exe
2012-12-12 20:01:10 ----A---- C:\Users\Martin\AppData\Roaming\F2B3.exe
2012-12-12 19:57:43 ----A---- C:\Users\Martin\AppData\Roaming\C99F.exe
2012-12-12 19:54:20 ----A---- C:\Users\Martin\AppData\Roaming\AF6A.exe
2012-12-12 19:50:56 ----A---- C:\Users\Martin\AppData\Roaming\9313.exe
2012-12-12 19:47:30 ----A---- C:\Users\Martin\AppData\Roaming\6D4A.exe
2012-12-09 14:13:22 ----D---- C:\Users\Martin\AppData\Roaming\Xilisoft
2012-12-02 20:19:31 ----D---- C:\Program Files\Mozilla Firefox
2012-12-01 16:06:36 ----D---- C:\Program Files\ZAV1
2012-11-30 14:33:31 ----D---- C:\Program Files\Microsoft IntelliType Pro
2012-11-29 23:31:48 ----D---- C:\ProgramData\Orbit
2012-11-28 19:59:33 ----D---- C:\Program Files\GamePark
2012-11-28 17:37:31 ----A---- C:\Windows\game.ini
2012-11-22 20:17:08 ----D---- C:\Program Files\AFLICS
2012-11-22 20:16:18 ----D---- C:\Program Files\Common Files\InstallShield
2012-11-22 15:03:47 ----D---- C:\Program Files\SystemRequirementsLab
2012-11-22 14:59:22 ----D---- C:\ProgramData\Sun
2012-11-22 14:59:21 ----D---- C:\Program Files\Common Files\Java
2012-11-22 14:59:15 ----A---- C:\Windows\system32\npDeployJava1.dll
2012-11-22 14:59:15 ----A---- C:\Windows\system32\javaws.exe
2012-11-22 14:59:15 ----A---- C:\Windows\system32\deployJava1.dll
2012-11-22 14:59:06 ----A---- C:\Windows\system32\WindowsAccessBridge.dll
2012-11-22 14:59:06 ----A---- C:\Windows\system32\javaw.exe
2012-11-22 14:59:06 ----A---- C:\Windows\system32\java.exe
2012-11-22 14:58:58 ----D---- C:\Program Files\Java
2012-11-21 23:34:14 ----D---- C:\Program Files\Common Files\Alias Shared
2012-11-20 23:28:51 ----D---- C:\Users\Martin\AppData\Roaming\Theta
2012-11-18 14:34:13 ----D---- C:\Windows\Minidump
2012-11-18 14:10:29 ----D---- C:\Program Files\ICQ7M

======List of files/folders modified in the last 1 month======

2012-12-12 21:44:26 ----D---- C:\Windows\temp
2012-12-12 21:44:26 ----D---- C:\Program Files\trend micro
2012-12-12 21:44:08 ----D---- C:\Users\Martin\AppData\Roaming\uTorrent
2012-12-12 21:34:16 ----D---- C:\Users\Martin\AppData\Roaming\Skype
2012-12-12 16:54:38 ----D---- C:\Windows\System32
2012-12-12 16:54:36 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2012-12-12 13:13:16 ----D---- C:\Program Files\Common Files\Steam
2012-12-12 13:05:27 ----D---- C:\Users\Martin\AppData\Roaming\ICQ
2012-12-09 19:49:31 ----RD---- C:\Program Files
2012-12-09 19:49:31 ----D---- C:\ProgramData
2012-12-09 14:11:37 ----SHD---- C:\Windows\Installer
2012-12-09 14:11:10 ----D---- C:\Program Files\Common Files
2012-12-08 12:23:34 ----A---- C:\Windows\system32\PnkBstrB.exe
2012-12-07 15:22:21 ----D---- C:\Windows\system32\config
2012-12-07 15:08:55 ----SHD---- C:\System Volume Information
2012-12-04 15:40:05 ----D---- C:\Windows\inf
2012-12-04 15:40:05 ----A---- C:\Windows\system32\PerfStringBackup.INI
2012-12-04 11:40:13 ----D---- C:\Program Files\Mozilla Maintenance Service
2012-12-01 00:13:09 ----D---- C:\Windows\system32\catroot2
2012-11-30 14:34:03 ----SD---- C:\Users\Martin\AppData\Roaming\Microsoft
2012-11-30 14:34:03 ----D---- C:\Windows\system32\Tasks
2012-11-30 14:33:46 ----D---- C:\Windows\system32\DriverStore
2012-11-30 14:33:46 ----D---- C:\Windows\system32\catroot
2012-11-30 14:33:33 ----RSD---- C:\Windows\Fonts
2012-11-30 14:33:24 ----D---- C:\Windows\winsxs
2012-11-30 14:33:05 ----D---- C:\Windows\Prefetch
2012-11-29 23:21:26 ----A---- C:\Windows\system32\PnkBstrA.exe
2012-11-29 23:21:20 ----D---- C:\Program Files\Ubisoft
2012-11-29 23:20:46 ----RSD---- C:\Windows\assembly
2012-11-29 23:09:27 ----HD---- C:\Program Files\InstallShield Installation Information
2012-11-28 17:38:24 ----D---- C:\Windows
2012-11-23 21:00:59 ----D---- C:\Windows\system32\directx
2012-11-21 23:36:53 ----D---- C:\Users\Martin\AppData\Roaming\Autodesk
2012-11-21 23:36:53 ----D---- C:\ProgramData\Autodesk
2012-11-21 23:35:33 ----D---- C:\Program Files\Common Files\Autodesk Shared
2012-11-21 23:34:36 ----D---- C:\Program Files\Autodesk
2012-11-21 16:40:52 ----D---- C:\ProgramData\boost_interprocess

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 173648]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2008-07-19 23152]
R1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2008-07-19 78416]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2008-07-19 42912]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 387584]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-09-06 242240]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-19 51280]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2012-07-28 8758784]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2012-07-28 296448]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW73.sys [2012-05-14 86656]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 netr28u;RT2870 USB Wireless LAN Card Driver pro systém Windows Vista; C:\Windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x32.sys [2009-07-13 347264]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 CFcatchme;CFcatchme; \??\C:\Users\Martin\AppData\Local\Temp\CFcatchme.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 28224]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]
R2 AfterFLICS v3;AfterFLICS v3; C:\Program Files\AFLICS\AfterFLICS.exe [2012-11-21 135170]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2012-07-28 217600]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2008-07-19 16056]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2008-07-19 147640]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 390504]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 mi-raysat_3dsmax2010_32;mental ray 3.7 Satellite for Autodesk 3ds Max 2010 32-bit 32-bit; C:\Program Files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe [2009-03-12 86016]
R2 mi-raysat_3dsmax2013_32;mental ray 3.10 Satellite for Autodesk 3ds Max 2013 32-bit; C:\Program Files\Autodesk\3ds Max 2013\NVIDIA\raysat_3dsmax2013_32server.exe [2011-09-14 86016]
R2 PanService;PandoraService; C:\Program Files\PANDORA.TV\PanService\PandoraService.exe [2012-06-22 625816]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2012-11-29 76888]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2008-07-19 250040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2008-07-19 348344]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2012-12-12 541168]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2012-07-13 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-12 250808]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2012-09-21 1044816]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2010-12-27 31124344]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2012-12-02 115168]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 SwitchBoard;SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

Re: Skype vir

Napsal: 12 pro 2012 21:50
od vyosek
Na ty Office jste si jiz koupil licenci nebo jsou tam porad ty cracknute :???:

Re: Skype vir

Napsal: 12 pro 2012 21:52
od lokem22
Já je dám pryč..

Re: Skype vir

Napsal: 12 pro 2012 22:03
od lokem22
Tak už sem to odinstaloval..

Re: Skype vir

Napsal: 12 pro 2012 22:06
od vyosek
:arrow: Pokud tam budou i priste, tak pomoc odmitneme :!:

:arrow: Kamaradovi tez doporucte vycisteni PC tady u nas, at vam to porad neposila

:arrow: Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
:arrow: Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
  • Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
  • Pokud mate Win XP spustte pod uctem Spravce\Administratora
  • Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
  • Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
  • Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
  • Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
  • Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
  • Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
  • Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

Re: Skype vir

Napsal: 12 pro 2012 22:40
od lokem22
Rkill 2.4.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 12/12/2012 10:19:31 PM in x86 mode.
Windows Version: Windows 7 Ultimate

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* C:\Users\Martin\AppData\Roaming\A1CF.exe (PID: 1088) [UP-HEUR]

1 proccess terminated!

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* No issues found.

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost
127.0.0.1 activate.adobe.com

Program finished at: 12/12/2012 10:19:45 PM
Execution time: 0 hours(s), 0 minute(s), and 13 seconds(s)







ComboFix 12-12-10.01 - Martin 12.12.2012 22:29:54.3.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.3071.1774 [GMT 1:00]
Spuštěný z: c:\users\Martin\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Martin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{4C1F911A-5F9E-4568-8CA0-0CAEA23FDDA0}.xps
c:\users\Martin\AppData\Roaming\11C1.exe
c:\users\Martin\AppData\Roaming\1357.exe
c:\users\Martin\AppData\Roaming\2767.exe
c:\users\Martin\AppData\Roaming\27AB.exe
c:\users\Martin\AppData\Roaming\2909.exe
c:\users\Martin\AppData\Roaming\299E.exe
c:\users\Martin\AppData\Roaming\2B33.exe
c:\users\Martin\AppData\Roaming\3B29.exe
c:\users\Martin\AppData\Roaming\4026.exe
c:\users\Martin\AppData\Roaming\4192.exe
c:\users\Martin\AppData\Roaming\42BA.exe
c:\users\Martin\AppData\Roaming\45A7.exe
c:\users\Martin\AppData\Roaming\4E85.exe
c:\users\Martin\AppData\Roaming\51AC.exe
c:\users\Martin\AppData\Roaming\5947.exe
c:\users\Martin\AppData\Roaming\5B98.exe
c:\users\Martin\AppData\Roaming\5C20.exe
c:\users\Martin\AppData\Roaming\5EB4.exe
c:\users\Martin\AppData\Roaming\5F7D.exe
c:\users\Martin\AppData\Roaming\68B6.exe
c:\users\Martin\AppData\Roaming\6D4A.exe
c:\users\Martin\AppData\Roaming\6F57.exe
c:\users\Martin\AppData\Roaming\72A2.exe
c:\users\Martin\AppData\Roaming\762B.exe
c:\users\Martin\AppData\Roaming\7C66.exe
c:\users\Martin\AppData\Roaming\82CD.exe
c:\users\Martin\AppData\Roaming\8A96.exe
c:\users\Martin\AppData\Roaming\8C8A.exe
c:\users\Martin\AppData\Roaming\9313.exe
c:\users\Martin\AppData\Roaming\9A05.exe
c:\users\Martin\AppData\Roaming\A1CF.exe
c:\users\Martin\AppData\Roaming\ADD7.exe
c:\users\Martin\AppData\Roaming\AF6A.exe
c:\users\Martin\AppData\Roaming\B5FF.exe
c:\users\Martin\AppData\Roaming\B6F8.exe
c:\users\Martin\AppData\Roaming\B6FD.exe
c:\users\Martin\AppData\Roaming\C36B.exe
c:\users\Martin\AppData\Roaming\C3A9.exe
c:\users\Martin\AppData\Roaming\C4A0.exe
c:\users\Martin\AppData\Roaming\C99F.exe
c:\users\Martin\AppData\Roaming\D499.exe
c:\users\Martin\AppData\Roaming\DA4B.exe
c:\users\Martin\AppData\Roaming\E778.exe
c:\users\Martin\AppData\Roaming\ED49.exe
c:\users\Martin\AppData\Roaming\F2B3.exe
c:\users\Martin\AppData\Roaming\FA79.exe
c:\users\Martin\AppData\Roaming\Klrory.exe
c:\users\Martin\AppData\Roaming\Microsoft\Windows\Recent\GlassVariegato.mat
.
----- Souboroví replikátoři -----
.
c:\users\Martin\AppData\Roaming\11C1.exe
c:\users\Martin\AppData\Roaming\1357.exe
c:\users\Martin\AppData\Roaming\2767.exe
c:\users\Martin\AppData\Roaming\27AB.exe
c:\users\Martin\AppData\Roaming\2909.exe
c:\users\Martin\AppData\Roaming\299E.exe
c:\users\Martin\AppData\Roaming\2B33.exe
c:\users\Martin\AppData\Roaming\3B29.exe
c:\users\Martin\AppData\Roaming\4026.exe
c:\users\Martin\AppData\Roaming\4192.exe
c:\users\Martin\AppData\Roaming\42BA.exe
c:\users\Martin\AppData\Roaming\45A7.exe
c:\users\Martin\AppData\Roaming\4E85.exe
c:\users\Martin\AppData\Roaming\51AC.exe
c:\users\Martin\AppData\Roaming\5947.exe
c:\users\Martin\AppData\Roaming\5B98.exe
c:\users\Martin\AppData\Roaming\5C20.exe
c:\users\Martin\AppData\Roaming\5EB4.exe
c:\users\Martin\AppData\Roaming\5F7D.exe
c:\users\Martin\AppData\Roaming\68B6.exe
c:\users\Martin\AppData\Roaming\6D4A.exe
c:\users\Martin\AppData\Roaming\6F57.exe
c:\users\Martin\AppData\Roaming\72A2.exe
c:\users\Martin\AppData\Roaming\762B.exe
c:\users\Martin\AppData\Roaming\7C66.exe
c:\users\Martin\AppData\Roaming\82CD.exe
c:\users\Martin\AppData\Roaming\8A96.exe
c:\users\Martin\AppData\Roaming\8C8A.exe
c:\users\Martin\AppData\Roaming\9313.exe
c:\users\Martin\AppData\Roaming\9A05.exe
c:\users\Martin\AppData\Roaming\A1CF.exe
c:\users\Martin\AppData\Roaming\ADD7.exe
c:\users\Martin\AppData\Roaming\AF6A.exe
c:\users\Martin\AppData\Roaming\B5FF.exe
c:\users\Martin\AppData\Roaming\B6F8.exe
c:\users\Martin\AppData\Roaming\B6FD.exe
c:\users\Martin\AppData\Roaming\C36B.exe
c:\users\Martin\AppData\Roaming\C3A9.exe
c:\users\Martin\AppData\Roaming\C4A0.exe
c:\users\Martin\AppData\Roaming\C99F.exe
c:\users\Martin\AppData\Roaming\D499.exe
c:\users\Martin\AppData\Roaming\DA4B.exe
c:\users\Martin\AppData\Roaming\E778.exe
c:\users\Martin\AppData\Roaming\ED49.exe
c:\users\Martin\AppData\Roaming\F2B3.exe
c:\users\Martin\AppData\Roaming\FA79.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-11-12 do 2012-12-12 )))))))))))))))))))))))))))))))
.
.
2012-12-12 21:35 . 2012-12-12 21:35 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-12-12 21:35 . 2012-12-12 21:35 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-12-12 20:44 . 2012-12-12 20:44 -------- d-----w- C:\rsit
2012-12-09 13:13 . 2012-12-09 18:50 -------- d-----w- c:\users\Martin\AppData\Roaming\Xilisoft
2012-12-01 15:06 . 2012-12-01 15:06 -------- d-----w- c:\program files\ZAV1
2012-11-30 13:33 . 2012-11-30 13:33 -------- d-----w- c:\program files\Microsoft IntelliType Pro
2012-11-29 22:31 . 2012-11-29 22:31 -------- d-----w- c:\programdata\Orbit
2012-11-28 18:59 . 2012-11-28 18:59 -------- d-----w- c:\program files\GamePark
2012-11-22 19:17 . 2012-11-22 19:23 -------- d-----w- c:\program files\AFLICS
2012-11-22 19:16 . 2012-11-22 19:16 -------- d-----w- c:\program files\Common Files\InstallShield
2012-11-22 14:03 . 2012-11-22 14:03 -------- d-----w- c:\program files\SystemRequirementsLab
2012-11-22 14:03 . 2012-11-22 14:03 -------- d-----w- c:\users\Martin\SystemRequirementsLab
2012-11-22 13:59 . 2012-11-22 13:59 -------- d-----w- c:\program files\Common Files\Java
2012-11-22 13:59 . 2012-11-22 13:59 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-11-22 13:59 . 2012-11-22 13:59 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-11-22 13:59 . 2012-11-22 13:59 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-11-22 13:58 . 2012-11-22 13:58 -------- d-----w- c:\program files\Java
2012-11-21 22:34 . 2012-11-21 22:34 -------- d-----w- c:\users\Martin\AppData\Local\backburner
2012-11-21 22:34 . 2012-11-21 22:34 -------- d-----w- c:\program files\Common Files\Alias Shared
2012-11-20 22:28 . 2012-11-20 22:28 -------- d-----w- c:\users\Martin\AppData\Roaming\Theta
2012-11-18 13:10 . 2012-11-18 13:28 -------- d-----w- c:\program files\ICQ7M
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-12 15:54 . 2012-08-20 10:13 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-12 15:54 . 2012-08-20 10:13 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-12-08 11:23 . 2012-10-30 12:51 138032 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-12-08 11:23 . 2012-10-30 12:51 281688 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-12-08 11:23 . 2012-08-22 11:05 281688 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-12-06 18:57 . 2012-08-20 19:48 281688 ----a-w- c:\windows\system32\PnkBstrB.ex0
2012-11-29 22:21 . 2012-10-30 12:51 76888 ----a-w- c:\windows\system32\PnkBstrA.exe
2012-11-28 16:37 . 2012-08-20 19:49 22328 ----a-w- c:\users\Martin\AppData\Roaming\PnkBstrK.sys
2012-10-30 12:51 . 2012-10-29 16:00 2434856 ----a-w- c:\windows\system32\pbsvc_bc2.exe
2012-10-25 02:12 . 2012-10-25 02:12 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2012-10-25 02:12 . 2012-10-25 02:12 69632 ----a-w- c:\windows\system32\QuickTime.qts
2012-10-09 11:50 . 2012-10-09 11:50 421888 ----a-w- c:\windows\system32\RealMediaSplitter.ax
2012-10-09 11:49 . 2012-10-09 11:49 2174976 ----a-w- c:\program files\Common Files\atimpenc.dll
2012-09-15 21:47 . 2012-09-11 20:29 466944 ------w- c:\windows\Setup1.exe
2012-09-15 21:47 . 2012-09-11 20:29 73216 ----a-w- c:\windows\ST6UNST.EXE
2012-12-02 19:19 . 2012-12-02 19:19 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2012-08-20 896400]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2012-08-28 3671904]
"ICQ"="c:\program files\ICQ7M\ICQ.exe" [2012-11-18 127040]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\program files\Alwil Software\Avast4\ashDisp.exe" [2008-07-19 78008]
"Tilt"="c:\program files\GIGABYTE\GHOST\Tilt.exe" [2009-06-26 724992]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-08-10 1313640]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
R2 AfterFLICS v3;AfterFLICS v3;c:\program files\AFLICS\AfterFLICS.exe [x]
R2 mi-raysat_3dsmax2010_32;mental ray 3.7 Satellite for Autodesk 3ds Max 2010 32-bit 32-bit;c:\program files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe [x]
R2 mi-raysat_3dsmax2013_32;mental ray 3.10 Satellite for Autodesk 3ds Max 2013 32-bit;c:\program files\Autodesk\3ds Max 2013\NVIDIA\raysat_3dsmax2013_32server.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 CFcatchme;CFcatchme;c:\users\Martin\AppData\Local\Temp\CFcatchme.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
S1 aswSP;avast! Self Protection; [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [x]
S2 PanService;PandoraService;c:\program files\PANDORA.TV\PanService\PandoraService.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [x]
S3 netr28u;RT2870 USB Wireless LAN Card Driver pro systém Windows Vista;c:\windows\system32\DRIVERS\netr28u.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2012-12-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-20 15:54]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files\ICQ7M\ICQ.exe
TCP: DhcpNameServer = 192.168.1.1 192.168.1.1
FF - ProfilePath - c:\users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\0wym3m74.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL -
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
HKCU-Run-Klrory - c:\users\Martin\AppData\Roaming\Klrory.exe
AddRemove-Akamai - c:\users\Martin\AppData\Local\Akamai\uninstall.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-2514172838-1309040562-4224439681-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{CB6C33D0-CBF1-0755-57DF-41236D9E5A3F}*]
"jagipblihpampnpbojnm"=hex:62,61,6b,6e,00,00
"jagipblihpampnpbojjm"=hex:62,61,6c,6e,00,00
"iaghoonlabogbpifog"=hex:6b,61,6e,6e,66,69,68,6f,67,6e,65,67,6b,6e,65,6d,6f,6e,
62,69,66,66,00,ff
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2012-12-12 22:36:43
ComboFix-quarantined-files.txt 2012-12-12 21:36
.
Před spuštěním: Volných bajtů: 33 570 287 616
Po spuštění: Volných bajtů: 33 462 382 592
.
- - End Of File - - F04B53C4A08A82672E4E5C5558CEE2E2

Ano..a kámošoj to vyřídim..

Re: Skype vir

Napsal: 12 pro 2012 22:49
od vyosek
:arrow: Poprosim o DDS http://forum.viry.cz/viewtopic.php?f=13&t=125171

:arrow: Stahnete Farbar Service Scanner http://download.bleepingcomputer.com/farbar/FSS.exe
  • Ulozte nejlepe na Plochu
  • U vsech polozek udelejte zatrzitko (tim je oznacite pro skenovani)
  • Kliknete na Scan
  • Po dokonceni skenu se objevi log FSS.txt ten sem vlozte

Re: Skype vir

Napsal: 12 pro 2012 22:58
od lokem22
DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 10.9.2
Run by Martin at 22:55:27 on 2012-12-12
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.420.1029.18.3071.1696 [GMT 1:00]
.
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\system32\atieclxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\GIGABYTE\GHOST\Tilt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\PANDORA.TV\PanService\PandoraService.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\notepad.exe
C:\Windows\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe" /MINIMIZED
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
uRun: [ICQ] "c:\program files\icq7m\ICQ.exe" silent loginmode=4
mRun: [avast!] "c:\program files\alwil software\avast4\ashDisp.exe"
mRun: [Tilt] c:\program files\gigabyte\ghost\Tilt.exe
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [itype] "c:\program files\microsoft intellitype pro\itype.exe"
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~1\micros~2\office14\ONBttnIE.dll/105
IE: {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files\icq7m\ICQ.exe
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{A1F2417C-E1BF-4B1B-A3EA-F5385E8B1AFD} : DHCPNameServer = 192.168.1.1 192.168.1.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\martin\appdata\roaming\mozilla\firefox\profiles\0wym3m74.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL -
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\users\martin\appdata\roaming\mozilla\firefox\profiles\0wym3m74.default\extensions\2020player_ikea@2020technologies.com\plugins\NP_2020Player_IKEA.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_5_502_135.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2012-8-20 78416]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2012-9-6 242240]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-7-28 217600]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-8-20 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-8-20 51280]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2012-8-20 147640]
R2 PanService;PandoraService;c:\program files\pandora.tv\panservice\PandoraService.exe [2012-8-20 625816]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2012-5-14 86656]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2012-8-20 250040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2012-8-20 348344]
R3 netr28u;RT2870 USB Wireless LAN Card Driver pro systém Windows Vista;c:\windows\system32\drivers\netr28u.sys [2009-6-10 657408]
S2 AfterFLICS v3;AfterFLICS v3;c:\program files\aflics\AfterFLICS.exe [2012-11-22 135170]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 mi-raysat_3dsmax2010_32;mental ray 3.7 Satellite for Autodesk 3ds Max 2010 32-bit 32-bit;c:\program files\autodesk\3ds max 2010\mentalray\satellite\raysat_3dsmax2010_32server.exe [2009-3-12 86016]
S2 mi-raysat_3dsmax2013_32;mental ray 3.10 Satellite for Autodesk 3ds Max 2013 32-bit;c:\program files\autodesk\3ds max 2013\nvidia\raysat_3dsmax2013_32server.exe [2011-9-14 86016]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-13 160944]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 SwitchBoard;SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
.
=============== File Associations ===============
.
FileExt: .reg: regfile=regedit.exe "%1" [UserChoice]
.
=============== Created Last 30 ================
.
2012-12-12 21:36:46 -------- d-sh--w- C:\$RECYCLE.BIN
2012-12-12 21:28:39 98816 ----a-w- c:\windows\sed.exe
2012-12-12 21:28:39 256000 ----a-w- c:\windows\PEV.exe
2012-12-12 21:28:39 208896 ----a-w- c:\windows\MBR.exe
2012-12-09 13:13:22 -------- d-----w- c:\users\martin\appdata\roaming\Xilisoft
2012-12-01 15:06:36 -------- d-----w- c:\program files\ZAV1
2012-11-30 13:33:31 -------- d-----w- c:\program files\Microsoft IntelliType Pro
2012-11-29 22:31:48 -------- d-----w- c:\programdata\Orbit
2012-11-28 18:59:33 -------- d-----w- c:\program files\GamePark
2012-11-22 19:17:08 -------- d-----w- c:\program files\AFLICS
2012-11-22 19:16:20 77824 ------w- c:\program files\common files\installshield\engine\6\intel 32\ctor.dll
2012-11-22 19:16:20 32768 ------w- c:\program files\common files\installshield\engine\6\intel 32\objectps.dll
2012-11-22 19:16:20 225280 ------w- c:\program files\common files\installshield\iscript\IScript.dll
2012-11-22 19:16:20 212992 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\ILog.dll
2012-11-22 19:16:20 176128 ------w- c:\program files\common files\installshield\engine\6\intel 32\iuser.dll
2012-11-22 14:03:47 -------- d-----w- c:\program files\SystemRequirementsLab
2012-11-22 14:03:44 -------- d-----w- c:\users\martin\SystemRequirementsLab
2012-11-22 13:59:15 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-11-22 13:59:15 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-11-22 13:59:06 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-11-21 22:34:21 -------- d-----w- c:\users\martin\appdata\local\backburner
2012-11-21 22:34:14 -------- d-----w- c:\program files\common files\Alias Shared
2012-11-20 22:28:51 -------- d-----w- c:\users\martin\appdata\roaming\Theta
2012-11-18 13:10:29 -------- d-----w- c:\program files\ICQ7M
.
==================== Find3M ====================
.
2012-12-12 15:54:36 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-12 15:54:36 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-12-08 11:23:48 138032 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2012-12-08 11:23:34 281688 ----a-w- c:\windows\system32\PnkBstrB.xtr
2012-12-08 11:23:34 281688 ----a-w- c:\windows\system32\PnkBstrB.exe
2012-12-06 18:57:28 281688 ----a-w- c:\windows\system32\PnkBstrB.ex0
2012-11-29 22:21:26 76888 ----a-w- c:\windows\system32\PnkBstrA.exe
2012-11-28 16:37:59 22328 ----a-w- c:\users\martin\appdata\roaming\PnkBstrK.sys
2012-10-30 12:51:20 2434856 ----a-w- c:\windows\system32\pbsvc_bc2.exe
2012-10-25 02:12:26 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2012-10-25 02:12:26 69632 ----a-w- c:\windows\system32\QuickTime.qts
2012-10-09 11:50:06 421888 ----a-w- c:\windows\system32\RealMediaSplitter.ax
2012-10-09 11:49:56 2174976 ----a-w- c:\program files\common files\atimpenc.dll
2012-09-15 21:47:47 466944 ------w- c:\windows\Setup1.exe
2012-09-15 21:47:44 73216 ----a-w- c:\windows\ST6UNST.EXE
.
============= FINISH: 22:55:36,05 ===============




Farbar Service Scanner Version: 10-12-2012
Ran by Martin (administrator) on 12-12-2012 at 22:57:05
Running from "C:\Users\Martin\Desktop"
Windows 7 Ultimate (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcore.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll
[2009-07-14 00:53] - [2009-07-14 02:15] - 0565760 ____A (Microsoft Corporation) 5CD996CECF45CBC3E8D109C86B82D69E

C:\Windows\system32\bfe.dll
[2009-07-14 00:54] - [2009-07-14 02:14] - 0493568 ____A (Microsoft Corporation) 85AC71C045CEB054ED48A7841AAE0C11

C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll
[2009-07-14 00:23] - [2009-07-14 02:16] - 0125952 ____A (Microsoft Corporation) 5FD90ABDBFAEE85986802622CBB03446

C:\Windows\system32\vssvc.exe
[2009-07-14 00:24] - [2009-07-14 02:14] - 1025536 ____A (Microsoft Corporation) 7EA2BCD94D9CFAF4C556F5CC94532A6C

C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll
[2009-07-14 01:15] - [2009-07-14 02:16] - 1912832 ____A (Microsoft Corporation) A33408CC036F9C08142B11BE5E93F0A1

C:\Windows\system32\qmgr.dll
[2009-07-14 00:30] - [2009-07-14 02:16] - 0589312 ____A (Microsoft Corporation) 53F476476F55A27F580661BDE09C4EC4

C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll
[2009-07-14 00:54] - [2009-07-14 02:15] - 0497152 ____A (Microsoft Corporation) 477397B432A256A50EE7E4339EB9EA14

C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****

Re: Skype vir

Napsal: 14 pro 2012 10:27
od vyosek
:arrow: Pokud nemate, tak presunte Combofix na plochu
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize
  • Kód: Vybrat vše

    KillAll::
    
    RegNull::
    [HKEY_USERS\S-1-5-21-2514172838-1309040562-4224439681-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{CB6C33D0-CBF1-0755-57DF-41236D9E5A3F}*]
    
    RegLock::
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    
    File::
    c:\windows\Tasks\Adobe Flash Player Updater.job
    
    Registry::
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "uTorrent"=-
    "DAEMON Tools Lite"=-
    "ICQ"=-
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task"=-
    "SunJavaUpdateSched"=-
    
    Replicator::
    
    AtJob::
    
    ClearJavaCache::
    
    Reboot::
  • Ulozte vytvoreny TXT jako CFScript.txt
  • Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
    Obrázek
  • Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte
:arrow: Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

:arrow: Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

Re: Skype vir

Napsal: 16 pro 2012 20:51
od lokem22
Dobry den, udělal jsem to..ale žadnej log se mi na ploše neobjevil..

Re: Skype vir

Napsal: 16 pro 2012 23:11
od vyosek
:arrow: On neni na plose, mel by byt c:\combofix.txt

:arrow: Zabalte mi slozku c:\qoobox a nekam prosim uploadnete

Re: Skype vir

Napsal: 17 pro 2012 14:45
od lokem22
Dobry den, tak tam se mi taky nic nezobrazilo..jinak Qoobox zde: http://ulozto.cz/x4rKoQP/qoobox-rar

Re: Skype vir

Napsal: 17 pro 2012 22:13
od vyosek
Heslo poprosim do mailu :)