VIRY.CZ

Zdravím Vás,
No ide o to, že som USB pichol do notebooku (nevediac o víruse) a USB-cko sa mi otvorilo takým spôsobom, že sa mi tam nezobrazili súbory ako by sa mali normálne zobraziť, ale bol tam akoby odkaz na USB, otvoril som ho a potom sa mi už normálne zobrazili ako zvyčajne.
Problém mám aj z prenosným Hardiscom (mám tam zálohované všetky dáta). pichol som ho do notebooku, a spravilo mi to isté ako som spomínal hore pri usb-cku.

no ale na druhý deň keď som zapojil prenosný Harddisc do notebooku, tak mi už nezobrazilo absolútne nič. Ako keby na ňom nebolo nič nahraté...pritom, keď si otvorím vlastnosti HDD tak mi píše, že využité miesto 250 Gb z 320 ... čiže súbory by tam mali byť, akurát sa k nim neviem dostať.
Prosím, viete niekto ako nato? Vďaka .

Logfile of random's system information tool 1.09 (written by random/random)
Run by Marek at 2013-03-30 17:35:05
Microsoft Windows 7 Home Basic Service Pack 1
System drive C: has 20 GB (49%) free of 41 GB
Total RAM: 1014 MB (15% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:35:38, on 30. 3. 2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Marek\Downloads\RSIT.exe
C:\Program Files\trend micro\Marek.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\IDM\QUICKF~1\PlugIns\IEHelp.dll
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Google Update] "C:\Users\Marek\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

--
End of file - 3902 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4041266699-321728482-1265548969-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4041266699-321728482-1265548969-1000UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-02-28 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C08DF07A-3E49-4E25-9AB0-D3882835F153}]
QUICKfind BHO Object - C:\PROGRA~1\IDM\QUICKF~1\PlugIns\IEHelp.dll [2007-02-16 457216]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"=C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2010-03-13 91520]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2013-03-04 5078504]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\Marek\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-11 136176]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=l3codecp.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=xvidvfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.lameacm"=lameACM.acm
"VIDC.FFDS"=ff_vfw.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-03-30 17:35:10 ----D---- C:\Program Files\trend micro
2013-03-30 17:35:04 ----D---- C:\rsit
2013-03-29 15:11:19 ----D---- C:\Users\Marek\AppData\Roaming\Malwarebytes
2013-03-29 15:10:49 ----D---- C:\ProgramData\Malwarebytes
2013-03-29 15:10:45 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2013-03-29 15:10:45 ----A---- C:\Windows\system32\drivers\mbam.sys
2013-03-29 14:12:50 ----D---- C:\Program Files\Recuva
2013-03-29 13:52:21 ----D---- C:\ProgramData\ESET
2013-03-29 13:52:21 ----D---- C:\Program Files\ESET
2013-03-26 09:50:17 ----D---- C:\Users\Marek\AppData\Roaming\{4C766D83-785B-4C68-8FFF-64FFE9A5AFE9}
2013-03-26 09:49:33 ----D---- C:\Users\Marek\AppData\Roaming\{E287A29A-E0C0-4805-9623-C43280552DDA}
2013-03-26 09:48:48 ----D---- C:\Temp
2013-03-13 13:55:55 ----D---- C:\Program Files\SecureW2

======List of files/folders modified in the last 1 month======

2013-03-30 17:35:14 ----D---- C:\Windows\Temp
2013-03-30 17:35:10 ----RD---- C:\Program Files
2013-03-30 15:16:38 ----D---- C:\Windows\system32\config
2013-03-30 15:07:48 ----D---- C:\Windows\System32
2013-03-30 15:07:48 ----D---- C:\Windows\inf
2013-03-30 15:07:48 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-03-29 15:22:53 ----D---- C:\Windows\system32\drivers
2013-03-29 15:10:49 ----HD---- C:\ProgramData
2013-03-29 14:58:13 ----SD---- C:\ProgramData\Microsoft
2013-03-29 14:57:42 ----SD---- C:\Users\Marek\AppData\Roaming\Microsoft
2013-03-29 13:54:45 ----SHD---- C:\Windows\Installer
2013-03-29 13:53:59 ----D---- C:\Windows\system32\DriverStore
2013-03-29 13:53:59 ----D---- C:\Windows\system32\catroot
2013-03-29 13:36:49 ----D---- C:\Windows\Prefetch
2013-03-28 18:16:35 ----D---- C:\Users\Marek\AppData\Roaming\AIMP3
2013-03-25 21:44:50 ----D---- C:\Users\Marek\AppData\Roaming\vlc
2013-03-19 14:32:48 ----D---- C:\Windows\system32\catroot2

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2013-02-14 171680]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2013-01-10 122240]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2013-01-10 105760]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2009-07-13 1096704]
R3 BthEnum;Bluetooth Request Block Driver; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2010-11-20 60416]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-06-10 4756480]
R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20); C:\Windows\system32\DRIVERS\L1C62x86.sys [2009-07-13 50688]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2012-12-14 21104]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-20 84992]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 14336]
S2 Parvdm;Parvdm; C:\Windows\system32\drivers\parvdm.sys [2009-07-14 8704]
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2010-11-20 393216]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 52224]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 35840]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2013-03-04 1341664]
R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344]
R2 MBAMScheduler;MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 398184]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]

-----------------EOF-----------------

Zdravím!
Na USB zařízení pusťte USBFix: http://forum.viry.cz/viewtopic.php?f=24&t=102308 . Pak dejte log ComobFix:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

############################## | UsbFix V 7.096 | [Deletion]

User: Marek (Administrator) # MAREK-NB
Updated 15/08/2012 by El Desaparecido
Started at 11:25:10 | 31/03/2013

Website: http://eldesaparecido.com
Forum: http://forum.eldesaparecido.com
Suspicious file ? : http://eldesaparecido.com/upload.php
Contact: contact@eldesaparecido.com

PC: Sony Corporation (VPCW12S1E) (X86-based PC) # Notebook
CPU: Intel(R) Atom(TM) CPU N280 @ 1.66GHz (1667)
RAM -> [Total : 1014 | Free : 235]
BIOS: Ver 1.00PARTTBL
BOOT: Normal boot

OS: Microsoft Windows 7 Home Basic (6.1.7601 32-Bit) # Service Pack 1
WB: Windows Internet Explorer 8.0.7601.17514

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: ESET NOD32 Antivirus 6.0 [(!) Disabled | Updated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Fixed drive # 40 Gb (19 Mb free - 49%) [] # NTFS
D:\ -> Fixed drive # 193 Gb (79 Mb free - 41%) [] # NTFS
E:\ -> Removable drive # 4 Gb (2 Mb free - 58%) [] # NTFS
F:\ -> Fixed drive # 298 Gb (36 Mb free - 12%) [USB-HDD] # FAT32

################## | Active Processes |

C:\Windows\system32\csrss.exe (372)
C:\Windows\system32\csrss.exe (424)
C:\Windows\system32\wininit.exe (432)
C:\Windows\system32\winlogon.exe (468)
C:\Windows\system32\services.exe (536)
C:\Windows\system32\lsass.exe (544)
C:\Windows\system32\lsm.exe (552)
C:\Windows\system32\svchost.exe (656)
C:\Windows\system32\svchost.exe (732)
C:\Windows\System32\svchost.exe (816)
C:\Windows\System32\svchost.exe (864)
C:\Windows\system32\svchost.exe (896)
C:\Windows\system32\svchost.exe (1032)
C:\Windows\system32\svchost.exe (1156)
C:\Windows\System32\spoolsv.exe (1348)
C:\Windows\system32\Dwm.exe (1412)
C:\Windows\system32\svchost.exe (1428)
C:\Windows\Explorer.EXE (1456)
C:\Windows\system32\taskhost.exe (1556)
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (1696)
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (1772)
C:\Program Files\Windows Sidebar\sidebar.exe (1800)
C:\Windows\system32\svchost.exe (1840)
C:\Windows\system32\svchost.exe (2000)
C:\Windows\system32\svchost.exe (2152)
C:\Windows\system32\SearchIndexer.exe (2356)
C:\Windows\system32\WUDFHost.exe (3000)
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe (3376)
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe (4024)
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe (2808)
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe (3048)
C:\Windows\System32\svchost.exe (3820)
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (3600)
C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe (2440)
C:\Windows\system32\taskeng.exe (3232)
C:\UsbFix\Go.exe (2396)
C:\Windows\system32\wbem\wmiprvse.exe (3864)

################## | Stopped processes |

Stopped! C:\Windows\System32\spoolsv.exe (1348)
Stopped! C:\Windows\Explorer.EXE (1456)
Stopped! C:\Windows\system32\taskhost.exe (1556)
Stopped! C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (1696)
Stopped! C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (1772)
Stopped! C:\Program Files\Windows Sidebar\sidebar.exe (1800)
Stopped! C:\Windows\system32\SearchIndexer.exe (2356)
Stopped! C:\Windows\system32\WUDFHost.exe (3000)
Stopped! C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe (3376)
Stopped! C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe (4024)
Stopped! C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe (2808)
Stopped! C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe (3048)
Stopped! C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (3600)
Stopped! C:\Users\Marek\AppData\Local\Google\Chrome\Application\chrome.exe (2440)
Stopped! C:\Windows\system32\taskeng.exe (3232)
Stopped! \\?\C:\Windows\system32\wbem\WMIADAP.EXE (2644)

################## | Files # Infected Folders |

Deleted ! C:\Users\Marek\AppData\Local\Temp\WZCPlugin_Vista.exe
Deleted ! C:\$RECYCLE.BIN\S-1-5-21-4041266699-321728482-1265548969-1000
Deleted ! D:\$RECYCLE.BIN\S-1-5-21-4041266699-321728482-1265548969-1000
Deleted ! E:\autorun.inf
Deleted ! F:\autorun.inf

(!) Temporary files deleted.

################## | Registry |


################## | Mountpoints2 |

Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\E
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{5409cb6a-80b7-11e1-b858-002643410944}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{68442434-4817-11e2-b990-806e6f6e6963}

################## | Listing |

[31/03/2013 - 11:29:50 | SHD ] C:\$Recycle.Bin
[17/09/2012 - 11:58:40 | N | 253337] C:\AnalysisLog.sr0
[10/06/2009 - 23:42:20 | N | 24] C:\autoexec.bat
[10/06/2009 - 23:42:20 | N | 10] C:\config.sys
[14/07/2009 - 06:53:55 | SHD ] C:\Documents and Settings
[31/03/2013 - 11:00:24 | ASH | 797777920] C:\hiberfil.sys
[11/03/2012 - 15:49:02 | RHD ] C:\MSOCache
[31/03/2013 - 11:00:25 | ASH | 1073741824] C:\pagefile.sys
[14/07/2009 - 04:37:05 | D ] C:\PerfLogs
[31/03/2013 - 11:06:27 | D ] C:\Program Files
[29/03/2013 - 16:10:49 | HD ] C:\ProgramData
[11/03/2012 - 15:28:47 | SHD ] C:\Recovery
[30/03/2013 - 18:49:27 | D ] C:\rsit
[28/02/2013 - 23:38:53 | SHD ] C:\System Volume Information
[26/03/2013 - 10:48:48 | D ] C:\Temp
[31/03/2013 - 11:29:50 | D ] C:\UsbFix
[31/03/2013 - 11:25:55 | A | 5467] C:\UsbFix.txt
[11/03/2012 - 15:29:04 | D ] C:\Users
[28/02/2013 - 23:39:58 | D ] C:\Windows
[31/03/2013 - 11:29:50 | SHD ] D:\$RECYCLE.BIN
[26/01/2013 - 20:43:48 | D ] D:\22.1.2013 Fotky
[22/01/2013 - 20:14:37 | D ] D:\22.1.2013 Hudba
[21/02/2013 - 11:22:40 | D ] D:\22.1.2013 Hudba - Netriedené
[29/03/2013 - 14:30:50 | N | 1415824] D:\29.3.2013 - eset_nod32_antivirus_live_installer.exe
[11/03/2012 - 16:16:36 | SHD ] D:\System Volume Information
[24/01/2013 - 14:39:38 | D ] D:\Zdielanie
[29/03/2013 - 14:58:08 | RASH | 2959] E:\desktop.ini
[29/03/2013 - 14:58:08 | RASH | 226823] E:\Thumbs.db
[29/03/2013 - 14:58:05 | D ] E:\ 
[28/03/2013 - 16:50:28 | N | 3072] F:\~$WZXB.FAT
[28/03/2013 - 16:50:28 | RASH | 3990] F:\desktop.ini
[28/03/2013 - 16:50:28 | RASH | 226823] F:\Thumbs.db
[29/03/2013 - 13:21:06 | SHD ] F:\$RECYCLE.BIN
[28/03/2013 - 16:50:18 | D ] F:\ 

################## | Vaccin |

C:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
E:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
F:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_MAREK-NB.zip
http://eldesaparecido.com/upload.php
Thank you for your contribution.

################## | E.O.F |






ComboFix 13-03-31.01 - Marek . 03. 2013 11:41:34.1.2 - x86
Microsoft Windows 7 Home Basic 6.1.7601.1.1250.421.1051.18.1014.444 [GMT 2:00]
Running from: c:\users\Marek\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\SecureW2
c:\program files\SecureW2\Uninstall.exe
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2\TTLS Manager.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2\Uninstall.lnk
c:\users\Marek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SecureW2
.
.
((((((((((((((((((((((((( Files Created from 2013-02-28 to 2013-03-31 )))))))))))))))))))))))))))))))
.
.
2013-03-31 09:53 . 2013-03-31 09:53 -------- d-----w- c:\users\Marek\AppData\Local\temp
2013-03-31 09:53 . 2013-03-31 09:53 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-03-31 09:24 . 2013-03-31 09:33 -------- d-----w- C:\UsbFix
2013-03-31 09:05 . 2013-03-31 09:05 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2013-03-30 16:35 . 2013-03-30 16:35 -------- d-----w- c:\program files\trend micro
2013-03-30 16:35 . 2013-03-30 16:49 -------- d-----w- C:\rsit
2013-03-29 14:11 . 2013-03-29 14:11 -------- d-----w- c:\users\Marek\AppData\Roaming\Malwarebytes
2013-03-29 14:10 . 2013-03-29 14:10 -------- d-----w- c:\programdata\Malwarebytes
2013-03-29 14:10 . 2013-03-29 14:10 -------- d-----w- c:\users\Marek\AppData\Local\Programs
2013-03-29 13:12 . 2013-03-29 13:41 -------- d-----w- c:\program files\Recuva
2013-03-29 12:58 . 2013-03-29 12:58 -------- d-----w- c:\users\Marek\AppData\Local\ESET
2013-03-29 12:52 . 2013-03-29 12:52 -------- d-----w- c:\program files\ESET
2013-03-26 08:50 . 2013-03-26 08:50 -------- d-----w- c:\users\Marek\AppData\Roaming\{4C766D83-785B-4C68-8FFF-64FFE9A5AFE9}
2013-03-26 08:49 . 2013-03-26 08:49 -------- d-----w- c:\users\Marek\AppData\Roaming\{E287A29A-E0C0-4805-9623-C43280552DDA}
2013-03-26 08:48 . 2013-03-26 08:48 -------- d-----w- C:\Temp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-31 09:33 . 2013-03-31 09:33 2362616 ----a-w- C:\UsbFix_Upload_Me_MAREK-NB.zip
2013-02-14 11:21 . 2013-02-14 11:21 171680 ----a-w- c:\windows\system32\drivers\eamonm.sys
2013-01-10 08:25 . 2013-01-10 08:25 122240 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2013-01-10 08:25 . 2013-01-10 08:25 105760 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2013-03-04 5078504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [x]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x86.sys [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MBAMSWISSARMY
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc
.
Contents of the 'Scheduled Tasks' folder
.
2013-03-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4041266699-321728482-1265548969-1000Core.job
- c:\users\Marek\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-11 13:42]
.
2013-03-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4041266699-321728482-1265548969-1000UA.job
- c:\users\Marek\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-11 13:42]
.
.
------- Supplementary Scan -------
.
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-RunOnce-<NO NAME> - (no file)
AddRemove-SecureW2 EAP Suite - c:\program files\SecureW2\Uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-4041266699-321728482-1265548969-1000\Software\SecuROM\License information*]
"datasecu"=hex:ba,bb,01,8a,3c,10,e6,9e,d4,60,5e,24,12,5c,19,e2,46,52,09,b3,6d,
b2,14,ae,75,99,e9,c4,79,54,a2,92,d9,1c,e7,08,60,d1,36,45,8f,b5,79,67,ee,f5,\
"rkeysecu"=hex:c3,73,aa,a2,8e,42,ec,0d,02,07,7a,08,5a,62,86,d7
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-03-31 11:58:23
ComboFix-quarantined-files.txt 2013-03-31 09:58
.
Pre-Run: 20 869 173 248 bytes free
Post-Run: 21 714 116 608 bytes free
.
- - End Of File - - 2E35974F17FD9F729E8339F9CB198D42

Toto není Combofix. Ten vypadá takto: http://forum.viry.cz/viewtopic.php?f=13 ... 8#p1206869 .

Zdravím,
Prvý je log z usb fixu a druhy je combofix, pridal som oba logy (aj z usbfixu preistotu)
alebo je tam fakt nieco iné a treba iný log? lebo toto mi ten combofix vyhodil po dokoncení.
Vďaka.

OK, smazáno. Je teď vše v pořádku?

V poriadku, ďakujem pomohli ste mi veľmi. Ešte raz vďaka.

Nemáte zač!