Kontrola logu

[synologic]

Prosím o kontrolu logu, děkuji.
Podezření na vir.
Log z RSIT:


Logfile of random's system information tool 1.06 (written by random/random)
Run by Doma at 2009-07-07 23:17:19
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 16 GB (53%) free of 30 GB
Total RAM: 1022 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:17:44, on 7.7.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
D:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
D:\program files\valve\steam\steam.exe
D:\Program Files\CursorXP\CursorXP.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Doma\Plocha\RSIT.exe
C:\Program Files\trend micro\Doma.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.seznam.cz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60209
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60209
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.seznam.cz
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CursorXP] "d:\Program Files\CursorXP\CursorXP.exe" -s
O4 - HKCU\..\Run: [Steam] "d:\program files\valve\steam\steam.exe" -silent
O4 - Startup: ObjectDock Plus.lnk = D:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Startup: Zástupce - Psycho.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout Free Download Managerem - file://d:\Program Files\Free Download Manager\dllink.htm
O9 - Extra button: Nastavení Lištičky ... - {0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - C:\Program Files\Seznam.cz\listicka.dll
O9 - Extra 'Tools' menuitem: Nastavení Lištičky ... - {0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - C:\Program Files\Seznam.cz\listicka.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Zvýrazňovač slov Lištičky - {4E6D6F90-31CA-4878-A7A3-1CD50F115A69} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Zvýrazňovač slov Lištičky - {4E6D6F90-31CA-4878-A7A3-1CD50F115A69} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{386C99A1-BF6B-4FDC-A67A-16B15859A7A1}: NameServer = 212.71.128.8,193.85.1.100
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Malware Defender Service (MalwareDefenderService) - ULi Electronics Inc. - (no file)
O23 - Service: ScsiAccess - Unknown owner - D:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: Spy Emergency Engine Service (SpyEmrgSrv) - NETGATE Technologies s.r.o. - d:\Program Files\NETGATE\Spy Emergency 2009\SpyEmergencySrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 5077 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Click Maintenance.job
C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\NeroLiveEpgUpdate-NON_Evička.job
C:\WINDOWS\tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job
C:\WINDOWS\tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job
C:\WINDOWS\tasks\Úklid 1 kliknutím.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4fe6-8A56-BBB695989046}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2009-02-06 2021400]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"=d:\Program Files\CursorXP\CursorXP.exe [2005-01-19 128000]
"Steam"=d:\program files\valve\steam\steam.exe [2009-06-10 1217784]

C:\Documents and Settings\Doma\Nabídka Start\Programy\Po spuštění
ObjectDock Plus.lnk - D:\Program Files\Stardock\ObjectDock\ObjectDock.exe
Zástupce - Psycho.lnk - D:\Security\Programy\Ostatní\Změna Vzhledu\Změna - Kurzoru\Cursor XP\Psycho.CurXPTheme

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-07-04 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"NoDrives"=
"NoDriveAutoRun"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"D:\Program Files\QIP\qip.exe"="D:\Program Files\QIP\qip.exe:*:Disabled:Quiet Internet Pager"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Media Player\wmplayer.exe"="C:\Program Files\Windows Media Player\wmplayer.exe:*:Disabled:Windows Media Player"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"D:\Program Files\Counter-Strike 1.6\hl.exe"="D:\Program Files\Counter-Strike 1.6\hl.exe:*:Enabled:Half-Life Launcher"
"D:\Program Files\Valve\Steam\SteamApps\synologic\counter-strike\hl.exe"="D:\Program Files\Valve\Steam\SteamApps\synologic\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Documents and Settings\All Users\Data aplikací\Kaspersky Lab Setup Files\Kaspersky Internet Security 2009\Czech\setup.exe"="C:\Documents and Settings\All Users\Data aplikací\Kaspersky Lab Setup Files\Kaspersky Internet Security 2009\Czech\setup.exe:*:Enabled:Kaspersky Internet Security 2009 Setup"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.js - open - NOTEPAD.EXE %1
.vbs - open - NOTEPAD.EXE %1

======List of files/folders created in the last 1 months======

2009-07-07 23:17:19 ----D---- C:\rsit
2009-07-07 23:17:19 ----D---- C:\Program Files\trend micro
2009-07-07 21:09:56 ----A---- C:\WINDOWS\msb.exe
2009-07-07 16:27:46 ----D---- C:\Documents and Settings\Doma\Data aplikací\Spy Emergency
2009-07-07 16:27:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\NETGATE
2009-07-07 16:19:08 ----D---- C:\Program Files\Lavasoft
2009-07-07 15:17:49 ----SHD---- C:\RECYCLER
2009-07-07 15:08:27 ----A---- C:\WINDOWS\VFIND.exe
2009-07-07 15:08:27 ----A---- C:\WINDOWS\fdsv.exe
2009-07-07 15:08:26 ----A---- C:\WINDOWS\SWXCACLS.exe
2009-07-07 15:03:55 ----HDC---- C:\Documents and Settings\All Users\Data aplikací\~0
2009-07-07 14:37:31 ----A---- C:\WINDOWS\ntbtlog.txt
2009-07-07 14:27:40 ----A---- C:\WINDOWS\system32\un2065.txt
2009-07-07 14:27:40 ----A---- C:\WINDOWS\system32\2065.txt
2009-07-07 14:26:24 ----D---- C:\WINDOWS\system32\logs
2009-07-07 14:23:33 ----D---- C:\WINDOWS\system32\URTTEMP
2009-07-07 14:22:00 ----D---- C:\Program Files\Common Files\BitDefender
2009-07-07 14:12:16 ----A---- C:\WINDOWS\msa.exe
2009-07-07 14:11:35 ----A---- C:\WINDOWS\system32\tpsaxyd.exe
2009-07-07 14:11:33 ----D---- C:\Documents and Settings\All Users\Data aplikací\16397034
2009-07-07 14:00:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\PrevxCSI
2009-07-06 19:05:10 ----A---- C:\WINDOWS\OEWABLog.txt
2009-06-29 21:56:56 ----D---- C:\Program Files\uTorrent
2009-06-29 21:56:25 ----D---- C:\Documents and Settings\Doma\Data aplikací\uTorrent
2009-06-29 02:05:46 ----D---- C:\Documents and Settings\Doma\Data aplikací\Kaspersky_Key_Finder_(KKF
2009-06-28 22:34:18 ----D---- C:\Documents and Settings\All Users\Data aplikací\Kaspersky Lab Setup Files
2009-06-28 01:31:06 ----D---- C:\WINDOWS\temp
2009-06-28 01:26:59 ----A---- C:\WINDOWS\PEV.exe
2009-06-28 01:15:20 ----A---- C:\WINDOWS\_MSRSTRT.EXE
2009-06-28 01:07:50 ----D---- C:\Program Files\Common Files\Kaspersky Lab
2009-06-28 01:07:17 ----A---- C:\WINDOWS\system32\smrgdf.exe
2009-06-28 01:07:17 ----A---- C:\WINDOWS\system32\iolobtdfg.exe
2009-06-27 23:51:39 ----A---- C:\VundoFix.txt
2009-06-27 22:46:38 ----D---- C:\Documents and Settings\Doma\Data aplikací\SUPERAntiSpyware.com

======List of files/folders modified in the last 1 months======

2009-07-07 23:17:19 ----RD---- C:\Program Files
2009-07-07 23:00:01 ----SD---- C:\WINDOWS\Tasks
2009-07-07 21:14:42 ----D---- C:\WINDOWS\system32\CatRoot2
2009-07-07 21:12:30 ----SHD---- C:\WINDOWS\Installer
2009-07-07 21:12:10 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-07-07 21:12:10 ----D---- C:\WINDOWS\system32\drivers
2009-07-07 21:12:08 ----D---- C:\WINDOWS\system32
2009-07-07 21:10:00 ----D---- C:\WINDOWS
2009-07-07 21:08:14 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-07-07 16:26:30 ----D---- C:\Documents and Settings\Doma\Data aplikací\GetRightToGo
2009-07-07 16:25:58 ----HD---- C:\WINDOWS\inf
2009-07-07 16:11:31 ----D---- C:\Documents and Settings\Doma\Data aplikací\Mozilla
2009-07-07 15:10:11 ----D---- C:\WINDOWS\ERDNT
2009-07-07 15:09:37 ----A---- C:\WINDOWS\system.ini
2009-07-07 15:03:13 ----D---- C:\WINDOWS\WinSxS
2009-07-07 15:01:04 ----D---- C:\WINDOWS\WBEM
2009-07-07 15:01:04 ----D---- C:\WINDOWS\twain_32
2009-07-07 15:01:03 ----D---- C:\WINDOWS\system32\XPSViewer
2009-07-07 15:01:03 ----D---- C:\WINDOWS\system32\xircom
2009-07-07 15:01:00 ----D---- C:\WINDOWS\system32\wins
2009-07-07 15:00:59 ----D---- C:\WINDOWS\system32\windows media
2009-07-07 15:00:58 ----D---- C:\WINDOWS\system32\wbem
2009-07-07 15:00:57 ----D---- C:\WINDOWS\system32\usmt
2009-07-07 15:00:54 ----D---- C:\WINDOWS\system32\spool
2009-07-07 15:00:53 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2009-07-07 15:00:52 ----D---- C:\WINDOWS\system32\ShellExt
2009-07-07 15:00:51 ----D---- C:\WINDOWS\system32\Setup
2009-07-07 15:00:50 ----D---- C:\WINDOWS\system32\RTCOM
2009-07-07 15:00:50 ----D---- C:\WINDOWS\system32\Restore
2009-07-07 15:00:48 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-07-07 15:00:48 ----D---- C:\WINDOWS\system32\ras
2009-07-07 15:00:47 ----D---- C:\WINDOWS\system32\PreInstall
2009-07-07 15:00:46 ----D---- C:\WINDOWS\system32\oobe
2009-07-07 15:00:44 ----D---- C:\WINDOWS\system32\npp
2009-07-07 15:00:43 ----D---- C:\WINDOWS\system32\mui
2009-07-07 15:00:39 ----D---- C:\WINDOWS\system32\MsDtc
2009-07-07 15:00:37 ----D---- C:\WINDOWS\system32\Microsoft
2009-07-07 15:00:34 ----D---- C:\WINDOWS\system32\Macromed
2009-07-07 15:00:31 ----D---- C:\WINDOWS\system32\LogFiles
2009-07-07 15:00:31 ----D---- C:\WINDOWS\system32\Lang
2009-07-07 15:00:28 ----D---- C:\WINDOWS\system32\inetsrv
2009-07-07 15:00:27 ----D---- C:\WINDOWS\system32\IME
2009-07-07 15:00:27 ----D---- C:\WINDOWS\system32\iifgfgf.dll
2009-07-07 15:00:27 ----D---- C:\WINDOWS\system32\icsxml
2009-07-07 15:00:26 ----D---- C:\WINDOWS\system32\ias
2009-07-07 15:00:23 ----D---- C:\WINDOWS\system32\export
2009-07-07 15:00:21 ----D---- C:\WINDOWS\system32\en-us
2009-07-07 15:00:17 ----D---- C:\WINDOWS\system32\DirectX
2009-07-07 15:00:17 ----D---- C:\WINDOWS\system32\dhcp
2009-07-07 15:00:15 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spybot - Search & Destroy
2009-07-07 15:00:12 ----D---- C:\WINDOWS\system32\cs-cz
2009-07-07 15:00:12 ----D---- C:\WINDOWS\system32\cs
2009-07-07 15:00:11 ----D---- C:\WINDOWS\system32\config
2009-07-07 15:00:11 ----D---- C:\WINDOWS\system32\Com
2009-07-07 15:00:07 ----D---- C:\WINDOWS\system32\CatRoot
2009-07-07 15:00:03 ----D---- C:\WINDOWS\system32\bits
2009-07-07 14:59:59 ----D---- C:\WINDOWS\system32\appmgmt
2009-07-07 14:59:58 ----D---- C:\WINDOWS\system32\3com_dmi
2009-07-07 14:59:58 ----D---- C:\WINDOWS\system32\3076
2009-07-07 14:59:58 ----D---- C:\WINDOWS\system32\2052
2009-07-07 14:59:58 ----D---- C:\WINDOWS\system32\1054
2009-07-07 14:59:58 ----D---- C:\WINDOWS\system32\1042
2009-07-07 14:59:58 ----D---- C:\WINDOWS\system32\1041
2009-07-07 14:59:58 ----D---- C:\WINDOWS\system32\1037
2009-07-07 14:59:58 ----D---- C:\WINDOWS\system32\1033
2009-07-07 14:59:58 ----D---- C:\WINDOWS\system32\1031
2009-07-07 14:59:58 ----D---- C:\WINDOWS\system32\1029
2009-07-07 14:59:58 ----D---- C:\WINDOWS\system32\1028
2009-07-07 14:59:58 ----D---- C:\WINDOWS\system32\1025
2009-07-07 14:59:58 ----D---- C:\WINDOWS\system
2009-07-07 14:59:58 ----D---- C:\WINDOWS\Sun
2009-07-07 14:59:57 ----D---- C:\WINDOWS\srchasst
2009-07-07 14:59:53 ----D---- C:\WINDOWS\SoftwareDistribution
2009-07-07 14:59:53 ----D---- C:\WINDOWS\SHELLNEW
2009-07-07 14:58:09 ----D---- C:\WINDOWS\ServicePackFiles
2009-07-07 14:58:09 ----D---- C:\WINDOWS\security
2009-07-07 14:58:07 ----D---- C:\WINDOWS\Resources
2009-07-07 14:58:07 ----D---- C:\WINDOWS\repair
2009-07-07 14:58:07 ----D---- C:\WINDOWS\Registration
2009-07-07 14:58:02 ----D---- C:\WINDOWS\RegisteredPackages
2009-07-07 14:58:02 ----D---- C:\WINDOWS\pss
2009-07-07 14:58:02 ----D---- C:\WINDOWS\provisioning
2009-07-07 14:58:02 ----D---- C:\WINDOWS\peernet
2009-07-07 14:58:00 ----D---- C:\WINDOWS\PCHealth
2009-07-07 14:57:59 ----D---- C:\WINDOWS\Options
2009-07-07 14:57:59 ----D---- C:\WINDOWS\network diagnostic
2009-07-07 14:57:59 ----D---- C:\WINDOWS\MyInstall
2009-07-07 14:57:59 ----D---- C:\WINDOWS\mui
2009-07-07 14:57:59 ----D---- C:\WINDOWS\msapps
2009-07-07 14:57:59 ----D---- C:\WINDOWS\msagent
2009-07-07 14:57:59 ----D---- C:\WINDOWS\Minidump
2009-07-07 14:57:43 ----D---- C:\WINDOWS\Microsoft.NET
2009-07-07 14:57:43 ----D---- C:\WINDOWS\Media
2009-07-07 14:57:43 ----D---- C:\WINDOWS\Logs
2009-07-07 14:57:43 ----D---- C:\WINDOWS\l2schemas
2009-07-07 14:57:43 ----D---- C:\WINDOWS\java
2009-07-07 14:57:43 ----D---- C:\WINDOWS\ime
2009-07-07 14:57:43 ----D---- C:\WINDOWS\ie8updates
2009-07-07 14:57:43 ----D---- C:\WINDOWS\ie7updates
2009-07-07 14:57:42 ----D---- C:\WINDOWS\Help
2009-07-07 14:57:42 ----D---- C:\WINDOWS\ERUNT
2009-07-07 14:57:41 ----D---- C:\WINDOWS\EHome
2009-07-07 14:57:39 ----D---- C:\WINDOWS\Driver Cache
2009-07-07 14:57:39 ----D---- C:\WINDOWS\Downloaded Installations
2009-07-07 14:57:39 ----D---- C:\WINDOWS\Debug
2009-07-07 14:57:39 ----D---- C:\WINDOWS\Cursors
2009-07-07 14:57:39 ----D---- C:\WINDOWS\Connection Wizard
2009-07-07 14:57:39 ----D---- C:\WINDOWS\Config
2009-07-07 14:57:35 ----D---- C:\WINDOWS\BricoPacks
2009-07-07 14:57:35 ----D---- C:\WINDOWS\AppPatch
2009-07-07 14:57:35 ----D---- C:\WINDOWS\addins
2009-07-07 14:57:35 ----D---- C:\Downloads
2009-07-07 14:57:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\Windows Genuine Advantage
2009-07-07 14:57:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\vsosdk
2009-07-07 14:57:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\Ulead Systems
2009-07-07 14:57:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\TuneUp Software
2009-07-07 14:57:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\Trymedia
2009-07-07 14:57:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\SUPERAntiSpyware.com
2009-07-07 14:57:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\Sony
2009-07-07 14:57:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\Skype
2009-07-07 14:57:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\Pinnacle Studio Ultimate
2009-07-07 14:57:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\Pinnacle
2009-07-07 14:57:29 ----D---- C:\Documents and Settings\All Users\Data aplikací\NOS
2009-07-07 14:57:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\Nero
2009-07-07 14:57:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\MicroWorld
2009-07-07 14:57:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\Microsoft Help
2009-07-07 14:57:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2009-07-07 14:57:26 ----D---- C:\Documents and Settings\All Users\Data aplikací\Lavasoft
2009-07-07 14:57:26 ----D---- C:\Documents and Settings\All Users\Data aplikací\iolo
2009-07-07 14:57:26 ----D---- C:\Documents and Settings\All Users\Data aplikací\InstallShield
2009-07-07 14:57:26 ----D---- C:\Documents and Settings\All Users\Data aplikací\ICQ
2009-07-07 14:57:26 ----D---- C:\Documents and Settings\All Users\Data aplikací\hps
2009-07-07 14:57:26 ----D---- C:\Documents and Settings\All Users\Data aplikací\Google
2009-07-07 14:57:26 ----D---- C:\Documents and Settings\All Users\Data aplikací\FLEXnet
2009-07-07 14:57:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\ESET
2009-07-07 14:57:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\DVD Shrink
2009-07-07 14:57:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\DAEMON Tools Lite
2009-07-07 14:57:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\CyberLink
2009-07-07 14:57:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\ATI
2009-07-07 14:57:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\ashampoo
2009-07-07 14:57:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\Arovax
2009-07-07 14:57:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\Apple Computer
2009-07-07 14:57:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\Apple
2009-07-07 14:57:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\Anvsoft
2009-07-07 14:57:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2009-07-07 14:57:25 ----D---- C:\Documents and Settings\All Users\Data aplikací\Acronis
2009-07-07 14:57:25 ----D---- C:\Documents and Settings
2009-07-07 14:57:24 ----D---- C:\ATI
2009-07-07 14:29:22 ----D---- C:\Program Files\ESET
2009-07-07 14:24:07 ----RSD---- C:\WINDOWS\assembly
2009-07-07 14:24:05 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-07-07 14:22:00 ----D---- C:\Program Files\Common Files
2009-07-07 14:14:26 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2009-07-07 14:05:43 ----A---- C:\Documents and Settings\Doma\Data aplikací\install.txt
2009-07-07 14:00:28 ----D---- C:\WINDOWS\Prefetch
2009-07-07 14:00:28 ----A---- C:\WINDOWS\wininit.ini
2009-07-04 15:14:35 ----D---- C:\Documents and Settings\Doma\Data aplikací\Free Download Manager
2009-07-04 01:55:12 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-06-28 23:07:28 ----D---- C:\Program Files\Common Files\Adobe
2009-06-28 20:58:35 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2009-06-28 14:42:48 ----D---- C:\Documents and Settings\Doma\Data aplikací\Vso
2009-06-28 01:32:28 ----DC---- C:\WINDOWS\system32\dllcache
2009-06-11 22:08:14 ----HD---- C:\WINDOWS\$hf_mig$

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-02-06 106208]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2009-02-06 56280]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 SpyEmrg;Spy Emergency Driver; C:\WINDOWS\System32\Drivers\spyemrg.sys [2009-02-04 12344]
R1 USIUDF;USIUDF; C:\WINDOWS\System32\Drivers\USIUDF.sys [2004-07-07 292896]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-02-06 113448]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2009-02-06 130952]
R2 nxsIO32;NextSensor Kernel I/O Driver; \??\C:\WINDOWS\System32\DRIVERS\nxsIO32.sys []
R2 tifsfilter;Acronis True Image FS Filter; C:\WINDOWS\system32\DRIVERS\tifsfilt.sys [2001-10-27 44384]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-07-04 3230720]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2009-02-06 33096]
R3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\System32\DRIVERS\fetnd5.sys [2001-08-17 27165]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2009-04-14 5069312]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2008-12-02 47360]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-12-05 10368]
R3 SpyEmrgAccess;Spy Emergency OnAccess Driver; C:\WINDOWS\System32\Drivers\spyemrg_access.sys [2009-02-14 15672]
R3 SpyEmrgGuard;Spy Emergency Real-Time Shield Driver; C:\WINDOWS\System32\Drivers\spyemrg_guard.sys [2009-02-04 14392]
R3 ULCDRHlp;ULCDRHlp; C:\WINDOWS\System32\Drivers\ULCDRHlp.sys [2004-12-23 27392]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbstor;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 ZSMC301b;Philips SPC315NC Webcam; C:\WINDOWS\System32\Drivers\usbVM31b.sys [2005-02-26 91527]
S1 SASDIFSV;SASDIFSV; \??\D:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
S1 SASKUTIL;SASKUTIL; \??\D:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2008-08-05 1684736]
S3 ASFWHide;ASFWHide; \??\C:\Documents and Settings\Doma\Local Settings\TEMP\ASFWHide []
S3 BlueletAudio;Bluetooth Audio Service; C:\WINDOWS\system32\DRIVERS\blueletaudio.sys [2004-10-19 20096]
S3 BT;Bluetooth PAN Network Adapter; C:\WINDOWS\system32\DRIVERS\btnetdrv.sys [2004-09-21 10804]
S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:\WINDOWS\System32\Drivers\btcusb.sys [2005-01-17 23000]
S3 BTHidEnum;Bluetooth HID Enumerator; C:\WINDOWS\system32\DRIVERS\vbtenum.sys [2005-01-13 12500]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 k750bus;Sony Ericsson 750 driver (WDM); C:\WINDOWS\system32\DRIVERS\k750bus.sys [2005-03-11 55216]
S3 k750mdfl;Sony Ericsson 750 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\k750mdfl.sys [2005-03-11 6576]
S3 k750mdm;Sony Ericsson 750 USB WMC Modem Drivers; C:\WINDOWS\system32\DRIVERS\k750mdm.sys [2005-03-11 89872]
S3 k750mgmt;Sony Ericsson 750 USB WMC Device Management Drivers; C:\WINDOWS\system32\DRIVERS\k750mgmt.sys [2005-03-11 81728]
S3 k750obex;Sony Ericsson 750 USB WMC OBEX Interface Drivers; C:\WINDOWS\system32\DRIVERS\k750obex.sys [2005-03-11 79488]
S3 M9205;M9205 USB TV Box; C:\WINDOWS\System32\Drivers\M9205.sys [2005-08-19 143563]
S3 MarvinBus;Pinnacle Marvin Bus; C:\WINDOWS\system32\DRIVERS\MarvinBus.sys [2005-09-24 171520]
S3 MemStPCI;Řadič Sony Memory Stick (PCI); C:\WINDOWS\system32\DRIVERS\MemStPCI.SYS [2008-04-13 26112]
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2006-01-04 1389056]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 Profos;Profos; \??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\profos.sys []
S3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-10-25 5888]
S3 SASENUM;SASENUM; \??\D:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
S3 Ser2pl;Prolific Serial port driver; C:\WINDOWS\system32\DRIVERS\ser2pl.sys [2003-01-02 41088]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbaudio;Ovladač zvukové karty USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 VBoxNetFlt;VBoxNetFlt Service; C:\WINDOWS\system32\DRIVERS\VBoxNetFlt.sys []
S3 VComm;Virtual Serial port driver; C:\WINDOWS\system32\DRIVERS\VComm.sys [2004-10-19 61312]
S3 VcommMgr;Bluetooth VComm Manager Service; C:\WINDOWS\System32\Drivers\VcommMgr.sys [2004-11-05 82148]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S3 zebrbus;Sony Ericsson Composite Device driver; C:\WINDOWS\system32\DRIVERS\zebrbus.sys [2008-01-15 83200]
S3 zebrmdfl;Sony Ericsson Modem Filter; C:\WINDOWS\system32\DRIVERS\zebrmdfl.sys [2008-01-15 14848]
S3 zebrmdm;Sony Ericsson Port (WDM); C:\WINDOWS\system32\DRIVERS\zebrmdm.sys [2008-01-15 109568]
S3 zebrmdmc;Sony Ericsson mRouter Port (WDM); C:\WINDOWS\system32\DRIVERS\zebrmdmc.sys [2008-01-15 109568]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2009-02-06 727720]
R2 ScsiAccess;ScsiAccess; D:\Program Files\Photodex\ProShowGold\ScsiAccess.exe [2008-12-25 181312]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2004-03-13 49152]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-07-04 561152]
S2 SpyEmrgSrv;Spy Emergency Engine Service; d:\Program Files\NETGATE\Spy Emergency 2009\SpyEmergencySrv.exe [2009-03-05 1788472]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2009-02-06 20680]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2007-08-24 68464]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2008-07-03 593920]
S4 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2008-09-24 935208]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------

[motji]

Dobré ranko

Máte tam potvůrky

Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

-Spusťte,pro potvrzení volby mačkejte klávesu A, Enter
-po použití prográmek vymažte.Pozor,antiviry ho mohou falešně označit za vir



Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe

- ComboFix je třeba spustit pod účtem s právy administrátora

- Před použitím vypněte všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary

- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího se okna

- Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, skopírujte celý jeho obsah sem




Stahněte MBAM z mého podpisu
-Nainstalujte,dejte úplný sken

NIC NEMAZAT
MBAM má občas falešné detekce,proto budeme mazat až po kontrole logu
-Log zkopírujte sem

[synologic]

Tak to s tím T-Cleanerem jsem udělal.
Ale ztroskotal jsem u ComboFixu.
Hlásí mi to tuhle hlášku - viz příloha.
Přitom Spy Energency 2009 jsem v počítači měl, ale už jsem ho dávno odinstaloval.
Jde to nějak vyřešit?
Jinak mám v PC tyhle programy:
Eset Smart Security 4 verze 4.0.314.0
CCleaner verze 2.12.660
Spybot-Search And Destroy verze 1.6.2
Windows Doctor verze 2.0
Teď jdu řešit ten MBAM.

[motji]

Jděte přes Start –spustit – napište – services.msc – ok – najít službu
Spy Emergency Engine Service
Klikněte na ni pravým myšítkem, zvolte vlastnosti,na další kartě nejprve službu zastavte tlačítkem zastavit, a u položky Typ spouštění zvolit Zakázáno

A ted spustte ten combofix

[synologic]

Další problém.
Tahle služba tam není a nebo jsem lama a nevidím ji.

[motji]

Zkuste combofix spustit i tak

[synologic]

Tak log z ComboFixu je konečně na světě.


ComboFix 09-07-07.A7 - Doma 08.07.2009 13:52.3 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1022.586 [GMT 2:00]
Spuštěný z: c:\documents and settings\Doma\Plocha\ComboFix.exe
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Spy Emergency *On-access scanning enabled* (Updated) {82117492-906E-4b02-A33A-84D42A2DD907}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
SP: Spyware Doctor *disabled* (Updated) {1C3EDD79-273E-46ac-99F8-EFA9E7CBC301}
.

((((((((((((((((((((((((( Soubory vytvořené od 2009-06-08 do 2009-07-08 )))))))))))))))))))))))))))))))
.

2009-07-07 14:31 . 2009-07-07 14:31 -------- d-----w- c:\documents and settings\LocalService\Plocha
2009-07-07 14:11 . 2009-07-07 14:11 0 ----a-w- c:\windows\nsreg.dat
2009-07-07 12:26 . 2009-07-07 13:00 -------- d-----w- c:\windows\system32\logs
2009-07-07 12:23 . 2009-07-07 13:00 -------- d-----w- c:\windows\system32\URTTEMP
2009-07-07 12:22 . 2009-07-07 12:49 -------- d-----w- c:\program files\Common Files\BitDefender
2009-06-29 19:56 . 2009-06-29 19:56 -------- d-----w- c:\program files\uTorrent
2009-06-27 23:15 . 2009-06-27 23:15 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2009-06-27 23:07 . 2009-06-27 23:07 -------- d-----w- c:\program files\Common Files\Kaspersky Lab
2009-06-27 23:07 . 2004-09-16 15:07 31454 ----a-w- c:\windows\system32\iolobtdfg.exe
2009-06-27 23:07 . 2004-08-28 13:18 25264 ----a-w- c:\windows\system32\smrgdf.exe
2009-06-20 22:00 . 2009-07-02 22:00 664 ----a-w- c:\windows\system32\d3d9caps.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-08 08:06 . 2001-10-25 12:00 83936 ----a-w- c:\windows\system32\perfc005.dat
2009-07-08 08:06 . 2001-10-25 12:00 440772 ----a-w- c:\windows\system32\perfh005.dat
2009-07-07 12:29 . 2001-10-31 18:04 -------- d-----w- c:\program files\ESET
2009-07-07 12:14 . 2008-12-02 16:58 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-06-28 21:07 . 2008-10-12 15:31 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-17 09:27 . 2009-01-24 10:43 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-17 09:27 . 2009-01-24 10:43 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-07 15:33 . 2002-09-20 16:04 346624 ------w- c:\windows\system32\localspl.dll
2009-04-29 04:35 . 2009-05-06 19:28 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-04-29 04:35 . 2002-09-20 16:05 667648 ----a-w- c:\windows\system32\wininet.dll
2009-04-19 19:52 . 2002-09-20 15:41 1847168 ------w- c:\windows\system32\win32k.sys
2009-04-16 15:23 . 2001-10-19 13:47 540672 ----a-w- c:\windows\RtlExUpd.dll
2009-04-15 14:54 . 2002-09-20 16:04 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-14 14:09 . 2001-10-19 13:48 5069312 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys
2009-04-10 11:38 . 2001-10-19 13:47 17879552 ----a-w- c:\windows\RTHDCPL.EXE
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="d:\program files\CursorXP\CursorXP.exe" [2005-01-19 128000]
"Steam"="d:\program files\valve\steam\steam.exe" [2009-06-10 1217784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-02-06 2021400]

c:\documents and settings\Eviźka\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Z stupce - ObjectDock.lnk - d:\program files\Stardock\ObjectDock\ObjectDock.exe [2008-12-3 3581680]

c:\documents and settings\Doma\Nabˇdka Start\Programy\Po spuçtŘnˇ\
ObjectDock Plus.lnk - d:\program files\Stardock\ObjectDock\ObjectDock.exe [2008-12-3 3581680]
Z stupce - Psycho.lnk - d:\security\Programy\Ostatnˇ\ZmŘna Vzhledu\ZmŘna - Kurzoru\Cursor XP\Psycho.CurXPTheme [2001-10-31 452175]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sremcon.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"d:\\Program Files\\QIP\\qip.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"d:\\Program Files\\Counter-Strike 1.6\\hl.exe"=
"d:\\Program Files\\Valve\\Steam\\SteamApps\\synologic\\counter-strike\\hl.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\Czech\\setup.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [6.2.2009 14:23 106208]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [6.2.2009 14:23 727720]
R2 nxsIO32;NextSensor Kernel I/O Driver;c:\windows\system32\drivers\nxsIO32.sys [3.11.2008 13:19 2208]
S1 SASDIFSV;SASDIFSV;\??\d:\program files\SUPERAntiSpyware\SASDIFSV.SYS --> d:\program files\SUPERAntiSpyware\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\d:\program files\SUPERAntiSpyware\SASKUTIL.sys --> d:\program files\SUPERAntiSpyware\SASKUTIL.sys [?]
S2 MalwareDefenderService;Malware Defender Service; [x]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [5.5.2009 11:00 1684736]
S3 getPlus(R) Helper;getPlus(R) Helper; [x]
S3 M9205;M9205 USB TV Box;c:\windows\system32\drivers\M9205.sys [27.11.2008 20:06 143563]
S3 MemStPCI;Řadič Sony Memory Stick (PCI);c:\windows\system32\drivers\memstpci.sys [3.9.2008 22:21 26112]
S3 SASENUM;SASENUM;\??\d:\program files\SUPERAntiSpyware\SASENUM.SYS --> d:\program files\SUPERAntiSpyware\SASENUM.SYS [?]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys --> c:\windows\system32\DRIVERS\VBoxNetFlt.sys [?]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - NTLMSSP
.
Obsah adresáře 'Naplánované úlohy'

2009-07-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 11:42]

2009-07-07 c:\windows\Tasks\NeroLiveEpgUpdate-NON_Evička.job
- d:\program files\Nero 9\Nero 9\Nero Live\NeroLive.exe [2008-09-18 12:51]
.
.
------- Doplňkový sken -------
.
uStart Page = www.seznam.cz
uDefault_Search_URL = hxxp://search.qip.ru
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&s ... f8&oe=utf8
mStart Page = www.seznam.cz
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Excel - d:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Stáhnout Free Download Managerem - file://d:\program files\Free Download Manager\dllink.htm
IE: {{0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - {0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - c:\program files\Seznam.cz\listicka.dll
TCP: {386C99A1-BF6B-4FDC-A67A-16B15859A7A1} = 212.71.128.8,193.85.1.100
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
.
.
------- Asociace souborů -------
.
JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-08 13:55
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ASFWHide]
"ImagePath"="\??\c:\documents and settings\Doma\Local Settings\TEMP\ASFWHide"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-4208744717-3381665663-3290484060-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,15"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"
"{208D2C60-3AEA-1069-A2D7-08002B30309D}"="c:\\WINDOWS\\system32\\SHELL32.dll,17"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,22"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,23"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="c:\\WINDOWS\\system32\\shell32.dll,24"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="c:\\WINDOWS\\system32\\shell32.dll,-175"
"{21EC2020-3AEA-1069-A2DD-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-137"
"{2227A280-3AEA-1069-A2DE-08002B30309D}"="c:\\WINDOWS\\System32\\shell32.dll,-138"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="c:\\WINDOWS\\system32\\shell32.dll,38"
"AudioCD"="c:\\WINDOWS\\System32\\shell32.dll,40"
"{FBF23B42-E3F0-101B-8488-00AA003E56F8}"="c:\\WINDOWS\\system32\\shell32.dll,220"
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="c:\\WINDOWS\\system32\\mydocs.dll,0"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="c:\\WINDOWS\\system32\\main.cpl,10"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="c:\\WINDOWS\\system32\\wiashext.dll,0"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="c:\\WINDOWS\\system32\\mstask.dll,-100"
"{88C6C381-2E85-11D0-94DE-444553540000}"="c:\\WINDOWS\\System32\\occache.dll,0"
"{BDEADF00-C265-11d0-BCED-00A0C90AB50F}"="c:\\Program Files\\COMMON~1\\MICROS~1\\WEBFOL~1\\MSONSEXT.DLL,0"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="c:\\WINDOWS\\System32\\shdocvw.dll,-20785"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="c:\\WINDOWS\\System32\\webcheck.dll,0"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="c:\\WINDOWS\\system32\\syncui.dll,0"

[HKEY_USERS\S-1-5-21-4208744717-3381665663-3290484060-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:a6,9c,76,1d,44,c8,d0,88,68,58,17,bf,4f,3f,f5,79,2f,85,34,92,f0,a2,0a,
24,fa,f7,92,72,f7,5c,67,c2,4f,06,ce,0a,aa,80,60,06,49,a4,92,c2,c7,6c,22,c5,\
"??"=hex:b0,3a,aa,9c,b2,9b,90,10,24,1e,bd,a8,3e,69,4f,dd

[HKEY_USERS\S-1-5-21-4208744717-3381665663-3290484060-1003\Software\SecuROM\License information*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"datasecu"=hex:1d,e6,1d,e8,99,46,fd,f6,59,f3,5a,28,1d,bb,67,5f,4a,eb,1f,00,af,
c0,1c,d9,95,8f,3f,ef,87,d4,93,03,9b,b8,f7,d8,63,d2,bd,5b,bc,fc,02,da,22,28,\
"rkeysecu"=hex:d0,ef,4a,86,9d,e5,93,63,17,83,d3,98,dd,41,b2,f8

[HKEY_LOCAL_MACHINE\software\Classes\.xaml\bootstrap]
@DACL=(02 0000)
@="bootstrap.xaml.1"

[HKEY_LOCAL_MACHINE\software\Classes\.xbap\bootstrap]
@DACL=(02 0000)
@="bootstrap.xbap.1"

[HKEY_LOCAL_MACHINE\software\Classes\.xps\bootstrap]
@DACL=(02 0000)
@="bootstrap.xps.1"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,0a,34,10,c8,7e,
54,f3,6a,c8,28,51,af,b0,29,a3,98,46,9b,a1,04,49,d1,e7,13,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:46,47,15,b0,92,4b,c7,ef,fb,82,50,f2,fd,
77,14,16,71,3b,04,66,8b,46,0d,96,c1,94,b1,95,c4,8f,7f,20,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,48,52,00,61,3b,
f1,6e,9a,25,da,ec,7e,55,20,c9,26,dd,8e,d2,b9,88,e4,5d,5e,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,ba,08,e8,be,2b,
31,1d,06,3e,1e,9e,e0,57,5a,93,61,e8,4d,f7,bc,13,ae,ca,b0,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,7b,6c,e1,e6,87,
b2,86,25,cd,44,cd,b9,a6,33,6c,cd,2e,62,db,92,49,9d,b0,d6,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:df,20,58,62,78,6b,cf,c8,61,b7,ff,e2,ee,
f7,58,54,b0,18,ed,a7,3f,8d,37,a4,1f,23,38,83,8f,99,78,c5,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,24,3d,0e,a5,95,
1d,a6,7c,31,77,e1,ba,b1,f8,68,02,17,96,6f,5b,9d,b5,92,6c,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,1b,27,08,08,11,
16,89,e2,83,6c,56,8b,a0,85,96,ab,3c,1c,32,87,70,d0,be,9f,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,e8,66,56,f1,c3,
43,bf,7a,51,fa,6e,91,28,9e,14,cc,ae,e5,57,eb,60,c5,f1,51,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,7c,43,f8,56,ed,
68,d9,35,b1,cd,45,5a,a8,c4,f8,b9,49,0c,e5,b5,ab,c1,47,04,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,da,f6,30,6b,db,
b0,b2,04,e3,0e,66,d5,eb,bc,2f,6b,c4,95,b8,35,6e,14,a2,38,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:05,73,21,dd,54,d8,4a,c5,86,3d,e4,d3,d3,
e2,94,b4,fa,ea,66,7f,d4,3b,6b,70,87,13,49,d2,12,4f,91,d7,6c,43,2d,1e,aa,22,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1168)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(444)
d:\program files\Stardock\ObjectDock\DockShellHook.dll
c:\windows\system32\ntshrui.dll
d:\program files\CursorXP\CurXP0.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
.
Celkový čas: 2009-07-08 13:57
ComboFix-quarantined-files.txt 2009-07-08 11:57

Před spuštěním: Volných bajtů: 18 880 155 648
Po spuštění: Volných bajtů: 18 889 232 384

245 --- E O F --- 2009-07-08 08:17

[motji]

Pak poprosím o log z MBAMU

Dejte soubor otestovat na www.virustotal.com
c:\windows\system32\iolobtdfg.exe
c:\windows\system32\smrgdf.exe
Do okénka zkopírujte cestu k souboru , pokud napíše, že soubor byl už testován, dejte otestovat znovu.
Sem vložte link s výsledky.

[synologic]

Tak MBAM - infikované objekty 0.
Jinak ty dva soubory jsou čisté - viz přílohy.
Tak už by ten kompl měl být v poho?

[motji]

Ale mě se ty soubory nelíbí

Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka

Kód: Vybrat vše

KillAll::
File:: 
c:\documents and settings\Doma\Local Settings\TEMP\ASFWHide
c:\windows\system32\iolobtdfg.exe
c:\windows\system32\smrgdf.exe
c:\windows\system32\d3d9caps.dat
C:\WINDOWS\System32\Drivers\spyemrg_access.sys
C:\WINDOWS\System32\Drivers\spyemrg_guard.sys 
C:\WINDOWS\System32\Drivers\spyemrg.sys 

Folder::
d:\Program Files\NETGATE\Spy Emergency 2009
C:\Documents and Settings\Doma\Data aplikací\Spy Emergency
C:\Documents and Settings\All Users\Data aplikací\NETGATE

Registry:: 
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ASFWHide]
"ImagePath"=-
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ASFWHide]

Driver:: 
getPlus(R) Helpe
MalwareDefenderService
ASFWHide
SpyEmrgSrv
SpyEmrgAccess
SpyEmrgGuard

Reglock::
[HKEY_USERS\S-1-5-21-4208744717-3381665663-3290484060-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]

RegNull::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]

-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:




-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

otestujte prosím na http://www.virustotal.com
C:\WINDOWS\msb.exe
C:\WINDOWS\fdsv.exe

[synologic]

Tak ty dva soubory msb.exe a fdsv.exe nemůžu najít.
Je fakt, že než jsem otevřel tuhle stránku, tak se mi spustil program ArowaxAntiSpyware a nějaké problémy objevil, které jsem následně pomocí tohoto programu vyčistil.
Tak jestli se to netýkalo zrovna těhle dvou souborů.
Jdu na ten ComboFix.

[motji]

Ani když do spodního okénka nakopírujete cestu k souboru, tak se nezobrazí?

[synologic]

Vůbec, v komplu nejsou.
Tady je log.
A díky moc za trpělivost a čas.

ComboFix 09-07-08.02 - Doma 08.07.2009 22:45.4 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1022.509 [GMT 2:00]
Spuštěný z: c:\documents and settings\Doma\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Doma\Plocha\CFScript.txt
AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Spy Emergency *On-access scanning enabled* (Updated) {82117492-906E-4b02-A33A-84D42A2DD907}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
SP: Spyware Doctor *disabled* (Updated) {1C3EDD79-273E-46ac-99F8-EFA9E7CBC301}

FILE ::
"c:\documents and settings\Doma\Local Settings\TEMP\ASFWHide"
"c:\windows\system32\d3d9caps.dat"
"c:\windows\System32\Drivers\spyemrg.sys"
"c:\windows\System32\Drivers\spyemrg_access.sys"
"c:\windows\System32\Drivers\spyemrg_guard.sys"
"c:\windows\system32\iolobtdfg.exe"
"c:\windows\system32\smrgdf.exe"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\d3d9caps.dat
c:\windows\system32\iolobtdfg.exe
c:\windows\system32\smrgdf.exe

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ASFWHIDE
-------\Legacy_MALWAREDEFENDERSERVICE
-------\Legacy_SPYEMRGGUARD
-------\Service_MalwareDefenderService


((((((((((((((((((((((((( Soubory vytvořené od 2009-06-08 do 2009-07-08 )))))))))))))))))))))))))))))))
.

2009-07-07 14:31 . 2009-07-07 14:31 -------- d-----w- c:\documents and settings\LocalService\Plocha
2009-07-07 14:11 . 2009-07-07 14:11 0 ----a-w- c:\windows\nsreg.dat
2009-07-07 12:26 . 2009-07-07 13:00 -------- d-----w- c:\windows\system32\logs
2009-07-07 12:23 . 2009-07-07 13:00 -------- d-----w- c:\windows\system32\URTTEMP
2009-06-29 19:56 . 2009-06-29 19:56 -------- d-----w- c:\program files\uTorrent
2009-06-27 23:15 . 2009-06-27 23:15 2560 ----a-w- c:\windows\_MSRSTRT.EXE

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-08 08:06 . 2001-10-25 12:00 83936 ----a-w- c:\windows\system32\perfc005.dat
2009-07-08 08:06 . 2001-10-25 12:00 440772 ----a-w- c:\windows\system32\perfh005.dat
2009-07-07 12:29 . 2001-10-31 18:04 -------- d-----w- c:\program files\ESET
2009-07-07 12:14 . 2008-12-02 16:58 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-06-28 21:07 . 2008-10-12 15:31 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-17 09:27 . 2009-01-24 10:43 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-17 09:27 . 2009-01-24 10:43 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-07 15:33 . 2002-09-20 16:04 346624 ------w- c:\windows\system32\localspl.dll
2009-04-29 04:35 . 2009-05-06 19:28 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-04-29 04:35 . 2002-09-20 16:05 667648 ----a-w- c:\windows\system32\wininet.dll
2009-04-19 19:52 . 2002-09-20 15:41 1847168 ------w- c:\windows\system32\win32k.sys
2009-04-16 15:23 . 2001-10-19 13:47 540672 ----a-w- c:\windows\RtlExUpd.dll
2009-04-15 14:54 . 2002-09-20 16:04 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-14 14:09 . 2001-10-19 13:48 5069312 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys
2009-04-10 11:38 . 2001-10-19 13:47 17879552 ----a-w- c:\windows\RTHDCPL.EXE
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CursorXP"="d:\program files\CursorXP\CursorXP.exe" [2005-01-19 128000]
"Steam"="d:\program files\valve\steam\steam.exe" [2009-06-10 1217784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-02-06 2021400]

c:\documents and settings\Eviźka\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Z stupce - ObjectDock.lnk - d:\program files\Stardock\ObjectDock\ObjectDock.exe [2008-12-3 3581680]

c:\documents and settings\Doma\Nabˇdka Start\Programy\Po spuçtŘnˇ\
ObjectDock Plus.lnk - d:\program files\Stardock\ObjectDock\ObjectDock.exe [2008-12-3 3581680]
Z stupce - Psycho.lnk - d:\security\Programy\Ostatnˇ\ZmŘna Vzhledu\ZmŘna - Kurzoru\Cursor XP\Psycho.CurXPTheme [2001-10-31 452175]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sremcon.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"d:\\Program Files\\QIP\\qip.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"d:\\Program Files\\Counter-Strike 1.6\\hl.exe"=
"d:\\Program Files\\Valve\\Steam\\SteamApps\\synologic\\counter-strike\\hl.exe"=
"c:\\Documents and Settings\\All Users\\Data aplikací\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\Czech\\setup.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [6.2.2009 14:23 106208]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [6.2.2009 14:23 727720]
R2 nxsIO32;NextSensor Kernel I/O Driver;c:\windows\system32\drivers\nxsIO32.sys [3.11.2008 13:19 2208]
S1 SASDIFSV;SASDIFSV;\??\d:\program files\SUPERAntiSpyware\SASDIFSV.SYS --> d:\program files\SUPERAntiSpyware\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\d:\program files\SUPERAntiSpyware\SASKUTIL.sys --> d:\program files\SUPERAntiSpyware\SASKUTIL.sys [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [5.5.2009 11:00 1684736]
S3 getPlus(R) Helper;getPlus(R) Helper; [x]
S3 M9205;M9205 USB TV Box;c:\windows\system32\drivers\M9205.sys [27.11.2008 20:06 143563]
S3 MemStPCI;Řadič Sony Memory Stick (PCI);c:\windows\system32\drivers\memstpci.sys [3.9.2008 22:21 26112]
S3 SASENUM;SASENUM;\??\d:\program files\SUPERAntiSpyware\SASENUM.SYS --> d:\program files\SUPERAntiSpyware\SASENUM.SYS [?]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys --> c:\windows\system32\DRIVERS\VBoxNetFlt.sys [?]
.
Obsah adresáře 'Naplánované úlohy'

2009-07-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 11:42]

2009-07-07 c:\windows\Tasks\NeroLiveEpgUpdate-NON_Evička.job
- d:\program files\Nero 9\Nero 9\Nero Live\NeroLive.exe [2008-09-18 12:51]
.
.
------- Doplňkový sken -------
.
uStart Page = http://www.seznam.cz
uDefault_Search_URL = hxxp://search.qip.ru
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&s ... f8&oe=utf8
mStart Page = http://www.seznam.cz
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Excel - d:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Stáhnout Free Download Managerem - file://d:\program files\Free Download Manager\dllink.htm
IE: {{0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - {0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - c:\program files\Seznam.cz\listicka.dll
TCP: {386C99A1-BF6B-4FDC-A67A-16B15859A7A1} = 212.71.128.8,193.85.1.100
DPF: DirectAnimation Java Classes
DPF: Microsoft XML Parser for Java
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-08 22:52
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-4208744717-3381665663-3290484060-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:a6,9c,76,1d,44,c8,d0,88,68,58,17,bf,4f,3f,f5,79,2f,85,34,92,f0,a2,0a,
24,fa,f7,92,72,f7,5c,67,c2,4f,06,ce,0a,aa,80,60,06,49,a4,92,c2,c7,6c,22,c5,\
"??"=hex:b0,3a,aa,9c,b2,9b,90,10,24,1e,bd,a8,3e,69,4f,dd

[HKEY_USERS\S-1-5-21-4208744717-3381665663-3290484060-1003\Software\SecuROM\License information*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"datasecu"=hex:1d,e6,1d,e8,99,46,fd,f6,59,f3,5a,28,1d,bb,67,5f,4a,eb,1f,00,af,
c0,1c,d9,95,8f,3f,ef,87,d4,93,03,9b,b8,f7,d8,63,d2,bd,5b,bc,fc,02,da,22,28,\
"rkeysecu"=hex:d0,ef,4a,86,9d,e5,93,63,17,83,d3,98,dd,41,b2,f8

[HKEY_LOCAL_MACHINE\software\Classes\.xaml\bootstrap]
@DACL=(02 0000)
@="bootstrap.xaml.1"

[HKEY_LOCAL_MACHINE\software\Classes\.xbap\bootstrap]
@DACL=(02 0000)
@="bootstrap.xbap.1"

[HKEY_LOCAL_MACHINE\software\Classes\.xps\bootstrap]
@DACL=(02 0000)
@="bootstrap.xps.1"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1164)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3236)
d:\program files\Stardock\ObjectDock\DockShellHook.dll
c:\windows\system32\ntshrui.dll
d:\program files\CursorXP\CurXP0.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
d:\program files\Photodex\ProShowGold\scsiaccess.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\system32\wdfmgr.exe
.
**************************************************************************
.
Celkový čas: 2009-07-08 22:56 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-07-08 20:55
ComboFix2.txt 2009-07-08 11:57

Před spuštěním: Volných bajtů: 18 878 504 960
Po spuštění: Volných bajtů: 18 889 461 760

177 --- E O F --- 2009-07-08 08:17

[motji]

:arrow:Stáhněte OtmoveIt3 http://oldtimer.geekstogo.com/OTM.exe
Stáhněte na plochu Otmovelt3, 2krát klikněte na Otmovelt3,spustí se program,
Do levého okna "Paste Instructions for Items to be Moved" pod žlutou čáru skopírujete skript

Kód: Vybrat vše

:processes
explorer.exe
 
:files
C:\WINDOWS\system32\*.tmp.dll /s
C:\WINDOWS\system32\SET*.tmp /s
C:\WINDOWS\*.tmp /s
C:\WINDOWS\msb.exe
C:\WINDOWS\fdsv.exe

:Services
getPlus(R) Helpe

:commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

-klikněte na červené tlačítko Moveit!
-sem vložte obsah zeleného okénka
-Pokud se bude chtít restartovat pc, dejte YES,log pak najdete C:\_OTMoveIt\MovedFiles. Log vložte sem

[synologic]

Tady to je:

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
C:\WINDOWS\system32\SET1CBF.tmp moved successfully.
C:\WINDOWS\system32\SET1CC7.tmp moved successfully.
C:\WINDOWS\system32\SET1CD2.tmp moved successfully.
C:\WINDOWS\system32\SET1DBA.tmp moved successfully.
C:\WINDOWS\system32\SET38A.tmp moved successfully.
C:\WINDOWS\system32\SET38E.tmp moved successfully.
C:\WINDOWS\system32\SET396.tmp moved successfully.
C:\WINDOWS\msdownld.tmp moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPF0F.tmp moved successfully.
C:\WINDOWS\system32\CONFIG.TMP moved successfully.
C:\WINDOWS\system32\KERNEL.TMP moved successfully.
File/Folder C:\WINDOWS\msb.exe not found.
File/Folder C:\WINDOWS\fdsv.exe not found.
========== SERVICES/DRIVERS ==========
Service\Driver getPlus(R) Helpe not found.
Service\Driver getPlus(R) Helpe not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Doma
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 169371272 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 15928917 bytes

User: Evička
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 4709 bytes
->Java cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32835 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 176,75 mb


OTM by OldTimer - Version 3.0.0.4 log created on 07082009_233553

Files moved on Reboot...

Registry entries deleted on Reboot...