VIRY.CZ

Dobrý den, mám problém s sshnas.dll, vždy při startu win vyskočí okno rundll nenalezen. A navíc mě to našlo vir
"Trojský kůň Downloader.Agent2.PYX";"C:\Windows\System32\sshnas.dll";"Přesunuto do trezoru";"2.1.2010, 17:32:12";"Soubor";"C:\Program Files\Mozilla Firefox\firefox.exe"

log z mbam:
Malwarebytes' Anti-Malware 1.43
Verze databáze: 3486
Windows 6.1.7600
Internet Explorer 8.0.7600.16385

8.1.2010 0:06:03
mbam-log-2010-01-08 (00-05-53).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 99610
Uplynulý čas: 2 minute(s), 48 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 1
Infikované hodnoty registru: 1
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> No action taken.

Infikované hodnoty registru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\losalamos (Trojan.Agent) -> No action taken.

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
(Nebyly nalezeny žádné škodlivé položky)


Jak jsme zminoval, mam windows 7. Predem dekuji za pomoc.

Ahoj, ked zmazes nalez MbAMu, tak by mala prestat vyskakovat ta hlaska.
Sprav vsak aj kompletny scan, co program najde, zmaz. Log sem hod.

Stiahni Runscanner. Zvol "Beginner Mode". V dalsom okne vyber len "Save a binary .Run file" -> "Scan Computer". Zacne scan, po jeho skonceni uloz OBA subory na plochu (nic nemen). Na ploche sa objavi subor runscanner.run - tento subor daj do archivu (zip, rar,...) a vloz ako prilohu sem na forum.

Pozor: Na ploche bude aj subor runscanner.txt, netreba si ich pomylit.

Btw, Win7 32bit?

Ano Win7 32 bit....

Po rychlem skenu a smazanim te haveti uz okno s chybou nevyskocilo.

Restartoval jsem a tady je log z uplne kontroly. Nic nenalezeno .

Log z mbam:
Malwarebytes' Anti-Malware 1.43
Verze databáze: 3486
Windows 6.1.7600
Internet Explorer 8.0.7600.16385

8.1.2010 11:37:39
mbam-log-2010-01-08 (11-37-39).txt

Typ kontroly: Kompletní kontrola (C:\|)
Zkontrolované objekty: 191881
Uplynulý čas: 21 minute(s), 1 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
(Nebyly nalezeny žádné škodlivé položky)



Log z runescape:
Runscanner logfile

* = signed file
- = file not found

General info
------------
Computer name : DOMA-PC
Creation time : 8.1.2010 11:39:13
Hosts <> 127.0.0.1 : 0
Hosts file location : %SystemRoot%\System32\drivers\etc
IE version : 8.0.7600.16385
OS : Windows 7 Home Premium
OS Build : 7600
OS SP :
RunScanner Version : 1.9.0.9
User Language : Čeština (Česká republika)
User rights : Administrator
Windows folder : C:\Windows

Running processes
-----------------
* C:\Windows\system32\atieclxx.exe (AMD)
* C:\Windows\system32\atiesrxx.exe (AMD)
* C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
* C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
* C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
* C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
* C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
* C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
* C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
* C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Advanced Micro Devices Inc.)
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (ATI Technologies Inc.)
* C:\Windows\system32\csrss.exe (Microsoft Corporation)
* C:\Windows\system32\csrss.exe (Microsoft Corporation)
* C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
* C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
* C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
* C:\Windows\system32\svchost.exe (Microsoft Corporation)
* C:\Windows\system32\svchost.exe (Microsoft Corporation)
* C:\Windows\system32\svchost.exe (Microsoft Corporation)
* C:\Windows\system32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\system32\svchost.exe (Microsoft Corporation)
* C:\Windows\system32\svchost.exe (Microsoft Corporation)
* C:\Windows\system32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\system32\svchost.exe (Microsoft Corporation)
* C:\Windows\system32\taskhost.exe (Microsoft Corporation)
* C:\Windows\system32\lsass.exe (Microsoft Corporation)
* C:\Windows\system32\lsm.exe (Microsoft Corporation)
* C:\Windows\system32\SearchIndexer.exe (Microsoft Corporation)
* C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG)
C:\Windows\system32\IoctlSvc.exe (Prolific Technology Inc.)
* C:\Windows\system32\PnkBstrA.exe
* C:\Windows\Explorer.EXE (Microsoft Corporation)
* C:\Zbytek\runscanner.exe (Runscanner.net)
C:\Program Files\Salamander\Salamander\SALAMAND.EXE
* C:\Windows\system32\services.exe (Microsoft Corporation)
* C:\Windows\System32\spoolsv.exe (Microsoft Corporation)
* C:\Windows\system32\Dwm.exe (Microsoft Corporation)
* C:\Windows\system32\audiodg.exe (Microsoft Corporation)
* C:\Windows\system32\WUDFHost.exe (Microsoft Corporation)
* C:\Windows\system32\winlogon.exe (Microsoft Corporation)
* C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
* c:\windows\System32\smss.exe (Microsoft Corporation)
* C:\Windows\system32\wininit.exe (Microsoft Corporation)

Unrated items
-------------
002 C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)
002 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
003 * C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
010 C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (IDriverT Module)
010 C:\Windows\system32\IoctlSvc.exe (PLFlash DeviceIoControl Service)
010 * C:\Windows\system32\PnkBstrA.exe (PnkBstrA.exe)
011 C:\Windows\System32\Drivers\sptd.sys (sptd)
042 GUID / CLSID not found {2670000A-7350-4f3c-8081-5663EE0C6C49}
042 GUID / CLSID not found {92780B25-18CC-41C8-B9BE-3C9C571A8263}
060 GUID / CLSID not found {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
061 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll (Advanced Micro Devices, Inc.) {5E2121EE-0300-11D4-8D3B-444553540000}
061 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiamaxx.dll (Advanced Micro Devices, Inc.) {872A9397-E0D6-4e28-B64D-52B8D0A7EA35}
061 C:\Program Files\WinRAR\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}
100 Start Page HKCU : http://www.seznam.cz/
105 E&xportovat do aplikace Microsoft Excel : res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
173 C:\Program Files\WinRAR\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}
221 C:\Program Files\WinRAR\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}
223 * C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes Corporation) {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
225 * C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes Corporation) {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
225 * C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes Corporation) {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
225 C:\Program Files\WinRAR\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}
225 C:\Program Files\WinRAR\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}
227 C:\Program Files\WinRAR\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}
229 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll (Advanced Micro Devices, Inc.) {5E2121EE-0300-11D4-8D3B-444553540000}
251 C:\Program Files\WinRAR\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA}

Missing files
-------------
032 rdpclip

1) Stiahni The_Comedian a uloz na plochu. Spust klasickym dvojklikom. Otvori sa uvodne okno programu, ktory ta z casu nacas vyzve na stlacenie lubovolnej klavesy. V 3. kroku sa ta spyta na instalaciu Eruntu (zalohovacej utility), zvol "OK" a pokracuj podla pokynov (nic nemen). Po 4. kroku sa program stlacenim lubovolnej slavesy ukonci.


2) Stiahni subor z prilohy. Spust ho, klikni na "Item Fixer" -> "Fix Selected Items".


3) Stiahni ComboFix, najlepsie na plochu. Vypni vsetky otvorene aplikacie, ako aj rezidenty antiviru, antispywaru a firewall. Spust program cez ucet s administratorskymi pravami a postupuj podla instrukcii. Cely sken bude trvat cca 10 minut. Pocas neho moze byt PC restartovane. Log, ktory ComboFix vytvori, najdes na adrese "C:\ComboFix.txt".
Ten vloz sem.

Pozor: Kym ComboFix nevytvori log, na nic neklikat, nic nestlacat !!

pri otevirani comedianu to naslo vir trojsky kun backdoor.smallx.vx
a v čem mam spustit ten soubor z prilohy?

Hlasku ignorovat, FP.

Prilohu by ti mal automaticky spustit runscanner (pripona .run by mala byt asociovana s nim). Ak by to nefungovalo, vyber prosim runscanner ako program, v ktorom treba subor spustit.

tak ten comedian se nechce pustit. Vzdy napise ze program prestal pracovat.

Pouzi miesto neho len Erunt...
Stiahni Erunt. Uloz na plochu a spust. Prebehne klasicka instalacia (odporucam nic nemenit) a postupuj podla pokynov. Nakoniec program vytvori zalohu. Hotovo.

A pokracuj podla navodu

Vše provedeno, ten erunt akorat vytvoril ve windows slozku s datem a asi zalohou, muzu to vse smazat?

Tady je log
ComboFix 10-01-04.01 - doma 08.01.2010 23:54:56.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1250.420.1029.18.3327.2415 [GMT 1:00]
Spuštěný z: c:\users\doma\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\ICQ6.5\ICQLRun.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-08 do 2010-01-08 )))))))))))))))))))))))))))))))
.

2010-01-08 22:58 . 2010-01-08 22:58 -------- d-----w- c:\users\doma\AppData\Local\temp
2010-01-08 22:58 . 2010-01-08 22:58 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-01-08 22:42 . 2010-01-08 22:42 -------- d-----w- c:\program files\ERUNT
2010-01-08 10:38 . 2010-01-08 22:45 -------- d-----w- c:\users\doma\AppData\Local\Runscanner.net
2010-01-03 12:07 . 2010-01-03 12:07 -------- d-----w- c:\users\doma\AppData\Roaming\Malwarebytes
2010-01-03 12:07 . 2009-12-30 13:55 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-03 12:07 . 2010-01-03 12:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-03 12:07 . 2010-01-03 12:07 -------- d-----w- c:\programdata\Malwarebytes
2010-01-03 12:07 . 2009-12-30 13:54 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-03 11:54 . 2010-01-03 11:54 -------- d-----w- c:\program files\trend micro
2009-12-30 15:11 . 2009-12-30 15:11 -------- d-----w- c:\program files\PopCap Games
2009-12-30 13:52 . 2009-12-30 13:52 -------- d-----w- c:\programdata\Protexis
2009-12-30 12:26 . 2009-12-30 12:26 -------- d-----w- c:\program files\MachrSoft
2009-12-30 12:26 . 1999-03-23 09:12 299520 ----a-w- c:\windows\uninst.exe
2009-12-30 12:23 . 2009-12-30 12:26 -------- d-----w- c:\program files\Čtyřka
2009-12-23 19:02 . 2009-12-23 19:02 -------- d-----w- c:\users\doma\AppData\Local\Diagnostics
2009-12-21 21:56 . 2009-12-21 21:56 -------- d--h--w- c:\windows\msdownld.tmp
2009-12-21 21:55 . 2009-12-21 21:56 -------- d-----w- c:\program files\Igneous
2009-12-20 16:55 . 2009-12-20 16:55 -------- d-----w- c:\users\doma\AppData\Local\ElevatedDiagnostics
2009-12-19 07:22 . 2009-12-19 07:22 484160 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2009-12-18 14:01 . 2009-12-18 14:01 294656 ----a-w- c:\programdata\avg9\update\backup\avglngx.dll
2009-12-13 19:21 . 2009-12-23 08:50 4043544 ----a-w- c:\programdata\avg9\update\backup\avgui.exe
2009-12-13 19:21 . 2009-12-13 19:21 2033432 ----a-w- c:\programdata\avg9\update\backup\avgtray.exe
2009-12-13 19:21 . 2009-12-13 19:21 3776280 ----a-w- c:\programdata\avg9\update\backup\setup.exe
2009-12-13 19:21 . 2009-12-13 19:21 2352920 ----a-w- c:\programdata\avg9\update\backup\avgresf.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-08 22:58 . 2009-12-05 10:34 -------- d-----w- c:\program files\ICQ6.5
2010-01-08 22:53 . 2009-12-05 10:34 -------- d-----w- c:\users\doma\AppData\Roaming\ICQ
2010-01-08 16:14 . 2009-12-05 11:34 -------- d-----w- c:\program files\Call of Duty Game of the Year Edition
2010-01-08 16:01 . 2009-12-05 12:38 138376 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-01-08 16:01 . 2009-12-05 12:38 202448 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-01-08 13:46 . 2009-07-14 08:44 622422 ----a-w- c:\windows\system32\perfh005.dat
2010-01-08 13:46 . 2009-07-14 08:44 118604 ----a-w- c:\windows\system32\perfc005.dat
2010-01-02 16:34 . 2009-12-04 09:33 -------- d-----w- c:\programdata\avg9
2009-12-30 15:11 . 2009-12-05 10:03 -------- d-----w- c:\programdata\PopCap Games
2009-12-30 12:26 . 2009-12-30 12:23 -------- d-----w- c:\program files\Čtyřka
2009-12-24 03:09 . 2009-12-04 13:38 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2009-12-23 08:50 . 2009-12-05 12:27 3966744 ----a-w- c:\programdata\avg9\update\backup\avgcorex.dll
2009-12-07 00:46 . 2009-12-07 00:46 -------- d-----w- c:\program files\MSXML 4.0
2009-12-06 18:18 . 2009-12-06 18:18 -------- d-----w- c:\program files\Common Files\InstallShield
2009-12-05 12:37 . 2009-12-05 12:37 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-12-05 12:03 . 2009-12-05 12:03 -------- d-----w- c:\program files\GamePark
2009-12-05 11:24 . 2009-12-05 11:24 -------- d-----w- c:\program files\BFG
2009-12-05 11:16 . 2009-12-05 11:16 -------- d-----w- c:\program files\ReflexiveArcade
2009-12-05 11:10 . 2009-12-05 11:10 -------- d-----w- c:\users\doma\AppData\Roaming\Nero
2009-12-05 11:06 . 2009-12-05 11:04 -------- d-----w- c:\program files\Common Files\Nero
2009-12-05 11:04 . 2009-12-05 11:04 -------- d-----w- c:\programdata\Nero
2009-12-05 11:04 . 2009-12-05 11:04 -------- d-----w- c:\program files\Nero
2009-12-05 10:35 . 2009-12-05 10:35 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-05 10:21 . 2009-12-05 10:21 -------- d-----w- c:\users\doma\AppData\Roaming\vlc
2009-12-05 10:21 . 2009-12-05 10:21 -------- d-----w- c:\program files\VideoLAN
2009-12-05 10:20 . 2009-12-05 10:20 209616 ----a-w- c:\windows\IPUI_DivXG400.exe
2009-12-05 09:57 . 2009-12-05 09:57 -------- d-----w- c:\programdata\Trymedia
2009-12-05 09:41 . 2009-12-04 09:17 108824 ----a-w- c:\users\doma\AppData\Local\GDIPFONTCACHEV1.DAT
2009-12-05 09:31 . 2009-12-05 09:28 -------- d-----w- c:\programdata\Microsoft Help
2009-12-05 09:30 . 2009-12-05 09:30 -------- d-----w- c:\program files\Microsoft Works
2009-12-05 09:30 . 2009-07-14 04:52 -------- d-----w- c:\program files\MSBuild
2009-12-05 09:30 . 2009-12-05 09:30 -------- d-----w- c:\program files\Microsoft.NET
2009-12-05 09:29 . 2009-12-05 09:29 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-12-05 09:26 . 2009-12-05 09:22 -------- d-----w- c:\users\doma\AppData\Roaming\DAEMON Tools Lite
2009-12-05 09:25 . 2009-12-05 09:25 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2009-12-05 09:23 . 2009-12-05 09:23 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-12-05 09:23 . 2009-12-05 09:23 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-12-05 09:22 . 2009-12-05 09:22 -------- d-----w- c:\programdata\DAEMON Tools Lite
2009-12-05 09:03 . 2009-12-05 09:03 -------- d-----w- c:\users\doma\AppData\Roaming\Canon
2009-12-05 09:03 . 2009-12-05 09:03 -------- d-----w- c:\program files\Canon
2009-12-05 09:02 . 2009-12-05 09:02 -------- d--h--w- c:\programdata\CanonBJ
2009-12-05 09:01 . 2009-12-05 09:01 -------- d--h--w- c:\program files\CanonBJ
2009-12-04 13:57 . 2009-12-04 13:29 -------- d-----w- c:\users\doma\AppData\Roaming\Winamp
2009-12-04 13:38 . 2009-12-04 13:38 484144 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-12-04 13:29 . 2009-12-04 13:29 -------- d-----w- c:\program files\Winamp
2009-12-04 13:29 . 2009-12-04 13:29 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2009-12-04 13:18 . 2009-12-04 13:18 -------- d-----w- c:\program files\Salamander
2009-12-04 13:10 . 2009-12-04 13:10 -------- d-----w- c:\program files\Codec Pack - All In 1
2009-12-04 13:10 . 2009-12-04 13:10 737280 ----a-w- c:\windows\iun6002.exe
2009-12-04 09:33 . 2009-12-04 09:33 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-12-04 09:33 . 2009-12-04 09:33 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-12-04 09:33 . 2009-12-04 09:33 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-12-04 09:33 . 2009-12-04 09:33 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-12-04 09:33 . 2009-12-04 09:33 -------- d-----w- c:\program files\AVG
2009-12-04 09:17 . 2009-12-04 09:17 -------- d-----w- c:\users\doma\AppData\Roaming\ATI
2009-12-04 09:17 . 2009-12-04 09:17 -------- d-----w- c:\programdata\ATI
2009-12-04 09:16 . 2009-12-04 09:15 -------- d-----w- c:\program files\ATI
2009-12-04 09:16 . 2009-12-04 09:15 -------- d-----w- c:\program files\ATI Technologies
2009-12-04 09:15 . 2009-12-04 09:15 10134 ----a-r- c:\users\doma\AppData\Roaming\Microsoft\Installer\{A548C254-03BB-22F8-1064-899487B3CF85}\ARPPRODUCTICON.exe
2009-12-04 08:39 . 2009-12-04 08:39 -------- d-sh--we c:\programdata\Plocha
2009-12-04 08:39 . 2009-12-04 08:39 -------- d-sh--we c:\programdata\Oblíbené položky
2009-12-04 08:39 . 2009-12-04 08:39 -------- d-sh--we c:\programdata\Šablony
2009-12-04 08:39 . 2009-12-04 08:39 -------- d-sh--we c:\programdata\Nabídka Start
2009-12-04 08:39 . 2009-12-04 08:39 -------- d-sh--we c:\programdata\Dokumenty
2009-12-04 08:39 . 2009-12-04 08:39 -------- d-sh--we c:\programdata\Data aplikací
2009-12-04 08:36 . 2009-12-04 08:36 0 ----a-w- c:\windows\ativpsrm.bin
2009-12-04 08:36 . 2009-12-04 08:36 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
2009-11-04 16:16 . 2009-11-04 16:16 5079040 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2009-11-04 15:46 . 2009-11-04 15:46 479232 ----a-w- c:\windows\system32\ATIDEMGX.dll
2009-11-04 15:45 . 2009-11-04 15:45 360448 ----a-w- c:\windows\system32\atieclxx.exe
2009-11-04 15:45 . 2009-11-04 15:45 172032 ----a-w- c:\windows\system32\atiesrxx.exe
2009-11-04 15:43 . 2009-11-04 15:43 159744 ----a-w- c:\windows\system32\atitmmxx.dll
2009-11-04 15:43 . 2009-11-04 15:43 356352 ----a-w- c:\windows\system32\atipdlxx.dll
2009-11-04 15:43 . 2009-11-04 15:43 274432 ----a-w- c:\windows\system32\Oemdspif.dll
2009-11-04 15:43 . 2009-11-04 15:43 11776 ----a-w- c:\windows\system32\atimuixx.dll
2009-11-04 15:42 . 2009-11-04 15:42 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2009-11-04 15:39 . 2009-07-13 22:09 3034624 ----a-w- c:\windows\system32\atidxx32.dll
2009-11-04 15:23 . 2009-08-18 01:20 3602432 ----a-w- c:\windows\system32\atiumdag.dll
2009-11-04 15:11 . 2009-11-04 15:11 12964352 ----a-w- c:\windows\system32\atioglxx.dll
2009-11-04 15:05 . 2009-08-18 01:05 2899456 ----a-w- c:\windows\system32\atiumdva.dll
2009-11-04 14:52 . 2009-11-04 14:52 52224 ----a-w- c:\windows\system32\atimpc32.dll
2009-11-04 14:52 . 2009-11-04 14:52 52224 ----a-w- c:\windows\system32\amdpcom32.dll
2009-11-04 14:52 . 2009-11-04 14:52 208896 ----a-w- c:\windows\system32\atiadlxx.dll
2009-11-04 14:47 . 2009-11-04 14:47 53248 ----a-w- c:\windows\system32\aticalrt.dll
2009-11-04 14:47 . 2009-11-04 14:47 53248 ----a-w- c:\windows\system32\aticalcl.dll
2009-11-04 14:46 . 2009-11-04 14:46 3547136 ----a-w- c:\windows\system32\aticaldd.dll
2009-11-04 14:37 . 2009-11-04 14:37 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2009-11-02 19:42 . 2009-12-04 08:57 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-29 07:22 . 2009-12-05 10:54 2048 ----a-w- c:\windows\system32\tzres.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-04 98304]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2009-06-14 307200]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-01-02 2033432]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]

c:\users\doma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [4.12.2009 10:33 333192]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\System32\drivers\avgtdix.sys [4.12.2009 10:33 360584]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\System32\atiesrxx.exe [4.11.2009 16:45 172032]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [4.12.2009 10:33 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [4.12.2009 10:33 285392]
R3 RTL8167;Ovladač Realtek 8167 NT;c:\windows\System32\drivers\Rt86win7.sys [10.6.2009 22:18 139776]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [5.12.2009 10:23 691696]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\doma\AppData\Roaming\Mozilla\Firefox\Profiles\k1porwq0.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2010-01-08 23:59:35
ComboFix-quarantined-files.txt 2010-01-08 22:59

Před spuštěním: Volných bajtů: 180 866 113 536
Po spuštění: Volných bajtů: 181 042 511 872

- - End Of File - - F4334B763C3400BD80ED128F42AEC7DB

Log je v poriadku, ako sa sprava pocitac? Radsej este nic nemaz, odstranime to az ked skoncime robotu s PC

Počítač se tvaří v pořádku, nenarazil jsem na žádnou závadu. Při startu to nevyhodí žádnou chybu. Projel jsem to Mbam a nenašel nic, Projel jsem to AVG a nenašel nic. Takže myslím že vše ok.
Děkuji moc

Teď už můžu všechny věci co jsme použily smazat ?

1) Docistime to:

• Odinstaluj Combofix:
  Start -> Spustit -> (napis) combofix /uninstall

• Pouzi T-Cleaner (ak by ho antivirus hlasil ako smejda, nic sa netreba bat, ide len o paranoju AV programu).

• Precisti PC CCleanerom (vratane registrov).

• Pouzi TFC (spust program a klikni na "Start". Pozor, PC moze byt restartovane).

2) Vloz log z HJT.

V pripade nezrovnalosti sa >>tu<< nachadza navod.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:14:31, on 9.1.2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\explorer.exe
C:\Program Files\Salamander\Salamander\SALAMAND.EXE
C:\Lukáš\Programy\Na viry\HiJackThis new\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - AppInit_DLLs: C:\Windows\System32\avgrsstx.dll
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

--
End of file - 3372 bytes

Este ta poprosim o toto:

Stiahni SecurityCheck. Spust ho a postupuj podla instrukcii. Nakoniec vyhodi log, ktory skopiruj sem.

Results of screen317's Security Check version 0.99.1
Windows 7 (UAC is enabled)
``````````````````````````````
Antivirus/Firewall Check:
AVG Free 9.0
WMIC entry does not exist for antivirus; attempting automatic update.
``````````````````````````````
Anti-malware/Other Utilities Check:
HijackThis 2.0.2
CCleaner (remove only)
Adobe Flash Player 10
``````````````````````````````
Process Check:
objlist.exe by Laurent
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
AVG avgemc.exe
``````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

`````````End of Log```````````