Backdoor, Generic

[HonzaJV]

1.JPG

vysledek avg

(123.83 KiB) Staženo 293 x

Dobry vecer nedari se mi odstranit dva trojany. Nainstaloval jsem si AVG free a hlasi mi ze by nemeli byt odstraneny, protoze jsou vedeny na bile listine.
Nevim jestli je muzu smazat nebo vylecit jinak.

Dekuji za pomoc

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 21:57:31, on 20.1.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ShaPlus Bandwidth Meter\ShaPlus Bandwidth Meter.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\TO2SSM\McciTrayApp.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\TO2WCM\McciTrayApp.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Seznam.cz\postak.exe
C:\Documents and Settings\Olga Effemberkova\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Documents and Settings\Olga Effemberkova\Local Settings\Data aplikací\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Olga Effemberkova\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Olga Effemberkova\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Olga Effemberkova\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Olga Effemberkova\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60341
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60341
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60341
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Ukazatel S-Rank - {EA837F48-5AD1-443E-AE34-FFE03CBF3099} - C:\Program Files\Seznam.cz\core.2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ShaPlus Bandwidth Meter] "C:\Program Files\ShaPlus Bandwidth Meter\ShaPlus Bandwidth Meter" /s
O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TO2SSM_McciTrayApp] C:\Program Files\TO2SSM\McciTrayApp.exe
O4 - HKLM\..\Run: [TO2WCM_McciTrayApp] C:\Program Files\TO2WCM\McciTrayApp.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Seznam Postak] "C:\Program Files\Seznam.cz\postak.exe" -s
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Olga Effemberkova\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O20 - AppInit_DLLs: cru629.dat
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: CyberLink Media Library Service - Cyberlink - c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe

--
End of file - 8053 bytes

[Rudy]

Dejte log z Combofix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly

stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet

zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci

skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do

Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu

pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[HonzaJV]

rezidentni stit jsem uplne vypnul a i na podruhe mi to napsalo chybu

[HonzaJV]

dobry den,
tak se mi to ted rano povedlo spustit.
Prikladam vysledek.
dekuji



ComboFix 10-01-20.05 - Olga Effemberkova 21.01.2010 8:20.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.447.113 [GMT 1:00]
Spuštěný z: c:\documents and settings\Olga Effemberkova\Plocha\Slozky z plochy\H\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Data aplikacˇ\cyhig.vbs
c:\documents and settings\All Users\Data aplikacˇ\efevekypik.bat
c:\documents and settings\All Users\Data aplikacˇ\hafup.vbs
c:\documents and settings\All Users\Data aplikacˇ\jarozo.vbs
c:\documents and settings\All Users\Data aplikacˇ\kohazubit.bat
c:\documents and settings\All Users\Data aplikacˇ\kuvubezi.vbs
c:\documents and settings\All Users\Data aplikacˇ\kyfi.inf
c:\documents and settings\All Users\Data aplikacˇ\utyhifexyp.reg
c:\documents and settings\All Users\Data aplikacˇ\yqah.reg
c:\documents and settings\All Users\Dokumenty\guzevahe.reg
c:\documents and settings\All Users\Dokumenty\notyhikoty.bat
c:\documents and settings\All Users\Dokumenty\ovelibuh.inf
c:\documents and settings\All Users\Dokumenty\sytode.reg
c:\documents and settings\All Users\Dokumenty\wiwux.inf
c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\documents and settings\Olga Effemberkova\Cookies\bomawuluv.bin
c:\documents and settings\Olga Effemberkova\Cookies\gevagepum._sy
c:\documents and settings\Olga Effemberkova\Cookies\gyson.scr
c:\documents and settings\Olga Effemberkova\Cookies\lalyhihez.db
c:\documents and settings\Olga Effemberkova\Cookies\vixura.dll
c:\documents and settings\Olga Effemberkova\Data aplikacˇ\dijys.vbs
c:\documents and settings\Olga Effemberkova\Data aplikacˇ\gyjiwe.inf
c:\documents and settings\Olga Effemberkova\Data aplikacˇ\ohify.bat
c:\documents and settings\Olga Effemberkova\Data aplikacˇ\vureh.bat
c:\documents and settings\Olga Effemberkova\Data aplikacˇ\vywonyhymu.vbs
c:\documents and settings\Olga Effemberkova\delself.bat
c:\documents and settings\Olga Effemberkova\Local Settings\Data aplikacˇ\cotabixoq.bat
c:\documents and settings\Olga Effemberkova\Local Settings\Data aplikacˇ\ejajegifo.reg
c:\documents and settings\Olga Effemberkova\Local Settings\Data aplikacˇ\odufid.inf
c:\documents and settings\Olga Effemberkova\Local Settings\Temporary Internet Files\elapy.sys
c:\documents and settings\Olga Effemberkova\Local Settings\Temporary Internet Files\iqukuluwib.bin
c:\documents and settings\Olga Effemberkova\Local Settings\Temporary Internet Files\lyfofut.reg
c:\documents and settings\Olga Effemberkova\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\program files\Common Files\nepi.reg
c:\program files\Common Files\xicugacyh.reg
c:\program files\Common Files\zubanyk.inf
c:\program files\Java\jre6\bin\jucheck.exe
c:\recycler\S-1-5-21-995533147-2784491932-3128793636-1003
c:\windows\ahupurero.vbs
c:\windows\arofovow.dll
c:\windows\cimapajaw.scr
c:\windows\cru629.dat
c:\windows\igeh.reg
c:\windows\jotyxy.scr
c:\windows\lafof._sy
c:\windows\ogunucig.reg
c:\windows\sewusy.dll
c:\windows\system32\cru629.dat
c:\windows\system32\DelSelf.bat
c:\windows\system32\duqyhuvuw.inf
c:\windows\system32\guju.inf
c:\windows\system32\hulijuxa.inf
c:\windows\system32\wylecy.bat
c:\windows\ufelicuwi.bat
c:\windows\urikacek.bat
c:\windows\wisyhofu.inf
c:\windows\ygijap.scr
c:\windows\ymytader.dll

c:\windows\system32\drivers\ntfs.sys . . . je infikován!!

c:\windows\system32\drivers\AGP440.sys . . . je infikován!!

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-21 do 2010-01-21 )))))))))))))))))))))))))))))))
.

2010-01-20 20:53 . 2010-01-20 20:53 -------- d-----w- c:\program files\TrendMicro
2010-01-20 06:51 . 2004-08-18 11:00 4224 ----a-w- c:\windows\system32\drivers\beep.sys
2010-01-20 06:51 . 2004-08-18 11:00 4224 ----a-w- c:\windows\system32\dllcache\beep.sys
2010-01-20 01:11 . 2010-01-20 01:50 -------- d-----w- C:\$AVG
2010-01-20 01:08 . 2010-01-20 01:09 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-01-20 01:08 . 2010-01-20 01:08 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-01-20 01:07 . 2010-01-20 01:07 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-01-20 01:06 . 2010-01-21 01:48 -------- d-----w- c:\windows\system32\drivers\Avg
2010-01-20 01:06 . 2010-01-20 01:06 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-01-20 01:06 . 2010-01-20 01:06 -------- d-----w- c:\program files\AVG
2010-01-19 08:43 . 2010-01-19 08:43 -------- d-sh--w- c:\documents and settings\Olga Effemberkova\IECompatCache
2010-01-19 08:41 . 2010-01-19 08:41 -------- d-sh--w- c:\documents and settings\Olga Effemberkova\PrivacIE
2010-01-19 08:23 . 2010-01-19 08:23 -------- d-sh--w- c:\documents and settings\Olga Effemberkova\IETldCache
2010-01-19 08:19 . 2010-01-20 07:32 -------- d-----w- c:\windows\ie8updates
2010-01-19 08:15 . 2010-01-19 08:17 -------- dc-h--w- c:\windows\ie8
2010-01-19 08:15 . 2010-01-19 08:16 -------- d-----w- c:\windows\system32\cs-CZ
2010-01-19 07:16 . 2009-10-29 07:43 594432 ------w- c:\windows\system32\dllcache\msfeeds.dll
2010-01-19 07:16 . 2009-10-29 07:43 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll
2010-01-19 07:16 . 2009-10-29 07:43 55296 ------w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-01-19 07:16 . 2009-10-29 07:43 1985536 ------w- c:\windows\system32\dllcache\iertutil.dll
2010-01-19 07:16 . 2009-10-29 07:43 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2010-01-19 07:16 . 2009-10-29 07:43 11069952 ------w- c:\windows\system32\dllcache\ieframe.dll
2010-01-19 07:14 . 2009-10-02 04:44 92160 ------w- c:\windows\system32\dllcache\iecompat.dll
2010-01-19 07:13 . 2010-01-19 07:13 -------- d-----w- C:\2c13af5bf981653e49916433bc
2010-01-13 12:37 . 2009-11-21 16:46 470528 ------w- c:\windows\system32\dllcache\aclayers.dll
2009-12-27 15:51 . 2010-01-20 00:47 -------- d-----w- c:\program files\Windows Media Connect 2
2009-12-27 15:47 . 2009-12-27 15:49 -------- d-----w- c:\windows\system32\drivers\UMDF
2009-12-27 15:47 . 2009-12-27 15:47 -------- d-----w- c:\windows\system32\LogFiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-20 07:54 . 2009-11-20 13:36 -------- d-----w- c:\program files\F-Secure
2010-01-20 07:54 . 2009-08-31 00:49 -------- d-----w- c:\program files\Seznam.cz
2010-01-20 07:46 . 2005-07-05 14:52 443666 ----a-w- c:\windows\system32\perfh005.dat
2010-01-20 07:46 . 2005-07-05 14:52 84974 ----a-w- c:\windows\system32\perfc005.dat
2009-12-05 16:45 . 2009-09-16 17:31 -------- d-----w- c:\program files\BitComet
2009-12-05 16:42 . 2009-11-07 22:53 -------- d---a-w- c:\program files\Furnish Pro
2009-12-05 16:42 . 2009-11-07 22:54 -------- d-----w- c:\program files\Pixie
2009-12-05 16:40 . 2009-09-02 19:33 -------- d-----w- c:\program files\Opera
2009-11-22 21:22 . 2009-11-22 21:22 -------- d-----w- c:\program files\DVD Shrink
2009-11-22 21:20 . 2009-11-22 21:20 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-11-21 16:46 . 2005-07-05 14:51 470528 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-18 11:36 . 2005-07-05 15:37 94112 ----a-w- c:\windows\system32\drivers\AGP440.SYS
2009-10-29 07:43 . 2005-07-05 14:52 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-27 18:57 . 2009-08-27 18:57 14472 ----a-w- c:\program files\Common Files\pavudogygu.pif
2009-08-23 23:13 . 2009-08-23 23:13 18248 ----a-w- c:\program files\Common Files\etebopatec.bin
2009-08-19 12:53 . 2009-08-19 12:53 16583 ----a-w- c:\program files\Common Files\ihiqinemiq.dll
2009-08-19 12:53 . 2009-08-19 12:53 12197 ----a-w- c:\program files\Common Files\jeqakekus._dl
2009-08-19 12:53 . 2009-08-19 12:53 10992 ----a-w- c:\program files\Common Files\ykovasat._sy
2009-08-06 11:30 . 2009-08-06 11:30 18798 ----a-w- c:\program files\Common Files\kyfumaj.pif
2009-08-06 11:30 . 2009-08-06 11:30 15283 ----a-w- c:\program files\Common Files\voneqigip.scr
2009-08-06 11:30 . 2009-08-06 11:30 13640 ----a-w- c:\program files\Common Files\ysum.com
2009-08-06 11:30 . 2009-08-06 11:30 18811 ----a-w- c:\program files\Common Files\piwaq.dl
2009-07-22 22:04 . 2009-07-22 22:04 15236 ----a-w- c:\program files\Common Files\exazinem.ban
2009-07-22 22:04 . 2009-07-22 22:04 11994 ----a-w- c:\program files\Common Files\ujijeboxuk.bin
2009-07-22 19:59 . 2009-07-22 19:59 18759 ----a-w- c:\program files\Common Files\epydakeci.dl
2009-07-22 19:59 . 2009-07-22 19:59 16419 ----a-w- c:\program files\Common Files\esylaqymiz._sy
2009-07-22 19:59 . 2009-07-22 19:59 16120 ----a-w- c:\program files\Common Files\enizaj.exe
2009-07-22 19:59 . 2009-07-22 19:59 13519 ----a-w- c:\program files\Common Files\buwesyp.com
2009-07-22 19:59 . 2009-07-22 19:59 10041 ----a-w- c:\program files\Common Files\heqekeca.com
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Seznam Postak"="c:\program files\Seznam.cz\postak.exe" [2009-11-02 448664]
"Google Update"="c:\documents and settings\Olga Effemberkova\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2009-05-26 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ShaPlus Bandwidth Meter"="c:\program files\ShaPlus Bandwidth Meter\ShaPlus Bandwidth Meter" [X]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-06-16 794713]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"TO2SSM_McciTrayApp"="c:\program files\TO2SSM\McciTrayApp.exe" [2008-08-15 1473536]
"TO2WCM_McciTrayApp"="c:\program files\TO2WCM\McciTrayApp.exe" [2008-01-30 1473536]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-01-20 2033432]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 0 (0x0)
"NoFileAssociate"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-01-20 01:09 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"PHIME2002ASync"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
"PHIME2002A"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
"PCMService"="c:\apps\Powercinema\PCMService.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6\\ICQ.exe"=
"c:\\APPS\\skype\\Phone\\Skype.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"17634:TCP"= 17634:TCP:BitComet 17634 TCP
"17634:UDP"= 17634:UDP:BitComet 17634 UDP

R3 adusbmdm6501;AnyDATA CDMA USB Modem Driver (PID 6501);c:\windows\system32\DRIVERS\adusbmdm65.sys [2005-05-02 64896]
R3 adusbser6501;AnyDATA CDMA USB Serial Port (PID 6501);c:\windows\system32\DRIVERS\adusbser65.sys [2005-05-02 64896]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2010-01-20 333192]
S1 AvgTdiX;AVG Free Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2010-01-20 360584]
S2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-01-20 285392]

.
Obsah adresáře 'Naplánované úlohy'

2010-01-20 c:\windows\Tasks\User_Feed_Synchronization-{3FEC8792-2322-4E7D-99CF-E977171E215A}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
.
------- Asociace souborů -------
.
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-21 08:44
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
"ImagePath"="\"c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe\"\00\00\00\00\02\00\00\00€
[%\00«Ô‘|\00\00\00\00\00\00\00\00\00\00\00\003\00\00\00\00\004\03pč\13\00pč\13\00\18î"

.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(680)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2010-01-21 08:52:22
ComboFix-quarantined-files.txt 2010-01-21 07:51

Před spuštěním: Volných bajtů: 65 383 890 944
Po spuštění: Volných bajtů: 65 821 323 264

- - End Of File - - E4F470D522D81F9600EA09FABD49DCF3

[Rudy]

Většina problémů vyřešena. Ještě provedeme následující: Přesuňte ComboFix na plochu. Otevřte poznámkový blok a zkopírujte do něj:

FCopy::
c:\windows\ServicePackFiles\i386\ntfs.sys | c:\windows\system32\drivers\ntfs.sys
c:\windows\ServicePackFiles\i386\AGP440.sys | c:\windows\system32\drivers\AGP440.sys

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.