prosim o surnu pomoc / personal security /

[marilynman]

nechtiac som stiahol update na nejaky antivir a stiahlo mi to plevel taky ze sa neviem dostat do svojich suborov, neustale to chce odo mna generacne cody no hrozne mrzne mi a dostanem sa do pocitaca a net iba cez safe mode. prosim o surnu pomoc, dakujem.



Logfile of random's system information tool 1.06 (written by random/random)
Run by eugen at 2010-02-18 15:17:06
Microsoft® Windows Vista™ Home Basic
System drive C: has 51 GB (65%) free of 79 GB
Total RAM: 446 MB (7% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:17:13, on 18. 2. 2010
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16982)
Boot mode: Safe mode with network support

Running processes:
C:\Windows\Explorer.EXE
C:\Windows\helppane.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\eugen\RSIT.exe
C:\Program Files\trend micro\eugen.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: &Security Update - {6551001F-A07B-40B1-8F55-B44BF35A42A6} - C:\Windows\System32\win32extension.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: T-Com Softphone Slovak.lnk = ?
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Update Service (gupdate1c95c49614cd6b5) (gupdate1c95c49614cd6b5) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 5206 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Google Software Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\Norton Security Scan for eugen.job
C:\Windows\tasks\PersSecurity.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-24 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2007-12-12 1372160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2009-12-12 1111320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6551001F-A07B-40B1-8F55-B44BF35A42A6}]
&Security Update - C:\Windows\System32\win32extension.dll [2010-02-17 631296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
AVG Security Toolbar BHO - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll [2009-11-25 1230080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-01-29 279664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll [2010-01-29 812528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - AVG Security Toolbar - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll [2009-11-25 1230080]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-01-29 279664]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2007-11-14 1006264]
"VTTimer"=C:\Windows\system32\VTTimer.exe [2006-09-14 53248]
"VTTrayp"=C:\Windows\system32\VTtrayp.exe [2007-04-25 176128]
"SoundMan"=C:\Windows\SOUNDMAN.EXE [2008-09-10 604704]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2009-12-12 2043160]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-12-08 39408]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
T-Com Softphone Slovak.lnk - C:\Windows\Installer\{BED6356D-6D21-4E8D-BEEB-FD2938E91BDE}\SoftphoneIcon.exe

C:\Users\eugen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="avgrsstx.dll"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2010-02-18 15:10:20 ----D---- C:\Program Files\trend micro
2010-02-18 15:10:19 ----D---- C:\rsit
2010-02-18 07:34:38 ----A---- C:\Windows\ntbtlog.txt
2010-02-17 19:55:58 ----D---- C:\Program Files\Common Files\PersSecurityUninstall
2010-02-17 19:55:52 ----A---- C:\Windows\system32\win32extension.dll
2010-02-17 19:55:43 ----D---- C:\Program Files\PersSecurity
2010-02-10 07:18:59 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-02-10 07:18:56 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-02-10 07:18:50 ----A---- C:\Windows\system32\netiougc.exe
2010-02-10 07:18:49 ----A---- C:\Windows\system32\tcpipcfg.dll
2010-02-10 07:18:45 ----A---- C:\Windows\system32\quartz.dll
2010-02-10 07:18:44 ----A---- C:\Windows\system32\tsbyuv.dll
2010-02-10 07:18:44 ----A---- C:\Windows\system32\msyuv.dll
2010-02-10 07:18:44 ----A---- C:\Windows\system32\msvidc32.dll
2010-02-10 07:18:44 ----A---- C:\Windows\system32\msrle32.dll
2010-02-10 07:18:44 ----A---- C:\Windows\system32\mciavi32.dll
2010-02-10 07:18:44 ----A---- C:\Windows\system32\iyuv_32.dll
2010-02-10 07:18:44 ----A---- C:\Windows\system32\avifil32.dll
2010-02-10 07:18:43 ----A---- C:\Windows\system32\msvfw32.dll
2010-02-10 07:18:43 ----A---- C:\Windows\system32\avicap32.dll
2010-01-22 07:28:45 ----A---- C:\Windows\system32\mshtml.dll
2010-01-22 07:28:43 ----A---- C:\Windows\system32\wininet.dll
2010-01-22 07:28:42 ----A---- C:\Windows\system32\urlmon.dll
2010-01-22 07:28:41 ----A---- C:\Windows\system32\ieframe.dll
2010-01-22 07:28:40 ----A---- C:\Windows\system32\mstime.dll
2010-01-22 07:28:39 ----A---- C:\Windows\system32\ieapfltr.dll
2010-01-22 07:28:38 ----A---- C:\Windows\system32\iertutil.dll
2010-01-22 07:28:38 ----A---- C:\Windows\system32\iedkcs32.dll
2010-01-22 07:28:38 ----A---- C:\Windows\system32\dxtmsft.dll
2010-01-22 07:28:37 ----A---- C:\Windows\system32\occache.dll
2010-01-22 07:28:37 ----A---- C:\Windows\system32\mshtmled.dll
2010-01-22 07:28:37 ----A---- C:\Windows\system32\msfeeds.dll
2010-01-22 07:28:37 ----A---- C:\Windows\system32\ieaksie.dll
2010-01-22 07:28:36 ----A---- C:\Windows\system32\ieencode.dll
2010-01-22 07:28:36 ----A---- C:\Windows\system32\icardie.dll
2010-01-22 07:28:36 ----A---- C:\Windows\system32\dxtrans.dll
2010-01-22 07:28:35 ----A---- C:\Windows\system32\jsproxy.dll
2010-01-22 07:28:34 ----A---- C:\Windows\system32\ieui.dll
2010-01-22 07:28:34 ----A---- C:\Windows\system32\iesetup.dll
2010-01-22 07:28:34 ----A---- C:\Windows\system32\iernonce.dll
2010-01-22 07:28:34 ----A---- C:\Windows\system32\advpack.dll
2010-01-22 07:28:34 ----A---- C:\Windows\system32\admparse.dll
2010-01-22 07:28:33 ----A---- C:\Windows\system32\ieUnatt.exe
2010-01-22 07:28:33 ----A---- C:\Windows\system32\ie4uinit.exe
2010-01-22 07:28:32 ----A---- C:\Windows\system32\pngfilt.dll
2010-01-22 07:28:32 ----A---- C:\Windows\system32\ieakui.dll
2010-01-22 07:28:31 ----A---- C:\Windows\system32\mshtmler.dll

======List of files/folders modified in the last 1 months======

2010-02-18 15:10:20 ----RD---- C:\Program Files
2010-02-18 15:06:20 ----D---- C:\Users\eugen\AppData\Roaming\OpenOffice.org2
2010-02-18 15:06:07 ----D---- C:\Windows\Temp
2010-02-18 15:01:15 ----D---- C:\Windows\Tasks
2010-02-18 15:00:49 ----D---- C:\Windows\Prefetch
2010-02-18 14:59:05 ----D---- C:\Windows\system32\catroot2
2010-02-18 12:49:39 ----HD---- C:\$AVG8.VAULT$
2010-02-18 10:24:19 ----D---- C:\ProgramData\Google Updater
2010-02-18 09:05:16 ----SHD---- C:\System Volume Information
2010-02-18 07:34:38 ----D---- C:\Windows
2010-02-17 19:56:03 ----D---- C:\Windows\System32
2010-02-17 19:55:59 ----D---- C:\Windows\system32\Tasks
2010-02-17 19:55:58 ----D---- C:\Program Files\Common Files
2010-02-16 07:59:37 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-02-16 07:59:36 ----D---- C:\Windows\inf
2010-02-11 15:14:53 ----D---- C:\Program Files\Common Files\Symantec Shared
2010-02-11 08:05:57 ----D---- C:\Windows\winsxs
2010-02-11 08:05:45 ----D---- C:\Windows\system32\catroot
2010-02-11 08:02:02 ----D---- C:\Windows\system32\drivers
2010-02-11 08:02:00 ----D---- C:\Windows\system32\migration
2010-02-11 08:02:00 ----D---- C:\Program Files\Windows Mail
2010-02-09 08:05:54 ----SHD---- C:\Windows\Installer
2010-02-09 08:03:35 ----D---- C:\Program Files\Google
2010-02-01 20:26:20 ----A---- C:\Windows\system32\mrt.exe
2010-01-25 08:55:56 ----D---- C:\Program Files\Internet Explorer
2010-01-25 08:55:41 ----D---- C:\Windows\AppPatch

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgTdiX;AVG Free8 Network Redirector; C:\Windows\System32\Drivers\avgtdix.sys [2009-05-05 108552]
R3 FETNDIS;VIA Rhine-Family Fast Ethernet Adapter Driver Service; C:\Windows\system32\DRIVERS\fetnd5.sys [2006-11-02 45568]
S1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\Windows\System32\Drivers\avgldx86.sys [2009-08-20 335240]
S1 AvgMfx86;AVG Minifilter x86 Resident Driver; C:\Windows\System32\Drivers\avgmfx86.sys [2009-08-20 27784]
S3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\Windows\system32\drivers\RTKVAC.SYS [2008-09-16 4127648]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
S3 viagfx;viagfx; C:\Windows\system32\DRIVERS\vtmini.sys [2007-04-28 283904]
S3 VIAudio;VIA AC'97 Audio Controller; C:\Windows\system32\drivers\ac97via.sys [2006-11-02 68096]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2009-08-20 297752]
S2 gupdate1c95c49614cd6b5;Google Update Service (gupdate1c95c49614cd6b5); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-02-13 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-24 183280]
S2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ); c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2006-04-14 28933976]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2006-04-14 87840]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2005-10-14 45272]
S4 SQLBrowser;SQL Server Browser; c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2006-04-14 240416]

-----------------EOF-----------------

[stell]

Zdravim.
v nudzovom rezime.
Stiahnite si prosím Rkill z jedného z týchto štyroch odkazov:

Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe

Rkill COM:
http://download.bleepingcomputer.com/grinler/rkill.com

Rkill SCR:
http://download.bleepingcomputer.com/grinler/rkill.scr
Rkill PIF:
http://download.bleepingcomputer.com/grinler/rkill.pif

Uložiť jeden z tých 4 na plochu a spustite ho. Ak sa infekcia blokuje, potom skúste použiť niektorý z ďalších. Po spustení prosím, skúste spustiť Malwarebytes 'Anti-Malware, spustite aktualizáciu, spustite Rychly Scan a odstrániť všetko, čo nájde. Logy RKILL a MBAM vloz sem
http://download.bleepingcomputer.com/ma ... -setup.exe
Stiahnes>>Malwarebytes' Anti-Malware
log vloz sem,

[marilynman]

Malwarebytes' Anti-Malware 1.44
Verzia databázy: 3755
Windows 6.0.6000 (Safe Mode)
Internet Explorer 7.0.6000.16982

18. 2. 2010 16:48:15
mbam-log-2010-02-18 (16-48-15).txt

Typ kontroly: Rýchla
Objektov kontrolovaných: 108944
Uplynutý cas: 3 minute(s), 58 second(s)

Infikovaných procesov pamäte: 0
Infikovaných modulov pamäte: 0
Infikovaných registracných klúcov: 5
Infikovaných registracných hodnôt: 0
Infikovaných registracných údajov položiek: 0
Infikovaných priecinkov: 3
Infikovaných súborov: 13

Infikovaných procesov pamäte:
(Žiadne škodlivé položky)

Infikovaných modulov pamäte:
(Žiadne škodlivé položky)

Infikovaných registracných klúcov:
HKEY_CLASSES_ROOT\CLSID\{6551001f-a07b-40b1-8f55-b44bf35a42a6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6551001f-a07b-40b1-8f55-b44bf35a42a6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6551001f-a07b-40b1-8f55-b44bf35a42a6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\PersSecurity (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servises (Malware.Trace) -> Quarantined and deleted successfully.

Infikovaných registracných hodnôt:
(Žiadne škodlivé položky)

Infikovaných registracných údajov položiek:
(Žiadne škodlivé položky)

Infikovaných priecinkov:
C:\Program Files\PersSecurity (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.
C:\Program Files\Common Files\PersSecurityUninstall (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\PersSecurity (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.

Infikovaných súborov:
C:\Users\eugen\Desktop\Setup_364s1.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\System32\win32extension.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\PersSecurity\psecurity.exe (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.
C:\Program Files\Common Files\PersSecurityUninstall\Uninstall.lnk (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\PersSecurity\Computer Scan.lnk (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\PersSecurity\Help.lnk (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\PersSecurity\Personal Security.lnk (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\PersSecurity\Registration.lnk (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\PersSecurity\Security Center.lnk (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\PersSecurity\Settings.lnk (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\PersSecurity\Update.lnk (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.
C:\Users\eugen\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PersSecurity.lnk (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.
C:\Users\eugen\Desktop\Personal Security.lnk (Rogue.PSecurity) -> Quarantined and deleted successfully.




This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Ran as eugen on . 02. 2010 at 16:49:15.


Processes terminated by Rkill or while it was running:


C:\Users\eugen\rkill.exe


Rkill completed on . 02. 2010 at 16:49:17.

[stell]

Vypni obnovu systemu
Restart spat do nudzoveho rezimu,a spust Malwarebytes komplet skan,co najde zmaz,log vloz sem,,restart do Windows>>

PROSIM CITAJTE POZORNE NAVODY!!!,

Stáhněte na plochu, ukončete všechna aktivní okna a spusťte>>
http://download.bleepingcomputer.com/sUBs/ComboFix.exe






- ComboFix je třeba spustit pod účtem s právy administrátora.
- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano;

A este raz >ANO<

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího modreho okna

- Po dokončení skenování, trvajícího maximálně 10-15 minut, by měl program vytvořit log - C:\ComboFix.txt, zkopírujte celý jeho obsah do svého threadu na forum
- Před použitím ComboFixu je treba vypnout všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary. NAVOD: http://www.bleepingcomputer.com/forums/topic114351.html
Mohou zasahovat do činnosti ComboFixu, což může způsobit, že nebude fungovat korektně.
V případě detekce antiviru u ComboFixu se jedná o falešný poplach.

stiahnes specialnu verziu G-Mer
Special
uloz na plochu >>
Odpojiť sa od internetu a zatvor všetky otvorené programy,
Dočasne zakázať akékoľvek real-time aktívnej ochrany,
a spust>.prebehne kratky skan,,,
ak dostanes hlasku rootkit activity and asks if you want to run scan>>kliknes NO<<
a nastavis to takto


>> kliknes scan,<<
na konci skanu >>SAVE<< nazov das mojlog.txt>>uloz na plochu a log vloz sem,,


Ak nedostanes ziadnu hlasku,,,nechas vsetko zafajknute a kliknes SCAN->>>>po skane >>SAVE<<log vloz sem,

[marilynman]

sorry co je obnova systemu nic take nema zapnute pokial viem, dik

[stell]

Tam je aj na Vistu
http://www.viry.cz/forum/viewtopic.php?f=11&t=47040

[marilynman]

mne to tu tabulku a moznost o vypnutie obnovy systemu neukazuje, dava mi to len moznst obnovit alebo vytvorit novy bod....je to nutne mat to vypnute ?

[stell]

ok,pokracuj mas to vypnute

[marilynman]

Malwarebytes' Anti-Malware 1.44
Verzia databázy: 3755
Windows 6.0.6000 (Safe Mode)
Internet Explorer 7.0.6000.16982

18. 2. 2010 18:28:54
mbam-log-2010-02-18 (18-28-54).txt

Typ kontroly: Úplná (C:\|)
Objektov kontrolovaných: 213055
Uplynutý cas: 32 minute(s), 58 second(s)

Infikovaných procesov pamäte: 0
Infikovaných modulov pamäte: 0
Infikovaných registracných klúcov: 0
Infikovaných registracných hodnôt: 0
Infikovaných registracných údajov položiek: 0
Infikovaných priecinkov: 0
Infikovaných súborov: 0

Infikovaných procesov pamäte:
(Žiadne škodlivé položky)

Infikovaných modulov pamäte:
(Žiadne škodlivé položky)

Infikovaných registracných klúcov:
(Žiadne škodlivé položky)

Infikovaných registracných hodnôt:
(Žiadne škodlivé položky)

Infikovaných registracných údajov položiek:
(Žiadne škodlivé položky)

Infikovaných priecinkov:
(Žiadne škodlivé položky)

Infikovaných súborov:
(Žiadne škodlivé položky)



ComboFix 10-02-17.01 - eugen . 02. 2010 18:53:17.1.1 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1250.421.1051.18.446.125 [GMT 1:00]
Running from: c:\users\eugen\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2365545147-1999384947-2466353664-500
c:\$recycle.bin\S-1-5-21-95127698-2245150545-438509162-500

.
((((((((((((((((((((((((( Files Created from 2010-01-18 to 2010-02-18 )))))))))))))))))))))))))))))))
.

2010-02-18 18:07 . 2010-02-18 18:08 -------- d-----w- c:\users\eugen\AppData\Local\temp
2010-02-18 18:07 . 2010-02-18 18:07 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-02-18 18:07 . 2010-02-18 18:07 -------- d-----w- c:\users\USER\AppData\Local\temp
2010-02-18 15:58 . 2010-02-18 15:58 3861435 ----a-r- c:\users\eugen\ComboFix.exe
2010-02-18 15:58 . 2010-02-18 15:58 293376 ----a-w- c:\users\eugen\21bq8s0s.exe
2010-02-18 15:42 . 2010-02-18 15:42 -------- d-----w- c:\users\eugen\AppData\Roaming\Malwarebytes
2010-02-18 15:42 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-18 15:42 . 2010-02-18 15:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-18 15:42 . 2010-02-18 15:42 -------- d-----w- c:\programdata\Malwarebytes
2010-02-18 15:42 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-18 15:41 . 2010-02-18 15:41 5115824 ----a-w- c:\users\eugen\mbam-setup.exe
2010-02-18 15:39 . 2010-02-18 15:39 363008 ----a-w- c:\users\eugen\rkill.exe
2010-02-18 15:03 . 2010-02-18 15:03 -------- d-----w- c:\program files\CCleaner
2010-02-18 14:10 . 2010-02-18 14:17 -------- d-----w- c:\program files\trend micro
2010-02-18 14:10 . 2010-02-18 14:10 -------- d-----w- C:\rsit
2010-02-18 14:09 . 2010-02-18 14:10 781909 ----a-w- c:\users\eugen\RSIT.exe
2010-02-18 07:22 . 2010-02-18 07:22 1 ----a-w- c:\users\USER\AppData\Roaming\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2010-02-18 07:21 . 2010-02-18 07:21 -------- d-----w- c:\users\USER\AppData\Roaming\OpenOffice.org2
2010-02-10 06:19 . 2009-12-11 12:15 306688 ----a-w- c:\windows\system32\drivers\srv.sys
2010-02-10 06:19 . 2009-12-11 12:15 84992 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-02-04 14:14 . 2009-10-19 07:03 84912 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20100203.004\NAVENG.SYS
2010-02-04 14:14 . 2009-10-19 07:03 371248 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20100203.004\EECTRL.SYS
2010-02-04 14:14 . 2009-10-19 07:03 259440 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20100203.004\ECMSVR32.DLL
2010-02-04 14:14 . 2009-10-19 07:03 177520 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20100203.004\NAVENG32.DLL
2010-02-04 14:14 . 2009-10-19 07:03 1647984 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20100203.004\NAVEX32A.DLL
2010-02-04 14:14 . 2009-10-19 07:03 1323568 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20100203.004\NAVEX15.SYS
2010-02-04 14:14 . 2009-10-19 07:03 102448 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20100203.004\ERASER.SYS
2010-02-04 14:14 . 2009-12-14 09:00 2747440 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20100203.004\CCERASER.DLL
2010-01-29 08:20 . 2010-01-29 08:20 509552 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb4FFC.tmp.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-18 17:45 . 2007-11-18 12:29 -------- d-----w- c:\users\eugen\AppData\Roaming\OpenOffice.org2
2010-02-18 17:42 . 2007-11-14 09:39 1356 ----a-w- c:\users\eugen\AppData\Local\d3d9caps.dat
2010-02-18 09:24 . 2008-12-08 09:59 -------- d-----w- c:\programdata\Google Updater
2010-02-18 07:22 . 2007-10-05 09:55 101840 ----a-w- c:\users\USER\AppData\Local\GDIPFONTCACHEV1.DAT
2010-02-18 07:20 . 2007-10-05 09:55 680 ----a-w- c:\users\USER\AppData\Local\d3d9caps.dat
2010-02-17 17:03 . 2007-11-18 12:30 1 ----a-w- c:\users\eugen\AppData\Roaming\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2010-02-11 14:14 . 2009-10-30 17:01 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-02-11 07:02 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-02-09 07:03 . 2007-12-27 13:00 -------- d-----w- c:\program files\Google
2010-01-14 10:12 . 2009-10-04 07:43 181120 ------w- c:\windows\system32\MpSigStub.exe
2009-12-28 12:36 . 2010-02-10 06:18 11776 ----a-w- c:\windows\system32\tsbyuv.dll
2009-12-28 12:35 . 2010-02-10 06:18 1327616 ----a-w- c:\windows\system32\quartz.dll
2009-12-28 12:34 . 2010-02-10 06:18 22528 ----a-w- c:\windows\system32\msyuv.dll
2009-12-28 12:34 . 2010-02-10 06:18 31232 ----a-w- c:\windows\system32\msvidc32.dll
2009-12-28 12:34 . 2010-02-10 06:18 123904 ----a-w- c:\windows\system32\msvfw32.dll
2009-12-28 12:34 . 2010-02-10 06:18 13312 ----a-w- c:\windows\system32\msrle32.dll
2009-12-28 12:33 . 2010-02-10 06:18 82944 ----a-w- c:\windows\system32\mciavi32.dll
2009-12-28 12:32 . 2010-02-10 06:18 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2009-12-28 12:30 . 2010-02-10 06:18 88576 ----a-w- c:\windows\system32\avifil32.dll
2009-12-28 12:30 . 2010-02-10 06:18 65024 ----a-w- c:\windows\system32\avicap32.dll
2009-12-18 12:52 . 2010-01-22 06:28 832512 ----a-w- c:\windows\system32\wininet.dll
2009-12-18 12:48 . 2010-01-22 06:28 56320 ----a-w- c:\windows\system32\iesetup.dll
2009-12-18 12:48 . 2010-01-22 06:28 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-12-18 12:48 . 2010-01-22 06:28 52736 ----a-w- c:\windows\AppPatch\iebrshim.dll
2009-12-18 12:46 . 2010-01-22 06:28 72704 ----a-w- c:\windows\system32\admparse.dll
2009-12-18 10:18 . 2010-01-22 06:28 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-12-18 08:45 . 2010-01-22 06:28 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-12-14 09:00 . 2009-12-14 09:00 2747440 ----a-w- c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\CCERASER.DLL
2009-12-08 20:54 . 2010-02-10 06:18 3467848 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 20:54 . 2010-02-10 06:18 3502168 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-08 20:19 . 2010-02-10 06:18 167424 ----a-w- c:\windows\system32\tcpipcfg.dll
2009-12-08 17:58 . 2010-02-10 06:18 813568 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-12-08 17:57 . 2010-02-10 06:18 22016 ----a-w- c:\windows\system32\netiougc.exe
2009-12-04 16:27 . 2010-02-10 06:18 211968 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2009-12-04 16:27 . 2010-02-10 06:18 101888 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-12-01 19:59 . 2009-12-01 19:59 484976 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb1C23.tmp.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-11-25 12:01 1230080 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-08 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2007-11-14 1006264]
"VTTimer"="VTTimer.exe" [2006-09-14 53248]
"VTTrayp"="VTtrayp.exe" [2007-04-25 176128]
"SoundMan"="SOUNDMAN.EXE" [2008-09-10 604704]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-12-12 2043160]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-01-07 1394000]

c:\users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-9-11 393216]

c:\users\eugen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-9-11 393216]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]
T-Com Softphone Slovak.lnk - c:\windows\Installer\{BED6356D-6D21-4E8D-BEEB-FD2938E91BDE}\SoftphoneIcon.exe [2009-7-13 12288]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=""
"FirewallOverride"=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiSpywareOverride"=dword:00000001

R2 gupdate1c95c49614cd6b5;Google Update Service (gupdate1c95c49614cd6b5);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-13 133104]
S0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\DRIVERS\xfilt.sys [2006-10-18 17920]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-08-20 335240]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-05-05 108552]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-08-20 297752]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
Contents of the 'Scheduled Tasks' folder

2010-02-18 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-12-27 11:10]

2010-02-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-12-12 18:18]

2010-02-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-12-12 18:18]

2010-02-11 c:\windows\Tasks\Norton Security Scan for eugen.job
- c:\program files\Norton Security Scan\Norton Security Scan\Engine\2.7.0.52\Nss.exe [2009-12-11 10:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.sk/
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-18 19:08
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-02-18 19:18:11
ComboFix-quarantined-files.txt 2010-02-18 18:18

Pre-Run: 53 363 400 704 bytes free
Post-Run: 53 233 410 048 bytes free

- - End Of File - - 7FA3A16173C1AC3824D8DA9640CD37D6

[marilynman]

chcem sa opytat ci je G-Mer nutny nakolko za chvilu odchadzam a nebudem pri pocitaci ....dakujem

[stell]

skontrolujem log combofixu a napisem ti,,

[stell]

ano bude potrebny,ale kludne chod kde treba ,,stacis, ked budes mat cas... ja ti tu este napisem ze co treba spravit,

ok .ked budes mat cas vloz sem log z G-Mer

[Hodule]

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Ran as Uzivatel on 01.05.2010 at 14:13:01.


Processes terminated by Rkill or while it was running:


C:\Users\Uzivatel\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Uzivatel\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Uzivatel\Desktop\rkill.exe


Rkill completed on 01.05.2010 at 14:13:0

[stell]

prosim otvor si novy vlastny topic,
dakujem.