Kontrola logu

[tom.a.s]

Poprosil bych o kontrolu logu.
Dostal se mi do PC nejaky "Antimalware defender", toho jsem se asi zbavil ale PC porad zlobi - vytizeny procesor, stahovani a odesilani neceho na net.
Předem diky za pomoc.

Logfile of random's system information tool 1.06 (written by random/random)
Run by tomas at 2010-03-05 16:25:59
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 2 GB (24%) free of 10 GB
Total RAM: 511 MB (42% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:26:23, on 5.3.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
C:\WINDOWS\soundman.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Opera\opera.exe
D:\DOWNLOAD\RSIT.exe
C:\Program Files\trend micro\tomas.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {D187A56B-A33F-4CBE-9D77-459FC0BAE012} - (no file)
O3 - Toolbar: (no name) - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - (no file)
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpywareTerminatorUpdate] "C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,L (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSection nLite.inf,C (User 'Default user')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/v7/ ... 5473550141
O17 - HKLM\System\CCS\Services\Tcpip\..\{43DA7323-2E55-4058-980C-9CA343394E05}: NameServer = 212.96.160.50
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag 2000 (OOD2000) - O&O Software GmbH - C:\WINDOWS\system32\OOD2000.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe

--
End of file - 6443 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll [2007-09-25 501136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D187A56B-A33F-4CBE-9D77-459FC0BAE012}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4F11ACBB-393F-4C86-A214-FF3D0D155CC3}
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2009-06-01 962808]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\WINDOWS\soundman.exe [2002-03-22 46592]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2005-05-12 6729728]
"nwiz"=nwiz.exe /install []
"DU Meter"=C:\Program Files\DU Meter\DUMeter.exe [2005-02-01 1469952]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"=C:\Program Files\Google\Gmail Notifier\gnotify.exe [2005-07-15 479232]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2005-05-12 86016]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]
"SpywareTerminatorUpdate"=C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [2010-03-04 3037696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
bthprops.cpl,,BluetoothAuthenticationAgent []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
C:\Program Files\ICQ6.5\ICQ.exe [2009-03-01 172792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
C:\Program Files\ICQLite\ICQLite.exe -minimize []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\realteks]
C:\Documents and Settings\tomas\Data aplikací\Google\orgwy448442.exe 2 []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Gamma Loader.lnk]
C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [2002-09-25 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Akcelerátor spuštění AutoCADu.lnk]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^tomas^Nabídka Start^Programy^Po spuštění^MagicDisc.lnk]
C:\PROGRA~1\MAGICD~1\MAGICD~1.EXE []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"mnmsrvc"=3
"NVSvc"=2

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQLite\ICQLite.exe"="C:\Program Files\ICQLite\ICQLite.exe:*:Enabled:ICQ Lite"
"C:\Program Files\Miranda IM\miranda32.exe"="C:\Program Files\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"F:\PROGRAMY\Miranda\miranda32.exe"="F:\PROGRAMY\Miranda\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\Opera\Opera.exe"="C:\Program Files\Opera\Opera.exe:*:Enabled:Opera Internet Browser"
"C:\Program Files\BORGChat\BORGChat.exe"="C:\Program Files\BORGChat\BORGChat.exe:*:Enabled:BORGChat"
"C:\Program Files\Maple 10\jre\bin\maple.exe"="C:\Program Files\Maple 10\jre\bin\maple.exe:*:Enabled:maple"
"C:\Program Files\EA GAMES\Battlefield 1942 Singleplayer Demo\BF1942.exe"="C:\Program Files\EA GAMES\Battlefield 1942 Singleplayer Demo\BF1942.exe:*:Enabled:BF1942"
"C:\Program Files\ICQ6\ICQ.exe"="C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"D:\DOWNLOAD\QIPinfium9004irc\infium.exe"="D:\DOWNLOAD\QIPinfium9004irc\infium.exe:*:Enabled:QIP Infium Beta"
"D:\DOWNLOAD\utorrent.exe"="D:\DOWNLOAD\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\FlashGet\FlashGet.exe"="C:\Program Files\FlashGet\FlashGet.exe:*:Enabled:Flashget"
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Disabled:Quiet Internet Pager"
"C:\Program Files\EA GAMES\Battlefield 1942\BF1942.exe"="C:\Program Files\EA GAMES\Battlefield 1942\BF1942.exe:*:Enabled:BF1942"
"D:\DOWNLOAD\RatioMaster-1.7.5\RatioMaster-vs.exe"="D:\DOWNLOAD\RatioMaster-1.7.5\RatioMaster-vs.exe:*:Enabled:Ratio Master"
"%windir%\system32\drivers\svchost.exe"="%windir%\system32\drivers\svchost.exe:*:Enabled:svchost"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Java\jre1.6.0_03\launch4j-tmp\frd.exe"="C:\Program Files\Java\jre1.6.0_03\launch4j-tmp\frd.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Beach Head 2002\BH2Game\BH2.exe"="C:\Program Files\Beach Head 2002\BH2Game\BH2.exe:*:Enabled:BH2"
"C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe"="C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe:*:Enabled:Crawler Spyware Terminator"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\system32\drivers\svchost.exe"="%windir%\system32\drivers\svchost.exe:*:Enabled:svchost"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a92a72f7-f527-11de-b2bf-00248ce37f26}]
shell\AutoRun\command - G:\RECYCLER\usbassist.exe
shell\opEN\command - G:\RECYCLER\usbassist.exe


======List of files/folders created in the last 1 months======

2010-03-05 16:26:02 ----D---- C:\Program Files\trend micro
2010-03-05 16:25:59 ----D---- C:\rsit
2010-03-05 15:44:59 ----D---- C:\Program Files\Lavasoft
2010-03-05 15:44:29 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-03-05 00:11:30 ----D---- C:\Documents and Settings\tomas\Data aplikací\Malwarebytes
2010-03-05 00:11:19 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-03-05 00:11:19 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2010-03-05 00:06:56 ----D---- C:\Program Files\Common Files\PC Tools
2010-03-05 00:06:10 ----AD---- C:\Documents and Settings\All Users\Data aplikací\TEMP
2010-03-04 23:44:04 ----D---- C:\Documents and Settings\tomas\Data aplikací\Spyware Terminator
2010-03-04 23:43:52 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2010-03-04 23:43:49 ----D---- C:\Program Files\Spyware Terminator
2010-03-04 23:35:28 ----D---- C:\Program Files\ESET
2010-03-04 23:28:21 ----D---- C:\Program Files\RapidDown
2010-03-04 23:28:21 ----D---- C:\Config.Msi
2010-03-04 23:28:14 ----D---- C:\Program Files\OOD2KFRE
2010-03-04 22:03:35 ----D---- C:\Program Files\Ashampoo
2010-02-20 20:06:29 ----A---- C:\WINDOWS\system32\pdfcmnnt.dll
2010-02-20 20:06:24 ----D---- C:\Program Files\PDFCreator
2010-02-20 20:06:24 ----A---- C:\WINDOWS\system32\MSMPIDE.DLL

======List of files/folders modified in the last 1 months======

2010-03-05 16:26:02 ----D---- C:\Program Files
2010-03-05 16:18:40 ----N---- C:\WINDOWS\SchedLgU.Txt
2010-03-05 15:45:59 ----SHD---- C:\WINDOWS\Installer
2010-03-05 15:45:59 ----D---- C:\WINDOWS
2010-03-05 15:45:11 ----SD---- C:\Documents and Settings\tomas\Data aplikací\Microsoft
2010-03-05 15:44:59 ----D---- C:\WINDOWS\system32\drivers
2010-03-05 15:44:59 ----D---- C:\WINDOWS\system32
2010-03-05 15:44:29 ----D---- C:\Program Files\Common Files
2010-03-05 13:24:03 ----D---- C:\WINDOWS\addins
2010-03-05 00:47:13 ----HDC---- C:\WINDOWS\$NtUninstallKB914882$
2010-03-05 00:07:48 ----D---- C:\WINDOWS\WinSxS
2010-03-05 00:07:40 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-03-04 23:29:02 ----D---- C:\WINDOWS\system32\config
2010-03-04 23:28:48 ----D---- C:\WINDOWS\system32\wbem
2010-03-04 23:28:47 ----D---- C:\WINDOWS\Registration
2010-03-04 23:28:18 ----SHD---- C:\RECYCLER
2010-03-04 23:28:18 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-03-04 23:27:39 ----D---- C:\WINDOWS\system32\Restore
2010-03-04 23:02:53 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-04 22:48:25 ----A---- C:\WINDOWS\win.ini
2010-03-04 22:48:25 ----A---- C:\WINDOWS\system.ini
2010-03-04 22:28:56 ----D---- C:\Program Files\DU Meter
2010-03-04 21:42:48 ----D---- C:\WINDOWS\Prefetch
2010-03-04 21:41:47 ----D---- C:\WINDOWS\system
2010-02-28 10:53:20 ----D---- C:\Program Files\Common Files\Autodesk Shared
2010-02-28 10:52:35 ----RSD---- C:\WINDOWS\Fonts
2010-02-28 10:51:08 ----D---- C:\Documents and Settings\All Users\Data aplikací\Autodesk
2010-02-27 22:01:54 ----D---- C:\Documents and Settings\tomas\Data aplikací\AIMP
2010-02-20 22:10:17 ----A---- C:\WINDOWS\wincmd.ini
2010-02-13 15:36:04 ----D---- C:\Documents and Settings\tomas\Data aplikací\vlc
2010-02-06 13:38:41 ----D---- C:\Program Files\ICQ6.5

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK7;Ovladač procesoru AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2006-11-03 41216]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R1 VIAPFD;VIAPFD; C:\WINDOWS\System32\Drivers\VIAPFD.SYS [2001-12-18 3279]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2005-05-12 3189376]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 vaxscsi;vaxscsi; C:\WINDOWS\System32\Drivers\vaxscsi.sys [2008-06-13 223128]
R3 VIAudio;Vinyl AC'97 Audio Controller (WDM); C:\WINDOWS\system32\drivers\vinyl97.sys [2005-11-25 203776]
S3 ALCXWDM;Service for Avance AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2002-03-22 278908]
S3 BlueletAudio;Bluetooth Audio Service; C:\WINDOWS\system32\DRIVERS\blueletaudio.sys [2004-10-19 20096]
S3 BlueletSCOAudio;Bluetooth SCO Audio Service; C:\WINDOWS\system32\DRIVERS\BlueletSCOAudio.sys [2007-06-24 27656]
S3 BT;Bluetooth PAN Network Adapter; C:\WINDOWS\system32\DRIVERS\btnetdrv.sys [2004-09-21 10804]
S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:\WINDOWS\System32\Drivers\btcusb.sys [2005-01-17 23000]
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2004-08-03 17024]
S3 BTHidEnum;Bluetooth HID Enumerator; C:\WINDOWS\System32\Drivers\vbtenum.sys [2005-01-13 12500]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2004-08-03 100992]
S3 BTHPORT;Ovladač portu Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2004-08-17 274304]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2004-08-03 18944]
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 ip100xp;ASUS NX1001 Network Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\ipfnd51.sys [2006-03-27 26752]
S3 mcdbus;Driver for MagicISO SCSI Host Controller; C:\WINDOWS\system32\DRIVERS\mcdbus.sys []
S3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
S3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2004-08-03 59648]
S3 sermouse;Ovladač sériové myši; C:\WINDOWS\system32\DRIVERS\sermouse.sys [2006-11-03 17664]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 VComm;Virtual Serial port driver; C:\WINDOWS\system32\DRIVERS\VComm.sys [2004-10-19 61312]
S3 VcommMgr;Bluetooth VComm Manager Service; C:\WINDOWS\System32\Drivers\VcommMgr.sys [2004-11-05 82148]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Ad-Aware 2007 Service; C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe [2007-09-25 574808]
R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2009-06-01 222968]
R2 NMSAccessU;NMSAccessU; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2008-06-15 71096]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2005-05-12 127042]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2010-03-04 488960]
R2 StarWindService;StarWind iSCSI Service; C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe [2005-04-02 217600]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
S2 OOD2000;O&O Defrag 2000; C:\WINDOWS\system32\OOD2000.exe [2001-04-06 238080]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2009-10-03 69120]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-31 136120]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

-----------------EOF-----------------

[Caroprd111]

Zdravím

Na logu se pracuje, prosím o strpení.

[Caroprd111]

Odinstalujte Ad-Aware.


Doporučuji odinstalovat (pokud nepoužíváte) toolbary (lišty) v Přidat nebo odebrat programy.



Stáhněte a uložte, nejlépe na plochu http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypněte všechny rezidentní bezpečnostní programy - firewally, antiviry, antispywary

Vložte do PC všechny flash disky, které používáte.

Spusťte aplikaci pod účtem s oprávněním Administrátora (Správce), ihned po startu se zobrází stránka s licenčnímy podmínkami, pokračujte stisknutím tlačítka "Ano"

Dále postupujte dle pokynů, během scanu nespouštějte jiné aplikace a neklikejte do zobrazujícího se okna

Scan by měl trvat okolo 5 - 10 minut, po dokončení Combofix zobrazí log C:\ComboFix.txt , který sem vložte.

Během skenování může být počítač restartován.

[tom.a.s]

ComboFix 10-03-04.05 - tomas 05.03.2010 17:21:42.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.511.322 [GMT 1:00]
Spuštěný z: c:\documents and settings\tomas\Plocha\ComboFix.exe
AV: Spy Emergency *On-access scanning disabled* (Updated) {82117492-906E-4b02-A33A-84D42A2DD907}
SP: Spy Emergency *disabled* (Updated) {82117492-906E-4b02-A33A-84D42A2DD907}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-7402467161-8241568944-988069620-3568
c:\windows\system32\crt.dat
c:\windows\system32\ieuinit.inf

Nakažená kopie c:\windows\system32\drivers\ndis.sys byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\system32\drivers\ndis(2).sys
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-02-05 do 2010-03-05 )))))))))))))))))))))))))))))))
.

2010-03-05 15:26 . 2010-03-05 15:26 -------- d-----w- c:\program files\trend micro
2010-03-05 15:25 . 2010-03-05 15:26 -------- d-----w- C:\rsit
2010-03-05 14:44 . 2010-03-05 14:44 -------- d-----w- c:\program files\Lavasoft
2010-03-04 23:11 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-04 23:11 . 2010-03-04 23:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-04 23:11 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-04 23:06 . 2010-03-05 14:42 -------- d-----w- c:\program files\Common Files\PC Tools
2010-03-04 22:44 . 2010-03-04 22:44 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-03-04 22:43 . 2010-03-04 23:53 -------- d-----w- c:\program files\Spyware Terminator
2010-03-04 22:35 . 2010-03-05 14:40 -------- d-----w- c:\program files\ESET
2010-03-04 22:28 . 2010-03-04 22:28 -------- d-----w- c:\windows\system32\wbem\Repository
2010-03-04 22:28 . 2010-03-04 22:28 -------- d-----w- c:\program files\RapidDown
2010-03-04 22:28 . 2010-03-04 22:28 -------- d-----w- c:\program files\OOD2KFRE
2010-03-04 21:03 . 2010-03-04 21:03 -------- d-----w- c:\program files\Ashampoo
2010-02-20 19:06 . 2001-10-28 15:42 116224 ----a-w- c:\windows\system32\pdfcmnnt.dll
2010-02-20 19:06 . 2010-02-20 19:06 -------- d-----w- c:\program files\PDFCreator
2010-02-20 19:06 . 1998-07-05 23:00 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-04 22:23 . 2010-03-04 22:27 8530 ----a-w- c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1029.dat
2010-03-04 21:28 . 2007-12-24 16:24 -------- d-----w- c:\program files\DU Meter
2010-02-28 09:53 . 2009-09-27 10:09 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2010-02-06 12:38 . 2009-08-20 10:03 -------- d-----w- c:\program files\ICQ6.5
2010-02-01 13:19 . 2010-02-01 13:19 -------- d-----w- c:\program files\Trymedia
2010-02-01 13:06 . 2007-12-24 15:36 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-01 11:23 . 2007-12-24 15:36 -------- d-----w- c:\program files\Common Files\InstallShield
2010-01-30 19:53 . 2008-04-26 15:01 -------- d-----w- c:\program files\AIMP2
2010-01-30 19:48 . 2001-10-25 11:00 68916 ----a-w- c:\windows\system32\perfc005.dat
2010-01-30 19:48 . 2001-10-25 11:00 389938 ----a-w- c:\windows\system32\perfh005.dat
2010-01-30 12:01 . 2010-01-30 12:01 -------- d-----w- c:\program files\Lavalys
2006-03-20 14:34 . 2007-12-24 16:10 4796416 ----a-w- c:\program files\mplayerc.exe
2006-02-01 22:02 . 2007-12-24 16:10 2015232 ----a-w- c:\program files\FoxitReader.exe
2005-07-14 11:31 . 2005-07-14 11:31 27648 --sha-r- c:\windows\system32\AVSredirect.dll
2005-06-26 14:32 . 2005-06-26 14:32 616448 --sha-r- c:\windows\system32\cygwin1.dll
2005-06-21 21:37 . 2005-06-21 21:37 45568 --sha-r- c:\windows\system32\cygz.dll
2006-05-03 09:06 . 2008-10-24 09:52 163328 --sh--r- c:\windows\system32\flvDX.dll
2004-01-24 23:00 . 2004-01-24 23:00 70656 --sha-r- c:\windows\system32\i420vfw.dll
2007-02-21 10:47 . 2008-10-24 09:52 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2008-10-24 09:52 216064 --sh--r- c:\windows\system32\nbDX.dll
2006-04-27 09:24 . 2006-04-27 09:24 2945024 --sha-r- c:\windows\system32\Smab.dll
2005-02-28 12:16 . 2005-02-28 12:16 240128 --sha-r- c:\windows\system32\x.264.exe
2004-01-24 23:00 . 2004-01-24 23:00 70656 --sha-r- c:\windows\system32\yv12vfw.dll
.

------- Sigcheck -------


[-] 2006-11-03 . B2242CF5F8EBF39D2DA605A77A2CD56E . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll


c:\windows\System32\wuauclt.exe ... chybí !!
c:\windows\System32\regsvc.dll ... chybí !!
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\tomas\Data aplikací\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\tomas\Data aplikací\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\tomas\Data aplikací\Dropbox\bin\DropboxExt.3.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-03-04 3037696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="soundman.exe" [2002-03-22 46592]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-05-11 6729728]
"nwiz"="nwiz.exe" [2005-05-11 1519616]
"DU Meter"="c:\program files\DU Meter\DUMeter.exe" [2005-02-01 1469952]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-05-11 86016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
"NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2005-05-11 86016]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Akcelerátor spuštění AutoCADu.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Akcelerátor spuštění AutoCADu.lnk
backup=c:\windows\pss\Akcelerátor spuštění AutoCADu.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^tomas^Nabídka Start^Programy^Po spuštění^MagicDisc.lnk]
path=c:\documents and settings\tomas\Nabídka Start\Programy\Po spuštění\MagicDisc.lnk
backup=c:\windows\pss\MagicDisc.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2004-08-17 13:49 110592 ----a-w- c:\windows\system32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2009-03-01 10:59 172792 ----a-w- c:\program files\ICQ6.5\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"mnmsrvc"=3 (0x3)
"NVSvc"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"d:\\DOWNLOAD\\utorrent.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"d:\\DOWNLOAD\\RatioMaster-1.7.5\\RatioMaster-vs.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Java\\jre1.6.0_03\\launch4j-tmp\\frd.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [24.12.2007 17:27 715248]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [4.3.2010 23:44 142592]
R3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys [13.6.2008 14:53 223128]
S0 icmnjbc;icmnjbc;c:\windows\system32\drivers\hivylg.sys --> c:\windows\system32\drivers\hivylg.sys [?]
S0 tnab;tnab;c:\windows\system32\drivers\yigev.sys --> c:\windows\system32\drivers\yigev.sys [?]
S3 ip100xp;ASUS NX1001 Network Adapter NT Driver;c:\windows\system32\drivers\ipfnd51.sys [5.8.2009 19:24 26752]
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {43DA7323-2E55-4058-980C-9CA343394E05} = 212.96.160.50
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

BHO-{D187A56B-A33F-4CBE-9D77-459FC0BAE012} - (no file)
Toolbar-{4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - (no file)
HKU-Default-RunOnce-nltide3 - rundll32 advpack.dll
MSConfigStartUp-ICQ Lite - c:\program files\ICQLite\ICQLite.exe
MSConfigStartUp-realteks - c:\documents and settings\tomas\Data aplikací\Google\orgwy448442.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-05 17:28
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x823721F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf857afc3
\Driver\ACPI -> ACPI.sys @ 0xf83d7cb8
\Driver\atapi -> 0x823721f8
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0130
ParseProcedure -> ntoskrnl.exe @ 0x8056f10e
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0130
ParseProcedure -> ntoskrnl.exe @ 0x8056f10e
NDIS: Realtek RTL8139 Family PCI Fast Ethernet NIC #3 -> SendCompleteHandler -> NDIS.sys @ 0xf8276bc3
PacketIndicateHandler -> NDIS.sys @ 0xf8282b21
SendHandler -> NDIS.sys @ 0xf8276d33
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(1692)
c:\documents and settings\tomas\Data aplikací\Dropbox\bin\DropboxExt.3.dll
c:\progra~1\WINDOW~1\wmpband.dll
c:\windows\system32\Audiodev.dll
c:\windows\system32\WMVCore.DLL
c:\windows\system32\WMASF.DLL
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\soundman.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\program files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
c:\windows\system32\wdfmgr.exe
.
**************************************************************************
.
Celkový čas: 2010-03-05 17:31:50 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-03-05 16:31

Před spuštěním: 2 307 952 640
Po spuštění: 2 385 031 168

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 8BA2153D4D68ABD5D8F3C8408A9EFC1E

[Caroprd111]

Tohle otestujte na http://www.virustotal.com/cs/
c:\windows\system32\drivers\ndis.sys
c:\windows\system32\sfcfiles.dll

(Soubor nehledejte, jenom vložíte tučně označenou cestu, v případě hlášky "Soubor již byl testován" dejte otestovat znovu. Výsledek analýzy sem v podobě odkazu vložte.)

[tom.a.s]

ndis.sys
sfcfiles.dll

[Caroprd111]

Následující kroky proveďte přesně v pořadí jak jsou.


Stáhněte a rozbalte soubor z přílohy na disk c:\ (Cesta souboru bude c:\wuauclt.exe, nesmí to být archív )

wuauclt.zip

(51.46 KiB) Staženo 39 x

Pokud nemáte, přesuňte Combofix na plochu

• otevřete si Poznámkový blok a zkopírujte do něj text z bílého okénka.

Kód: Vybrat vše

FCopy:: 
c:\wuauclt.exe | c:\windows\System32\wuauclt.exe

Restore::
c:\windows\System32\regsvc.dll

• Uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
• Po uložení uchopte vámi vytvořený skript levým myšítkem a přesuňte ho nad ikonu Combofixu, kde ho upustíte:
  
  
• Po aplikaci na Vás vypadne další log,vložte ho sem

Může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

[tom.a.s]

ComboFix 10-03-04.06 - tomas 05.03.2010 18:08:39.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.511.247 [GMT 1:00]
Spuštěný z: c:\documents and settings\tomas\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\tomas\Plocha\CFScript.txt
AV: Spy Emergency *On-access scanning disabled* (Updated) {82117492-906E-4b02-A33A-84D42A2DD907}
SP: Spy Emergency *disabled* (Updated) {82117492-906E-4b02-A33A-84D42A2DD907}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\System32\regsvc.dll . . . je infikován!!

.
--------------- FCopy ---------------

c:\wuauclt.exe --> c:\windows\System32\wuauclt.exe
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-02-05 do 2010-03-05 )))))))))))))))))))))))))))))))
.

2010-03-05 17:08 . 2009-08-21 11:05 111104 ----a-w- c:\windows\system32\wuauclt.exe
2010-03-05 17:01 . 2009-08-21 11:05 111104 ------w- C:\wuauclt.exe
2010-03-05 15:26 . 2010-03-05 15:26 -------- d-----w- c:\program files\trend micro
2010-03-05 15:25 . 2010-03-05 15:26 -------- d-----w- C:\rsit
2010-03-05 14:44 . 2010-03-05 14:44 -------- d-----w- c:\program files\Lavasoft
2010-03-04 23:11 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-04 23:11 . 2010-03-04 23:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-04 23:11 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-04 23:06 . 2010-03-05 14:42 -------- d-----w- c:\program files\Common Files\PC Tools
2010-03-04 22:44 . 2010-03-04 22:44 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-03-04 22:43 . 2010-03-04 23:53 -------- d-----w- c:\program files\Spyware Terminator
2010-03-04 22:35 . 2010-03-05 14:40 -------- d-----w- c:\program files\ESET
2010-03-04 22:28 . 2010-03-04 22:28 -------- d-----w- c:\windows\system32\wbem\Repository
2010-03-04 22:28 . 2010-03-04 22:28 -------- d-----w- c:\program files\RapidDown
2010-03-04 22:28 . 2010-03-04 22:28 -------- d-----w- c:\program files\OOD2KFRE
2010-03-04 21:03 . 2010-03-04 21:03 -------- d-----w- c:\program files\Ashampoo
2010-02-20 19:06 . 2001-10-28 15:42 116224 ----a-w- c:\windows\system32\pdfcmnnt.dll
2010-02-20 19:06 . 2010-02-20 19:06 -------- d-----w- c:\program files\PDFCreator
2010-02-20 19:06 . 1998-07-05 23:00 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-04 22:23 . 2010-03-04 22:27 8530 ----a-w- c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1029.dat
2010-03-04 21:28 . 2007-12-24 16:24 -------- d-----w- c:\program files\DU Meter
2010-02-28 09:53 . 2009-09-27 10:09 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2010-02-06 12:38 . 2009-08-20 10:03 -------- d-----w- c:\program files\ICQ6.5
2010-02-01 13:19 . 2010-02-01 13:19 -------- d-----w- c:\program files\Trymedia
2010-02-01 13:06 . 2007-12-24 15:36 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-01 11:23 . 2007-12-24 15:36 -------- d-----w- c:\program files\Common Files\InstallShield
2010-01-30 19:53 . 2008-04-26 15:01 -------- d-----w- c:\program files\AIMP2
2010-01-30 19:48 . 2001-10-25 11:00 68916 ----a-w- c:\windows\system32\perfc005.dat
2010-01-30 19:48 . 2001-10-25 11:00 389938 ----a-w- c:\windows\system32\perfh005.dat
2010-01-30 12:01 . 2010-01-30 12:01 -------- d-----w- c:\program files\Lavalys
2006-03-20 14:34 . 2007-12-24 16:10 4796416 ----a-w- c:\program files\mplayerc.exe
2006-02-01 22:02 . 2007-12-24 16:10 2015232 ----a-w- c:\program files\FoxitReader.exe
2005-07-14 11:31 . 2005-07-14 11:31 27648 --sha-r- c:\windows\system32\AVSredirect.dll
2005-06-26 14:32 . 2005-06-26 14:32 616448 --sha-r- c:\windows\system32\cygwin1.dll
2005-06-21 21:37 . 2005-06-21 21:37 45568 --sha-r- c:\windows\system32\cygz.dll
2006-05-03 09:06 . 2008-10-24 09:52 163328 --sh--r- c:\windows\system32\flvDX.dll
2004-01-24 23:00 . 2004-01-24 23:00 70656 --sha-r- c:\windows\system32\i420vfw.dll
2007-02-21 10:47 . 2008-10-24 09:52 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2008-10-24 09:52 216064 --sh--r- c:\windows\system32\nbDX.dll
2006-04-27 09:24 . 2006-04-27 09:24 2945024 --sha-r- c:\windows\system32\Smab.dll
2005-02-28 12:16 . 2005-02-28 12:16 240128 --sha-r- c:\windows\system32\x.264.exe
2004-01-24 23:00 . 2004-01-24 23:00 70656 --sha-r- c:\windows\system32\yv12vfw.dll
.

------- Sigcheck -------

[-] 2006-11-03 . B2242CF5F8EBF39D2DA605A77A2CD56E . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll


c:\windows\System32\regsvc.dll ... chybí !!
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\tomas\Data aplikací\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\tomas\Data aplikací\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\tomas\Data aplikací\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="soundman.exe" [2002-03-22 46592]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-05-11 6729728]
"nwiz"="nwiz.exe" [2005-05-11 1519616]
"DU Meter"="c:\program files\DU Meter\DUMeter.exe" [2005-02-01 1469952]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-05-11 86016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
"NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2005-05-11 86016]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Akcelerátor spuštění AutoCADu.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Akcelerátor spuštění AutoCADu.lnk
backup=c:\windows\pss\Akcelerátor spuštění AutoCADu.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^tomas^Nabídka Start^Programy^Po spuštění^MagicDisc.lnk]
path=c:\documents and settings\tomas\Nabídka Start\Programy\Po spuštění\MagicDisc.lnk
backup=c:\windows\pss\MagicDisc.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2004-08-17 13:49 110592 ----a-w- c:\windows\system32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2009-03-01 10:59 172792 ----a-w- c:\program files\ICQ6.5\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"mnmsrvc"=3 (0x3)
"NVSvc"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"d:\\DOWNLOAD\\utorrent.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"d:\\DOWNLOAD\\RatioMaster-1.7.5\\RatioMaster-vs.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Java\\jre1.6.0_03\\launch4j-tmp\\frd.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=

R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [4.3.2010 23:44 142592]
S0 icmnjbc;icmnjbc;c:\windows\system32\drivers\hivylg.sys --> c:\windows\system32\drivers\hivylg.sys [?]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [24.12.2007 17:27 715248]
S0 tnab;tnab;c:\windows\system32\drivers\yigev.sys --> c:\windows\system32\drivers\yigev.sys [?]
S3 ip100xp;ASUS NX1001 Network Adapter NT Driver;c:\windows\system32\drivers\ipfnd51.sys [5.8.2009 19:24 26752]
S3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys [13.6.2008 14:53 223128]
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {43DA7323-2E55-4058-980C-9CA343394E05} = 212.96.160.50
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-05 18:12
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(1364)
c:\documents and settings\tomas\Data aplikací\Dropbox\bin\DropboxExt.3.dll
c:\progra~1\WINDOW~1\wmpband.dll
c:\windows\system32\Audiodev.dll
c:\windows\system32\WMVCore.DLL
c:\windows\system32\WMASF.DLL
.
Celkový čas: 2010-03-05 18:14:38
ComboFix-quarantined-files.txt 2010-03-05 17:14
ComboFix2.txt 2010-03-05 16:31

Před spuštěním: 2 371 387 392
Po spuštění: 2 346 737 664

- - End Of File - - 5B6326102A0EF52CD84EBFD5407AE9B0

[Caroprd111]

Pokud nemáte, přesuňte Combofix na plochu

• Otevřete si Poznámkový blok a zkopírujte do něj text z bílého okénka.

Kód: Vybrat vše

Driver::
icmnjbc
tnab

File::
c:\windows\system32\drivers\hivylg.sys 
c:\windows\system32\drivers\yigev.sys 

srpeek::
c:\windows\system32\regsvc.dll

• Uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
• Po uložení uchopte vámi vytvořený skript levým myšítkem a přesuňte ho nad ikonu Combofixu, kde ho upustíte:
  
  
• Po aplikaci na Vás vypadne další log,vložte ho sem

Může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

[tom.a.s]

ComboFix 10-03-04.06 - tomas 05.03.2010 18:32:47.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.511.266 [GMT 1:00]
Spuštěný z: c:\documents and settings\tomas\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\tomas\Plocha\CFScript.txt
AV: Spy Emergency *On-access scanning disabled* (Updated) {82117492-906E-4b02-A33A-84D42A2DD907}
SP: Spy Emergency *disabled* (Updated) {82117492-906E-4b02-A33A-84D42A2DD907}

FILE ::
"c:\windows\system32\drivers\hivylg.sys"
"c:\windows\system32\drivers\yigev.sys"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_icmnjbc
-------\Service_tnab


((((((((((((((((((((((((( Soubory vytvořené od 2010-02-05 do 2010-03-05 )))))))))))))))))))))))))))))))
.

2010-03-05 17:08 . 2009-08-21 11:05 111104 ------w- c:\windows\system32\wuauclt.exe
2010-03-05 17:01 . 2009-08-21 11:05 111104 ------w- C:\wuauclt.exe
2010-03-05 15:26 . 2010-03-05 15:26 -------- d-----w- c:\program files\trend micro
2010-03-05 15:25 . 2010-03-05 15:26 -------- d-----w- C:\rsit
2010-03-05 14:44 . 2010-03-05 14:44 -------- d-----w- c:\program files\Lavasoft
2010-03-04 23:11 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-04 23:11 . 2010-03-04 23:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-04 23:11 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-04 23:06 . 2010-03-05 14:42 -------- d-----w- c:\program files\Common Files\PC Tools
2010-03-04 22:44 . 2010-03-04 22:44 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-03-04 22:43 . 2010-03-04 23:53 -------- d-----w- c:\program files\Spyware Terminator
2010-03-04 22:35 . 2010-03-05 14:40 -------- d-----w- c:\program files\ESET
2010-03-04 22:28 . 2010-03-04 22:28 -------- d-----w- c:\windows\system32\wbem\Repository
2010-03-04 22:28 . 2010-03-04 22:28 -------- d-----w- c:\program files\RapidDown
2010-03-04 22:28 . 2010-03-04 22:28 -------- d-----w- c:\program files\OOD2KFRE
2010-03-04 21:03 . 2010-03-04 21:03 -------- d-----w- c:\program files\Ashampoo
2010-02-20 19:06 . 2001-10-28 15:42 116224 ----a-w- c:\windows\system32\pdfcmnnt.dll
2010-02-20 19:06 . 2010-02-20 19:06 -------- d-----w- c:\program files\PDFCreator
2010-02-20 19:06 . 1998-07-05 23:00 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-04 22:23 . 2010-03-04 22:27 8530 ----a-w- c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1029.dat
2010-03-04 21:28 . 2007-12-24 16:24 -------- d-----w- c:\program files\DU Meter
2010-02-28 09:53 . 2009-09-27 10:09 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2010-02-06 12:38 . 2009-08-20 10:03 -------- d-----w- c:\program files\ICQ6.5
2010-02-01 13:19 . 2010-02-01 13:19 -------- d-----w- c:\program files\Trymedia
2010-02-01 13:06 . 2007-12-24 15:36 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-01 11:23 . 2007-12-24 15:36 -------- d-----w- c:\program files\Common Files\InstallShield
2010-01-30 19:53 . 2008-04-26 15:01 -------- d-----w- c:\program files\AIMP2
2010-01-30 19:48 . 2001-10-25 11:00 68916 ----a-w- c:\windows\system32\perfc005.dat
2010-01-30 19:48 . 2001-10-25 11:00 389938 ----a-w- c:\windows\system32\perfh005.dat
2010-01-30 12:01 . 2010-01-30 12:01 -------- d-----w- c:\program files\Lavalys
2006-03-20 14:34 . 2007-12-24 16:10 4796416 ----a-w- c:\program files\mplayerc.exe
2006-02-01 22:02 . 2007-12-24 16:10 2015232 ----a-w- c:\program files\FoxitReader.exe
2005-07-14 11:31 . 2005-07-14 11:31 27648 --sha-r- c:\windows\system32\AVSredirect.dll
2005-06-26 14:32 . 2005-06-26 14:32 616448 --sha-r- c:\windows\system32\cygwin1.dll
2005-06-21 21:37 . 2005-06-21 21:37 45568 --sha-r- c:\windows\system32\cygz.dll
2006-05-03 09:06 . 2008-10-24 09:52 163328 --sh--r- c:\windows\system32\flvDX.dll
2004-01-24 23:00 . 2004-01-24 23:00 70656 --sha-r- c:\windows\system32\i420vfw.dll
2007-02-21 10:47 . 2008-10-24 09:52 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2008-10-24 09:52 216064 --sh--r- c:\windows\system32\nbDX.dll
2006-04-27 09:24 . 2006-04-27 09:24 2945024 --sha-r- c:\windows\system32\Smab.dll
2005-02-28 12:16 . 2005-02-28 12:16 240128 --sha-r- c:\windows\system32\x.264.exe
2004-01-24 23:00 . 2004-01-24 23:00 70656 --sha-r- c:\windows\system32\yv12vfw.dll
.

(((((((((((((((((((((((((((((((((((((((((( SR_Search ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
------- Sigcheck -------

[-] 2006-11-03 . B2242CF5F8EBF39D2DA605A77A2CD56E . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll


c:\windows\System32\regsvc.dll ... chybí !!
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\tomas\Data aplikací\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\tomas\Data aplikací\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\tomas\Data aplikací\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="soundman.exe" [2002-03-22 46592]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-05-11 6729728]
"nwiz"="nwiz.exe" [2005-05-11 1519616]
"DU Meter"="c:\program files\DU Meter\DUMeter.exe" [2005-02-01 1469952]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-05-11 86016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
"NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2005-05-11 86016]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Akcelerátor spuštění AutoCADu.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Akcelerátor spuštění AutoCADu.lnk
backup=c:\windows\pss\Akcelerátor spuštění AutoCADu.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^tomas^Nabídka Start^Programy^Po spuštění^MagicDisc.lnk]
path=c:\documents and settings\tomas\Nabídka Start\Programy\Po spuštění\MagicDisc.lnk
backup=c:\windows\pss\MagicDisc.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2004-08-17 13:49 110592 ----a-w- c:\windows\system32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2009-03-01 10:59 172792 ----a-w- c:\program files\ICQ6.5\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"mnmsrvc"=3 (0x3)
"NVSvc"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Opera\\Opera.exe"=
"d:\\DOWNLOAD\\utorrent.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"d:\\DOWNLOAD\\RatioMaster-1.7.5\\RatioMaster-vs.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Java\\jre1.6.0_03\\launch4j-tmp\\frd.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [24.12.2007 17:27 715248]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [4.3.2010 23:44 142592]
R3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys [13.6.2008 14:53 223128]
S3 ip100xp;ASUS NX1001 Network Adapter NT Driver;c:\windows\system32\drivers\ipfnd51.sys [5.8.2009 19:24 26752]
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {43DA7323-2E55-4058-980C-9CA343394E05} = 212.96.160.50
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-05 18:38
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x823DE1F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf857afc3
\Driver\ACPI -> ACPI.sys @ 0xf83d7cb8
\Driver\atapi -> 0x823de1f8
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0130
ParseProcedure -> ntoskrnl.exe @ 0x8056f10e
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0130
ParseProcedure -> ntoskrnl.exe @ 0x8056f10e
NDIS: Realtek RTL8139 Family PCI Fast Ethernet NIC #3 -> SendCompleteHandler -> NDIS.sys @ 0xf8276bc3
PacketIndicateHandler -> NDIS.sys @ 0xf8282b21
SendHandler -> NDIS.sys @ 0xf8276d33
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(1888)
c:\documents and settings\tomas\Data aplikací\Dropbox\bin\DropboxExt.3.dll
c:\progra~1\WINDOW~1\wmpband.dll
c:\windows\system32\Audiodev.dll
c:\windows\system32\WMVCore.DLL
c:\windows\system32\WMASF.DLL
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\soundman.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\program files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
c:\windows\system32\wdfmgr.exe
.
**************************************************************************
.
Celkový čas: 2010-03-05 18:41:17 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-03-05 17:41
ComboFix2.txt 2010-03-05 17:14
ComboFix3.txt 2010-03-05 16:31

Před spuštěním: 2 353 823 744
Po spuštění: 2 249 048 064

- - End Of File - - 69F8F7CE22941B037E182ABF7EA2E8ED

[Caroprd111]

Odinstalujte všechny emulátory virtuálních mechanik.

Stáhněte SPTD http://www.duplexsecure.com/en/downloads

• Vyberte verzi podle svého operačního systému (64 & 32b). Uložte na plochu a spusťte.
• zvolte možnost Uninstall a restartujte PC.

Stáhněte MBR na plochu http://www2.gmer.net/mbr/mbr.exe

Start > Spustit (Win + R)

• Vyskočí okénko, zkopírujte do něj:

Kód: Vybrat vše

"%userprofile%\plocha\mbr" -t

• Klikněte na OK

• Vytvoří se log s názvem mbr.log, vložte ho sem.

Máte instalační CD Vaší verze Windows

[tom.a.s]

Instalačku mám.

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys viaidexp.sys
kernel: MBR read successfully
user & kernel MBR OK

[Caroprd111]

Za chvilku Vám sem napíšu další postup.

[Caroprd111]

Omlouvám se za zpoždění.

Nabootujte z instalačního CD a vstupte do konzole pro zotavení.

D:[=vaše jednotka CD/DVD][ENTER]
CD I386 [ENTER]
EXPAND regsvc.dl_ C:\WINDOWS\SYSTEM32 [ENTER]