Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

nakazene PC

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
mejl
Návštěvník
Návštěvník
Příspěvky: 26
Registrován: 30 čer 2008 17:15

nakazene PC

#1 Příspěvek od mejl »

zdravim...mam problem s nejakym virem ktery avast detekoval ale nedari se mu ho smazat....

tady posilam log z RSIT

Logfile of random's system information tool 1.08 (written by random/random)
Run by uživatel at 2010-12-13 16:01:12
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 8 GB (15%) free of 50 GB
Total RAM: 1023 MB (38% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:01:46, on 13.12.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\WINDOWS\system32\spool\drivers\Distributed.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ICQ6Toolbar\ICQ Service.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Seznam\Postak\Postak.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\nvsvc32.exe
C:\Documents and Settings\uživatel\Data aplikací\Microsoft\vafy.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
D:\Program Files\ArcSoft\TotalMedia 3.5\TMMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Crawler\CToolbar.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Documents and Settings\uživatel\Plocha\RSIT.exe
C:\Program Files\trend micro\uživatel.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatche ... tbid=60446
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://googleure.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60446
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60446
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60446
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_custo ... TbId=60446
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: &S-Rank - {B71B15CF-3093-459C-B764-AEB2486F2273} - C:\Program Files\Seznam\Postak\SRank.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (file missing)
O3 - Toolbar: &Crawler lišta - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\ctbr.dll (file missing)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SMail] "C:\Program Files\Seznam\Postak\Postak.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [NVIDIA driver monitor] C:\WINDOWS\nvsvc32.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [NVIDIA driver monitor] C:\WINDOWS\nvsvc32.exe
O4 - HKCU\..\Run: [coudef] C:\Documents and Settings\uživatel\Data aplikací\Microsoft\vafy.exe
O4 - HKCU\..\Run: [MSConfig] C:\Documents and Settings\uživatel\mqf.exe \u
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: 0uupllh.exe
O4 - Startup: 0vrmm70.exe
O4 - Startup: 2xidtze.exe
O4 - Startup: 2zkpq0m.exe
O4 - Startup: 70dtze3.exe
O4 - Startup: 70xtoo6.exe
O4 - Startup: 9s69e1a.exe
O4 - Startup: a0b0rns8.exe
O4 - Startup: aa6mm70tp.exe
O4 - Startup: avmmhyytkk.exe
O4 - Startup: bxnnjzzvll.exe
O4 - Startup: fl870njz.exe
O4 - Startup: g69so0e3qq.exe
O4 - Startup: hdttpffb.exe
O4 - Startup: o9k1gccxoo.exe
O4 - Startup: ooz83q3ssn.exe
O4 - Startup: u86bc70dzpf.exe
O4 - Startup: zvllhxxt.exe
O4 - Startup: zzvllhxxi3k.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O4 - Global Startup: TMMonitor.lnk = D:\Program Files\ArcSoft\TotalMedia 3.5\TMMonitor.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\ctbr.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: DistributedAgentServices - BrainWork - C:\WINDOWS\system32\spool\drivers\Distributed.exe
O23 - Service: Služba Google Update (gupdate1ca3f42ddb1aee2) (gupdate1ca3f42ddb1aee2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: ASUSKeyboardService (y6ajoaoakfxs) - Unknown owner - C:\Documents and Settings\uživatel\Data aplikací\Microsoft\rougaruvih.exe (file missing)

--
End of file - 13111 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\Norton Security Scan for uživatel.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-06-29 370296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-10-27 297648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll [2010-10-27 843832]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-10-04 1049912]
{B71B15CF-3093-459C-B764-AEB2486F2273} - &S-Rank - C:\Program Files\Seznam\Postak\SRank.dll [2005-05-17 266240]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2008-10-14 863688]
{EEE6C35B-6118-11DC-9C72-001320C79847} - SweetIM Toolbar for Internet Explorer - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll []
{4B3803EA-5230-4DC3-A7FC-33638F3D3542} - &Crawler lišta - C:\PROGRA~1\Crawler\ctbr.dll []
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-10-27 297648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-05-20 2879488]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-02-03 16116224]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-07 69632]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-12-10 49152]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2008-07-19 78008]
"SpywareTerminator"=C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2008-10-15 1783808]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-06-29 185896]
"NeroFilterCheck"=C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2008-04-28 570664]
"NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-02-18 2221352]
"SMail"=C:\Program Files\Seznam\Postak\Postak.exe [2006-05-18 450560]
"SweetIM"=C:\Program Files\SweetIM\Messenger\SweetIM.exe [2009-02-15 111928]
"DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-09-01 1164584]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"NVIDIA driver monitor"=C:\WINDOWS\nvsvc32.exe [2010-11-14 61440]
"ArcSoft Connection Service"=C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [2010-10-27 207424]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-02-28 1828136]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-10-23 68856]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-07-24 490952]
"NVIDIA driver monitor"=C:\WINDOWS\nvsvc32.exe [2010-11-14 61440]
"coudef"=C:\Documents and Settings\uživatel\Data aplikací\Microsoft\vafy.exe [2010-12-02 461824]
"MSConfig"=C:\Documents and Settings\uživatel\mqf.exe [2010-11-24 18432]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
TMMonitor.lnk - D:\Program Files\ArcSoft\TotalMedia 3.5\TMMonitor.exe

C:\Documents and Settings\uživatel\Nabídka Start\Programy\Po spuštění
0uupllh.exe
0vrmm70.exe
2xidtze.exe
2zkpq0m.exe
70dtze3.exe
70xtoo6.exe
9s69e1a.exe
a0b0rns8.exe
aa6mm70tp.exe
avmmhyytkk.exe
bxnnjzzvll.exe
fl870njz.exe
g69so0e3qq.exe
hdttpffb.exe
o9k1gccxoo.exe
ooz83q3ssn.exe
u86bc70dzpf.exe
zvllhxxt.exe
zzvllhxxi3k.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2006-11-22 90112]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\crhcwhpk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\gfwctunh]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\kujtfczr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\trtnetbs]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\xorsbsab]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\crhcwhpk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\gfwctunh]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\kujtfczr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\trtnetbs]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\xorsbsab]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\ICQ6\ICQ.exe"="C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Firefox"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:iexplore"
"C:\Program Files\BitComet\BitComet.exe"="C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\Program Files\TrackMania Nations ESWC\TmNationsESWC.exe"="C:\Program Files\TrackMania Nations ESWC\TmNationsESWC.exe:*:Enabled:TmNationsESWC"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Disabled:Microsoft DirectPlay Helper"
"C:\Documents and Settings\uživatel\Plocha\bulanci.exe"="C:\Documents and Settings\uživatel\Plocha\bulanci.exe:*:Enabled:bulanci"
"D:\Hry\hl.exe"="D:\Hry\hl.exe:*:Enabled:Half-Life Launcher"
"D:\Hry\hltv.exe"="D:\Hry\hltv.exe:*:Disabled:HLTV Launcher"
"D:\cod\iw3mp.exe"="D:\cod\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM)"
"C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe"="C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:*:Enabled:Crysis_32"
"C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe"="C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32"
"D:\MARTIM\koš\hry\bulanci.exe"="D:\MARTIM\koš\hry\bulanci.exe:*:Enabled:bulanci"
"D:\Hry\nfs_undergroun_2\speed2.exe"="D:\Hry\nfs_undergroun_2\speed2.exe:*:Enabled:speed2"
"D:\Hry\Counter-Strike Source\hl2.exe"="D:\Hry\Counter-Strike Source\hl2.exe:*:Enabled:hl2"
"C:\Program Files\Counter-Strike Source\hl2.exe"="C:\Program Files\Counter-Strike Source\hl2.exe:*:Enabled:hl2"
"C:\Program Files\ICQ7.0\ICQ.exe"="C:\Program Files\ICQ7.0\ICQ.exe:*:Enabled:ICQ7"
"C:\Program Files\ICQ7.0\aolload.exe"="C:\Program Files\ICQ7.0\aolload.exe:*:Enabled:aolload.exe"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"D:\MARTIM\koš\dirt2_game.exe"="D:\MARTIM\koš\dirt2_game.exe:*:Enabled:DiRT2"
"C:\Documents and Settings\uživatel\Plocha\P1876832.JPG-www.facebook.exe"="C:\WINDOWS\nvsvc32.exe:*:Enabled:NVIDIA driver monitor"
"D:\Hry\cod\iw3mp.exe"="D:\Hry\cod\iw3mp.exe:*:Enabled:iw3mp"
"C:\Documents and Settings\uživatel\Data aplikací\Microsoft\vafy.exe"="C:\Documents and Settings\uživatel\Data aplikací\Microsoft\vafy.exe:*:Enabled:joorin64"
"C:\Documents and Settings\uživatel\Data aplikací\Microsoft\petabu.exe"="C:\Documents and Settings\uživatel\Data aplikací\Microsoft\petabu.exe:*:Enabled:joorin64"
"C:\Documents and Settings\uživatel\Data aplikací\Microsoft\gefasojys.exe"="C:\Documents and Settings\uživatel\Data aplikací\Microsoft\gefasojys.exe:*:Enabled:joorin64"
"C:\Documents and Settings\uživatel\Data aplikací\Microsoft\zoonehoum.exe"="C:\Documents and Settings\uživatel\Data aplikací\Microsoft\zoonehoum.exe:*:Enabled:joorin64"
"C:\WINDOWS\system32\vafy.exe"="C:\WINDOWS\system32\vafy.exe:*:Enabled:joorin64"
"C:\Documents and Settings\uživatel\Data aplikací\Microsoft\rougaruvih.exe"="C:\Documents and Settings\uživatel\Data aplikací\Microsoft\rougaruvih.exe:*:Enabled:joorin64"
"C:\WINDOWS\system32\gefasojys.exe"="C:\WINDOWS\system32\gefasojys.exe:*:Enabled:joorin64"
"C:\WINDOWS\system32\zoonehoum.exe"="C:\WINDOWS\system32\zoonehoum.exe:*:Enabled:joorin64"
"D:\Program Files\ArcSoft\TotalMedia 3.5\TotalMedia.exe"="D:\Program Files\ArcSoft\TotalMedia 3.5\TotalMedia.exe:LocalSubNet:Enabled:ArcSoft TotalMedia 3.5"
"C:\Documents and Settings\užvatel\Data aplikací\Microsoft\vafy.exe"="C:\Documents and Settings\užvatel\Data aplikací\Microsoft\vafy.exe:*:Disabled:vafy"
"C:\WINDOWS\system32\spool\drivers\Distributed.exe"="C:\WINDOWS\system32\spool\drivers\Distributed.exe:*:Enabled:BWProxyClient"
"C:\Documents and Settings\užvatel\Data aplikací\lsass.exe"="C:\Documents and Settings\užvatel\Data aplikací\lsass.exe:*:Disabled:lsass"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\ICQ7.0\ICQ.exe"="C:\Program Files\ICQ7.0\ICQ.exe:*:Enabled:ICQ7"
"C:\Program Files\ICQ7.0\aolload.exe"="C:\Program Files\ICQ7.0\aolload.exe:*:Enabled:aolload.exe"

======File associations======

.js - open - %SystemRoot%\System32\CScript.exe "%1" %*
.vbs - open - %SystemRoot%\System32\CScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-12-13 16:01:12 ----D---- C:\rsit
2010-12-13 16:01:12 ----D---- C:\Program Files\trend micro
2010-12-13 15:53:47 ----A---- C:\WINDOWS\system32\drivers\zcvsxnap.sys
2010-12-05 11:23:12 ----A---- C:\WINDOWS\system32\drivers\vtwmfzao.sys
2010-11-28 12:37:25 ----A---- C:\WINDOWS\system32\drivers\kujtfczr.sys
2010-11-26 04:29:47 ----A---- C:\pen.exe
2010-11-26 04:25:09 ----N---- C:\kmedia.exe
2010-11-26 02:20:50 ----N---- C:\bejewled.exe
2010-11-25 19:21:59 ----A---- C:\psp.exe
2010-11-25 18:05:22 ----A---- C:\WINDOWS\system32\drivers\ipnrnerj.sys
2010-11-25 17:43:38 ----A---- C:\WINDOWS\system32\drivers\hkqzsabn.sys
2010-11-25 17:09:41 ----A---- C:\WINDOWS\system32\drivers\RTL2832UUSB.sys
2010-11-25 17:09:41 ----A---- C:\WINDOWS\system32\drivers\RTL2832UBDA.sys
2010-11-25 17:09:41 ----A---- C:\WINDOWS\system32\drivers\RTL2832U_IRHID.sys
2010-11-25 17:09:31 ----D---- C:\Program Files\NewSoft
2010-11-25 17:09:31 ----A---- C:\WINDOWS\system32\RTKFMSOURCE.dll
2010-11-25 16:56:00 ----D---- C:\Documents and Settings\All Users\Data aplikací\ArcSoft
2010-11-25 16:52:31 ----A---- C:\WINDOWS\system32\unicows.dll
2010-11-24 20:07:53 ----D---- C:\Program Files\Common Files\ArcSoft
2010-11-21 23:10:23 ----RA---- C:\Documents and Settings\uživatel\Data aplikací\BG0Ai.txt
2010-11-21 23:09:11 ----RSH---- C:\Documents and Settings\uživatel\Data aplikací\juzjf.exe
2010-11-21 23:09:10 ----A---- C:\HDTV.exe
2010-11-17 12:20:14 ----A---- C:\WINDOWS\system32\hidserv.dll
2010-11-17 12:20:04 ----A---- C:\WINDOWS\system32\drivers\kbdhid.sys
2010-11-17 12:19:53 ----A---- C:\WINDOWS\system32\drivers\MPE.sys
2010-11-17 12:19:43 ----A---- C:\WINDOWS\system32\PsisDecd.dll
2010-11-17 12:19:42 ----A---- C:\WINDOWS\system32\drivers\BdaSup.sys
2010-11-14 21:49:47 ----A---- C:\t6.exe
2010-11-14 09:41:10 ----RSH---- C:\WINDOWS\nvsvc32.exe

======List of files/folders modified in the last 1 months======

2010-12-13 16:01:27 ----A---- C:\WINDOWS\NeroDigital.ini
2010-12-13 16:01:12 ----RD---- C:\Program Files
2010-12-13 15:54:58 ----AD---- C:\WINDOWS\Temp
2010-12-13 15:53:47 ----D---- C:\WINDOWS\system32\drivers
2010-12-13 15:53:37 ----D---- C:\Program Files\Crawler
2010-12-13 15:52:59 ----D---- C:\Program Files\Mozilla Firefox
2010-12-13 15:52:34 ----D---- C:\WINDOWS\system32\CatRoot2
2010-12-10 22:56:01 ----D---- C:\Program Files\Spyware Terminator
2010-12-08 16:13:36 ----D---- C:\Program Files\TrackMania Nations ESWC
2010-12-06 19:25:56 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2010-12-06 05:43:03 ----D---- C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2010-12-06 00:00:28 ----D---- C:\Documents and Settings\uživatel\Data aplikací\Spyware Terminator
2010-12-05 15:05:03 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-12-03 18:58:46 ----D---- C:\Documents and Settings\uživatel\Data aplikací\dvdcss
2010-12-02 16:27:47 ----SD---- C:\Documents and Settings\uživatel\Data aplikací\Microsoft
2010-11-30 17:03:54 ----SHD---- C:\WINDOWS\Installer
2010-11-30 00:16:28 ----D---- C:\WINDOWS\Prefetch
2010-11-28 16:04:50 ----D---- C:\Program Files\Common Files\Symantec Shared
2010-11-26 18:19:29 ----D---- C:\Documents and Settings\uživatel\Data aplikací\ICQ
2010-11-26 18:19:05 ----D---- C:\Program Files\ICQ7.0
2010-11-26 17:08:52 ----RSHD---- C:\RECYCLER
2010-11-26 17:00:39 ----HD---- C:\Program Files\InstallShield Installation Information
2010-11-26 15:04:59 ----D---- C:\WINDOWS
2010-11-26 15:04:13 ----D---- C:\WINDOWS\system32
2010-11-25 17:12:25 ----D---- C:\WINDOWS\system32\CatRoot
2010-11-25 17:11:27 ----HD---- C:\WINDOWS\inf
2010-11-25 16:56:33 ----D---- C:\Documents and Settings\uživatel\Data aplikací\ArcSoft
2010-11-24 20:07:53 ----D---- C:\Program Files\Common Files
2010-11-24 19:54:49 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-11-20 13:01:21 ----A---- C:\WINDOWS\IE4 Error Log.txt
2010-11-17 12:20:57 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 gagp30kx;Filtr Microsoft Generic AGPv3.0 pro procesorovou platformu K8; C:\WINDOWS\system32\DRIVERS\gagp30kx.sys [2004-08-04 46464]
R0 PxHelp20;PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [2010-08-12 45648]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\WINDOWS\System32\drivers\sfdrv01.sys [2005-08-10 50688]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\WINDOWS\System32\drivers\sfhlp02.sys [2005-05-16 6656]
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x); C:\WINDOWS\System32\drivers\sfvfs02.sys [2005-11-03 63488]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2008-12-03 717296]
R0 videX32;videX32; C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-10-22 9216]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2008-07-19 26944]
R1 AmdK8;Ovladač procesoru AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-06-18 43008]
R1 AsIO;AsIO; C:\WINDOWS\system32\drivers\AsIO.sys [2006-10-18 12664]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2008-07-19 42912]
R1 sp_rsdrv2;Spyware Terminator Driver 2; \??\C:\WINDOWS\system32\drivers\sp_rsdrv2.sys []
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2008-07-19 94416]
R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2006-11-10 18688]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2008-07-19 23152]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-11-22 2829824]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2007-04-17 42496]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-10-25 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-02-03 4474368]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-14 5810]
R3 PAC207;Trust WB-1400T Webcam; C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 162176]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-17 14848]
S2 kujtfczr;kujtfczr; C:\WINDOWS\system32\drivers\kujtfczr.sys [2010-11-28 82944]
S3 aewhqeml;aewhqeml; C:\WINDOWS\system32\drivers\aewhqeml.sys []
S3 anlhltyi;anlhltyi; \??\C:\WINDOWS\System32\Drivers\anlhltyi.sys []
S3 CCDECODE;Dekodér Closed Caption; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 cmqklrsk;cmqklrsk; \??\C:\WINDOWS\System32\Drivers\cmqklrsk.sys []
S3 dlckeors;dlckeors; \??\C:\WINDOWS\System32\Drivers\dlckeors.sys []
S3 dtscsi;dtscsi; C:\WINDOWS\System32\Drivers\dtscsi.sys []
S3 ecbzrioj;ecbzrioj; \??\C:\WINDOWS\System32\Drivers\ecbzrioj.sys []
S3 eeibohyo;eeibohyo; \??\C:\WINDOWS\System32\Drivers\eeibohyo.sys []
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
S3 fpndnmck;fpndnmck; \??\C:\WINDOWS\System32\Drivers\fpndnmck.sys []
S3 gewtffud;gewtffud; \??\C:\WINDOWS\System32\Drivers\gewtffud.sys []
S3 gtmihavu;gtmihavu; \??\C:\WINDOWS\System32\Drivers\gtmihavu.sys []
S3 gvfnzodb;gvfnzodb; \??\C:\WINDOWS\System32\Drivers\gvfnzodb.sys []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-12-06 49920]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-12-06 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-12-06 21568]
S3 iuzjcxli;iuzjcxli; \??\C:\WINDOWS\System32\Drivers\iuzjcxli.sys []
S3 jdiotjfh;jdiotjfh; \??\C:\WINDOWS\System32\Drivers\jdiotjfh.sys []
S3 kvxqhzyc;kvxqhzyc; \??\C:\WINDOWS\System32\Drivers\kvxqhzyc.sys []
S3 MPE;Filtr MPE BDA; C:\WINDOWS\system32\DRIVERS\MPE.sys [2004-08-03 15360]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 nzfrikij;nzfrikij; \??\C:\WINDOWS\System32\Drivers\nzfrikij.sys []
S3 nzqvahpo;nzqvahpo; \??\C:\WINDOWS\System32\Drivers\nzqvahpo.sys []
S3 RTL2832U_IRHID;HID Infrared Remote Receiver; C:\WINDOWS\system32\DRIVERS\RTL2832U_IRHID.sys [2009-07-13 37280]
S3 RTL2832UBDA;REALTEK 2832U BDA Driver; C:\WINDOWS\system32\drivers\RTL2832UBDA.sys [2009-07-06 91168]
S3 RTL2832UUSB;REALTEK 2832U USB Driver; C:\WINDOWS\System32\Drivers\RTL2832UUSB.sys [2009-07-06 32800]
S3 sdbiemqa;sdbiemqa; \??\C:\WINDOWS\System32\Drivers\sdbiemqa.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 tvjjdavm;tvjjdavm; \??\C:\WINDOWS\System32\Drivers\tvjjdavm.sys []
S3 ughwdinq;ughwdinq; \??\C:\WINDOWS\System32\Drivers\ughwdinq.sys []
S3 ujoorlbo;ujoorlbo; \??\C:\WINDOWS\System32\Drivers\ujoorlbo.sys []
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 vtwmfzao;vtwmfzao; \??\C:\WINDOWS\System32\Drivers\vtwmfzao.sys []
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2004-08-11 18944]
S3 WSTCODEC;Dálnopisný kodek světového standardu; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 wzndoylh;wzndoylh; \??\C:\WINDOWS\System32\Drivers\wzndoylh.sys []
S3 xjwlnzku;xjwlnzku; \??\C:\WINDOWS\System32\Drivers\xjwlnzku.sys []
S3 yqqolonw;yqqolonw; \??\C:\WINDOWS\System32\Drivers\yqqolonw.sys []
S3 zvykjxdv;zvykjxdv; \??\C:\WINDOWS\System32\Drivers\zvykjxdv.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2010-03-18 113152]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2008-07-19 16056]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-11-22 430080]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2008-07-19 147640]
R2 DistributedAgentServices;DistributedAgentServices; C:\WINDOWS\system32\spool\drivers\Distributed.exe [2010-12-04 117732]
R2 hpqddsvc;Služba HP CUE DeviceDiscovery; C:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-01-03 246520]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-10-14 153376]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-07-20 935208]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2004-08-17 14336]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2004-08-17 14336]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-11-07 66872]
R2 sp_rssrv;Spyware Terminator Realtime Shield Service; C:\Program Files\Spyware Terminator\sp_rsser.exe [2008-10-15 570880]
R2 STI Simulator;STI Simulator; C:\WINDOWS\System32\PAStiSvc.exe [2005-01-14 53248]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2008-07-19 250040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2008-07-23 348344]
R3 hpqcxs08;hpqcxs08; C:\WINDOWS\system32\svchost.exe [2004-08-17 14336]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2006-11-22 520192]
S2 gupdate1ca3f42ddb1aee2;Služba Google Update (gupdate1ca3f42ddb1aee2); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-09-27 133104]
S2 y6ajoaoakfxs;ASUSKeyboardService; C:\Documents and Settings\uživatel\Data aplikací\Microsoft\rougaruvih.exe []
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2003-02-20 32768]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-12-05 182768]
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

-----------------EOF-----------------


diky za pomoc
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: nakazene PC

#2 Příspěvek od vyosek »

Zdravim a pekny den preji :)

:arrow: Vypnu Vam rezindetni stit u Spyware Terminatora, at neni v kolizi s Avastem = ST tak budeme mit pouze na obcasny rucni sken

:arrow: Kliknete na Start a pote Spustit, pripadne pouzijte klavesou zkratku Win+R
  • Vyskoci na Vas okenko, do ktereho zkopirujte text nize

  • Kód: Vybrat vše

    services.msc
  • Kliknete na OK
  • Najdete sluzby nize
  • Služba Google Update
    Google Software Updater
    Nero BackItUp Scheduler 3
    Nero BackItUp Scheduler 4.0
    Spyware Terminator Realtime Shield Service
  • U sluzby provedte toto
    • Klik na ni pravym mysidlem a zvolit Vlastnosti
    • Nyní klik na Zastavit
    • Typ spousteni nastavit na Zakazano
    • Potvrdte kliknutim na OK
:arrow: Tam teda te haveti je :arcisit:

:arrow: Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
:arrow: Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
  • Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
  • Vložte do PC vsechny USB klice (flash disky, ext.disky apod.)
  • Pokud mate Win XP spustte pod uctem Spravce\Administratora
  • Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
  • Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
  • Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
  • Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
  • Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
  • Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
  • Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
mejl
Návštěvník
Návštěvník
Příspěvky: 26
Registrován: 30 čer 2008 17:15

Re: nakazene PC

#3 Příspěvek od mejl »

zdravim a omlouvam se za zpozdeni se kterym reaguji na vasi pomoc (byl sem par dni mimo)....

zde vkladam log z combofixu a doufam ze se jeste najde pro me nejaka rada....dekuji...

ComboFix 10-12-21.03 - uživatel 22.12.2010 10:00:56.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1023.631 [GMT 1:00]
Spuštěný z: c:\documents and settings\uživatel\Plocha\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\uživatel\Data aplikací\Microsoft\petabu.exe
c:\documents and settings\uživatel\Data aplikací\Microsoft\quukou.exe
c:\documents and settings\uživatel\Data aplikací\Microsoft\vafy.exe
c:\documents and settings\užvatel\Data aplikací\lsass.exe
c:\documents and settings\užvatel\Data aplikací\Microsoft\dovogig.exe
c:\documents and settings\užvatel\Data aplikací\Microsoft\petabu.exe
c:\documents and settings\užvatel\Data aplikací\Microsoft\vafy.exe
c:\windows\nvsvc32.exe
c:\windows\system32\Drivers\jllrtrmc.sys
c:\windows\System32\Drivers\vtwmfzao.sys
c:\windows\system32\secupdat.dat
c:\windows\system32\spool\drivers\systempro.exe
c:\windows\system32\Thumbs.db

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_jllrtrmc
-------\Service_jllrtrmc
-------\Service_vtwmfzao


((((((((((((((((((((((((( Soubory vytvořené od 2010-11-22 do 2010-12-22 )))))))))))))))))))))))))))))))
.

2010-12-13 15:01 . 2010-12-13 15:01 -------- d-----w- C:\rsit
2010-12-13 15:01 . 2010-12-13 15:01 -------- d-----w- c:\program files\trend micro
2010-11-28 11:37 . 2010-11-28 11:37 82944 ----a-w- c:\windows\system32\drivers\kujtfczr.sys
2010-11-27 08:35 . 2010-11-27 08:35 -------- d-----w- c:\documents and settings\LocalService\Data aplikací\GRETECH
2010-11-26 16:59 . 2010-11-26 16:59 -------- d-----w- c:\documents and settings\užvatel\Local Settings\Data aplikací\ArcSoft
2010-11-26 03:29 . 2010-11-26 03:29 184951 ----a-w- C:\pen.exe
2010-11-26 03:25 . 2010-11-26 03:25 194560 ------w- C:\kmedia.exe
2010-11-26 01:20 . 2010-11-26 01:42 194560 ------w- C:\bejewled.exe
2010-11-25 18:21 . 2010-11-26 03:27 184951 ----a-w- C:\psp.exe
2010-11-25 17:05 . 2010-11-25 17:05 0 ----a-w- c:\windows\system32\drivers\ipnrnerj.sys
2010-11-25 16:43 . 2010-11-25 16:43 0 ----a-w- c:\windows\system32\drivers\hkqzsabn.sys
2010-11-25 16:09 . 2009-07-13 14:46 37280 ----a-w- c:\windows\system32\drivers\RTL2832U_IRHID.sys
2010-11-25 16:09 . 2009-07-06 16:37 32800 ----a-w- c:\windows\system32\drivers\RTL2832UUSB.sys
2010-11-25 16:09 . 2009-07-06 16:36 91168 ----a-w- c:\windows\system32\drivers\RTL2832UBDA.sys
2010-11-25 16:09 . 2010-11-25 16:09 -------- d-----w- c:\program files\NewSoft
2010-11-25 16:09 . 2009-04-02 13:22 127085 ----a-w- c:\windows\system32\RTKFMSOURCE.dll
2010-11-25 15:56 . 2010-11-25 15:56 -------- d-----w- c:\documents and settings\uživatel\Local Settings\Data aplikací\ArcSoft
2010-11-25 15:56 . 2010-11-26 16:00 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ArcSoft
2010-11-25 15:52 . 2005-04-27 15:36 245408 ----a-w- c:\windows\system32\unicows.dll
2010-11-24 19:07 . 2010-11-25 15:55 -------- d-----w- c:\program files\Common Files\ArcSoft
2010-11-24 18:33 . 2010-11-24 18:33 18432 ---ha-w- c:\documents and settings\uživatel\mqf.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-06 18:26 . 2008-06-26 12:15 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-12-06 18:25 . 2008-06-26 12:15 103736 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-11-30 16:02 . 2010-11-21 21:34 97792 --sh--r- c:\documents and settings\užvatel\Data aplikací\juzjf.exe
2010-11-21 22:09 . 2010-11-21 22:09 85504 --sh--r- c:\documents and settings\uživatel\Data aplikací\juzjf.exe
2010-11-21 22:09 . 2010-11-21 22:09 85504 ----a-w- C:\HDTV.exe
2010-11-21 21:35 . 2010-11-21 21:35 18432 ---ha-w- c:\documents and settings\užvatel\jwyad.exe
2010-11-21 21:35 . 2010-11-21 21:35 18432 ---ha-w- c:\documents and settings\užvatel\jwyad.exe
2010-11-03 14:00 . 2010-11-03 06:11 445016 ----a-w- c:\windows\system32\wrap_oal.dll
2010-11-03 14:00 . 2010-11-03 06:11 109144 ----a-w- c:\windows\system32\OpenAL32.dll
2010-10-14 19:05 . 2010-10-14 19:05 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-10-14 19:05 . 2010-10-14 19:05 472808 ----a-w- c:\windows\system32\deployJava1.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2008-10-08 173368]

[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-23 68856]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-20 2879488]
"RTHDCPL"="RTHDCPL.EXE" [2007-02-03 16116224]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-06-29 185896]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-04-28 570664]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]
"SMail"="c:\program files\Seznam\Postak\Postak.exe" [2006-05-18 450560]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2009-02-15 111928]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\u§vatel\Nabˇdka Start\Programy\Po spuçtŘnˇ\
0tjjpq6.exe [2010-11-30 50688]
1a2hcco.exe [2010-12-4 42496]
1okkflh.exe [2010-12-1 50688]
1yjkflg.exe [2010-11-28 50688]
3o6v6wc.exe [2010-11-27 50688]
5r5nde0.exe [2010-11-21 43008]
6d19u1q.exe [2010-11-25 50688]
6d8p58x.exe [2010-11-25 42496]
6iiuupv.exe [2010-11-25 50688]
6s81pkv.exe [2010-11-28 50688]
6wrms5t.exe [2010-11-22 43008]
70y6kk1.exe [2010-12-1 42496]
9ejfvvr.exe [2010-12-2 50688]
9y2p3wh.exe [2010-11-29 50688]
bssneezqqlc.exe [2010-11-22 43008]
c1yzzvlr.exe [2010-11-30 42496]
cc6ejfaqg.exe [2010-11-25 50688]
cnnjzpplbb.exe [2010-12-1 50688]
cxytz60gbs.exe [2010-11-28 50688]
djzkg0h1so.exe [2010-11-27 50688]
epak769xtt.exe [2010-11-29 50688]
fggbsidopp.exe [2010-11-30 42496]
fvvrhhs3.exe [2010-12-2 42496]
hsoojffgw6.exe [2010-11-27 42496]
hyytkkfl.exe [2010-12-1 50688]
i9j60llwhi.exe [2010-11-30 50688]
ju3wccxooj.exe [2010-11-26 50688]
lr5nde0u3.exe [2010-11-21 43008]
m6yy6kk6.exe [2010-11-22 43008]
miidzppggr.exe [2010-11-27 42496]
mmhyytkkfw.exe [2010-11-22 43008]
n1o21a9cc.exe [2010-11-29 50688]
nt66k6lm.exe [2010-11-28 42496]
oju3wccxooj.exe [2010-11-26 50688]
okffwccxoo.exe [2010-11-26 50688]
okkfwwrii9.exe [2010-12-1 42496]
pu30rrc0.exe [2010-11-30 50688]
qmmhyytkkf.exe [2010-12-10 43008]
qw5sdjo3.exe [2010-11-21 43008]
qw9c1yzzv.exe [2010-11-30 50688]
r2too6ag.exe [2010-11-30 50688]
s3o3f0lhccy.exe [2010-12-2 50688]
toupl2hcco.exe [2010-12-4 50688]
tppl2hccooj.exe [2010-12-4 50688]
tukk6ww6.exe [2010-12-4 50688]
uka9ccn8.exe [2010-11-29 42496]
vmmhyytk.exe [2010-12-10 43008]
vmmhyytkkfw.exe [2010-12-10 42496]
w5sdjo3aa3.exe [2010-11-21 43008]
w765j1uq.exe [2010-12-1 50688]
ww9c1yzzvl.exe [2010-11-30 50688]
xyj1uqql.exe [2010-12-1 50688]
y2zqqlccn3.exe [2010-12-2 50688]
y69k1r5x0dz.exe [2010-11-26 42496]
yy6kk1wrs.exe [2010-12-1 50688]

c:\documents and settings\u§ivatel\Nabˇdka Start\Programy\Po spuçtŘnˇ\
0uupllh.exe [2010-11-24 43008]
0vrmm70.exe [2010-11-22 43008]
2xidtze.exe [2010-11-22 43008]
2zkpq0m.exe [2010-11-24 43008]
70dtze3.exe [2010-11-22 43008]
70xtoo6.exe [2010-11-22 43008]
9s69e1a.exe [2010-11-22 43008]
a0b0rns8.exe [2010-11-21 43008]
aa6mm70tp.exe [2010-11-22 43008]
avmmhyytkk.exe [2010-11-22 43008]
bxnnjzzvll.exe [2010-11-22 43008]
fl870njz.exe [2010-11-21 43008]
g69so0e3qq.exe [2010-11-22 43008]
hdttpffb.exe [2010-11-22 43008]
o9k1gccxoo.exe [2010-11-22 43008]
ooz83q3ssn.exe [2010-11-24 43008]
u86bc70dzpf.exe [2010-11-21 43008]
zvllhxxt.exe [2010-11-22 43008]
zzvllhxxi3k.exe [2010-11-24 43008]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
TMMonitor.lnk - d:\program files\ArcSoft\TotalMedia 3.5\TMMonitor.exe [2010-11-25 258048]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"d:\\MARTIM\\koš\\hry\\bulanci.exe"=
"d:\\Hry\\nfs_undergroun_2\\speed2.exe"=
"c:\\Program Files\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\ICQ7.0\\ICQ.exe"=
"c:\\Program Files\\ICQ7.0\\aolload.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"d:\\MARTIM\\koš\\dirt2_game.exe"=
"c:\\Documents and Settings\\uživatel\\Plocha\\P1876832.JPG-www.facebook.exe"= c:\\WINDOWS\\nvsvc32.exe
"d:\\Hry\\cod\\iw3mp.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\Distributed.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"20030:TCP"= 20030:TCP:BitComet 20030 TCP
"20030:UDP"= 20030:UDP:BitComet 20030 UDP

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.6.2008 12:42 717296]
R2 DistributedAgentServices;DistributedAgentServices;c:\windows\system32\spool\drivers\Distributed.exe [4.12.2010 11:21 117732]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [24.1.2009 13:19 246520]
S2 gupdate1ca3f42ddb1aee2;Služba Google Update (gupdate1ca3f42ddb1aee2);c:\program files\Google\Update\GoogleUpdate.exe [27.9.2009 8:19 133104]
S2 kujtfczr;kujtfczr;c:\windows\system32\drivers\kujtfczr.sys [28.11.2010 12:37 82944]
S2 y6ajoaoakfxs;ASUSKeyboardService;c:\documents and settings\uživatel\Data aplikací\Microsoft\rougaruvih.exe --> c:\documents and settings\uživatel\Data aplikací\Microsoft\rougaruvih.exe [?]
S3 anlhltyi;anlhltyi;\??\c:\windows\System32\Drivers\anlhltyi.sys --> c:\windows\System32\Drivers\anlhltyi.sys [?]
S3 cmqklrsk;cmqklrsk;\??\c:\windows\System32\Drivers\cmqklrsk.sys --> c:\windows\System32\Drivers\cmqklrsk.sys [?]
S3 dlckeors;dlckeors;\??\c:\windows\System32\Drivers\dlckeors.sys --> c:\windows\System32\Drivers\dlckeors.sys [?]
S3 ecbzrioj;ecbzrioj;\??\c:\windows\System32\Drivers\ecbzrioj.sys --> c:\windows\System32\Drivers\ecbzrioj.sys [?]
S3 eeibohyo;eeibohyo;\??\c:\windows\System32\Drivers\eeibohyo.sys --> c:\windows\System32\Drivers\eeibohyo.sys [?]
S3 fpndnmck;fpndnmck;\??\c:\windows\System32\Drivers\fpndnmck.sys --> c:\windows\System32\Drivers\fpndnmck.sys [?]
S3 gewtffud;gewtffud;\??\c:\windows\System32\Drivers\gewtffud.sys --> c:\windows\System32\Drivers\gewtffud.sys [?]
S3 gtmihavu;gtmihavu;\??\c:\windows\System32\Drivers\gtmihavu.sys --> c:\windows\System32\Drivers\gtmihavu.sys [?]
S3 gvfnzodb;gvfnzodb;\??\c:\windows\System32\Drivers\gvfnzodb.sys --> c:\windows\System32\Drivers\gvfnzodb.sys [?]
S3 iuzjcxli;iuzjcxli;\??\c:\windows\System32\Drivers\iuzjcxli.sys --> c:\windows\System32\Drivers\iuzjcxli.sys [?]
S3 jdiotjfh;jdiotjfh;\??\c:\windows\System32\Drivers\jdiotjfh.sys --> c:\windows\System32\Drivers\jdiotjfh.sys [?]
S3 kvxqhzyc;kvxqhzyc;\??\c:\windows\System32\Drivers\kvxqhzyc.sys --> c:\windows\System32\Drivers\kvxqhzyc.sys [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15.1.2010 13:49 227232]
S3 nzfrikij;nzfrikij;\??\c:\windows\System32\Drivers\nzfrikij.sys --> c:\windows\System32\Drivers\nzfrikij.sys [?]
S3 nzqvahpo;nzqvahpo;\??\c:\windows\System32\Drivers\nzqvahpo.sys --> c:\windows\System32\Drivers\nzqvahpo.sys [?]
S3 PAC207;Trust WB-1400T Webcam;c:\windows\system32\drivers\PFC027.sys [24.2.2005 11:29 162176]
S3 RTL2832U_IRHID;HID Infrared Remote Receiver;c:\windows\system32\drivers\RTL2832U_IRHID.sys [25.11.2010 17:09 37280]
S3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys [25.11.2010 17:09 91168]
S3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\drivers\RTL2832UUSB.sys [25.11.2010 17:09 32800]
S3 sdbiemqa;sdbiemqa;\??\c:\windows\System32\Drivers\sdbiemqa.sys --> c:\windows\System32\Drivers\sdbiemqa.sys [?]
S3 tvjjdavm;tvjjdavm;\??\c:\windows\System32\Drivers\tvjjdavm.sys --> c:\windows\System32\Drivers\tvjjdavm.sys [?]
S3 ughwdinq;ughwdinq;\??\c:\windows\System32\Drivers\ughwdinq.sys --> c:\windows\System32\Drivers\ughwdinq.sys [?]
S3 ujoorlbo;ujoorlbo;\??\c:\windows\System32\Drivers\ujoorlbo.sys --> c:\windows\System32\Drivers\ujoorlbo.sys [?]
S3 wzndoylh;wzndoylh;\??\c:\windows\System32\Drivers\wzndoylh.sys --> c:\windows\System32\Drivers\wzndoylh.sys [?]
S3 xjwlnzku;xjwlnzku;\??\c:\windows\System32\Drivers\xjwlnzku.sys --> c:\windows\System32\Drivers\xjwlnzku.sys [?]
S3 yqqolonw;yqqolonw;\??\c:\windows\System32\Drivers\yqqolonw.sys --> c:\windows\System32\Drivers\yqqolonw.sys [?]
S3 zvykjxdv;zvykjxdv;\??\c:\windows\System32\Drivers\zvykjxdv.sys --> c:\windows\System32\Drivers\zvykjxdv.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Obsah adresáře 'Naplánované úlohy'

2010-12-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-27 07:19]

2010-12-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-27 07:19]

2010-12-09 c:\windows\Tasks\Norton Security Scan for uživatel.job
- c:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-06-28 07:48]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://googleure.com
mStart Page = hxxp://home.sweetim.com
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} -
FF - ProfilePath - c:\documents and settings\uživatel\Data aplikací\Mozilla\Firefox\Profiles\vf6f5zm6.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.1&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - c:\program files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - %profile%\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - Ext: Mininova Toolbar: {f592709f-ff4a-4862-b659-4afabda56312} - %profile%\extensions\{f592709f-ff4a-4862-b659-4afabda56312}
FF - Ext: SweetIM Toolbar for Firefox: {EEE6C361-6118-11DC-9C72-001320C79847} - %profile%\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
FF - Ext: Crawler Toolbar: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - c:\program files\Crawler\firefox
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

Toolbar-{EEE6C35B-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
HKCU-Run-coudef - c:\documents and settings\uživatel\Data aplikací\Microsoft\vafy.exe
SafeBoot-crhcwhpk
SafeBoot-gfwctunh
SafeBoot-jllrtrmc.sys
SafeBoot-kujtfczr
SafeBoot-trtnetbs
SafeBoot-xorsbsab
AddRemove-Counter-Strike 1.6 - d:\hry\Uninstal.exe
AddRemove-Totalcmd - c:\totalcmd\tcuninst.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-22 10:09
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-823518204-602162358-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
@Denied: (Full) (LocalSystem)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(696)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2788)
c:\windows\system32\msi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\windows\system32\spool\drivers\systempro.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\System32\PAStiSvc.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\program files\Common Files\Nero\Lib\NMIndexingService.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
.
**************************************************************************
.
Celkový čas: 2010-12-22 10:12:22 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-12-22 09:12

Před spuštěním: 7 917 101 056
Po spuštění: Volných bajtů: 14 924 161 024

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - 1B4E387C49F8693C74FC0034BD829ADD
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: nakazene PC

#4 Příspěvek od vyosek »

Omlouvam se za zpozdeni, ale pracovni povinnosti me k tomu drive nepustily :oops:

:arrow: Stahnete OTM (viz muj podpis)
  • Pokud pouzivate Win Vista ci W7, kliknete na OTM pravym a dejte Run As Administrator ci Spustit jako spravce
  • Do leveho okna Paste Instructions for Items to be Moved (pod zlutou caru) vlozte obsah, ktery mate nize

  • Kód: Vybrat vše

    :reg
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Documents and Settings\uživatel\Plocha\P1876832.JPG-www.facebook.exe"=-
"C:\Documents and Settings\uživatel\Data aplikací\Microsoft\vafy.exe"=-
"C:\Documents and Settings\uživatel\Data aplikací\Microsoft\petabu.exe"=-
"C:\Documents and Settings\uživatel\Data aplikací\Microsoft\gefasojys.exe"=-
"C:\Documents and Settings\uživatel\Data aplikací\Microsoft\zoonehoum.exe"=-
"C:\WINDOWS\system32\vafy.exe"=-
"C:\Documents and Settings\uživatel\Data aplikací\Microsoft\rougaruvih.exe"=-
"C:\WINDOWS\system32\gefasojys.exe"=-
"C:\WINDOWS\system32\zoonehoum.exe"=-
"C:\Documents and Settings\užvatel\Data aplikací\Microsoft\vafy.exe"=-
"C:\Documents and Settings\užvatel\Data aplikací\lsass.exe"=-

:files
C:\Documents and Settings\uživatel\Data aplikací\Microsoft\zoonehoum.exe
C:\Documents and Settings\uživatel\Data aplikací\Microsoft\gefasojys.exe
C:\WINDOWS\system32\vafy.exe
C:\Documents and Settings\uživatel\Data aplikací\Microsoft\rougaruvih.exe
C:\WINDOWS\system32\gefasojys.exe
C:\WINDOWS\system32\zoonehoum.exe
C:\Documents and Settings\uživatel\Plocha\P1876832.JPG-www.facebook.exe
C:\Documents and Settings\užvatel\Data aplikací\Microsoft\vafy.exe
C:\Documents and Settings\užvatel\Data aplikací\lsass.exe
C:\Documents and Settings\uživatel\Data aplikací\Microsoft\petabu.exe
C:\Documents and Settings\uživatel\Data aplikací\Microsoft\vafy.exe
C:\Documents and Settings\uživatel\Nabídka Start\Programy\Po spuštění\*.exe
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp /s

:commands
[ClearAllRestorePoints]
[RESETHOSTS]
[EMPTYTEMP]
[EMPTYFLASH]
  • Kliknete na cervene tlacitko MoveIt!
  • Budete vyzvani na restart, dejte Yes, log pote najdete C:\_OTM\MovedFiles, obsah sem vlozte
:arrow: Pokud nemate, tak presunte Combofix na plochu
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    Collect::
c:\windows\system32\drivers\kujtfczr.sys
C:\pen.exe
C:\kmedia.exe
C:\bejewled.exe
C:\psp.exe
c:\windows\system32\drivers\ipnrnerj.sys
c:\windows\system32\drivers\hkqzsabn.sys
c:\documents and settings\uživatel\mqf.exe
c:\documents and settings\užvatel\Data aplikací\juzjf.exe
c:\documents and settings\uživatel\Data aplikací\juzjf.exe
c:\documents and settings\užvatel\jwyad.exe
c:\documents and settings\užvatel\jwyad.exe
c:\windows\system32\drivers\kujtfczr.sys
c:\documents and settings\uživatel\Data aplikací\Microsoft\rougaruvih.exe 
c:\windows\System32\Drivers\anlhltyi.sys 
c:\windows\System32\Drivers\cmqklrsk.sys 
c:\windows\System32\Drivers\dlckeors.sys 
c:\windows\System32\Drivers\ecbzrioj.sys 
c:\windows\System32\Drivers\eeibohyo.sys 
c:\windows\System32\Drivers\fpndnmck.sys 
c:\windows\System32\Drivers\gewtffud.sys 
c:\windows\System32\Drivers\gtmihavu.sys 
c:\windows\System32\Drivers\gvfnzodb.sys 
c:\windows\System32\Drivers\iuzjcxli.sys 
c:\windows\System32\Drivers\jdiotjfh.sys 
c:\windows\System32\Drivers\kvxqhzyc.sys 
c:\windows\System32\Drivers\nzfrikij.sys 
c:\windows\System32\Drivers\nzqvahpo.sys 
c:\windows\System32\Drivers\sdbiemqa.sys 
c:\windows\System32\Drivers\tvjjdavm.sys 
c:\windows\System32\Drivers\ughwdinq.sys 
c:\windows\System32\Drivers\ujoorlbo.sys 
c:\windows\System32\Drivers\wzndoylh.sys 
c:\windows\System32\Drivers\xjwlnzku.sys 
c:\windows\System32\Drivers\yqqolonw.sys 
c:\windows\System32\Drivers\zvykjxdv.sys 

Folder::
c:\program files\SweetIM
c:\program files\ICQ6Toolbar

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"=-
[-HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[-HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[-HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[-HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=-
"swg"=-
"DAEMON Tools Lite"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"=-
"TkBellExe"=-
"NeroFilterCheck"=-
"NBKeyScan"=-
"SweetIM"=-
"DivXUpdate"=-
"SunJavaUpdateSched"=-

Driver::
ICQ Service
kujtfczr
y6ajoaoakfxs
anlhltyi
cmqklrsk
dlckeors
ecbzrioj
eeibohyo
fpndnmck
gewtffud
gtmihavu
gvfnzodb
iuzjcxli
jdiotjfh
kvxqhzyc
nzfrikij
nzqvahpo
sdbiemqa
tvjjdavm
ughwdinq
ujoorlbo
wzndoylh
xjwlnzku
yqqolonw
zvykjxdv

DDS::
uStart Page = hxxp://googleure.com
mStart Page = hxxp://home.sweetim.com
IE: Crawler Search - tbr:iemenu

Firefox::
FF - ProfilePath - c:\documents and settings\uživatel\Data aplikací\Mozilla\Firefox\Profiles\vf6f5zm6.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... 2.0.0.1&q=
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - c:\program files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - %profile%\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - Ext: SweetIM Toolbar for Firefox: {EEE6C361-6118-11DC-9C72-001320C79847} - %profile%\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}

RegLock::
[HKEY_USERS\S-1-5-21-823518204-602162358-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]
  • Ulozte vytvoreny TXT jako CFScript.txt
  • Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
    Obrázek
  • Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte
:arrow: Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“