Facebook virus

[Mihajko2222]

Dobry večer. omylom som spustil ten exe subor co teraz koluje na FB.

Možete sa pozrieť ci to je ešte v PC,lebo Combofix niečo zmazal ale neviem co to bolo.

Tu je log:

ComboFix 11-01-07.02 - Mihajko . 01. 2011 16:43:09.2.2 - x86
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1250.421.1029.18.3070.1866 [GMT 1:00]
Running from: d:\download\ComboFix.exe
AV: ESET Smart Security 4.2 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 4.2 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Public\nvsvc32.exe

.
((((((((((((((((((((((((( Files Created from 2010-12-08 to 2011-01-08 )))))))))))))))))))))))))))))))
.

2011-01-08 15:50 . 2011-01-08 15:50 -------- d-----w- c:\users\Mihajko\AppData\Local\temp
2011-01-08 15:50 . 2011-01-08 15:50 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-08 14:45 . 2011-01-08 14:45 -------- d-----w- c:\program files\Prevx
2011-01-08 14:44 . 2011-01-08 15:04 -------- d-----w- c:\programdata\PrevxCSI
2011-01-04 18:57 . 2011-01-04 18:58 -------- d-----w- c:\users\Mihajko\AppData\Roaming\GameRanger
2011-01-04 17:46 . 2011-01-04 17:46 -------- d-----w- c:\users\Mihajko\AppData\Roaming\Leadertech
2011-01-03 21:40 . 2011-01-03 21:44 -------- d-----w- c:\program files\PhotoFiltre
2010-12-31 18:58 . 2010-12-31 18:58 -------- d-----w- c:\program files\SmileyCentral_1v
2010-12-31 15:32 . 2010-12-31 15:45 -------- d-----w- c:\users\Mihajko\AppData\Local\Microsoft Games
2010-12-27 16:24 . 2010-12-27 16:24 -------- d-----w- c:\users\Mihajko\AppData\Local\JustGestures
2010-12-27 16:22 . 2010-12-27 16:23 -------- d-----w- c:\program files\Just
2010-12-27 16:20 . 2011-01-08 00:28 -------- d-----w- c:\program files\ICQ7.2
2010-12-25 12:38 . 2010-12-25 12:39 -------- d-----w- c:\program files\Defraggler
2010-12-25 12:00 . 2010-12-25 12:00 -------- d---a-w- c:\windows\rundll16.exe
2010-12-25 12:00 . 2010-12-25 12:00 -------- d---a-w- c:\windows\logo1_.exe
2010-12-25 11:53 . 2010-12-25 11:53 -------- d---a-w- c:\windows\VDLL.DLL
2010-12-25 11:53 . 2010-12-25 11:53 -------- d---a-w- c:\windows\system32\runouce.exe
2010-12-25 11:53 . 2010-12-25 11:53 -------- d---a-w- c:\windows\RUNDL132.EXE
2010-12-25 11:53 . 2010-12-25 11:53 -------- d---a-w- c:\windows\logo_1.exe
2010-12-25 11:46 . 2010-12-25 11:46 632064 ----a-w- c:\windows\system32\msvcr80.dll
2010-12-25 11:46 . 2010-12-25 11:46 554240 ----a-w- c:\windows\system32\msvcp80.dll
2010-12-25 11:46 . 2010-12-25 11:46 34048 ----a-w- c:\windows\system32\eEmpty.exe
2010-12-25 11:46 . 2010-12-25 11:46 -------- d-----w- c:\program files\Common Files\MicroWorld
2010-12-25 11:46 . 2010-12-25 11:46 -------- d-----w- c:\programdata\MicroWorld
2010-12-25 11:34 . 2010-12-25 11:42 -------- d-----w- c:\users\Mihajko\AppData\Roaming\Download Manager
2010-12-17 20:23 . 2010-12-17 20:23 -------- d-----w- c:\program files\QuickTime
2010-12-17 20:23 . 2010-12-17 20:23 -------- d-----w- c:\programdata\Apple Computer
2010-12-13 16:31 . 2010-12-13 16:31 -------- d-----w- c:\programdata\Codemasters
2010-12-13 16:25 . 2010-03-01 19:51 17686528 ----a-w- c:\windows\system32\mkl_blueripple.dll
2010-12-13 16:25 . 2010-07-28 18:10 1380352 ----a-w- c:\windows\system32\rapture3d_oal.dll
2010-12-13 16:25 . 2010-12-13 16:26 -------- d-----w- c:\program files\BRS
2010-12-13 16:25 . 2010-12-13 16:25 445016 ----a-w- c:\windows\system32\wrap_oal.dll
2010-12-13 16:25 . 2010-12-13 16:25 109144 ----a-w- c:\windows\system32\OpenAL32.dll
2010-12-13 16:25 . 2010-12-13 16:25 -------- d-----w- c:\program files\OpenAL
2010-12-13 16:12 . 2010-12-13 16:12 -------- d-----w- c:\program files\Codemasters

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-02 19:17 . 2010-12-02 19:17 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-11-29 16:38 . 2010-11-29 16:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 16:38 . 2010-11-29 16:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-10-20 19:08 . 2010-10-20 19:08 319456 ----a-w- c:\windows\DIFxAPI.dll
2010-10-20 19:08 . 2010-10-20 19:08 315392 ----a-w- c:\windows\HideWin.exe
2010-10-19 10:41 . 2010-10-31 12:26 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-18 08:41 . 2010-10-31 12:26 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{898F4636-CB78-4C41-854E-5421CE1623F0}\mpengine.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-04-05 1233920]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-12-03 14944136]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-10-20 160328]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"Just Gestures"="c:\program files\Just\Just Gestures\JustGestures.exe" [2010-12-12 1846784]
"ICQ"="c:\program files\ICQ7.2\ICQ.exe" [2011-01-05 133432]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-08-12 2215064]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-08-25 98304]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"TNOD UP"="c:\program files\TNod User & Password Finder\TNODUP.exe" [2010-04-01 1811968]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

c:\users\Mihajko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Automatick‚ vypnutˇ poźˇtaźe.lnk - c:\program files\Automatick‚ vypnutˇ poźˇtaźe\avp.exe [2004-12-28 443392]
GameRanger.lnk - c:\users\Mihajko\AppData\Roaming\GameRanger\GameRanger\GameRanger.exe [2010-12-10 1248992]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2007-03-23 11:04 4423680 ----a-w- c:\windows\RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-4032584465-1687109830-3115521887-1000]
"EnableNotificationsRef"=dword:00000001

R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
R3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\Belkin\F5D7000v8\jswpsapi.exe [2007-10-29 352338]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-12-02 691696]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-07-29 115008]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-08-26 176128]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-07-29 136632]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2010-08-12 810144]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2010-07-29 41336]
S2 SmileyCentral_1vService;SmileyCentral Service;c:\progra~1\SMILEY~2\bar\1.bin\1vbarsvc.exe [2010-12-31 28766]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-07-06 173352]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-08-26 6380032]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-08-26 221696]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdLH3.sys [2010-07-15 99344]
S3 JSWSCIMD;jswscimd Service;c:\windows\system32\DRIVERS\jswscimd.sys [2007-08-28 57344]

.
Contents of the 'Scheduled Tasks' folder

2011-01-07 c:\windows\Tasks\User_Feed_Synchronization-{97927A6F-48F8-4A65-99E0-8274E3293CB4}.job
- c:\windows\system32\msfeedssync.exe [2008-04-05 17:15]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://start.icq.com/
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Nástrojová lišta RoboFormu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Prispôsobiť menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Uložiť formulár - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: Vyplniť formulár - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
FF - ProfilePath - c:\users\Mihajko\AppData\Roaming\Mozilla\Firefox\Profiles\9acotge5.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_result ... r=1.1.7&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: 1-Click YouTube Video Downloader: YoutubeDownloader@PeterOlayev.com - %profile%\extensions\YoutubeDownloader@PeterOlayev.com
FF - Ext: Forecastbar Enhanced: {3CE993BF-A3D9-4fd2-B3B6-768CBBC337F8} - %profile%\extensions\{3CE993BF-A3D9-4fd2-B3B6-768CBBC337F8}
FF - Ext: Download Statusbar: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} - %profile%\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
FF - Ext: DAEMON Tools Toolbar: DTToolbar@toolbarnet.com - %profile%\extensions\DTToolbar@toolbarnet.com
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
MSConfigStartUp-uTorrent - c:\program files\uTorrent\uTorrent.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-08 16:50
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2011-01-08 16:51:43
ComboFix-quarantined-files.txt 2011-01-08 15:51

Pre-Run: 6 075 604 992
Post-Run: 5 991 112 704

- - End Of File - - 300A9FD6908EEC2B96AA9102CE483DAA


Vopred Dik za pomoc

[Rudy]

Zdravím! Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode, pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k nezadoucim kolizim s rezidentem antispyware

[Mihajko2222]

ComboFix 11-01-07.02 - Mihajko . 01. 2011 18:18:17.3.2 - x86
Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1250.421.1029.18.3070.1842 [GMT 1:00]
Running from: c:\users\Mihajko\Desktop\ComboFix.exe
AV: ESET Smart Security 4.2 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 4.2 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Resident AV is active

.

((((((((((((((((((((((((( Files Created from 2010-12-08 to 2011-01-08 )))))))))))))))))))))))))))))))
.

2011-01-08 17:24 . 2011-01-08 17:24 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-08 14:45 . 2011-01-08 14:45 -------- d-----w- c:\program files\Prevx
2011-01-08 14:44 . 2011-01-08 15:04 -------- d-----w- c:\programdata\PrevxCSI
2011-01-04 18:57 . 2011-01-04 18:58 -------- d-----w- c:\users\Mihajko\AppData\Roaming\GameRanger
2011-01-04 17:46 . 2011-01-04 17:46 -------- d-----w- c:\users\Mihajko\AppData\Roaming\Leadertech
2011-01-03 21:40 . 2011-01-03 21:44 -------- d-----w- c:\program files\PhotoFiltre
2010-12-31 18:58 . 2010-12-31 18:58 -------- d-----w- c:\program files\SmileyCentral_1v
2010-12-31 15:32 . 2010-12-31 15:45 -------- d-----w- c:\users\Mihajko\AppData\Local\Microsoft Games
2010-12-27 16:24 . 2010-12-27 16:24 -------- d-----w- c:\users\Mihajko\AppData\Local\JustGestures
2010-12-27 16:22 . 2010-12-27 16:23 -------- d-----w- c:\program files\Just
2010-12-27 16:20 . 2011-01-08 00:28 -------- d-----w- c:\program files\ICQ7.2
2010-12-25 12:38 . 2010-12-25 12:39 -------- d-----w- c:\program files\Defraggler
2010-12-25 12:00 . 2010-12-25 12:00 -------- d---a-w- c:\windows\rundll16.exe
2010-12-25 12:00 . 2010-12-25 12:00 -------- d---a-w- c:\windows\logo1_.exe
2010-12-25 11:53 . 2010-12-25 11:53 -------- d---a-w- c:\windows\VDLL.DLL
2010-12-25 11:53 . 2010-12-25 11:53 -------- d---a-w- c:\windows\system32\runouce.exe
2010-12-25 11:53 . 2010-12-25 11:53 -------- d---a-w- c:\windows\RUNDL132.EXE
2010-12-25 11:53 . 2010-12-25 11:53 -------- d---a-w- c:\windows\logo_1.exe
2010-12-25 11:46 . 2010-12-25 11:46 632064 ----a-w- c:\windows\system32\msvcr80.dll
2010-12-25 11:46 . 2010-12-25 11:46 554240 ----a-w- c:\windows\system32\msvcp80.dll
2010-12-25 11:46 . 2010-12-25 11:46 34048 ----a-w- c:\windows\system32\eEmpty.exe
2010-12-25 11:46 . 2010-12-25 11:46 -------- d-----w- c:\program files\Common Files\MicroWorld
2010-12-25 11:46 . 2010-12-25 11:46 -------- d-----w- c:\programdata\MicroWorld
2010-12-25 11:34 . 2010-12-25 11:42 -------- d-----w- c:\users\Mihajko\AppData\Roaming\Download Manager
2010-12-17 20:23 . 2010-12-17 20:23 -------- d-----w- c:\program files\QuickTime
2010-12-17 20:23 . 2010-12-17 20:23 -------- d-----w- c:\programdata\Apple Computer
2010-12-13 16:31 . 2010-12-13 16:31 -------- d-----w- c:\programdata\Codemasters
2010-12-13 16:25 . 2010-03-01 19:51 17686528 ----a-w- c:\windows\system32\mkl_blueripple.dll
2010-12-13 16:25 . 2010-07-28 18:10 1380352 ----a-w- c:\windows\system32\rapture3d_oal.dll
2010-12-13 16:25 . 2010-12-13 16:26 -------- d-----w- c:\program files\BRS
2010-12-13 16:25 . 2010-12-13 16:25 445016 ----a-w- c:\windows\system32\wrap_oal.dll
2010-12-13 16:25 . 2010-12-13 16:25 109144 ----a-w- c:\windows\system32\OpenAL32.dll
2010-12-13 16:25 . 2010-12-13 16:25 -------- d-----w- c:\program files\OpenAL
2010-12-13 16:12 . 2010-12-13 16:12 -------- d-----w- c:\program files\Codemasters

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-02 19:17 . 2010-12-02 19:17 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-11-29 16:38 . 2010-11-29 16:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 16:38 . 2010-11-29 16:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-10-20 19:08 . 2010-10-20 19:08 319456 ----a-w- c:\windows\DIFxAPI.dll
2010-10-20 19:08 . 2010-10-20 19:08 315392 ----a-w- c:\windows\HideWin.exe
2010-10-19 10:41 . 2010-10-31 12:26 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-10-18 08:41 . 2010-10-31 12:26 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{898F4636-CB78-4C41-854E-5421CE1623F0}\mpengine.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-04-05 1233920]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-12-03 14944136]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-10-20 160328]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"Just Gestures"="c:\program files\Just\Just Gestures\JustGestures.exe" [2010-12-12 1846784]
"ICQ"="c:\program files\ICQ7.2\ICQ.exe" [2011-01-05 133432]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-08-12 2215064]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-08-25 98304]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-03-04 311296]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"TNOD UP"="c:\program files\TNod User & Password Finder\TNODUP.exe" [2010-04-01 1811968]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

c:\users\Mihajko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Automatick‚ vypnutˇ poźˇtaźe.lnk - c:\program files\Automatick‚ vypnutˇ poźˇtaźe\avp.exe [2004-12-28 443392]
GameRanger.lnk - c:\users\Mihajko\AppData\Roaming\GameRanger\GameRanger\GameRanger.exe [2010-12-10 1248992]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2007-03-23 11:04 4423680 ----a-w- c:\windows\RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-4032584465-1687109830-3115521887-1000]
"EnableNotificationsRef"=dword:00000001

R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
R3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\Belkin\F5D7000v8\jswpsapi.exe [2007-10-29 352338]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-12-02 691696]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2010-07-29 115008]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-08-26 176128]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2010-07-29 136632]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2010-08-12 810144]
S2 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2010-07-29 41336]
S2 SmileyCentral_1vService;SmileyCentral Service;c:\progra~1\SMILEY~2\bar\1.bin\1vbarsvc.exe [2010-12-31 28766]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-07-06 173352]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-08-26 6380032]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-08-26 221696]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdLH3.sys [2010-07-15 99344]
S3 JSWSCIMD;jswscimd Service;c:\windows\system32\DRIVERS\jswscimd.sys [2007-08-28 57344]

.
Contents of the 'Scheduled Tasks' folder

2011-01-07 c:\windows\Tasks\User_Feed_Synchronization-{97927A6F-48F8-4A65-99E0-8274E3293CB4}.job
- c:\windows\system32\msfeedssync.exe [2008-04-05 17:15]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://start.icq.com/
IE: E&xportovať do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Nástrojová lišta RoboFormu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Prispôsobiť menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Uložiť formulár - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: Vyplniť formulár - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
FF - ProfilePath - c:\users\Mihajko\AppData\Roaming\Mozilla\Firefox\Profiles\9acotge5.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: 1-Click YouTube Video Downloader: YoutubeDownloader@PeterOlayev.com - %profile%\extensions\YoutubeDownloader@PeterOlayev.com
FF - Ext: Forecastbar Enhanced: {3CE993BF-A3D9-4fd2-B3B6-768CBBC337F8} - %profile%\extensions\{3CE993BF-A3D9-4fd2-B3B6-768CBBC337F8}
FF - Ext: Download Statusbar: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} - %profile%\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
FF - Ext: DAEMON Tools Toolbar: DTToolbar@toolbarnet.com - %profile%\extensions\DTToolbar@toolbarnet.com
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-08 18:24
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2011-01-08 18:26:08
ComboFix-quarantined-files.txt 2011-01-08 17:26
ComboFix2.txt 2011-01-08 15:51

Pre-Run: 5 937 344 512
Post-Run: 5 912 125 440

- - End Of File - - 736D41BBA386B84C943F287B7B92F12B

[Rudy]

Log již vypadá čistý. Máte cracklý NOD, ve vlastním zájmu ho odinstalujte a použijte nějakou free verzi antiviru.

[martybx]

zdravim, i moje kamaradka ma stejny problem s facebookem.
Vkladam log z combofixu a prosim o jeho kontrolu..
dekuji
marty

ComboFix 11-01-07.02 - Martin 08.01.2011 18:59:12.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.420.1029.18.1014.570 [GMT 1:00]
Spuštěný z: d:\z netu\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\nvsvc32.exe
c:\windows\system32\Desktop_.ini

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-12-08 do 2011-01-08 )))))))))))))))))))))))))))))))
.

2011-01-04 06:51 . 2011-01-04 06:51 -------- d-----w- c:\program files\Common Files\Skype
2010-12-29 11:00 . 2010-12-29 11:01 -------- d-----w- c:\program files\IrfanView

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 20:51 . 2010-07-18 19:20 222080 ------w- c:\windows\system32\MpSigStub.exe
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-07-18 39408]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-12-03 14944136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-11-11 1236992]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 16248320]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 53248]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]

c:\documents and settings\Martin\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer_Service.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [18.7.2010 20:08 135664]
S3 adusbmdm6501;AnyDATA CDMA USB Modem Driver (PID 6501);c:\windows\system32\drivers\adusbmdm65.sys [15.10.2010 9:15 65408]
S3 adusbser6501;AnyDATA CDMA USB Serial Port (PID 6501);c:\windows\system32\drivers\adusbser65.sys [15.10.2010 9:08 64896]
.
Obsah adresáře 'Naplánované úlohy'

2011-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-18 19:08]

2011-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-18 19:08]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Settings,ProxyOverride = *.local
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-08 19:05
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(776)
c:\windows\System32\BCMLogon.dll
.
Celkový čas: 2011-01-08 19:08:25
ComboFix-quarantined-files.txt 2011-01-08 18:08

Před spuštěním: Volných bajtů: 10 714 812 416
Po spuštění: Volných bajtů: 11 086 917 632

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - D5FBA5F9EEF29939C7F89885FFD0E077

[Rudy]

2martybx: Založte si, prosím, vlastní topic. Děkujeme.

[martybx]

omlouvam se, nove vlakno jsem jiz zalozil.
dekuji za upozorneni.

[Rudy]

omlouvam se, nove vlakno jsem jiz zalozil.
dekuji za upozorneni.

OK, omluva se přijímá.