security tool

[Tomhino]

Dobrý den prosím o pomoc nak se mo dostal do počítače vir security tool.. a nic mi nejde nevím co dělat prosím o pomoc

[Unlimited_Killer]

Dostanete se do Nouzového režimu?

[Tomhino]

Co je to nouzový reřim ?

[Tomhino]

Nevidím ani ikonky na ploše

[Unlimited_Killer]

Restartujte PC, před nabíháním loga mačkejte F8 - poté v nabídce vyberte Nouzový režim s prací síti. V něm udělejte následující krok.

1) ComboFix

• Stáhněte a uložte na Plochu ComboFix.
• Ještě před spuštěním vypněte rezidentní štít antiviru, či antispywaru.
• Spusťte ho s administrátorským oprávněním.
• Po spuštění se Vám zobrazí licenční podmínky, klikněte na 'Ano'.
• Budete také dotázáni na instalaci konzole pro zotavení, taktéž klikněte na 'Ano'.
• Celý sken bude trvat tak 5-10 minut, v závislosti na tom, kolika soubory se bude CF prodírat.
• Váš PC bude pravděpodobně restartován, tak se toho nelekněte.
• Než úplně skončí sken, nic nedělejte, hlavně neklikejte do spuštěného okna s ComboFixem.
• Po skončení skenu (či následném restartu) na Vás 'vypadne' log, který vkopírujete ve formě textu sem.
• Pokud žádný log 'nevypadne', naleznete jej v umístění C:\ComboFix.txt

[Tomhino]

je mi to trapné ale jak vipnu ty štítky prosím ?

[Unlimited_Killer]

Neřešte to, tento krok přeskočte.

[Tomhino]

dobře už se to skanuje je tam připojuji se k download.microsoft.cz a je to na 100procent a nic to nedela

[Unlimited_Killer]

Tak vyčkejte.

[Tomhino]

ComboFix 10-03-13.01 - admin 13.03.2010 21:07:54.1.1 - x86 NETWORK
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1023.681 [GMT 1:00]
Spuštěný z: c:\documents and settings\admin\Dokumenty\Downloads\ComboFix.exe
AV: avast! antivirus 4.7.892 [VPS 100313-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\admin\LOCALS~1\Temp\install_flash_player.exe
c:\documents and settings\admin\Plocha\Security Tool.lnk
c:\documents and settings\All Users\Data aplikací\02297626
c:\documents and settings\All Users\Data aplikací\02297626\02297626.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-02-13 do 2010-03-13 )))))))))))))))))))))))))))))))
.

2010-03-09 15:33 . 2010-03-09 15:33 -------- d-----w- c:\program files\Winamp Detect
2010-03-09 15:33 . 2010-03-09 15:33 -------- d-----w- c:\program files\Winamp Toolbar
2010-02-28 07:38 . 2010-02-28 07:38 -------- d-----w- c:\program files\AskBarDis
2010-02-28 07:38 . 2010-02-28 07:38 -------- d-----w- c:\program files\FlashFXP
2010-02-28 07:22 . 2010-03-13 06:43 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-02-27 14:26 . 2010-02-27 14:26 -------- d-----w- c:\program files\RadioBar
2010-02-19 15:41 . 2010-02-19 15:41 -------- d-----w- c:\windows\Sun
2010-02-19 15:41 . 2010-02-19 15:41 -------- d-----w- c:\program files\Common Files\Java
2010-02-19 15:40 . 2010-02-19 15:40 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-19 15:40 . 2010-02-19 15:40 -------- d-----w- c:\program files\Java
2010-02-13 15:32 . 2010-02-13 17:53 -------- d-s---w- c:\program files\HLSW
2010-02-13 13:58 . 2010-02-13 13:58 -------- d-----w- c:\program files\Sony Ericsson

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-13 18:20 . 2009-08-10 14:02 -------- d-----w- c:\program files\Counter-Strike Source
2010-03-13 10:21 . 2009-06-17 19:44 -------- d-----w- c:\program files\Valve
2010-03-13 08:39 . 2009-05-26 13:36 -------- d-----w- c:\program files\Winamp
2010-03-13 07:53 . 2009-07-19 10:12 -------- d-----w- c:\program files\spořič CHEMICUS
2010-03-06 08:18 . 2006-11-27 07:27 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-07 12:43 . 2010-02-07 12:42 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2010-02-07 12:43 . 2010-02-07 12:41 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-02-07 12:42 . 2010-02-07 12:42 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-02-03 16:24 . 2009-04-23 14:25 -------- d-----w- c:\program files\Google
2010-01-29 20:55 . 2010-01-29 20:55 -------- d-----w- c:\program files\Ventrilo
2010-01-29 20:54 . 2006-12-03 16:40 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-01-21 20:12 . 2010-01-21 20:12 -------- d-----w- c:\program files\Aspyr Media, Inc
2009-12-31 16:14 . 2004-08-18 12:00 352640 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-29 10:43 . 2009-12-29 10:43 1504768 ----a-w- C:\Texas Hold'em Poker.exe
2009-12-23 21:09 . 2007-12-18 10:01 62056 ----a-w- C:\Uninstall_mod.exe
2009-12-21 19:08 . 2004-08-18 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-17 08:00 . 2006-11-14 11:29 343552 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:37 . 2004-08-18 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-11-03 18:33 . 2007-04-09 13:32 7424 ----a-w- c:\program files\arena.rec
2009-11-03 18:33 . 2007-04-09 13:32 2148 ----a-w- c:\program files\weapon.rec
2009-11-03 18:33 . 2007-04-09 13:32 19764 ----a-w- c:\program files\player.rec
2009-11-03 18:33 . 2007-04-09 13:32 18 ----a-w- c:\program files\keyboard.rec
2009-11-03 18:33 . 2007-04-09 13:32 32 ----a-w- c:\program files\states.rec
2009-11-03 18:31 . 2007-04-09 12:57 0 ----a-w- c:\program files\paintball.log
2009-08-10 14:01 . 2009-08-10 14:01 501 ----a-w- c:\program files\Language Changer.lnk
2009-08-10 14:01 . 2009-08-10 14:01 341 ----a-w- c:\program files\Autoupdater.lnk
2002-06-05 18:30 . 2007-03-03 17:05 659456 ----a-w- c:\program files\Paintball.exe
2002-03-27 02:03 . 2007-03-03 17:05 10100169 ----a-w- c:\program files\Bitmaps.dat
2002-03-27 01:42 . 2007-03-03 17:05 17417421 ----a-w- c:\program files\Sound.dat
2002-03-27 01:41 . 2007-03-03 17:05 6143805 ----a-w- c:\program files\Graphics.dat
2002-03-27 01:40 . 2007-03-03 17:05 2545343 ----a-w- c:\program files\Menu.dat
2002-03-12 02:06 . 2007-08-27 10:29 3169936 ------w- c:\program files\E.msi
2001-05-19 11:08 . 2007-04-11 11:37 1953792 ----a-w- c:\program files\GPe.exe
2001-03-02 00:40 . 2007-12-21 15:29 2190 ----a-w- c:\program files\Readme.txt
2001-03-02 00:16 . 2007-12-21 15:29 1533 ----a-w- c:\program files\License.txt
2001-03-02 00:08 . 2007-12-21 15:29 363520 ----a-w- c:\program files\SponsorAds.exe
2000-12-19 10:43 . 2007-03-03 17:05 176128 ----a-w- c:\program files\direct3d.dll
2000-11-28 01:20 . 2007-03-03 17:05 536943 ----a-w- c:\program files\MENUFX.DAT
2000-11-26 15:02 . 2007-03-03 17:05 1912 ----a-w- c:\program files\resource.dat
2000-08-02 15:01 . 2007-04-11 11:37 155648 ----a-w- c:\program files\IFC21.dll
1998-10-23 15:25 . 2007-04-11 11:37 57344 ----a-w- c:\program files\IFORCE2.DLL
2009-10-08 15:38 . 2009-10-08 15:38 1056 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2009-05-06 1262888]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2008-10-08 173368]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-08-13 16:47 308616 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5B291E6C-9A74-4034-971B-A4B007A0B315}]
2010-01-11 11:18 451808 ----a-w- c:\program files\RadioBar\toolbar.ni.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2008-10-08 10:22 1172792 ----a-w- c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-10-08 1172792]
"{5B291E6C-9A74-4034-971B-A4B007A0B315}"= "c:\program files\RadioBar\toolbar.ni.dll" [2010-01-11 451808]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-13 308616]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]

[HKEY_CLASSES_ROOT\clsid\{5b291e6c-9a74-4034-971b-a4b007a0b315}]
[HKEY_CLASSES_ROOT\Pugi.PugiObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{810FCC0F-2CA3-414a-B8C8-550910C8B664}]
[HKEY_CLASSES_ROOT\Pugi.PugiObj]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-10-08 1172792]
"{5B291E6C-9A74-4034-971B-A4B007A0B315}"= "c:\program files\RadioBar\toolbar.ni.dll" [2010-01-11 451808]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-13 308616]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]

[HKEY_CLASSES_ROOT\clsid\{5b291e6c-9a74-4034-971b-a4b007a0b315}]
[HKEY_CLASSES_ROOT\Pugi.PugiObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{810FCC0F-2CA3-414a-B8C8-550910C8B664}]
[HKEY_CLASSES_ROOT\Pugi.PugiObj]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2005-05-19 1957888]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-02 68856]
"Free Download Manager"="c:\program files\Free Download Manager\fdm.exe" [2009-01-31 3399727]
"Software Informer"="c:\program files\Software Informer\softinfo.exe" [2009-09-17 1933381]
"Steam"="c:\program files\Counter-Strike Source\Steam.exe" [2010-02-20 1217872]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-04-29 3338240]
"Google Update"="c:\documents and settings\admin\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2009-10-30 133104]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2009-10-09 25623336]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]
"Fraps"="c:\fraps\FRAPS.EXE" [2009-11-21 2234288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-04-15 77824]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"RTBatteryMeter"="c:\program files\VibrateGameDeviceDriver\RFPIcon.exe" [2003-01-16 49152]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-11-03 188416]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-04-30 180269]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-01 282624]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2009-04-26 111928]
"FileFort"="c:\program files\NCH Software\FileFort\filefort.exe" [2009-12-13 323588]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-18 15360]

c:\documents and settings\admin\Nabˇdka Start\Programy\Po spuçtŘnˇ\
hamachi.lnk - c:\program files\Hamachi\hamachi.exe [2009-5-1 625952]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Wireless Utility.lnk - c:\program files\EDIMAX\Common\RaUI.exe [2009-4-23 716800]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Boiling Point - Cesta do pekel\\XENUS.EXE"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Metin2_CZ\\metin2.bin"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Documents and Settings\\admin\\Plocha\\Samp srver\\samp-server.exe"=
"c:\\Program Files\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Valve\\hlds.exe"=
"c:\\Program Files\\newlongju\\metin2.bin"=
"c:\\Program Files\\Activision\\Quantum of Solace(TM)\\JB_LiveEngine_s.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Codemasters\\Operation Flashpoint\\FlashpointResistance.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0-enUS-downloader.exe"=
"c:\\Program Files\\Pawno editor\\server\\samp-server.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\HLServer\\hltv.exe"=
"c:\\Program Files\\FlashFXP\\FlashFXP.exe"=
"c:\\Program Files\\Metin2_CZ\\Metin2Mod.bin"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9281:TCP"= 9281:TCP:BitComet 9281 TCP
"9281:UDP"= 9281:UDP:BitComet 9281 UDP

R3 DynCal;Dynamic Calibration Service;c:\windows\system32\drivers\DynCal.sys [14.11.2003 2:46 8192]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [7.2.2010 13:42 691696]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [3.2.2010 17:24 135664]
S2 HamachiService;Hamachi Service;c:\program files\Hamachi\hamachi.exe [1.5.2009 17:43 625952]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [23.4.2009 15:05 222456]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [17.4.2007 19:09 11032]
S2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [25.6.2009 8:22 185640]
S3 AEXPAM;Philips SmartManage Service;c:\windows\system32\drivers\aexpamdrv.sys [20.12.2005 10:57 27008]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]
.
Obsah adresáře 'Naplánované úlohy'

2009-06-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-08-29 12:21]

2009-12-13 c:\windows\Tasks\classicftpSevenDaysInit.job
- c:\program files\NCH Software\ClassicFTP\classicftp.exe [2009-12-13 15:53]

2009-12-16 c:\windows\Tasks\classicftpShakeIcon.job
- c:\program files\NCH Software\ClassicFTP\classicftp.exe [2009-12-13 15:53]

2010-03-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-03 16:24]

2010-03-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-03 16:24]

2010-03-13 c:\windows\Tasks\User_Feed_Synchronization-{D9BD0F06-EF55-42D7-B388-801FFFD13693}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]

2009-12-13 c:\windows\Tasks\videopadSevenDaysInit.job
- c:\program files\NCH Software\VideoPad\videopad.exe [2009-12-13 15:46]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://radiobar.toolbarhome.com?hp=df
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Winamp Search - c:\documents and settings\All Users\Data aplikací\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Stáhnout Free Download Managerem - file://c:\program files\Free Download Manager\dllink.htm
IE: Stáhnout video Free Download Managerem - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Stáhnout vybrané Free Download Managerem - file://c:\program files\Free Download Manager\dlselected.htm
IE: Stáhnout vše Free Download Managerem - file://c:\program files\Free Download Manager\dlall.htm
IE: {{0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - {0E46D7B6-887D-4F81-B4CA-FCC92AF73610} - c:\program files\Seznam.cz\listicka.dll
Handler: toolbarchrome - {718733BC-AD64-4e5f-AC18-A85FBD75D54D} - c:\program files\RadioBar\toolbar.ni.dll
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKCU-Run-fsm - (no file)
HKCU-Run-ICQ - ~c:\program files\ICQ6.5\ICQ.exe
HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe
AddRemove-Counter-Strike: Source Texture Pack 1.00 - c:\program files\Counter-Strike Source\Uninstall.exe
AddRemove-F1 2000 - c:\program files\EA SPORTS\F1 2000\uninst.log
AddRemove-Flashpoint - c:\program files\Codemasters\UnInstall.exe
AddRemove-Santa on Steam Locomotive - c:\windows\PY_UNINSTAL.EXE SOFTWARE\PySoft\Santa_Locomotive
AddRemove-{0938795F-85C6-4C77-B2EB-5834B5B8DE19}_is1 - c:\jana\RTL Winter Games 2007\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-13 21:13
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1482476501-1606980848-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(616)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2010-03-13 21:16:03
ComboFix-quarantined-files.txt 2010-03-13 20:15

Před spuštěním: 3 119 529 984
Po spuštění: Volných bajtů: 12 793 749 504

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 9A936240C5F93CF51912E2E650D55157

[Tomhino]

mám zustat v nouzovém režimu ?

[Tomhino]

vadí že se mi nerestartoval počítač ?

[Tomhino]

Mužu odejít z nouzového režimu ?

[Unlimited_Killer]

Ano, vyčkejte na další pokyny.

[Unlimited_Killer]

Omlouvám se za zpoždění a pokračujeme. ↓

1) Skript do ComboFix-u

• Otevřete si Poznámkový blok [Start → Spustit → notepad → Enter].
• Do něj vkopírujte následující text:

  Kód: Vybrat vše

  KillAll::
  
  Folder::
  c:\program files\Winamp Toolbar
  c:\program files\AskBarDis
  c:\program files\RadioBar
  c:\program files\DAEMON Tools Toolbar
  c:\program files\SweetIM\Toolbars
  c:\program files\ICQ6Toolbar
  
  Registry::
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
  "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"=-
  "{EEE6C35D-6118-11DC-9C72-001320C79847}"=-
  [-HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
  [-HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
  [-HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
  [-HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]
  [-HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
  [-HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
  [-HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
  [-HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5B291E6C-9A74-4034-971B-A4B007A0B315}]
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  "{EEE6C35B-6118-11DC-9C72-001320C79847}"=-
  "{5B291E6C-9A74-4034-971B-A4B007A0B315}"=-
  "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"=-
  [-HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
  [-HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
  [-HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
  [-HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]
  [-HKEY_CLASSES_ROOT\clsid\{5b291e6c-9a74-4034-971b-a4b007a0b315}]
  [-HKEY_CLASSES_ROOT\Pugi.PugiObj.1]
  [-HKEY_CLASSES_ROOT\TypeLib\{810FCC0F-2CA3-414a-B8C8-550910C8B664}]
  [-HKEY_CLASSES_ROOT\Pugi.PugiObj]
  [-HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
  [-HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
  "{EEE6C35B-6118-11DC-9C72-001320C79847}"=-
  "{5B291E6C-9A74-4034-971B-A4B007A0B315}"=-
  "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"=-
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "swg"=-
  "Google Update"=-
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "TkBellExe"=-
  "QuickTime Task"=-
  "SunJavaUpdateSched"=-
  
  File::
  c:\windows\Tasks\AppleSoftwareUpdate.job
  c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
  c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
  
  Driver::
  ICQ Service
  
  Extra::
  
  DDS::
  uStart Page = hxxp://radiobar.toolbarhome.com?hp=df
  IE: &Winamp Search - c:\documents and settings\All Users\Data aplikací\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
  Handler: toolbarchrome - {718733BC-AD64-4e5f-AC18-A85FBD75D54D} - c:\program files\RadioBar\toolbar.ni.dll
  
  Reboot::

• Uložte tento soubor na Plochu pod jménem CFScript (koncovka .txt).
• Přetáhněte tento soubor nad ComboFix a pusťte ho.
• I tento soubor, i ComboFix musí být na Ploše!
  
• ComboFix se spustí a vykoná příkazy ze skriptu.
• Počítač bude pravděpodobně restartován.
• Po restartu na Vás vyskočí okno s logem, který mi vkopírujete sem ve formě textu.

2) VirusTotal

• Otestujte na VirusTotal soubory:

  Kód: Vybrat vše

  C:\Uninstall_mod.exe
  c:\program files\Software Informer\softinfo.exe
  c:\program files\NCH Software\FileFort\filefort.exe

• Jednoduše tam vkopírujete cesty, co jsem napsal do code.
• Jestliže Vám to napíše, že soubor byl již testován, nechte ho otestovat znovu.
• Poté sem vložíte linky (odkazy) na jednotlivé testy.