Trojský kůň (Vyřešeno)

83.Pepas · Příspěvekod **83.Pepas** » 18 led 2008 21:09

Ahod lidičky.. nedávno mi do pc namontovali novej HDD,kvůli rozbití starýho..
Dnes jsem instaloval všechen software atd.. (bez netu).. Po instalaci Comoda a Avasta jsem internet zapojil a za nějakou dobu mi Avast vyskočil že objevil trojana.. Dám smazat,ale po novym startu pc je tam zas a Avast zase řve "trojskej kůň.." Jsem z toho hotovej... Pc se mi nějak divně zamrzne bo co.. Jde vše dělat, ale některý prográmky se nespustí (třeba malování).. ne že bych ho potřeboval,ale neni dobrej pocit když vám v autě nefunguje airbag u spolujezdce...

No.. každopádně když chci dát restart ojbjeví se obrazovka vypínání a dál nic.. Ani po 30 minutách se to nevypne... Musim růčo strůčo..
Pls.. help

Reklama

83.Pepas · Příspěvekod **83.Pepas** » 18 led 2008 21:40

Ještě dodam že při testu Avastem žádnej Trojan nalezenej neni....
A všiml jsem si že pokaždý když vyskočí to okno Avastu je trojskej kůň pokaždý jinej soubor.

Příspěvekod **fredik** » 18 led 2008 22:24

Vlož sem pro začátek log z HJT.

83.Pepas · Příspěvekod **83.Pepas** » 18 led 2008 22:26

Tady to máš šéfe..

Logfile of HijackThis v1.99.1
Scan saved at 22:26:17, on 18.1.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\QIP\qip.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Pepas\Dokumenty\!!Používané složky!!\Ccleaner,Spybot,Ad Adware\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {8CD034DD-E9AD-47D3-8689-51886345799C} - C:\WINDOWS\system32\vturpqn.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [upm] C:\Documents and Settings\Pepas\Plocha\UPM\upm.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{FB2B9F1C-8901-495E-AD30-CD342178D641}: NameServer = 10.10.10.10,10.10.11.11
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: vturpqn - C:\WINDOWS\SYSTEM32\vturpqn.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

83.Pepas · Příspěvekod **83.Pepas** » 18 led 2008 22:44

Před chvilkou ase Avast řádil...
Přikládam obrázek.. to je už za tenhle běh pc po druhý.

Baron Prášil · Příspěvekod **Baron Prášil** » 18 led 2008 22:45

použij vundofix podle návodu http://www.viry.cz/forum/viewtopic.php?t=16634
a po něm COMBOFIX
Stáhni si ComboFix (by sUBs) a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem klávesy 1
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log, který se ti zobrazí, jinak ho najdeš zde: C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah+nový log z HJT

//sorry,frediku,já se neudržel :smile:

83.Pepas · Příspěvekod **83.Pepas** » 18 led 2008 22:59

Tak ten první (Vundofix) nic nenašel...
Tady je log z Combofixu..

"Pepas" - 2008-01-18 22:55:03 - ComboFix 07-07-13.8 - Service Pack 2 NTFS

((((((((((((((((((((((((( Files Created from 2007-12-18 to 2008-01-18 )))))))))))))))))))))))))))))))

2008-01-18 22:54 51,200 --a------ C:\WINDOWS\nircmd.exe
2008-01-18 22:52 <DIR> d-------- C:\VundoFix Backups
2008-01-18 21:31 <DIR> d-------- C:\Program Files\RegScrubXP
2008-01-18 21:28 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\Lavasoft
2008-01-18 18:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\ATI
2008-01-18 18:04 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe
2008-01-18 18:04 <DIR> d-------- C:\Program Files\ATI Technologies
2008-01-18 17:38 88 -r-hs---- C:\WINDOWS\system32\62A8054C17.sys
2008-01-18 17:38 2,516 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2008-01-18 17:38 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\Corel
2008-01-18 17:38 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\Corel
2008-01-18 17:37 <DIR> d-------- C:\Program Files\Common Files\Corel
2008-01-18 17:33 <DIR> d-------- C:\Program Files\Corel
2008-01-18 17:33 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\InstallShield
2008-01-18 16:58 <DIR> d-------- C:\Program Files\QIP
2008-01-18 16:53 <DIR> d-------- C:\Program Files\WinASO
2008-01-18 16:50 <DIR> d-------- C:\Program Files\GoldWave
2008-01-18 16:50 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\Help
2008-01-18 16:37 <DIR> d-------- C:\Program Files\UltraISO
2008-01-18 16:37 <DIR> d-------- C:\Program Files\Common Files\EZB Systems
2008-01-18 16:17 <DIR> d--h----- C:\WINDOWS\Icons
2008-01-18 15:18 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2008-01-18 15:16 <DIR> d-------- C:\WINDOWS\system32\cs-cz
2008-01-18 15:16 <DIR> d-------- C:\Program Files\MSBuild
2008-01-18 15:16 <DIR> d-------- C:\Program Files\Microsoft Works
2008-01-18 15:15 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-01-18 15:14 <DIR> d-------- C:\WINDOWS\network diagnostic
2008-01-18 15:14 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-01-18 15:13 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-01-18 15:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\Microsoft Help
2008-01-18 15:08 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-01-18 15:04 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\ATI
2008-01-18 14:56 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-01-18 14:50 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-01-18 14:44 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\DAEMON Tools
2008-01-18 14:43 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-01-18 14:41 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-01-18 14:38 37,888 --a------ C:\WINDOWS\system32\vturpqn.dll
2008-01-18 14:38 37,888 --a------ C:\WINDOWS\system32\efcdaxv.dll
2008-01-18 14:34 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-01-18 14:34 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2008-01-18 14:32 1,167 --a------ C:\WINDOWS\mozver.dat
2008-01-18 14:16 0 --a------ C:\WINDOWS\nsreg.dat
2008-01-18 14:16 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\Talkback
2008-01-18 14:10 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2008-01-17 21:55 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\Comodo
2008-01-17 21:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\Comodo
2008-01-17 21:52 <DIR> d-------- C:\Program Files\Comodo
2008-01-17 21:32 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\Ahead
2008-01-17 21:32 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\Ahead
2008-01-17 21:30 <DIR> d-------- C:\WINDOWS\RegisteredPackages
2008-01-17 21:22 545 --a------ C:\WINDOWS\UC.PIF
2008-01-17 21:22 545 --a------ C:\WINDOWS\RAR.PIF
2008-01-17 21:22 545 --a------ C:\WINDOWS\PKZIP.PIF
2008-01-17 21:22 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2008-01-17 21:22 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2008-01-17 21:22 545 --a------ C:\WINDOWS\LHA.PIF
2008-01-17 21:22 545 --a------ C:\WINDOWS\ARJ.PIF
2008-01-17 21:22 <DIR> d-------- C:\totalcmd
2008-01-17 21:17 29,704 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-01-17 21:17 <DIR> d-------- C:\Program Files\TuneUp Utilities 2007
2008-01-17 21:17 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\TuneUp Software
2008-01-17 21:16 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-01-17 21:16 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-01-17 21:16 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-01-17 21:16 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-01-17 21:16 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2008-01-17 21:16 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-01-17 21:16 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2008-01-17 21:16 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-01-17 21:16 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-01-17 21:16 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-01-17 21:16 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-17 21:16 <DIR> d-------- C:\Program Files\Alwil Software
2008-01-17 21:16 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\TuneUp Software
2008-01-17 21:15 138,624 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2008-01-17 21:15 <DIR> d-------- C:\Program Files\Spyware Terminator
2008-01-17 21:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\Spyware Terminator
2008-01-17 21:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\Spybot - Search & Destroy
2008-01-17 21:14 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-17 21:14 <DIR> d-------- C:\Program Files\IObit
2008-01-17 21:13 <DIR> d-------- C:\Program Files\CCleaner
2008-01-17 21:13 <DIR> d-------- C:\Games
2008-01-17 21:02 <DIR> d--hs---- C:\RECYCLER
2008-01-17 20:57 208,896 --------- C:\WINDOWS\system32\nvuide.exe
2008-01-17 20:57 <DIR> d-------- C:\WINDOWS\system32\Lang
2008-01-17 20:55 9,709,568 -r------- C:\WINDOWS\RTLCPL.exe
2008-01-17 20:55 86,016 -r------- C:\WINDOWS\SoundMan.exe
2008-01-17 20:55 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2008-01-17 20:55 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2008-01-17 20:55 69,632 -r------- C:\WINDOWS\Alcmtr.exe
2008-01-17 20:55 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2008-01-17 20:55 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2008-01-17 20:55 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2008-01-17 20:55 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2008-01-17 20:55 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2008-01-17 20:55 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2008-01-17 20:55 499,712 -r------- C:\WINDOWS\RtlExUpd.dll
2008-01-17 20:55 49,152 -r------- C:\WINDOWS\system32\ChCfg.exe
2008-01-17 20:55 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2008-01-18 15:19:22 68,916 ----a-w C:\WINDOWS\system32\perfc005.dat
2008-01-18 15:19:22 389,938 ----a-w C:\WINDOWS\system32\perfh005.dat
2007-12-21 03:08:18 272,384 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-12-21 02:47:35 3,120,640 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-12-21 02:36:04 1,661,696 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-12-21 02:11:47 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-11-27 19:34:14 160,289 ----a-w C:\WINDOWS\system32\atiicdxx.dat
2007-11-07 09:29:19 720,896 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:44:31 1,290,240 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-20 05:01:32 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
2006-10-27 00:48 2210608 --a------ C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8CD034DD-E9AD-47D3-8689-51886345799C}]
2008-01-18 14:38 37888 --a------ C:\WINDOWS\system32\vturpqn.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 03:04 C:\WINDOWS\SkyTel.exe]
"Alcmtr"="ALCMTR.EXE" [2005-05-03 03:43 C:\WINDOWS\Alcmtr.exe]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-01-18 14:28]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2008-01-17 21:52]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35]
"UserFaultCheck"="%systemroot%\system32\dumprep 0 -u" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-18 13:00]
"upm"="C:\Documents and Settings\Pepas\Plocha\UPM\upm.exe" [2007-11-06 18:22]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{8CD034DD-E9AD-47D3-8689-51886345799C}"="C:\WINDOWS\system32\vturpqn.dll" [2008-01-18 14:38]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [2006-10-27 00:48]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vturpqn]
vturpqn.dll --a------ 2008-01-18 14:38 37888 C:\WINDOWS\system32\vturpqn.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"InCD"=C:\Program Files\Nero\Nero 7\InCD\InCD.exe
"SecurDisc"=C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
"RTHDCPL"=RTHDCPL.EXE
"ATICustomerCare"="C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe"
"Corel Photo Downloader"="C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs
UxTuneUp

Contents of the 'Scheduled Tasks' folder
2008-01-18 16:15:41 C:\WINDOWS\tasks\1-Click Maintenance.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-18 22:55:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2008-01-18 22:56:09

--- E O F ---

A tady z HijackThisu

Logfile of HijackThis v1.99.1
Scan saved at 22:58:59, on 18.1.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\Pepas\Dokumenty\!!Používané složky!!\Ccleaner,Spybot,Ad Adware\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {8CD034DD-E9AD-47D3-8689-51886345799C} - C:\WINDOWS\system32\vturpqn.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [upm] C:\Documents and Settings\Pepas\Plocha\UPM\upm.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{FB2B9F1C-8901-495E-AD30-CD342178D641}: NameServer = 10.10.10.10,10.10.11.11
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: vturpqn - C:\WINDOWS\SYSTEM32\vturpqn.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe[/b]

83.Pepas · Příspěvekod **83.Pepas** » 18 led 2008 23:37

Že by neřešitelný problémek ?? :lol:

No.. řešení půlpalcovýho Desert Eagle mi připadá jako blbost. To je jak jít s bazukou na mouchu... sestřelíte jí, ale vše kolem taky.

Baron Prášil · Příspěvekod **Baron Prášil** » 18 led 2008 23:44

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok)
Zkopíruj do něj následující text označený zeleně:

Kód: Vybrat vše

File::
C:\WINDOWS\system32\vturpqn.dll 
C:\WINDOWS\system32\efcdaxv.dll 

Registry:: 
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8CD034DD-E9AD-47D3-8689-51886345799C}] 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{8CD034DD-E9AD-47D3-8689-51886345799C}"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vturpqn]

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť
Obrázek

- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu+novej log z hijackthis

83.Pepas · Příspěvekod **83.Pepas** » 18 led 2008 23:57

O.K šéfe..
tady je ten Combofix:

"Pepas" - 2008-01-18 23:50:25 - ComboFix 07-07-13.8 - Service Pack 2 NTFS
Command switches used :: C:\Documents and Settings\Pepas\Plocha\CFScript.txt

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\efcdaxv.dll
C:\WINDOWS\system32\vturpqn.dll

((((((((((((((((((((((((( Files Created from 2007-12-18 to 2008-01-18 )))))))))))))))))))))))))))))))

2008-01-18 22:54 51,200 --a------ C:\WINDOWS\nircmd.exe
2008-01-18 22:52 <DIR> d-------- C:\VundoFix Backups
2008-01-18 21:31 <DIR> d-------- C:\Program Files\RegScrubXP
2008-01-18 21:28 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\Lavasoft
2008-01-18 18:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\ATI
2008-01-18 18:04 593,920 --a------ C:\WINDOWS\system32\ati2sgag.exe
2008-01-18 18:04 <DIR> d-------- C:\Program Files\ATI Technologies
2008-01-18 17:38 88 -rahs---- C:\WINDOWS\system32\62A8054C17.sys
2008-01-18 17:38 2,516 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2008-01-18 17:38 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\Corel
2008-01-18 17:38 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\Corel
2008-01-18 17:37 <DIR> d-------- C:\Program Files\Common Files\Corel
2008-01-18 17:33 <DIR> d-------- C:\Program Files\Corel
2008-01-18 17:33 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\InstallShield
2008-01-18 16:58 <DIR> d-------- C:\Program Files\QIP
2008-01-18 16:53 <DIR> d-------- C:\Program Files\WinASO
2008-01-18 16:50 <DIR> d-------- C:\Program Files\GoldWave
2008-01-18 16:50 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\Help
2008-01-18 16:37 <DIR> d-------- C:\Program Files\UltraISO
2008-01-18 16:37 <DIR> d-------- C:\Program Files\Common Files\EZB Systems
2008-01-18 16:17 <DIR> d--h----- C:\WINDOWS\Icons
2008-01-18 15:18 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2008-01-18 15:16 <DIR> d-------- C:\WINDOWS\system32\cs-cz
2008-01-18 15:16 <DIR> d-------- C:\Program Files\MSBuild
2008-01-18 15:16 <DIR> d-------- C:\Program Files\Microsoft Works
2008-01-18 15:15 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-01-18 15:14 <DIR> d-------- C:\WINDOWS\network diagnostic
2008-01-18 15:14 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-01-18 15:13 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-01-18 15:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\Microsoft Help
2008-01-18 15:08 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-01-18 15:04 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\ATI
2008-01-18 14:56 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-01-18 14:50 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-01-18 14:44 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\DAEMON Tools
2008-01-18 14:43 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-01-18 14:41 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-01-18 14:34 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-01-18 14:34 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2008-01-18 14:32 1,167 --a------ C:\WINDOWS\mozver.dat
2008-01-18 14:16 0 --a------ C:\WINDOWS\nsreg.dat
2008-01-18 14:16 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\Talkback
2008-01-18 14:10 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2008-01-17 21:55 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\Comodo
2008-01-17 21:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\Comodo
2008-01-17 21:52 <DIR> d-------- C:\Program Files\Comodo
2008-01-17 21:32 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\Ahead
2008-01-17 21:32 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\Ahead
2008-01-17 21:30 <DIR> d-------- C:\WINDOWS\RegisteredPackages
2008-01-17 21:22 545 --a------ C:\WINDOWS\UC.PIF
2008-01-17 21:22 545 --a------ C:\WINDOWS\RAR.PIF
2008-01-17 21:22 545 --a------ C:\WINDOWS\PKZIP.PIF
2008-01-17 21:22 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2008-01-17 21:22 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2008-01-17 21:22 545 --a------ C:\WINDOWS\LHA.PIF
2008-01-17 21:22 545 --a------ C:\WINDOWS\ARJ.PIF
2008-01-17 21:22 <DIR> d-------- C:\totalcmd
2008-01-17 21:17 29,704 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-01-17 21:17 <DIR> d-------- C:\Program Files\TuneUp Utilities 2007
2008-01-17 21:17 <DIR> d-------- C:\DOCUME~1\Pepas\DATAAP~1\TuneUp Software
2008-01-17 21:16 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-01-17 21:16 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-01-17 21:16 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-01-17 21:16 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-01-17 21:16 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2008-01-17 21:16 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-01-17 21:16 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2008-01-17 21:16 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-01-17 21:16 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-01-17 21:16 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-01-17 21:16 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-17 21:16 <DIR> d-------- C:\Program Files\Alwil Software
2008-01-17 21:16 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\TuneUp Software
2008-01-17 21:15 138,624 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2008-01-17 21:15 <DIR> d-------- C:\Program Files\Spyware Terminator
2008-01-17 21:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\Spyware Terminator
2008-01-17 21:15 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DATAAP~1\Spybot - Search & Destroy
2008-01-17 21:14 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-17 21:14 <DIR> d-------- C:\Program Files\IObit
2008-01-17 21:13 <DIR> d-------- C:\Program Files\CCleaner
2008-01-17 21:13 <DIR> d-------- C:\Games
2008-01-17 21:02 <DIR> d--hs---- C:\RECYCLER
2008-01-17 20:57 208,896 --a------ C:\WINDOWS\system32\nvuide.exe
2008-01-17 20:57 <DIR> d-------- C:\WINDOWS\system32\Lang
2008-01-17 20:55 9,709,568 -r------- C:\WINDOWS\RTLCPL.exe
2008-01-17 20:55 86,016 -r------- C:\WINDOWS\SoundMan.exe
2008-01-17 20:55 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2008-01-17 20:55 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2008-01-17 20:55 69,632 -r------- C:\WINDOWS\Alcmtr.exe
2008-01-17 20:55 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2008-01-17 20:55 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2008-01-17 20:55 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2008-01-17 20:55 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2008-01-17 20:55 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2008-01-17 20:55 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2008-01-17 20:55 499,712 -r------- C:\WINDOWS\RtlExUpd.dll
2008-01-17 20:55 49,152 -ra------ C:\WINDOWS\system32\ChCfg.exe
2008-01-17 20:55 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys
2008-01-17 20:55 4,394,496 -ra------ C:\WINDOWS\system32\drivers\RtkHDAud.Sys
2008-01-17 20:55 4,096 --a------ C:\WINDOWS\system32\ksuser.dll

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2008-01-18 15:19:22 68,916 ----a-w C:\WINDOWS\system32\perfc005.dat
2008-01-18 15:19:22 389,938 ----a-w C:\WINDOWS\system32\perfh005.dat
2007-12-21 03:08:18 272,384 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-12-21 02:47:35 3,120,640 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-12-21 02:36:04 1,661,696 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-12-21 02:11:47 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-11-27 19:34:14 160,289 ----a-w C:\WINDOWS\system32\atiicdxx.dat
2007-11-07 09:29:19 720,896 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:44:31 1,290,240 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-20 05:01:32 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
2006-10-27 00:48 2210608 --a------ C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 03:04 C:\WINDOWS\SkyTel.exe]
"Alcmtr"="ALCMTR.EXE" [2005-05-03 03:43 C:\WINDOWS\Alcmtr.exe]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-01-18 14:28]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]
"COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2008-01-17 21:52]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-18 13:00]
"upm"="C:\Documents and Settings\Pepas\Plocha\UPM\upm.exe" [2007-11-06 18:22]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [2006-10-27 00:48]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vturpqn]
vturpqn.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"InCD"=C:\Program Files\Nero\Nero 7\InCD\InCD.exe
"SecurDisc"=C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
"RTHDCPL"=RTHDCPL.EXE
"ATICustomerCare"="C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe"
"Corel Photo Downloader"="C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs
UxTuneUp

Contents of the 'Scheduled Tasks' folder
2008-01-18 16:15:41 C:\WINDOWS\tasks\1-Click Maintenance.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-18 23:53:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2008-01-18 23:54:57 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2008-01-18 23:54
C:\ComboFix2.txt ... 2008-01-18 22:56

--- E O F ---

A Tady HijackThis:

Logfile of HijackThis v1.99.1
Scan saved at 23:57:11, on 18.1.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\QIP\qip.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Pepas\Dokumenty\!!Používané složky!!\Ccleaner,Spybot,Ad Adware\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [upm] C:\Documents and Settings\Pepas\Plocha\UPM\upm.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{FB2B9F1C-8901-495E-AD30-CD342178D641}: NameServer = 10.10.10.10,10.10.11.11
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: vturpqn - vturpqn.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

Baron Prášil · Příspěvekod **Baron Prášil** » 19 led 2008 00:01

podle logu by to mělo bejt v pořádku.

ještě fixni
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O20 - Winlogon Notify: vturpqn - vturpqn.dll (file missing)

83.Pepas · Příspěvekod **83.Pepas** » 19 led 2008 00:08

Tak hotovo... kdyby byli zas problémy tak napíšu.
Prosimtě nevíš jak se dá proti těmhle problémum nějak chránit ??
Jinak diky moc za vše... i tobě Frediku

Trojský kůň (Vyřešeno) Vyřešeno

Trojský kůň (Vyřešeno) Vyřešeno

Kdo je online