Zdravím, prosím o kontrolu logu z mého notebooku. Mám tyto potíže: Zapnu notebook, zapnu firefox, jsem půl hodiny na internetu, vypnu firefox červeným křížkem v pravémé horním rohu, zaklapnu notebook (přepne se do úsporného reežimu), za chvíli přijdu, otevřu notebook, chci otevřít firefox, ale po 20 sekundácéh vyskočí tabulka, že firefox už je spuštěn, že musím ukončit proces a poté mohu otevřít nové okno, notebook je dost pomalý, musím zapnout Správce úloh (1 minuta než naskočí), a vidím proces firefox 98 % vytížení, proces vypnu a notebook je už v pořádku.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:50:20, on 27.8.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Documents and Settings\Admin\Dokumenty\Stažené soubory\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://eu.ask.com?o=15003&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.10:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - AppInit_DLLs:
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
--
End of file - 4392 bytes
Malwarebytes' Anti-Malware bez nálezu.
Prosím o kontrolu logu
Prosím o kontrolu logu
Notebook: Acer Extensa 5230E
Re: Prosím o kontrolu logu
Ahoj,
Já bych řekla, že je to chyba firefoxu. Zkoušel jsi ho přeinstalovat?
Stáhni na plochu ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- Před použitím vypni všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary
-Zavři všechna aktivní okna a spusť ho pod učtem s právy administrátora
- Po spuštění se zobrazí podmínky použití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování, se vytvoří log C:\ComboFix.txt, zkopíruj celý jeho obsah sem.
Já bych řekla, že je to chyba firefoxu. Zkoušel jsi ho přeinstalovat?
Stáhni na plochu ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- Před použitím vypni všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary
-Zavři všechna aktivní okna a spusť ho pod učtem s právy administrátora
- Po spuštění se zobrazí podmínky použití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování, se vytvoří log C:\ComboFix.txt, zkopíruj celý jeho obsah sem.
Re: Prosím o kontrolu logu
Zkusím přeinstalovat.
ComboFix 10-08-26.04 - Admin 27.08.2010 13:40:03.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1977.1481 [GMT 2:00]
Spuštěný z: c:\documents and settings\Admin\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: Kerio Personal Firewall *disabled* {333BECA0-DED8-4139-A516-8D9E44E22669}
* Vytvořen nový Bod Obnovení
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\systeminfo.dll
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-07-27 do 2010-08-27 )))))))))))))))))))))))))))))))
.
2010-08-26 19:06 . 2010-08-26 19:06 -------- d-----w- c:\program files\VideoLAN
2010-08-23 17:32 . 2010-08-23 17:32 -------- d-----w- c:\windows\Internet Logs
2010-08-23 11:42 . 2010-08-23 11:42 -------- d-----w- c:\program files\CheckPoint
2010-08-23 11:42 . 2010-08-23 11:42 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2010-08-23 07:33 . 2010-08-23 07:33 -------- d-----w- c:\program files\Kerio
2010-08-20 20:23 . 2010-08-20 20:23 -------- d-----w- c:\program files\Winamp Detect
2010-08-19 22:58 . 2010-08-19 22:58 -------- d-----w- c:\program files\PKR
2010-08-17 14:52 . 2005-04-27 14:36 245408 ----a-w- c:\windows\system32\unicows.dll
2010-08-17 14:50 . 2009-07-13 13:46 37280 ----a-w- c:\windows\system32\drivers\RTL2832U_IRHID.sys
2010-08-17 14:50 . 2009-07-06 15:37 32800 ----a-w- c:\windows\system32\drivers\RTL2832UUSB.sys
2010-08-17 14:50 . 2009-07-06 15:36 91168 ----a-w- c:\windows\system32\drivers\RTL2832UBDA.sys
2010-08-17 14:50 . 2010-08-17 14:50 -------- d-----w- c:\program files\NewSoft
2010-08-17 14:50 . 2009-04-02 12:22 127085 ----a-w- c:\windows\system32\RTKFMSOURCE.dll
2010-08-17 14:49 . 2010-08-17 14:52 -------- d-----w- c:\program files\MSI
2010-08-16 19:19 . 2010-08-16 19:19 -------- d-----w- c:\program files\Veetle
2010-08-16 19:11 . 2010-08-16 19:11 -------- d-----w- c:\program files\SopCast
2010-08-14 07:49 . 2006-11-10 13:05 18688 ----a-w- c:\windows\system32\drivers\afc.sys
2010-08-14 07:49 . 2010-08-17 14:52 -------- d-----w- c:\program files\Common Files\ArcSoft
2010-08-14 07:48 . 1995-08-01 02:44 212480 ----a-w- c:\windows\PCDLIB32.DLL
2010-08-14 07:46 . 2010-08-14 07:46 483200 ----a-w- c:\windows\system32\drivers\AF15BDA.SYS
2010-08-14 07:46 . 2010-08-14 07:46 28672 ----a-w- c:\windows\system32\AF15BDAEX.dll
2010-08-09 21:28 . 2010-08-09 21:28 -------- d-----w- c:\program files\QIP 2010
2010-08-02 15:33 . 2010-08-05 16:33 -------- d-----w- c:\program files\DVBT
2010-08-01 22:18 . 2010-08-01 23:26 -------- d-----w- c:\program files\PartyGaming
2010-07-29 08:04 . 2010-07-29 08:04 -------- d-----w- c:\program files\Jízdádyní ř
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-23 11:42 . 2010-08-23 11:42 -------- d-----w- c:\program files\CheckPoint
2010-08-23 07:16 . 2010-04-02 09:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-23 07:02 . 2010-01-15 14:30 -------- d-----w- c:\program files\PDF
2010-08-23 07:02 . 2009-12-04 06:00 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-08-23 07:02 . 2010-01-15 14:29 -------- d-----w- c:\program files\Common Files\soft602
2010-08-23 06:58 . 2010-07-12 14:56 -------- d-----w- c:\program files\ShowIP
2010-08-23 06:57 . 2010-08-20 20:22 -------- d-----w- c:\program files\Winamp
2010-08-20 09:50 . 2010-07-06 09:42 -------- d-----w- c:\program files\Full Tilt Poker
2010-08-19 23:10 . 2010-07-08 18:52 -------- d-----w- c:\program files\PokerStars
2010-08-14 07:46 . 2010-07-24 07:57 245 ----a-w- c:\windows\system32\AF15IRTBL.bin
2010-08-08 09:19 . 2010-07-10 08:44 -------- d-----w- c:\program files\Mozilla Firefox 4.0 Beta 1
2010-08-06 20:12 . 2001-10-25 14:00 47404 ----a-w- c:\windows\system32\perfc005.dat
2010-08-06 20:12 . 2001-10-25 14:00 313208 ----a-w- c:\windows\system32\perfh005.dat
2010-08-02 15:32 . 2009-12-04 05:59 -------- d-----w- c:\program files\Common Files\InstallShield
2010-07-24 07:58 . 2010-07-24 07:58 -------- d-----w- c:\program files\BlazeVideo
2010-07-21 15:57 . 2010-07-21 15:57 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-07-21 15:46 . 2010-07-21 15:46 -------- d-----w- c:\program files\Eidos
2010-07-15 14:46 . 2010-03-13 15:28 -------- d-----w- c:\program files\TrialDocSmartz
2010-07-15 12:39 . 2010-07-15 12:39 -------- d-----w- c:\program files\SystemRequirementsLab
2010-07-15 10:47 . 2010-07-15 10:46 -------- d-----w- c:\program files\DivX
2010-07-15 10:47 . 2010-07-15 10:46 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-07-10 08:26 . 2010-07-10 08:26 -------- d-----w- c:\program files\MagicScore Music Software
2010-07-09 15:18 . 2010-07-04 20:20 -------- d-----w- c:\program files\PokerStars.NET
2010-07-07 09:45 . 2010-07-07 09:32 127742 ----a-w- c:\windows\hpoins11.dat
2010-07-07 09:43 . 2010-07-07 09:42 -------- d-----w- c:\program files\Common Files\HP
2010-07-07 09:43 . 2010-07-07 09:36 -------- d-----w- c:\program files\HP
2010-07-07 09:41 . 2010-07-07 09:40 -------- d-----w- c:\program files\Hewlett-Packard
2010-07-07 09:40 . 2010-07-07 09:40 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2010-07-07 07:43 . 2010-07-07 07:43 -------- d-----w- c:\program files\NirSoft
2010-07-04 21:03 . 2010-07-04 21:03 -------- d-----w- c:\program files\QIP
2010-06-29 18:34 . 2010-06-29 18:34 -------- d-----w- c:\program files\trend micro
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2054360]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Kerio\\Personal Firewall 4\\kpf4gui.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [31.7.2008 21:45 20616]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16.11.2009 10:03 108792]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [16.11.2009 10:06 96408]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [26.9.2005 11:05 286720]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [26.9.2005 11:05 81920]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [16.11.2009 10:04 735960]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2.4.2010 11:32 304464]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2.4.2010 11:32 20952]
S3 EC168BDA;EC168BDA service;c:\windows\system32\DRIVERS\EC168BDA.sys --> c:\windows\system32\DRIVERS\EC168BDA.sys [?]
S3 IT9135BDA;IT9135 BDA Devices;c:\windows\system32\drivers\IT9135BDA.sys [24.7.2010 10:02 94336]
S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [2.7.2008 15:58 26248]
S3 RTL2832U_IRHID;HID Infrared Remote Receiver;c:\windows\system32\drivers\RTL2832U_IRHID.sys [17.8.2010 16:50 37280]
S3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys [17.8.2010 16:50 91168]
S3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\drivers\RTL2832UUSB.sys [17.8.2010 16:50 32800]
.
Obsah adresáře 'Naplánované úlohy'
2010-08-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 11:42]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://eu.ask.com?o=15003&l=dis
uInternet Settings,ProxyServer = 192.168.1.10:3128
uInternet Settings,ProxyOverride = <local>
FF - ProfilePath - c:\documents and settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\9hwt6vde.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.as ... 2611275&q=
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\9hwt6vde.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\documents and settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\9hwt6vde.default\extensions\{32a1fd71-835e-4b11-8e54-886fda0b4c89}\components\qippipe.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\Veetle\VLCBroadcast\npvbp.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-27 13:45
Windows 5.1.2600 Service Pack 2 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(652)
c:\windows\system32\igfxdev.dll
.
Celkový čas: 2010-08-27 13:48:31
ComboFix-quarantined-files.txt 2010-08-27 11:48
Před spuštěním: Volných bajtů: 186 583 633 920
Po spuštění: Volných bajtů: 186 593 087 488
- - End Of File - - C2E9986333BEDD9E4E1AA77AF1597F1C
ComboFix 10-08-26.04 - Admin 27.08.2010 13:40:03.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1977.1481 [GMT 2:00]
Spuštěný z: c:\documents and settings\Admin\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: Kerio Personal Firewall *disabled* {333BECA0-DED8-4139-A516-8D9E44E22669}
* Vytvořen nový Bod Obnovení
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\systeminfo.dll
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-07-27 do 2010-08-27 )))))))))))))))))))))))))))))))
.
2010-08-26 19:06 . 2010-08-26 19:06 -------- d-----w- c:\program files\VideoLAN
2010-08-23 17:32 . 2010-08-23 17:32 -------- d-----w- c:\windows\Internet Logs
2010-08-23 11:42 . 2010-08-23 11:42 -------- d-----w- c:\program files\CheckPoint
2010-08-23 11:42 . 2010-08-23 11:42 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2010-08-23 07:33 . 2010-08-23 07:33 -------- d-----w- c:\program files\Kerio
2010-08-20 20:23 . 2010-08-20 20:23 -------- d-----w- c:\program files\Winamp Detect
2010-08-19 22:58 . 2010-08-19 22:58 -------- d-----w- c:\program files\PKR
2010-08-17 14:52 . 2005-04-27 14:36 245408 ----a-w- c:\windows\system32\unicows.dll
2010-08-17 14:50 . 2009-07-13 13:46 37280 ----a-w- c:\windows\system32\drivers\RTL2832U_IRHID.sys
2010-08-17 14:50 . 2009-07-06 15:37 32800 ----a-w- c:\windows\system32\drivers\RTL2832UUSB.sys
2010-08-17 14:50 . 2009-07-06 15:36 91168 ----a-w- c:\windows\system32\drivers\RTL2832UBDA.sys
2010-08-17 14:50 . 2010-08-17 14:50 -------- d-----w- c:\program files\NewSoft
2010-08-17 14:50 . 2009-04-02 12:22 127085 ----a-w- c:\windows\system32\RTKFMSOURCE.dll
2010-08-17 14:49 . 2010-08-17 14:52 -------- d-----w- c:\program files\MSI
2010-08-16 19:19 . 2010-08-16 19:19 -------- d-----w- c:\program files\Veetle
2010-08-16 19:11 . 2010-08-16 19:11 -------- d-----w- c:\program files\SopCast
2010-08-14 07:49 . 2006-11-10 13:05 18688 ----a-w- c:\windows\system32\drivers\afc.sys
2010-08-14 07:49 . 2010-08-17 14:52 -------- d-----w- c:\program files\Common Files\ArcSoft
2010-08-14 07:48 . 1995-08-01 02:44 212480 ----a-w- c:\windows\PCDLIB32.DLL
2010-08-14 07:46 . 2010-08-14 07:46 483200 ----a-w- c:\windows\system32\drivers\AF15BDA.SYS
2010-08-14 07:46 . 2010-08-14 07:46 28672 ----a-w- c:\windows\system32\AF15BDAEX.dll
2010-08-09 21:28 . 2010-08-09 21:28 -------- d-----w- c:\program files\QIP 2010
2010-08-02 15:33 . 2010-08-05 16:33 -------- d-----w- c:\program files\DVBT
2010-08-01 22:18 . 2010-08-01 23:26 -------- d-----w- c:\program files\PartyGaming
2010-07-29 08:04 . 2010-07-29 08:04 -------- d-----w- c:\program files\Jízdádyní ř
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-23 11:42 . 2010-08-23 11:42 -------- d-----w- c:\program files\CheckPoint
2010-08-23 07:16 . 2010-04-02 09:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-23 07:02 . 2010-01-15 14:30 -------- d-----w- c:\program files\PDF
2010-08-23 07:02 . 2009-12-04 06:00 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-08-23 07:02 . 2010-01-15 14:29 -------- d-----w- c:\program files\Common Files\soft602
2010-08-23 06:58 . 2010-07-12 14:56 -------- d-----w- c:\program files\ShowIP
2010-08-23 06:57 . 2010-08-20 20:22 -------- d-----w- c:\program files\Winamp
2010-08-20 09:50 . 2010-07-06 09:42 -------- d-----w- c:\program files\Full Tilt Poker
2010-08-19 23:10 . 2010-07-08 18:52 -------- d-----w- c:\program files\PokerStars
2010-08-14 07:46 . 2010-07-24 07:57 245 ----a-w- c:\windows\system32\AF15IRTBL.bin
2010-08-08 09:19 . 2010-07-10 08:44 -------- d-----w- c:\program files\Mozilla Firefox 4.0 Beta 1
2010-08-06 20:12 . 2001-10-25 14:00 47404 ----a-w- c:\windows\system32\perfc005.dat
2010-08-06 20:12 . 2001-10-25 14:00 313208 ----a-w- c:\windows\system32\perfh005.dat
2010-08-02 15:32 . 2009-12-04 05:59 -------- d-----w- c:\program files\Common Files\InstallShield
2010-07-24 07:58 . 2010-07-24 07:58 -------- d-----w- c:\program files\BlazeVideo
2010-07-21 15:57 . 2010-07-21 15:57 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-07-21 15:46 . 2010-07-21 15:46 -------- d-----w- c:\program files\Eidos
2010-07-15 14:46 . 2010-03-13 15:28 -------- d-----w- c:\program files\TrialDocSmartz
2010-07-15 12:39 . 2010-07-15 12:39 -------- d-----w- c:\program files\SystemRequirementsLab
2010-07-15 10:47 . 2010-07-15 10:46 -------- d-----w- c:\program files\DivX
2010-07-15 10:47 . 2010-07-15 10:46 -------- d-----w- c:\program files\Common Files\DivX Shared
2010-07-10 08:26 . 2010-07-10 08:26 -------- d-----w- c:\program files\MagicScore Music Software
2010-07-09 15:18 . 2010-07-04 20:20 -------- d-----w- c:\program files\PokerStars.NET
2010-07-07 09:45 . 2010-07-07 09:32 127742 ----a-w- c:\windows\hpoins11.dat
2010-07-07 09:43 . 2010-07-07 09:42 -------- d-----w- c:\program files\Common Files\HP
2010-07-07 09:43 . 2010-07-07 09:36 -------- d-----w- c:\program files\HP
2010-07-07 09:41 . 2010-07-07 09:40 -------- d-----w- c:\program files\Hewlett-Packard
2010-07-07 09:40 . 2010-07-07 09:40 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2010-07-07 07:43 . 2010-07-07 07:43 -------- d-----w- c:\program files\NirSoft
2010-07-04 21:03 . 2010-07-04 21:03 -------- d-----w- c:\program files\QIP
2010-06-29 18:34 . 2010-06-29 18:34 -------- d-----w- c:\program files\trend micro
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2054360]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Kerio\\Personal Firewall 4\\kpf4gui.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [31.7.2008 21:45 20616]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16.11.2009 10:03 108792]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [16.11.2009 10:06 96408]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [26.9.2005 11:05 286720]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [26.9.2005 11:05 81920]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [16.11.2009 10:04 735960]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2.4.2010 11:32 304464]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2.4.2010 11:32 20952]
S3 EC168BDA;EC168BDA service;c:\windows\system32\DRIVERS\EC168BDA.sys --> c:\windows\system32\DRIVERS\EC168BDA.sys [?]
S3 IT9135BDA;IT9135 BDA Devices;c:\windows\system32\drivers\IT9135BDA.sys [24.7.2010 10:02 94336]
S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [2.7.2008 15:58 26248]
S3 RTL2832U_IRHID;HID Infrared Remote Receiver;c:\windows\system32\drivers\RTL2832U_IRHID.sys [17.8.2010 16:50 37280]
S3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys [17.8.2010 16:50 91168]
S3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\drivers\RTL2832UUSB.sys [17.8.2010 16:50 32800]
.
Obsah adresáře 'Naplánované úlohy'
2010-08-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 11:42]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://eu.ask.com?o=15003&l=dis
uInternet Settings,ProxyServer = 192.168.1.10:3128
uInternet Settings,ProxyOverride = <local>
FF - ProfilePath - c:\documents and settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\9hwt6vde.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as ... ource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.as ... 2611275&q=
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\9hwt6vde.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\documents and settings\Admin\Data aplikací\Mozilla\Firefox\Profiles\9hwt6vde.default\extensions\{32a1fd71-835e-4b11-8e54-886fda0b4c89}\components\qippipe.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\Veetle\VLCBroadcast\npvbp.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-27 13:45
Windows 5.1.2600 Service Pack 2 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(652)
c:\windows\system32\igfxdev.dll
.
Celkový čas: 2010-08-27 13:48:31
ComboFix-quarantined-files.txt 2010-08-27 11:48
Před spuštěním: Volných bajtů: 186 583 633 920
Po spuštění: Volných bajtů: 186 593 087 488
- - End Of File - - C2E9986333BEDD9E4E1AA77AF1597F1C
Notebook: Acer Extensa 5230E
Re: Prosím o kontrolu logu
Fajn, změnilo se něco?
Re: Prosím o kontrolu logu
Zatím není zač 

Kdo je online
Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 78 hostů