Prosím o kontrolu logu HijackThis Vyřešeno

[jaro3]

máš nějaké problémy?

[Reklama]

[martin krok]

pomale pc a dlouho mi načítají stranky

[memphisto]

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud bude po kontrole problém spustit aplikace nebo bude vyskakovat hláška o pokusu použít neplatnou operaci na klíč registru, který je oznaèen pro odstranění, stačí restartovat počítač.

[martin krok]

ComboFix 13-09-02.02 - SMCeleron 03.09.2013 17:54:36.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.629 [GMT 2:00]
Spuštěný z: c:\documents and settings\SMCeleron\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-08-03 do 2013-09-03 )))))))))))))))))))))))))))))))
.
.
2013-09-02 18:16 . 2013-09-02 18:16 -------- d-sh--w- c:\documents and settings\SMCeleron\IECompatCache
2013-09-01 15:45 . 2013-09-01 15:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-09-01 15:37 . 2013-09-01 20:02 -------- d-----w- C:\AdwCleaner
2013-09-01 15:26 . 2013-09-01 15:26 388096 ----a-r- c:\documents and settings\SMCeleron\Data aplikací\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2013-09-01 15:26 . 2013-09-01 15:26 -------- d-----w- c:\program files\Trend Micro
2013-09-01 09:01 . 2013-09-01 12:44 -------- d-----w- c:\documents and settings\SMCeleron\Data aplikací\BSplayer
2013-09-01 08:00 . 2013-09-01 08:00 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\VS Revo Group
2013-09-01 08:00 . 2013-09-01 08:00 -------- d-----w- c:\documents and settings\All Users\Data aplikací\VS Revo Group
2013-08-31 18:07 . 2013-08-31 18:07 170752 ----a-w- c:\windows\system32\drivers\snapman.sys
2013-08-31 18:07 . 2013-08-31 18:07 76768 ----a-w- c:\windows\system32\drivers\fltsrv.sys
2013-08-31 17:24 . 2013-08-31 17:46 -------- d-----w- c:\program files\Free Windows Cleanup Tool
2013-08-28 21:46 . 2013-08-28 21:47 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\Facebook
2013-08-28 18:57 . 2013-08-28 18:57 -------- d-----w- c:\documents and settings\SMCeleron\Data aplikací\ChemTable Software
2013-08-28 18:55 . 2013-08-28 18:55 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\ChemTable Software
2013-08-28 18:55 . 2013-08-28 19:20 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\AnVir
2013-08-28 17:43 . 2013-08-28 17:43 -------- d-----w- c:\windows\system32\wbem\mof\good
2013-08-28 17:43 . 2013-08-28 17:43 -------- d-----w- c:\windows\system32\wbem\mof\bad
2013-08-27 23:35 . 2013-08-27 23:35 -------- d-----w- c:\documents and settings\All Users\Data aplikací\YTD Video Downloader
2013-08-27 23:34 . 2013-08-27 23:34 -------- d-----w- c:\program files\GreenTree Applications
2013-08-27 15:51 . 2013-08-27 15:51 -------- d-----w- c:\program files\CCleaner
2013-08-25 21:12 . 2013-09-01 14:59 -------- d-----w- c:\program files\Microsoft Bootvis
2013-08-22 21:36 . 2013-08-22 21:36 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\Fighters
2013-08-22 21:04 . 2006-06-29 11:07 14048 ------w- c:\windows\system32\spmsg2.dll
2013-08-22 20:35 . 2013-08-22 21:50 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Common Toolkit Suite
2013-08-22 20:21 . 2013-08-22 20:21 -------- d-----w- c:\documents and settings\LocalService\Data aplikací\Fighters
2013-08-22 20:20 . 2013-08-22 22:17 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Fighters
2013-08-22 20:14 . 2013-08-22 20:14 23456 ----a-w- c:\windows\system32\drivers\DrvAgent32.sys
2013-08-22 20:14 . 2013-08-22 20:14 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\eSupport.com
2013-08-22 19:27 . 2013-08-22 19:29 -------- d-----w- c:\program files\Google
2013-08-18 21:42 . 2013-08-18 21:42 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\Anthropics
2013-08-15 16:15 . 2011-06-21 09:24 32768 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2013-08-14 05:46 . 2013-08-15 16:08 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\Unity
2013-08-11 13:29 . 2010-07-25 20:23 56496 ----a-w- c:\windows\system32\wbhelp2.dll
2013-08-11 13:29 . 2010-07-25 20:23 544768 ----a-w- c:\windows\system32\wbocx.ocx
2013-08-11 13:29 . 2010-07-25 20:23 258352 ----a-w- c:\windows\system32\unicows.dll
2013-08-11 13:29 . 2010-07-25 20:23 33968 ----a-w- c:\windows\system32\anim.dll
2013-08-11 13:29 . 2010-07-25 20:23 1706800 ----a-w- c:\windows\system32\gdiplus.dll
2013-08-11 13:29 . 2010-07-25 20:23 4608 ----a-w- c:\windows\system32\W95INF32.DLL
2013-08-11 13:29 . 2010-07-25 20:23 2272 ----a-w- c:\windows\system32\W95INF16.DLL
2013-08-11 12:15 . 2013-08-11 12:15 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ESET
2013-08-07 17:02 . 2013-08-07 17:02 4484 ----a-w- c:\windows\system32\drivers\cpuidlep.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-02 23:48 . 2006-10-18 19:47 1543680 ------w- c:\windows\system32\wmvdecod.dll
2013-07-29 17:49 . 2013-07-29 17:49 16048 ----a-w- c:\windows\system32\drivers\GdPhyMem.sys
2013-07-26 02:49 . 2008-04-14 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2013-07-26 02:48 . 2008-04-14 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-07-26 02:48 . 2008-04-14 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2013-07-25 15:52 . 2008-04-14 12:00 385024 ----a-w- c:\windows\system32\html.iec
2013-07-10 10:37 . 2008-04-14 12:00 406016 ----a-w- c:\windows\system32\usp10.dll
2013-07-04 07:34 . 2008-04-14 08:06 2072320 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-07-04 07:34 . 2008-04-14 12:00 2195712 ----a-w- c:\windows\system32\ntoskrnl.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="d:\programy\eset\egui.exe" [2013-03-21 5078504]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Windows Search.lnk]
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner]
2013-08-21 18:22 3676952 ----a-w- c:\program files\CCleaner\CCleaner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2013-07-25 06:58 20684656 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2006-11-17 03:42 577536 ----a-r- c:\windows\soundman.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\MadOnion.com\\3DMark2001 SE\\3DMark2001SE.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
.
R0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\drivers\fltsrv.sys [31.8.2013 20:07 76768]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [10.1.2013 10:25 122240]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [10.1.2013 10:25 105784]
R2 ekrn;ESET Service;d:\programy\eset\ekrn.exe [21.3.2013 15:19 1341664]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6.7.2013 23:31 22856]
S2 GDTdiInterceptor;GDTdiInterceptor;\??\c:\windows\system32\drivers\GDTdiIcpt.sys --> c:\windows\system32\drivers\GDTdiIcpt.sys [?]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [1.9.2013 17:45 701512]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [22.8.2013 22:14 23456]
S3 LMIRescue_391ac7ff-9f90-4cad-b200-d1ea20cd8371;LogMeIn Rescue (391ac7ff-9f90-4cad-b200-d1ea20cd8371);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR000B.tmp\LMI_Rescue_srv.exe [28.7.2013 16:31 2570592]
S3 LMIRescue_796396c6-ef97-4e85-a52a-782c471ee2ce;LogMeIn Rescue (796396c6-ef97-4e85-a52a-782c471ee2ce);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR000A.tmp\LMI_Rescue_srv.exe [28.7.2013 16:17 2570592]
S3 LMIRescue_b27ea1d2-3851-4c29-b5b2-00bfaf75611a;LogMeIn Rescue (b27ea1d2-3851-4c29-b5b2-00bfaf75611a);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR000C.tmp\LMI_Rescue_srv.exe [20.8.2013 17:43 2570592]
S3 LMIRescue_eb30bad3-8f1c-44a7-8b74-10db35342de0;LogMeIn Rescue (eb30bad3-8f1c-44a7-8b74-10db35342de0);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0009.tmp\LMI_Rescue_srv.exe [20.7.2013 15:02 2570592]
S3 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [25.7.2013 8:52 162672]
S4 LMIRescue_25b8023e-94c1-4a98-9c08-04bc13b20828;LogMeIn Rescue (25b8023e-94c1-4a98-9c08-04bc13b20828);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0005.tmp\LMI_Rescue_srv.exe [19.7.2013 20:23 2570592]
S4 LMIRescue_2a132eac-b3f6-4401-ad4d-57df7118dbc9;LogMeIn Rescue (2a132eac-b3f6-4401-ad4d-57df7118dbc9);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0001.tmp\LMI_Rescue_srv.exe [19.7.2013 20:03 2570592]
S4 LMIRescue_3f210bad-2787-4c38-96c1-fa9d220e8150;LogMeIn Rescue (3f210bad-2787-4c38-96c1-fa9d220e8150);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0006.tmp\LMI_Rescue_srv.exe [19.7.2013 20:36 2570592]
S4 LMIRescue_9cb5ae85-6c76-4fb0-ab82-956d017a0c28;LogMeIn Rescue (9cb5ae85-6c76-4fb0-ab82-956d017a0c28);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0008.tmp\LMI_Rescue_srv.exe [20.7.2013 10:58 2570592]
S4 LMIRescue_de44e4bb-4696-477e-92f3-b3a718683581;LogMeIn Rescue (de44e4bb-4696-477e-92f3-b3a718683581);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0004.tmp\LMI_Rescue_srv.exe [19.7.2013 20:18 2570592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-08-30 18:56 1177552 ----a-w- c:\program files\Google\Chrome\Application\29.0.1547.62\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-08-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-08-22 19:27]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.bing.com/
TCP: DhcpNameServer = 10.0.0.138
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-09-03 18:01
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG14.00.00.01PROFESSIONAL"="96BF69B2A24B8A8C4FD51275A18331D1D524B2404EACB0D5D92CB78429CA5535F99CC7974DB43C2B4F5557FA2EB772B27D28CEDDFA072202CFF041FE06FD5146720235DB3DABB13EB35D76A4B73AFD9D52B580134F19673FE652F5FEFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA9C6AECB7A5D1407A2D97226D213B555BA7FD869164D6794A2D97226D213B5556EC7FDE352371EFB5FE124C9F066F9100A1A2F9EFDEDEEBD493530FD2927BE5ACC98AA443B2ABF8B2C7C01BBFE2358DA94E474A32BFD00A983FAB0866CDE59EB0E2772D974E75733428528FA1BD5750B8AA240E9146378282B12E96430874E61CB457D482FF86B0116C5E4C7218A47DB57329EEE5ECFE13F468B46F5019955B1C3D83A68813B05F8BB99C51AD025CB7D8A015E658FCB466E7D0CF649CF612C46575C5AC765DE31136F6F9B984CD9FC93D716133416B0B6251ECD6FA3727E92FC8DDFD1253AE8813911C97C231BB3E0B719879475C22D45C8189F687AA1E3CD280F825AF5C2318DC92140C4C9AA8F7DF34781FB7748450B33025F5E7AFBD9A60E2AFCF0E1A5E4EB18C9FE8F52C89FDD4983C6293EC0CD243092059002027DE868D019D647EA06BD6B5245C13628E80F2C91A8407E28F32E81A89782A619BCE5E4993491B50368217F2DE4002461C6A483DA1228A35DB44D5C43B67E2E0C5BF1A63D4169F13FB43F83EAC6347DEF65352CE87D8C4CA663AB6989910F940672E5C29AC6EBF2D6683F98C2650DD5B247DB76ED7BD9C92C27F045C2EE058A996C1E43B2DEEAE6E4D24F5790CF7CF86DC1B6A53C304625797A5001DC2874F1BC0AFB27ACB7F92FE51AA14A52293AE2C67F68F14BD4C7957F2BFB2367A936E2475FE35FD113745D3E36EB712BAABD464B7D9787B8B4988C925EAAA298F3E429F853BD528EC7F4BC32F4E6BE629DC687698E6F86C3B0BA2BEA0919EE481EE0447022775A77BFDE49ED755198626157C074571E82CF3D6D4925F587E674514F67B5DA0045417A56B17F2F6B5B3A6AB63FA4D056846462BA6E41C4B860BCC9187AB0E1CD54450944DCD8E77CD51EBE6C85154BCF86AE3B6D5CA5E673246758E698AEEE583E029156E1CF3E4E4A627948C7C567437BFDFA14849725066F5D64AC91E08E9CAD19CEFD0E2022AC71034CDBEF981AF0C4C762020CC598BC73A9651C695E9F1BBFD090EEE1E758E97320777E9C56AD1A3CA04C4DCF3FB06ED47FE82FD51F56D8079235A49029FA5DF1FAD3C89D294086ACC624D25DF930F02DB111A0458039DE886D37D904C975DD00FBCC9A79224380D619E831F5CB2D20893B927154C525B8C0919E11D89588CB22AB6114E9337CD66E1DB1CA127414DB69B63766D8914A789A558910DEBAC907D53C249CDBB4855B9BF8A4485C"
"OODEFRAG16.00.00.01PROFESSIONAL"="D178F64B240F4B49E312A8E921AE3FADD1DB511A56EB544A95429920B6B2FD2E4435279E29E3D5FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA9C6AECB7A5D1407A2D97226D213B555BA7FD869164D6794A2D97226D213B5552ADF412764FAB7044731249BCC9ADA55C7DA7B8A4E9606129352F4C4EE8D50113C13F67ECFD5F75326BAD82F1AC315CAB6EE25BEF9B6726C1995F57FA3F568148D60D2FC776949BBD1A23018A212E17E0C7971F3DE61886B55C57F2F3FD13BAF44756E7581E04B81969A385784C6A0705F51FCF8390C076F497F5F9131EB073EEA53E82FB97BDE20AA28FCDE8434F5D8ACA2E50E6242718A5AAF66D0902055D370CEE1658E8B2B43242512970B45C522D56AD0E8DE201285521DE79198E26C3126907F46127999CCFDC08EDCA2743F6B1EFB64B151D5725C5F5EBD68A4B9DA51C2956CF5FC41D85398FA0D00FCD1CE06AEFECD85832A653D90DE44DF39BF7060E1ACD50B29705B9F37292B44EB02A778136D3BF56175FB0CDC5EDB767A2242BD7FFCEC8F95AA562F80770DE069BE42FEBB95E087FBA512609E71E89C32232CFE807EE6836528C3B20161D70390525905FD9B76B309BAC006117F543B4F19C8ECA97E7FDADE336491A6BAB7CA9F9D6B3111F43866E24BE87B57C48B29E36FF882A61CF17A6DAC36644627D94C7D95BB56926D65820381AFF6764FFDB6A423E372044E02BF9F8583F81721F10E304253010223C0DB0C977C5C5684A1A46CC7701F365CF377A8C6D3CF3377B60EE33FF9EEC38813BBC2617B4AC61C6DAAB881CE2313E311E65F8A751F1BCBE13BE83E4292A1E5A75E10449D0EF721DFF02B8CECC854D428C2BF817BD1B21233F9B281FC9346544E760237952DFE74F7950AB7819219F30BB7666D3C82BF166C2159E2C14BC343D9A847C9DC5ED5483B2B3FE1063463DB0EE398A65105EFF4D47E1A4EEBC80CF5230C379C2F0C59263338D885379619778CDA3B1898DECF1F3652D1C21CCEF90285AFC7648C56CB68EA3689AA15D5858762A35A4134C7555DDF4E8657B2D24954DF94196B381251BFF31325EE6742D622723924348B2FD646A51D60B159801929162EE90E3C4575AF62B12686B460202F210AEC1BC6358FC9DBD8A90F79366F1590671F3EE3AC230F4FE6AC364C69D56BD9792AADD5319E29DD925440430534FDBA9BC280BE36AC8AD6FC78593D49D3670A5F77BD6AAA88F90B4CF1A82936B31F839D81EEA186C8239A33EEDD5DA0D889A18693ADF960B3264602BCC0E2C19E86DFB0ABB525F50FAA3F3A1C45C7C40688172C61F3BFC26CEA751C8F16EBD78898C60F3697A30EFDC8EB382CA6573D63716506671EB878615A837CE9C682D96A8A3364BA68BF8F76FA4FC7F02C2DC6D9A608B8514928DA27"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(540)
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2013-09-03 18:04:25
ComboFix-quarantined-files.txt 2013-09-03 16:04
ComboFix2.txt 2013-08-29 19:42
.
Před spuštěním: Volných bajtů: 31 167 807 488
Po spuštění: Volných bajtů: 31 174 270 976
.
- - End Of File - - 733FF9D84C06B6013E5E738D49D185BC
413FC2A0C716421B3158746D63736515

[martin krok]

maš to tu ty logy jak si chtěl

[jaro3]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

ClearJavaCache::

KillAll::
File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\system32\drivers\sp_rsdrv2.sys

Folder::
c:\program files\Skype\Updater
c:\program files\Google\Update

Driver::
GDTdiInterceptor
SkypeUpdate
sp_rsdrv2

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.

Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.

V možnostech složky si povol zobrazování skrytých souborů a složek+ odškrtni zatržítko skrýt chráněné soubory operačního systému

Toto otestuj na Virustotal
c:\windows\system32\drivers\cpuidlep.sys
c:\windows\system32\drivers\GdPhyMem.sys

Klikni vpravo od okénka na Vybrat a v Exploreru najdi požadovaný soubor v Tvém PC. Označ ho myší a klikni na Otevřít , poté klikni na Send File. Pokud už byl soubor testován , objeví se okno ve kterém klikni na Reanalyze. Soubor se začne postupně testovat více antivirovými programy. Až skončí test posledního antiviru , objeví se nahoře result a červeně počet nákaz , např. 0/43 , nebo 1/43. Pak zkopíruj myší odkaz na tuto stránku a vlož ji do svého příspěvku.

Nebo na:
http://www.virscan.org/

[martin krok]

ComboFix 13-09-02.02 - SMCeleron 04.09.2013 17:31:51.5.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.489 [GMT 2:00]
Spuštěný z: c:\documents and settings\SMCeleron\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\SMCeleron\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
FILE ::
"c:\windows\system32\drivers\sp_rsdrv2.sys"
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Google\Update
c:\program files\Google\Update\1.3.21.153\GoogleCrashHandler.exe
c:\program files\Google\Update\1.3.21.153\GoogleCrashHandler64.exe
c:\program files\Google\Update\1.3.21.153\GoogleUpdate.exe
c:\program files\Google\Update\1.3.21.153\GoogleUpdateBroker.exe
c:\program files\Google\Update\1.3.21.153\GoogleUpdateHelper.msi
c:\program files\Google\Update\1.3.21.153\GoogleUpdateOnDemand.exe
c:\program files\Google\Update\1.3.21.153\GoogleUpdateSetup.exe
c:\program files\Google\Update\1.3.21.153\goopdate.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_am.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_ar.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_bg.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_bn.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_ca.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_cs.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_da.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_de.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_el.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_en-GB.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_en.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_es-419.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_es.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_et.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_fa.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_fi.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_fil.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_fr.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_gu.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_hi.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_hr.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_hu.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_id.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_is.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_it.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_iw.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_ja.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_kn.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_ko.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_lt.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_lv.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_ml.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_mr.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_ms.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_nl.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_no.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_pl.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_pt-BR.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_pt-PT.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_ro.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_ru.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_sk.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_sl.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_sr.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_sv.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_sw.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_ta.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_te.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_th.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_tr.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_uk.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_ur.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_vi.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_zh-CN.dll
c:\program files\Google\Update\1.3.21.153\goopdateres_zh-TW.dll
c:\program files\Google\Update\1.3.21.153\npGoogleUpdate3.dll
c:\program files\Google\Update\1.3.21.153\psmachine.dll
c:\program files\Google\Update\1.3.21.153\psuser.dll
c:\program files\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\29.0.1547.62\29.0.1547.62_29.0.1547.57_chrome_updater.exe
c:\program files\Google\Update\GoogleUpdate.exe
c:\program files\Skype\Updater
c:\program files\Skype\Updater\Updater.dll
c:\program files\Skype\Updater\Updater.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_GDTDIINTERCEPTOR
-------\Legacy_SKYPEUPDATE
-------\Legacy_SP_RSDRV2
-------\Service_GDTdiInterceptor
-------\Service_SkypeUpdate
-------\Legacy_gupdate
-------\Legacy_gupdatem
-------\Legacy_gupdate
-------\Legacy_gupdatem
-------\Service_gupdate
-------\Service_gupdatem
-------\Service_gupdate
-------\Service_gupdatem
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-08-04 do 2013-09-04 )))))))))))))))))))))))))))))))
.
.
2013-09-02 18:16 . 2013-09-02 18:16 -------- d-sh--w- c:\documents and settings\SMCeleron\IECompatCache
2013-09-01 15:45 . 2013-09-01 15:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-09-01 15:26 . 2013-09-01 15:26 -------- d-----w- c:\program files\Trend Micro
2013-09-01 09:01 . 2013-09-01 12:44 -------- d-----w- c:\documents and settings\SMCeleron\Data aplikací\BSplayer
2013-09-01 08:00 . 2013-09-01 08:00 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\VS Revo Group
2013-09-01 08:00 . 2013-09-01 08:00 -------- d-----w- c:\documents and settings\All Users\Data aplikací\VS Revo Group
2013-08-31 18:07 . 2013-08-31 18:07 170752 ----a-w- c:\windows\system32\drivers\snapman.sys
2013-08-31 18:07 . 2013-08-31 18:07 76768 ----a-w- c:\windows\system32\drivers\fltsrv.sys
2013-08-31 17:24 . 2013-08-31 17:46 -------- d-----w- c:\program files\Free Windows Cleanup Tool
2013-08-28 21:46 . 2013-08-28 21:47 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\Facebook
2013-08-28 18:57 . 2013-08-28 18:57 -------- d-----w- c:\documents and settings\SMCeleron\Data aplikací\ChemTable Software
2013-08-28 18:55 . 2013-08-28 18:55 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\ChemTable Software
2013-08-28 18:55 . 2013-08-28 19:20 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\AnVir
2013-08-28 17:43 . 2013-08-28 17:43 -------- d-----w- c:\windows\system32\wbem\mof\good
2013-08-28 17:43 . 2013-08-28 17:43 -------- d-----w- c:\windows\system32\wbem\mof\bad
2013-08-27 23:35 . 2013-08-27 23:35 -------- d-----w- c:\documents and settings\All Users\Data aplikací\YTD Video Downloader
2013-08-27 23:34 . 2013-08-27 23:34 -------- d-----w- c:\program files\GreenTree Applications
2013-08-27 15:51 . 2013-08-27 15:51 -------- d-----w- c:\program files\CCleaner
2013-08-25 21:12 . 2013-09-01 14:59 -------- d-----w- c:\program files\Microsoft Bootvis
2013-08-22 21:36 . 2013-08-22 21:36 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\Fighters
2013-08-22 21:04 . 2006-06-29 11:07 14048 ------w- c:\windows\system32\spmsg2.dll
2013-08-22 20:35 . 2013-08-22 21:50 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Common Toolkit Suite
2013-08-22 20:21 . 2013-08-22 20:21 -------- d-----w- c:\documents and settings\LocalService\Data aplikací\Fighters
2013-08-22 20:20 . 2013-08-22 22:17 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Fighters
2013-08-22 20:14 . 2013-08-22 20:14 23456 ----a-w- c:\windows\system32\drivers\DrvAgent32.sys
2013-08-22 20:14 . 2013-08-22 20:14 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\eSupport.com
2013-08-22 19:27 . 2013-08-22 19:29 -------- d-----w- c:\program files\Google
2013-08-18 21:42 . 2013-08-18 21:42 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\Anthropics
2013-08-15 16:15 . 2011-06-21 09:24 32768 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2013-08-14 05:46 . 2013-08-15 16:08 -------- d-----w- c:\documents and settings\SMCeleron\Local Settings\Data aplikací\Unity
2013-08-11 13:29 . 2010-07-25 20:23 56496 ----a-w- c:\windows\system32\wbhelp2.dll
2013-08-11 13:29 . 2010-07-25 20:23 544768 ----a-w- c:\windows\system32\wbocx.ocx
2013-08-11 13:29 . 2010-07-25 20:23 258352 ----a-w- c:\windows\system32\unicows.dll
2013-08-11 13:29 . 2010-07-25 20:23 33968 ----a-w- c:\windows\system32\anim.dll
2013-08-11 13:29 . 2010-07-25 20:23 1706800 ----a-w- c:\windows\system32\gdiplus.dll
2013-08-11 13:29 . 2010-07-25 20:23 4608 ----a-w- c:\windows\system32\W95INF32.DLL
2013-08-11 13:29 . 2010-07-25 20:23 2272 ----a-w- c:\windows\system32\W95INF16.DLL
2013-08-11 12:15 . 2013-08-11 12:15 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ESET
2013-08-07 17:02 . 2013-08-07 17:02 4484 ----a-w- c:\windows\system32\drivers\cpuidlep.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-02 23:48 . 2006-10-18 19:47 1543680 ------w- c:\windows\system32\wmvdecod.dll
2013-07-29 17:49 . 2013-07-29 17:49 16048 ----a-w- c:\windows\system32\drivers\GdPhyMem.sys
2013-07-26 02:49 . 2008-04-14 12:00 920064 ----a-w- c:\windows\system32\wininet.dll
2013-07-26 02:48 . 2008-04-14 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2013-07-26 02:48 . 2008-04-14 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2013-07-25 15:52 . 2008-04-14 12:00 385024 ----a-w- c:\windows\system32\html.iec
2013-07-10 10:37 . 2008-04-14 12:00 406016 ----a-w- c:\windows\system32\usp10.dll
2013-07-04 07:34 . 2008-04-14 08:06 2072320 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-07-04 07:34 . 2008-04-14 12:00 2195712 ----a-w- c:\windows\system32\ntoskrnl.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="d:\programy\eset\egui.exe" [2013-03-21 5078504]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Windows Search.lnk]
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner]
2013-08-21 18:22 3676952 ----a-w- c:\program files\CCleaner\CCleaner.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2013-07-25 06:58 20684656 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2006-11-17 03:42 577536 ----a-r- c:\windows\soundman.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\MadOnion.com\\3DMark2001 SE\\3DMark2001SE.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
.
R0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\drivers\fltsrv.sys [31.8.2013 20:07 76768]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [10.1.2013 10:25 122240]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [10.1.2013 10:25 105784]
R2 ekrn;ESET Service;d:\programy\eset\ekrn.exe [21.3.2013 15:19 1341664]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6.7.2013 23:31 22856]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [1.9.2013 17:45 701512]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [22.8.2013 22:14 23456]
S3 LMIRescue_391ac7ff-9f90-4cad-b200-d1ea20cd8371;LogMeIn Rescue (391ac7ff-9f90-4cad-b200-d1ea20cd8371);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR000B.tmp\LMI_Rescue_srv.exe [28.7.2013 16:31 2570592]
S3 LMIRescue_796396c6-ef97-4e85-a52a-782c471ee2ce;LogMeIn Rescue (796396c6-ef97-4e85-a52a-782c471ee2ce);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR000A.tmp\LMI_Rescue_srv.exe [28.7.2013 16:17 2570592]
S3 LMIRescue_b27ea1d2-3851-4c29-b5b2-00bfaf75611a;LogMeIn Rescue (b27ea1d2-3851-4c29-b5b2-00bfaf75611a);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR000C.tmp\LMI_Rescue_srv.exe [20.8.2013 17:43 2570592]
S3 LMIRescue_eb30bad3-8f1c-44a7-8b74-10db35342de0;LogMeIn Rescue (eb30bad3-8f1c-44a7-8b74-10db35342de0);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0009.tmp\LMI_Rescue_srv.exe [20.7.2013 15:02 2570592]
S4 LMIRescue_25b8023e-94c1-4a98-9c08-04bc13b20828;LogMeIn Rescue (25b8023e-94c1-4a98-9c08-04bc13b20828);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0005.tmp\LMI_Rescue_srv.exe [19.7.2013 20:23 2570592]
S4 LMIRescue_2a132eac-b3f6-4401-ad4d-57df7118dbc9;LogMeIn Rescue (2a132eac-b3f6-4401-ad4d-57df7118dbc9);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0001.tmp\LMI_Rescue_srv.exe [19.7.2013 20:03 2570592]
S4 LMIRescue_3f210bad-2787-4c38-96c1-fa9d220e8150;LogMeIn Rescue (3f210bad-2787-4c38-96c1-fa9d220e8150);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0006.tmp\LMI_Rescue_srv.exe [19.7.2013 20:36 2570592]
S4 LMIRescue_9cb5ae85-6c76-4fb0-ab82-956d017a0c28;LogMeIn Rescue (9cb5ae85-6c76-4fb0-ab82-956d017a0c28);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0008.tmp\LMI_Rescue_srv.exe [20.7.2013 10:58 2570592]
S4 LMIRescue_de44e4bb-4696-477e-92f3-b3a718683581;LogMeIn Rescue (de44e4bb-4696-477e-92f3-b3a718683581);c:\documents and settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0004.tmp\LMI_Rescue_srv.exe [19.7.2013 20:18 2570592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-08-30 18:56 1177552 ----a-w- c:\program files\Google\Chrome\Application\29.0.1547.62\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.bing.com/
TCP: DhcpNameServer = 10.0.0.138
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-09-04 17:41
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG14.00.00.01PROFESSIONAL"="96BF69B2A24B8A8C4FD51275A18331D1D524B2404EACB0D5D92CB78429CA5535F99CC7974DB43C2B4F5557FA2EB772B27D28CEDDFA072202CFF041FE06FD5146720235DB3DABB13EB35D76A4B73AFD9D52B580134F19673FE652F5FEFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA9C6AECB7A5D1407A2D97226D213B555BA7FD869164D6794A2D97226D213B5556EC7FDE352371EFB5FE124C9F066F9100A1A2F9EFDEDEEBD493530FD2927BE5ACC98AA443B2ABF8B2C7C01BBFE2358DA94E474A32BFD00A983FAB0866CDE59EB0E2772D974E75733428528FA1BD5750B8AA240E9146378282B12E96430874E61CB457D482FF86B0116C5E4C7218A47DB57329EEE5ECFE13F468B46F5019955B1C3D83A68813B05F8BB99C51AD025CB7D8A015E658FCB466E7D0CF649CF612C46575C5AC765DE31136F6F9B984CD9FC93D716133416B0B6251ECD6FA3727E92FC8DDFD1253AE8813911C97C231BB3E0B719879475C22D45C8189F687AA1E3CD280F825AF5C2318DC92140C4C9AA8F7DF34781FB7748450B33025F5E7AFBD9A60E2AFCF0E1A5E4EB18C9FE8F52C89FDD4983C6293EC0CD243092059002027DE868D019D647EA06BD6B5245C13628E80F2C91A8407E28F32E81A89782A619BCE5E4993491B50368217F2DE4002461C6A483DA1228A35DB44D5C43B67E2E0C5BF1A63D4169F13FB43F83EAC6347DEF65352CE87D8C4CA663AB6989910F940672E5C29AC6EBF2D6683F98C2650DD5B247DB76ED7BD9C92C27F045C2EE058A996C1E43B2DEEAE6E4D24F5790CF7CF86DC1B6A53C304625797A5001DC2874F1BC0AFB27ACB7F92FE51AA14A52293AE2C67F68F14BD4C7957F2BFB2367A936E2475FE35FD113745D3E36EB712BAABD464B7D9787B8B4988C925EAAA298F3E429F853BD528EC7F4BC32F4E6BE629DC687698E6F86C3B0BA2BEA0919EE481EE0447022775A77BFDE49ED755198626157C074571E82CF3D6D4925F587E674514F67B5DA0045417A56B17F2F6B5B3A6AB63FA4D056846462BA6E41C4B860BCC9187AB0E1CD54450944DCD8E77CD51EBE6C85154BCF86AE3B6D5CA5E673246758E698AEEE583E029156E1CF3E4E4A627948C7C567437BFDFA14849725066F5D64AC91E08E9CAD19CEFD0E2022AC71034CDBEF981AF0C4C762020CC598BC73A9651C695E9F1BBFD090EEE1E758E97320777E9C56AD1A3CA04C4DCF3FB06ED47FE82FD51F56D8079235A49029FA5DF1FAD3C89D294086ACC624D25DF930F02DB111A0458039DE886D37D904C975DD00FBCC9A79224380D619E831F5CB2D20893B927154C525B8C0919E11D89588CB22AB6114E9337CD66E1DB1CA127414DB69B63766D8914A789A558910DEBAC907D53C249CDBB4855B9BF8A4485C"
"OODEFRAG16.00.00.01PROFESSIONAL"="D178F64B240F4B49E312A8E921AE3FADD1DB511A56EB544A95429920B6B2FD2E4435279E29E3D5FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA9C6AECB7A5D1407A2D97226D213B555BA7FD869164D6794A2D97226D213B5552ADF412764FAB7044731249BCC9ADA55C7DA7B8A4E9606129352F4C4EE8D50113C13F67ECFD5F75326BAD82F1AC315CAB6EE25BEF9B6726C1995F57FA3F568148D60D2FC776949BBD1A23018A212E17E0C7971F3DE61886B55C57F2F3FD13BAF44756E7581E04B81969A385784C6A0705F51FCF8390C076F497F5F9131EB073EEA53E82FB97BDE20AA28FCDE8434F5D8ACA2E50E6242718A5AAF66D0902055D370CEE1658E8B2B43242512970B45C522D56AD0E8DE201285521DE79198E26C3126907F46127999CCFDC08EDCA2743F6B1EFB64B151D5725C5F5EBD68A4B9DA51C2956CF5FC41D85398FA0D00FCD1CE06AEFECD85832A653D90DE44DF39BF7060E1ACD50B29705B9F37292B44EB02A778136D3BF56175FB0CDC5EDB767A2242BD7FFCEC8F95AA562F80770DE069BE42FEBB95E087FBA512609E71E89C32232CFE807EE6836528C3B20161D70390525905FD9B76B309BAC006117F543B4F19C8ECA97E7FDADE336491A6BAB7CA9F9D6B3111F43866E24BE87B57C48B29E36FF882A61CF17A6DAC36644627D94C7D95BB56926D65820381AFF6764FFDB6A423E372044E02BF9F8583F81721F10E304253010223C0DB0C977C5C5684A1A46CC7701F365CF377A8C6D3CF3377B60EE33FF9EEC38813BBC2617B4AC61C6DAAB881CE2313E311E65F8A751F1BCBE13BE83E4292A1E5A75E10449D0EF721DFF02B8CECC854D428C2BF817BD1B21233F9B281FC9346544E760237952DFE74F7950AB7819219F30BB7666D3C82BF166C2159E2C14BC343D9A847C9DC5ED5483B2B3FE1063463DB0EE398A65105EFF4D47E1A4EEBC80CF5230C379C2F0C59263338D885379619778CDA3B1898DECF1F3652D1C21CCEF90285AFC7648C56CB68EA3689AA15D5858762A35A4134C7555DDF4E8657B2D24954DF94196B381251BFF31325EE6742D622723924348B2FD646A51D60B159801929162EE90E3C4575AF62B12686B460202F210AEC1BC6358FC9DBD8A90F79366F1590671F3EE3AC230F4FE6AC364C69D56BD9792AADD5319E29DD925440430534FDBA9BC280BE36AC8AD6FC78593D49D3670A5F77BD6AAA88F90B4CF1A82936B31F839D81EEA186C8239A33EEDD5DA0D889A18693ADF960B3264602BCC0E2C19E86DFB0ABB525F50FAA3F3A1C45C7C40688172C61F3BFC26CEA751C8F16EBD78898C60F3697A30EFDC8EB382CA6573D63716506671EB878615A837CE9C682D96A8A3364BA68BF8F76FA4FC7F02C2DC6D9A608B8514928DA27"
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(548)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(1340)
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe
.
**************************************************************************
.
Celkový čas: 2013-09-04 17:44:27 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-09-04 15:44
.
Před spuštěním: Volných bajtů: 31 827 529 728
Po spuštění: Volných bajtů: 31 772 282 880
.
- - End Of File - - CC31C2036297460C824EBF74845A4BB6
413FC2A0C716421B3158746D63736515

[martin krok]

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:49:11, on 4.9.2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\programy\eset\ekrn.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\WINDOWS\system32\svchost.exe
D:\programy\eset\egui.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O4 - HKLM\..\Run: [egui] "D:\programy\eset\egui.exe" /hide /waitservice
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 0013078437
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ESET Service (ekrn) - ESET - D:\programy\eset\ekrn.exe
O23 - Service: LogMeIn Rescue (391ac7ff-9f90-4cad-b200-d1ea20cd8371) (LMIRescue_391ac7ff-9f90-4cad-b200-d1ea20cd8371) - LogMeIn, Inc. - C:\Documents and Settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR000B.tmp\LMI_Rescue_srv.exe
O23 - Service: LogMeIn Rescue (796396c6-ef97-4e85-a52a-782c471ee2ce) (LMIRescue_796396c6-ef97-4e85-a52a-782c471ee2ce) - LogMeIn, Inc. - C:\Documents and Settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR000A.tmp\LMI_Rescue_srv.exe
O23 - Service: LogMeIn Rescue (b27ea1d2-3851-4c29-b5b2-00bfaf75611a) (LMIRescue_b27ea1d2-3851-4c29-b5b2-00bfaf75611a) - LogMeIn, Inc. - C:\Documents and Settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR000C.tmp\LMI_Rescue_srv.exe
O23 - Service: LogMeIn Rescue (eb30bad3-8f1c-44a7-8b74-10db35342de0) (LMIRescue_eb30bad3-8f1c-44a7-8b74-10db35342de0) - LogMeIn, Inc. - C:\Documents and Settings\SMCeleron\Local Settings\Data aplikací\LogMeIn Rescue Applet\LMIR0009.tmp\LMI_Rescue_srv.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

--
End of file - 4270 bytes

[martin krok]

aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-09-04 17:53:19
-----------------------------
17:53:19.937 OS Version: Windows 5.1.2600 Service Pack 3
17:53:19.937 Number of processors: 1 586 0x103
17:53:19.937 ComputerName: CELERON-5D8C779 UserName: SMCeleron
17:53:20.265 Initialize success
17:53:32.453 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0
17:53:32.453 Disk 0 Vendor: WDC_WD16 08.0 Size: 152627MB BusType: 3
17:53:32.515 Disk 0 MBR read successfully
17:53:32.515 Disk 0 MBR scan
17:53:32.515 Disk 0 Windows XP default MBR code
17:53:32.515 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 51999 MB offset 63
17:53:32.515 Disk 0 Partition - 00 0F Extended LBA 100618 MB offset 106494885
17:53:32.531 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 100618 MB offset 106494948
17:53:32.546 Disk 0 scanning sectors +312560640
17:53:32.578 Disk 0 scanning C:\WINDOWS\system32\drivers
17:53:36.593 Service scanning
17:53:44.031 Modules scanning
17:53:49.015 Disk 0 trace - called modules:
17:53:49.015 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll prosync1.sys IdeChnDr.sys
17:53:49.015 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86791ab8]
17:53:49.031 3 CLASSPNP.SYS[f786efd7] -> nt!IofCallDriver -> \Device\00000062[0x86794f18]
17:53:49.031 5 ACPI.sys[f77e5620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0[0x86792030]
17:53:49.031 Scan finished successfully
17:54:35.421 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\SMCeleron\Plocha\MBR.dat"
17:54:35.421 The log file has been saved successfully to "C:\Documents and Settings\SMCeleron\Plocha\aswMBR.txt"

[martin krok]

https://www.virustotal.com/cs/file/667a ... /analysis/

[martin krok]

https://www.virustotal.com/cs/file/55ae ... /analysis/

[martin krok]

tady to maš