PC-HELP.CZ

České diskuzní fórum o počítačích
https://pc-help.cnews.cz/

prosim o check jinak prijdu o nervy.

https://pc-help.cnews.cz/viewtopic.php?f=70&t=36665

Stránka 1 z 1

prosim o check jinak prijdu o nervy.  Vyřešeno

Napsal: 06 úno 2009 14:34
od britanie
Notas je celkově zpomalenej, seká se- na všechno musim klikat 30 x aby se např. zavřelo okno.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:30:37, on 6.2.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ICO.EXE
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.www.daemon-search.com/default
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\WINDOWS\WebIE.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\WINDOWS\WebIE.dll
O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [COMODO SafeSurf] "C:\Program Files\COMODO\SafeSurf\cssurf.exe" -s
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Zobrazit tento odkaz ve Firefoxu - file://C:\Documents and Settings\michala\Data aplikací\Mozilla\Firefox\Profiles\gg17d3pa.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html
O8 - Extra context menu item: Zobrazit tuto stránku ve Firefoxu - file://C:\Documents and Settings\michala\Data aplikací\Mozilla\Firefox\Profiles\gg17d3pa.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\WINDOWS\WebIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 5725995897
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 5726054756
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll C:\WINDOWS\system32\cssdll32.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 9182 bytes

Re: prosim o check jinak prijdu o nervy.

Napsal: 06 úno 2009 19:51
od jaro3
Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Re: prosim o check jinak prijdu o nervy.

Napsal: 07 úno 2009 13:38
od britanie
Nešel mi aktualizovat- přitom firewall byl vyplý- zkoušela jsem asi 3 x vždy to hodilo jen hlášku, že nešlo aktualizovat, ať zkontroluju nastavení firewall.

Malwarebytes' Anti-Malware 1.33
Verze databáze: 1654
Windows 5.1.2600 Service Pack 3

7.2.2009 13:29:11
mbam-log-2009-02-07 (13-29-11).txt

Typ skenu: Rychlý sken
Objektu skenováno: 48065
Uplynulý cas: 3 minute(s), 21 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)
Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)

Re: prosim o check jinak prijdu o nervy.

Napsal: 07 úno 2009 13:47
od jaro3
vypni rez. ochrany NOD32+ štít ST +Comodo firewall.
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

Re: prosim o check jinak prijdu o nervy.

Napsal: 07 úno 2009 15:00
od britanie
ComboFix 09-02-06.01 - michala 2009-02-06 19:56:58.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.1014.595 [GMT 1:00]
Spuštěný z: c:\documents and settings\michala\Plocha\ComboFix.exe
AV: Eset NOD32 Antivirus 2.70 *On-access scanning enabled* (Updated)
FW: COMODO Firewall *enabled*
* Vytvořen nový Bod Obnovení
* Resident AV is active


VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\michala\Data aplikací\inst.exe
c:\windows\system32\Pncrt.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-01-06 do 2009-02-06 )))))))))))))))))))))))))))))))
.

2009-02-06 14:29 . 2009-02-06 14:29 <DIR> d-------- c:\program files\Trend Micro
2009-02-06 14:04 . 2009-02-06 14:05 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Nero
2009-02-06 14:04 . 2009-02-06 14:05 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Nero
2009-02-06 14:04 . 2009-02-06 14:05 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Nero
2009-02-06 13:45 . 2009-02-06 13:45 4,767 --a------ c:\windows\Irremote.ini
2009-02-06 13:40 . 2009-02-06 13:40 <DIR> d-------- c:\program files\Windows Sidebar
2009-02-06 13:20 . 2009-02-06 13:43 <DIR> d-------- c:\program files\Nero
2009-02-06 12:53 . 2009-02-06 12:53 <DIR> d-------- c:\windows\Uninstall
2009-02-06 12:53 . 2009-02-06 12:53 <DIR> d-------- c:\windows\ScrData
2009-02-06 11:37 . 2009-02-06 13:21 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Nero
2009-02-06 11:36 . 2009-02-06 14:02 <DIR> d-------- c:\program files\Common Files\Nero
2009-01-31 11:55 . 2009-01-31 11:55 <DIR> d-------- c:\program files\MSECache
2009-01-25 12:58 . 2009-01-25 12:58 <DIR> d-------- c:\program files\DVD Shrink
2009-01-25 12:58 . 2009-01-25 13:02 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\DVD Shrink
2009-01-24 22:39 . 2009-01-24 22:39 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Sachy
2009-01-24 22:39 . 2009-01-24 22:39 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Sachy
2009-01-24 22:39 . 2009-01-24 22:39 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Sachy
2009-01-18 14:30 . 2009-01-18 14:30 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\vsosdk
2009-01-10 23:20 . 2009-02-06 11:27 <DIR> d-------- c:\program files\Spyware Terminator
2009-01-10 23:20 . 2009-01-26 21:30 <DIR> d-------- c:\program files\Crawler
2009-01-10 23:20 . 2009-02-06 11:00 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Spyware Terminator
2009-01-10 23:20 . 2009-02-06 11:00 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Spyware Terminator
2009-01-10 23:20 . 2009-02-06 11:00 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Spyware Terminator
2009-01-10 23:20 . 2009-02-06 11:27 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Spyware Terminator
2009-01-10 23:20 . 2009-01-10 23:20 142,592 --a------ c:\windows\system32\drivers\sp_rsdrv2.sys
2009-01-08 20:52 . 2009-01-08 20:52 47,360 --a------ c:\windows\system32\drivers\pcouffin.sys
2009-01-08 20:52 . 2009-01-08 20:52 47,360 --a------ c:\documents and settings\michala\Data aplikací\pcouffin.sys
2009-01-08 20:52 . 2009-01-08 20:52 47,360 --a------ c:\documents and settings\michala\Data aplikací\pcouffin.sys
2009-01-08 20:52 . 2009-01-08 20:52 47,360 --a------ c:\documents and settings\michala\Data aplikací\pcouffin.sys
2009-01-08 20:51 . 2009-02-06 19:52 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Vso
2009-01-08 20:51 . 2009-02-06 19:52 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Vso
2009-01-08 20:51 . 2009-02-06 19:52 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Vso
2009-01-08 20:51 . 2006-05-20 16:16 1,184,984 --a------ c:\windows\system32\wvc1dmod.dll
2009-01-08 20:51 . 2006-05-11 19:21 626,688 --a------ c:\windows\system32\vp7vfw.dll
2009-01-08 20:51 . 2006-09-29 12:24 217,127 --a------ c:\windows\system32\drv43260.dll
2009-01-08 20:51 . 2006-09-29 12:25 208,935 --a------ c:\windows\system32\drv33260.dll
2009-01-08 20:51 . 2006-09-29 12:26 176,165 --a------ c:\windows\system32\drv23260.dll
2009-01-08 20:51 . 2002-12-10 02:20 102,439 --a------ c:\windows\system32\sipr3260.dll
2009-01-08 20:51 . 2007-03-18 20:37 65,602 --a------ c:\windows\system32\cook3260.dll
2009-01-08 20:50 . 2009-01-08 20:51 <DIR> d-------- c:\program files\VSO
2009-01-08 20:50 . 2009-01-08 20:50 <DIR> d-------- c:\program files\ConvertX

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-06 17:32 --------- d-----w c:\documents and settings\michala\Data aplikací\uTorrent
2009-02-06 17:32 --------- d-----w c:\documents and settings\michala\Data aplikací\uTorrent
2009-02-06 17:32 --------- d-----w c:\documents and settings\michala\Data aplikací\uTorrent
2009-02-06 13:23 --------- d-----w c:\program files\The KMPlayer
2009-02-06 11:59 --------- d-----w c:\program files\Ahead
2009-02-06 11:04 --------- d-----w c:\documents and settings\michala\Data aplikací\Skype
2009-02-06 11:04 --------- d-----w c:\documents and settings\michala\Data aplikací\Skype
2009-02-06 11:04 --------- d-----w c:\documents and settings\michala\Data aplikací\Skype
2009-02-06 11:03 --------- d-----w c:\documents and settings\michala\Data aplikací\skypePM
2009-02-06 11:03 --------- d-----w c:\documents and settings\michala\Data aplikací\skypePM
2009-02-06 11:03 --------- d-----w c:\documents and settings\michala\Data aplikací\skypePM
2009-01-18 23:02 --------- d-----w c:\program files\pc translator
2008-12-26 09:03 --------- d-----w c:\program files\DAEMON Tools
2008-12-26 08:47 --------- d-----w c:\documents and settings\michala\Data aplikací\DAEMON Tools
2008-12-26 08:47 --------- d-----w c:\documents and settings\michala\Data aplikací\DAEMON Tools
2008-12-26 08:47 --------- d-----w c:\documents and settings\michala\Data aplikací\DAEMON Tools
2008-12-25 23:47 --------- d-----w c:\program files\free-downloads.net
2008-12-25 23:47 --------- d-----w c:\program files\Conduit
2008-12-25 23:45 --------- d-----w c:\program files\Alcohol Soft
2008-12-25 23:30 716,272 ----a-w c:\windows\system32\drivers\sptd.sys
2008-12-13 15:12 --------- d-----w c:\program files\ESET
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-04 15:47 147,192 ----a-w c:\windows\system32\guard32.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2008-02-14 1555480]

[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}]
2008-02-14 14:54 1555480 --a------ c:\program files\free-downloads.net\tbfree.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2008-02-14 1555480]

[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2008-02-14 1555480]

[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-16 1392640]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-07-11 949376]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-02-20 1191936]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"COMODO SafeSurf"="c:\program files\COMODO\SafeSurf\cssurf.exe" [2008-08-29 278264]
"COMODO Firewall Pro"="c:\program files\COMODO\Firewall\cfp.exe" [2008-12-02 1797880]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2009-01-10 2267136]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 c:\windows\stsystra.exe]
"Mouse Suite 98 Daemon"="ICO.EXE" [2004-07-14 c:\windows\system32\ICO.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\michala\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Documents and Settings\\michala\\Plocha\\bulanci.exe"=
"c:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\QIP Infium\\infium.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2008-08-29 101776]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2008-08-29 31504]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-07-11 15424]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2009-01-10 142592]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2004-08-03 69120]
S3 pelmouse;Mouse Suite Driver;c:\windows\system32\drivers\PELMOUSE.SYS [2008-12-24 16512]
S3 pelusblf;USB Mouse Low Filter Driver;c:\windows\system32\drivers\pelusblf.sys [2008-12-24 13824]
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

URLSearchHooks-{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
BHO-{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
HKCU-Run-OEXPRESS - (no file)
HKCU-Run-WEBTRAN - (no file)


.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.www.daemon-search.com/default
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Zobrazit tento odkaz ve Firefoxu - file://c:\documents and settings\michala\Data aplikací\Mozilla\Firefox\Profiles\gg17d3pa.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html
IE: Zobrazit tuto stránku ve Firefoxu - file://c:\documents and settings\michala\Data aplikací\Mozilla\Firefox\Profiles\gg17d3pa.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\windows\WebIE.dll
LSP: c:\windows\system32\imon.dll
FF - ProfilePath - c:\documents and settings\michala\Data aplikací\Mozilla\Firefox\Profiles\gg17d3pa.default\
FF - prefs.js: browser.startup.homepage - seznam.cz
FF - prefs.js: network.proxy.http - devetsil.vse.cz
FF - prefs.js: network.proxy.http_port - 5555
FF - prefs.js: network.proxy.type - 4

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-06 20:01:29
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(948)
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'lsass.exe'(1004)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\COMODO\Firewall\cmdagent.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\program files\ESET\nod32krn.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\igfxsrvc.exe
.
**************************************************************************
.
Celkový čas: 2009-02-06 20:03:46 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-02-06 19:03:42

Před spuštěním: Volných bajtů: 51 453 390 848
Po spuštění: Volných bajtů: 53,452,832,768

202 --- E O F --- 2009-02-01 14:09:07

Re: prosim o check jinak prijdu o nervy.

Napsal: 07 úno 2009 16:39
od jaro3
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

DirLook::
c:\windows\Uninstall

Registry::
[-HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
[-HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
[-HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Re: prosim o check jinak prijdu o nervy.

Napsal: 07 úno 2009 22:25
od britanie
ComboFix 09-02-06.01 - michala 2009-02-07 22:18:11.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.1014.656 [GMT 1:00]
Spuštěný z: c:\documents and settings\michala\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\michala\Plocha\CFScript.txt
AV: Eset NOD32 Antivirus 2.70 *On-access scanning enabled* (Updated)
FW: COMODO Firewall *enabled*
* Vytvořen nový Bod Obnovení
* Resident AV is active


VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((( Soubory vytvořené od 2009-01-07 do 2009-02-07 )))))))))))))))))))))))))))))))
.

2009-02-07 22:00 . 2009-02-07 22:00 <DIR> d-------- c:\program files\MSXML 4.0
2009-02-07 13:24 . 2009-02-07 13:24 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Malwarebytes
2009-02-07 13:24 . 2009-02-07 13:24 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Malwarebytes
2009-02-07 13:24 . 2009-02-07 13:24 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Malwarebytes
2009-02-07 13:23 . 2009-02-07 13:24 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-07 13:23 . 2009-02-07 13:23 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2009-02-07 13:23 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-07 13:23 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-06 14:29 . 2009-02-06 14:29 <DIR> d-------- c:\program files\Trend Micro
2009-02-06 14:04 . 2009-02-06 14:05 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Nero
2009-02-06 14:04 . 2009-02-06 14:05 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Nero
2009-02-06 14:04 . 2009-02-06 14:05 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Nero
2009-02-06 13:45 . 2009-02-06 13:45 4,767 --a------ c:\windows\Irremote.ini
2009-02-06 13:40 . 2009-02-06 13:40 <DIR> d-------- c:\program files\Windows Sidebar
2009-02-06 13:20 . 2009-02-06 13:43 <DIR> d-------- c:\program files\Nero
2009-02-06 12:53 . 2009-02-06 12:53 <DIR> d-------- c:\windows\Uninstall
2009-02-06 12:53 . 2009-02-06 12:53 <DIR> d-------- c:\windows\ScrData
2009-02-06 11:37 . 2009-02-06 13:21 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Nero
2009-02-06 11:36 . 2009-02-06 14:02 <DIR> d-------- c:\program files\Common Files\Nero
2009-01-31 11:55 . 2009-01-31 11:55 <DIR> d-------- c:\program files\MSECache
2009-01-25 12:58 . 2009-01-25 12:58 <DIR> d-------- c:\program files\DVD Shrink
2009-01-25 12:58 . 2009-01-25 13:02 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\DVD Shrink
2009-01-24 22:39 . 2009-01-24 22:39 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Sachy
2009-01-24 22:39 . 2009-01-24 22:39 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Sachy
2009-01-24 22:39 . 2009-01-24 22:39 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Sachy
2009-01-18 14:30 . 2009-01-18 14:30 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\vsosdk
2009-01-10 23:20 . 2009-02-06 11:27 <DIR> d-------- c:\program files\Spyware Terminator
2009-01-10 23:20 . 2009-01-26 21:30 <DIR> d-------- c:\program files\Crawler
2009-01-10 23:20 . 2009-02-06 11:00 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Spyware Terminator
2009-01-10 23:20 . 2009-02-06 11:00 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Spyware Terminator
2009-01-10 23:20 . 2009-02-06 11:00 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Spyware Terminator
2009-01-10 23:20 . 2009-02-06 11:27 <DIR> d-------- c:\documents and settings\All Users\Data aplikací\Spyware Terminator
2009-01-10 23:20 . 2009-01-10 23:20 142,592 --a------ c:\windows\system32\drivers\sp_rsdrv2.sys
2009-01-08 20:52 . 2009-01-08 20:52 47,360 --a------ c:\windows\system32\drivers\pcouffin.sys
2009-01-08 20:52 . 2009-01-08 20:52 47,360 --a------ c:\documents and settings\michala\Data aplikací\pcouffin.sys
2009-01-08 20:52 . 2009-01-08 20:52 47,360 --a------ c:\documents and settings\michala\Data aplikací\pcouffin.sys
2009-01-08 20:52 . 2009-01-08 20:52 47,360 --a------ c:\documents and settings\michala\Data aplikací\pcouffin.sys
2009-01-08 20:51 . 2009-02-06 19:52 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Vso
2009-01-08 20:51 . 2009-02-06 19:52 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Vso
2009-01-08 20:51 . 2009-02-06 19:52 <DIR> d-------- c:\documents and settings\michala\Data aplikací\Vso
2009-01-08 20:51 . 2006-05-20 16:16 1,184,984 --a------ c:\windows\system32\wvc1dmod.dll
2009-01-08 20:51 . 2006-05-11 19:21 626,688 --a------ c:\windows\system32\vp7vfw.dll
2009-01-08 20:51 . 2006-09-29 12:24 217,127 --a------ c:\windows\system32\drv43260.dll
2009-01-08 20:51 . 2006-09-29 12:25 208,935 --a------ c:\windows\system32\drv33260.dll
2009-01-08 20:51 . 2006-09-29 12:26 176,165 --a------ c:\windows\system32\drv23260.dll
2009-01-08 20:51 . 2002-12-10 02:20 102,439 --a------ c:\windows\system32\sipr3260.dll
2009-01-08 20:51 . 2007-03-18 20:37 65,602 --a------ c:\windows\system32\cook3260.dll
2009-01-08 20:50 . 2009-01-08 20:51 <DIR> d-------- c:\program files\VSO
2009-01-08 20:50 . 2009-01-08 20:50 <DIR> d-------- c:\program files\ConvertX

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-06 17:32 --------- d-----w c:\documents and settings\michala\Data aplikací\uTorrent
2009-02-06 17:32 --------- d-----w c:\documents and settings\michala\Data aplikací\uTorrent
2009-02-06 17:32 --------- d-----w c:\documents and settings\michala\Data aplikací\uTorrent
2009-02-06 13:23 --------- d-----w c:\program files\The KMPlayer
2009-02-06 11:59 --------- d-----w c:\program files\Ahead
2009-02-06 11:04 --------- d-----w c:\documents and settings\michala\Data aplikací\Skype
2009-02-06 11:04 --------- d-----w c:\documents and settings\michala\Data aplikací\Skype
2009-02-06 11:04 --------- d-----w c:\documents and settings\michala\Data aplikací\Skype
2009-02-06 11:03 --------- d-----w c:\documents and settings\michala\Data aplikací\skypePM
2009-02-06 11:03 --------- d-----w c:\documents and settings\michala\Data aplikací\skypePM
2009-02-06 11:03 --------- d-----w c:\documents and settings\michala\Data aplikací\skypePM
2009-01-18 23:02 --------- d-----w c:\program files\pc translator
2008-12-26 09:03 --------- d-----w c:\program files\DAEMON Tools
2008-12-26 08:47 --------- d-----w c:\documents and settings\michala\Data aplikací\DAEMON Tools
2008-12-26 08:47 --------- d-----w c:\documents and settings\michala\Data aplikací\DAEMON Tools
2008-12-26 08:47 --------- d-----w c:\documents and settings\michala\Data aplikací\DAEMON Tools
2008-12-25 23:47 --------- d-----w c:\program files\free-downloads.net
2008-12-25 23:47 --------- d-----w c:\program files\Conduit
2008-12-25 23:45 --------- d-----w c:\program files\Alcohol Soft
2008-12-25 23:30 716,272 ----a-w c:\windows\system32\drivers\sptd.sys
2008-12-13 15:12 --------- d-----w c:\program files\ESET
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-04 15:47 147,192 ----a-w c:\windows\system32\guard32.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of c:\windows\Uninstall ----

2008-10-04 15:15 72162 --a------ c:\windows\Uninstall\unins000.exe


((((((((((((((((((((((((((((( SnapShot@2009-02-06_20.02.55.01 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-07 21:00:09 32,768 ----a-r c:\windows\Installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}\icon.exe
- 2003-04-18 15:46:22 1,233,920 ----a-w c:\windows\system32\msxml4.dll
+ 2008-09-30 15:43:34 1,286,152 ----a-w c:\windows\system32\msxml4.dll
- 2009-02-06 14:51:27 75,254 ----a-w c:\windows\system32\perfc005.dat
+ 2009-02-07 21:02:40 75,254 ----a-w c:\windows\system32\perfc005.dat
- 2009-02-06 14:51:27 63,862 ----a-w c:\windows\system32\perfc009.dat
+ 2009-02-07 21:02:40 63,862 ----a-w c:\windows\system32\perfc009.dat
- 2009-02-06 14:51:27 404,108 ----a-w c:\windows\system32\perfh005.dat
+ 2009-02-07 21:02:40 404,108 ----a-w c:\windows\system32\perfh005.dat
- 2009-02-06 14:51:27 406,662 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-07 21:02:40 406,662 ----a-w c:\windows\system32\perfh009.dat
+ 2008-09-30 15:42:08 1,286,152 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf\msxml4.dll
+ 2008-09-30 15:45:12 91,656 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-16 1392640]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-07-11 949376]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-02-20 1191936]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"COMODO SafeSurf"="c:\program files\COMODO\SafeSurf\cssurf.exe" [2008-08-29 278264]
"COMODO Firewall Pro"="c:\program files\COMODO\Firewall\cfp.exe" [2008-12-02 1797880]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2009-01-10 2267136]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 c:\windows\stsystra.exe]
"Mouse Suite 98 Daemon"="ICO.EXE" [2004-07-14 c:\windows\system32\ICO.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\michala\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Documents and Settings\\michala\\Plocha\\bulanci.exe"=
"c:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\QIP Infium\\infium.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2008-08-29 101776]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2008-08-29 31504]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2008-07-11 15424]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2009-01-10 142592]
R3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\drivers\psched.sys [2004-08-03 69120]
S3 pelmouse;Mouse Suite Driver;c:\windows\system32\drivers\PELMOUSE.SYS [2008-12-24 16512]
S3 pelusblf;USB Mouse Low Filter Driver;c:\windows\system32\drivers\pelusblf.sys [2008-12-24 13824]
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

URLSearchHooks-{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
BHO-{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
Toolbar-{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
WebBrowser-{ECDEE021-0D17-467F-A1FF-C7A115230949} - (no file)


.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.www.daemon-search.com/default
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Zobrazit tento odkaz ve Firefoxu - file://c:\documents and settings\michala\Data aplikací\Mozilla\Firefox\Profiles\gg17d3pa.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html
IE: Zobrazit tuto stránku ve Firefoxu - file://c:\documents and settings\michala\Data aplikací\Mozilla\Firefox\Profiles\gg17d3pa.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\windows\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\windows\WebIE.dll
LSP: c:\windows\system32\imon.dll
FF - ProfilePath - c:\documents and settings\michala\Data aplikací\Mozilla\Firefox\Profiles\gg17d3pa.default\
FF - prefs.js: browser.startup.homepage - seznam.cz
FF - prefs.js: network.proxy.http - devetsil.vse.cz
FF - prefs.js: network.proxy.http_port - 5555
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-07 22:19:57
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(948)
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'lsass.exe'(1004)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll
.
Celkový čas: 2009-02-07 22:21:19
ComboFix-quarantined-files.txt 2009-02-07 21:21:15
ComboFix2.txt 2009-02-06 19:03:47

Před spuštěním: Volných bajtů: 53 380 841 472
Po spuštění: Volných bajtů: 53,488,013,312

202 --- E O F --- 2009-02-07 21:00:10

Re: prosim o check jinak prijdu o nervy.

Napsal: 07 úno 2009 22:27
od britanie
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:23:50, on 7.2.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ICO.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.www.daemon-search.com/default
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\WINDOWS\WebIE.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\WINDOWS\WebIE.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [COMODO SafeSurf] "C:\Program Files\COMODO\SafeSurf\cssurf.exe" -s
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Zobrazit tento odkaz ve Firefoxu - file://C:\Documents and Settings\michala\Data aplikací\Mozilla\Firefox\Profiles\gg17d3pa.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html
O8 - Extra context menu item: Zobrazit tuto stránku ve Firefoxu - file://C:\Documents and Settings\michala\Data aplikací\Mozilla\Firefox\Profiles\gg17d3pa.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\WINDOWS\WebIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\WINDOWS\WebIE.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 5725995897
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 5726054756
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 8250 bytes

Re: prosim o check jinak prijdu o nervy.

Napsal: 08 úno 2009 08:54
od jaro3
Odinstaluj: Ask Toolbar

Poté
Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:

Kód: Vybrat vše

O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)


ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš>spustíš

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.

Aktualizuj javu:
Java SE Runtime Environment 6u11
Vyber OS ( předpokládám Windows), zatržítko agree-continue
Vyber:
Windows Offline Installation
jre-6u11-windows-i586-p.exe
Ostatní javy odeber v přidat/odebrat programy.

Pokud nejsou problémy , je to vše.

Re: prosim o check jinak prijdu o nervy.

Napsal: 08 úno 2009 14:41
od britanie
Vypadá to dobře, díky moc....
Časové pásmo: UTC+02:00
Stránka 1 z 1
Powered by phpBB® Forum Software © phpBB Limited
https://www.phpbb.com/