PC-HELP.CZ

Zdravím, asi 10 dní se potýkám s velmi pomalými reakcemi u PC (před tím v poho), žádný virus apod jsem nezaznamenal, nic většího jsem neinstaloval nebo naopak.. apod. Proto moc prosím o kontrolu logu, zda v PC nemám něco, co nechci..Děkuji předem:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:48:51, on 31.8.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\Morák\Dokumenty\qolihu.exe
C:\PROGRA~1\TWINTO~1\MouseElf.EXE
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\IEPro\MiniDM.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: WinAVI FLVSense - {E8DF67A1-B618-4F3F-9E7C-CBE175ADEF5B} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [qolihu] "C:\Documents and Settings\Morák\Dokumenty\qolihu.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\TWINTO~1\MouseElf.EXE
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download FLV by WinAVI... - C:\Program Files\WinAVI FLV Converter\flv_link.htm
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: WinAVI FLV Manager - {DE365254-2F9B-4908-9E3A-7AAA6EC90BCC} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll
O9 - Extra 'Tools' menuitem: WinAVI FLV Manager - {DE365254-2F9B-4908-9E3A-7AAA6EC90BCC} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ6.5\ICQ.exe
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resour ... se6662.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 5126700015
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDow ... rtScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5A6EC6F1-F981-4E87-BD3C-7EE606CB58ED}: NameServer = 156.154.70.25,156.154.71.25
O17 - HKLM\System\CS4\Services\Tcpip\..\{5A6EC6F1-F981-4E87-BD3C-7EE606CB58ED}: NameServer = 217.197.144.4,192.168.0.17
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 8385 bytes

Děkuji, pěkný večer.

Spusť HJT (HijackThis), vypni prohlížeče, odpoj se od internetu a fixni (spustit HJT, "Do a system scan only",
zatrhnout políčko před hodnotou, zmáčknout "Fix checked" a poté "Ano"):

O4 - HKLM\..\Run: [qolihu] "C:\Documents and Settings\Morák\Dokumenty\qolihu.exe"
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)


Center OAK Plaza, přes to se připojuješ? Nebo přes NWT?
*****************************************************************************************************************************************
Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Jo jo, díky za velmi rychlou reakci - VŠE jsem udělal dle tvého návodu. Připojuji se přes NWT ! Je tam nějaký problém? Díky

Malwarebytes' Anti-Malware 1.40
Verze databáze: 2722
Windows 5.1.2600 Service Pack 2

31.8.2009 21:27:36
mbam-log-2009-08-31 (21-27-28).txt

Typ skenu: Rychlý sken
Objektu skenováno: 88278
Uplynulý cas: 8 minute(s), 43 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 2
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> No action taken.

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
C:\Program Files\ICQToolbar\toolbaru.dll (Trojan.BHO) -> No action taken.

Takže spusť znovu MbAM a dej Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Vypni rezidentní štít antiviru (pokud máš tak i antispyware).
Stáhni si ComboFix (by sUBs)
nebo ComboFix (subs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

Takže tady to je: (a co prosím to připojení NWT vers. to druhé..? jak jsi psal, je to nějaký problém?) Díky mooooc

Malwarebytes' Anti-Malware 1.40
Verze databáze: 2722
Windows 5.1.2600 Service Pack 2

31.8.2009 22:00:59
mbam-log-2009-08-31 (22-00-59).txt

Typ skenu: Rychlý sken
Objektu skenováno: 88678
Uplynulý cas: 9 minute(s), 43 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 2
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Trojan.BHO) -> Quarantined and deleted successfully.

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
C:\Program Files\ICQToolbar\toolbaru.dll (Trojan.BHO) -> Quarantined and deleted successfully.


A teď Combo Fix:

ComboFix 09-08-31.03 - Morák 31.08.2009 22:08.2.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.767.514 [GMT 2:00]
Spuštěný z: c:\documents and settings\Morák\Plocha\ComboFix.exe
AV: COMODO Antivirus *On-access scanning disabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: COMODO Firewall *disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
FW: Outpost Firewall Pro *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Fonts\img hearts.ttf
c:\windows\Fonts\img travel.ttf
c:\windows\Installer\132cff.msi
c:\windows\Installer\14f5bd.msi
c:\windows\Installer\1fab22.msi
c:\windows\Installer\2b07b2.msp
c:\windows\Installer\41db24.msp
c:\windows\Installer\e1664.msp
c:\windows\Installer\e1679.msp
c:\windows\Installer\e168e.msp
c:\windows\regedit.com
c:\windows\system32\ctfmon .exe
c:\windows\system32\Drivers\jzsa.sys
c:\windows\system32\drivers\npf.sys
c:\windows\system32\HHActiveX(2).dll
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\taskmgr.com
c:\windows\system32\wpcap.dll
c:\windows\vmreg32.dll

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF
-------\Service_swxoyo


((((((((((((((((((((((((( Soubory vytvořené od 2009-07-28 do 2009-08-31 )))))))))))))))))))))))))))))))
.

2009-08-31 19:16 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-31 19:16 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-31 19:16 . 2009-08-31 19:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-28 21:01 . 2009-08-28 21:01 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-08-28 20:59 . 2009-08-28 20:59 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-08-28 20:53 . 2009-08-07 08:48 100352 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-08-28 20:32 . 2009-07-03 16:59 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-08-28 20:32 . 2009-07-03 16:59 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-08-28 20:15 . 2009-08-28 20:30 -------- dc-h--w- c:\windows\ie8
2009-08-27 19:49 . 2009-08-27 19:49 -------- d-----w- c:\program files\proDAD
2009-08-27 19:49 . 2004-03-29 14:23 90112 ----a-w- c:\windows\unvise32.exe
2009-08-27 19:49 . 2009-08-27 19:49 -------- d-----w- c:\program files\LooksBuilderSE
2009-08-27 19:46 . 2003-07-01 14:49 69632 ------w- c:\windows\system32\MtxPreview.dll
2009-08-27 19:46 . 2003-07-01 14:49 49152 ------w- c:\windows\system32\MtxParhBFXPreview.dll
2009-08-27 19:46 . 2003-06-26 08:04 237568 ------w- c:\windows\system32\qtmlClient.dll
2009-08-27 19:46 . 2003-01-20 07:08 49152 ------w- c:\windows\system32\CvoAPI.dll
2009-08-27 19:43 . 2009-08-27 19:45 -------- d-----w- c:\program files\Boris FX, Inc
2009-08-27 19:27 . 2005-09-23 21:18 171520 ------w- c:\windows\system32\drivers\MarvinBus.sys
2009-08-27 19:19 . 2009-08-27 21:16 -------- d-----w- c:\program files\Pinnacle
2009-08-25 20:10 . 2009-08-25 20:11 -------- d-----w- c:\program files\OpenOffice.org 3
2009-08-24 04:41 . 2009-08-30 20:58 -------- d-----w- c:\program files\Advanced SystemCare 3
2009-08-23 12:16 . 2009-08-30 20:57 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat
2009-08-23 11:22 . 2009-08-25 19:02 179792 ------w- c:\windows\system32\guard32.dll
2009-08-23 11:22 . 2009-08-25 19:01 87104 ------w- c:\windows\system32\drivers\inspect.sys
2009-08-23 11:22 . 2009-08-25 19:01 25160 ------w- c:\windows\system32\drivers\cmdhlp.sys
2009-08-23 11:22 . 2009-08-25 19:01 132168 ------w- c:\windows\system32\drivers\cmdguard.sys
2009-08-23 11:22 . 2009-08-23 11:22 -------- d-----w- c:\program files\COMODO
2009-08-23 04:52 . 2009-08-23 04:52 -------- d-----w- c:\program files\FastStone Image Viewer
2009-08-21 03:49 . 2004-07-26 08:01 61440 ------w- c:\windows\system32\KBHook.dll
2009-08-21 03:49 . 2003-12-30 08:02 49152 ------w- c:\windows\system32\TaskKeyHook.dll
2009-08-21 03:49 . 2004-09-15 07:53 8576 ------w- c:\windows\system32\drivers\GMFILTR.SYS
2009-08-21 03:49 . 2004-04-19 05:01 6656 ------w- c:\windows\system32\drivers\gflmouhid.sys
2009-08-21 03:49 . 2009-08-21 03:49 -------- d-----w- c:\program files\TwinTouch Optical Office
2009-08-20 20:33 . 1996-10-30 07:35 32768 ------w- c:\windows\system32\PLUGIN.DLL
2009-08-20 20:33 . 1994-11-17 23:00 210944 ------w- c:\windows\system32\MSVCRT10.DLL
2009-08-15 19:28 . 2009-08-15 19:30 6181829 ----a-w- c:\windows\REGBK04.ZIP
2009-08-15 19:13 . 2009-08-15 19:13 -------- d-----w- c:\windows\system32\runouce.exe
2009-08-12 15:16 . 2009-08-12 15:16 -------- d-----w- c:\windows\ServicePackFiles
2009-08-10 20:02 . 2002-12-10 03:17 45056 ------w- c:\windows\system32\Whoru.dll
2009-08-06 10:28 . 2009-08-06 10:35 -------- d-----w- c:\program files\Microsoft Bootvis

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-31 20:00 . 2007-07-24 10:18 -------- d-----w- c:\program files\ICQToolbar
2009-08-29 12:19 . 2008-06-07 18:37 -------- d-----w- c:\program files\SopCast
2009-08-29 12:11 . 2008-07-26 11:32 -------- d-----w- c:\program files\TVUPlayer
2009-08-29 11:23 . 2008-01-17 20:46 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-08-27 19:43 . 2007-03-27 09:04 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-27 19:36 . 2001-10-25 12:00 90546 ------w- c:\windows\system32\perfc005.dat
2009-08-27 19:36 . 2001-10-25 12:00 458370 ------w- c:\windows\system32\perfh005.dat
2009-08-24 05:01 . 2009-05-19 19:07 -------- d-----w- c:\program files\Sothink Video Encoder for Adobe Flash
2009-08-24 05:01 . 2009-05-17 05:26 -------- d-----w- c:\program files\WinAVI Video Converter 9.0
2009-08-24 05:01 . 2009-02-25 11:48 -------- d-----w- c:\program files\WinHTTrack
2009-08-24 05:01 . 2008-12-07 20:06 -------- d-----w- c:\program files\DVDFab 5
2009-08-24 05:01 . 2008-10-02 18:52 -------- d-----w- c:\program files\TVAnts
2009-08-23 11:13 . 2009-06-24 10:27 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-08-23 09:37 . 2007-03-27 08:45 -------- d-----w- c:\program files\Common Files\ACD Systems
2009-08-16 11:59 . 2009-05-21 19:16 -------- d-----w- c:\program files\Ashampoo
2009-08-05 09:07 . 2004-08-17 13:49 205312 ------w- c:\windows\system32\mswebdvd.dll
2009-08-03 11:26 . 2008-12-18 05:40 -------- d-----w- c:\program files\Microsoft Silverlight
2009-08-02 19:58 . 2008-06-13 03:19 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-17 18:57 . 2004-08-17 13:49 58880 ------w- c:\windows\system32\atl.dll
2009-07-14 19:29 . 2008-11-25 13:58 -------- d-----w- c:\program files\Combined Community Codec Pack
2009-07-13 21:43 . 2004-08-17 13:49 286208 ------w- c:\windows\system32\wmpdxm.dll
2009-07-03 16:59 . 2004-08-17 13:49 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-27 18:45 . 2009-06-27 18:45 971552 ------w- c:\windows\system32\drivers\tdrpm174.sys
2009-06-27 18:45 . 2009-06-27 18:45 540000 ------w- c:\windows\system32\drivers\timntr.sys
2009-06-27 18:45 . 2009-06-27 18:45 44704 ------w- c:\windows\system32\drivers\tifsfilt.sys
2009-06-27 18:45 . 2009-06-27 18:45 134272 ------w- c:\windows\system32\drivers\snman380.sys
2009-06-25 18:37 . 2004-08-17 13:49 95744 ------w- c:\windows\system32\mqsec.dll
2009-06-25 18:37 . 2004-08-17 13:49 517120 ------w- c:\windows\system32\mqsnap.dll
2009-06-25 18:37 . 2004-08-17 13:49 489472 ------w- c:\windows\system32\mqutil.dll
2009-06-25 18:37 . 2004-08-17 13:49 48640 ------w- c:\windows\system32\mqupgrd.dll
2009-06-25 18:37 . 2004-08-17 13:49 186880 ------w- c:\windows\system32\mqtrig.dll
2009-06-25 18:37 . 2004-08-17 13:49 123392 ------w- c:\windows\system32\mqrtdep.dll
2009-06-25 18:37 . 2004-08-17 13:49 661504 ------w- c:\windows\system32\mqqm.dll
2009-06-25 18:37 . 2004-08-17 13:49 47104 ------w- c:\windows\system32\mqdscli.dll
2009-06-25 18:37 . 2004-08-17 13:49 225280 ------w- c:\windows\system32\mqoa.dll
2009-06-25 18:37 . 2004-08-17 13:49 177152 ------w- c:\windows\system32\mqrt.dll
2009-06-25 18:37 . 2004-08-17 13:49 16896 ------w- c:\windows\system32\mqise.dll
2009-06-25 18:37 . 2004-08-17 13:49 138240 ------w- c:\windows\system32\mqad.dll
2009-06-25 08:48 . 2004-08-17 13:49 59392 ------w- c:\windows\system32\wdigest.dll
2009-06-25 08:48 . 2004-08-17 13:49 56320 ------w- c:\windows\system32\secur32.dll
2009-06-25 08:48 . 2004-08-17 13:49 168448 ------w- c:\windows\system32\schannel.dll
2009-06-25 08:48 . 2004-08-17 13:49 133632 ------w- c:\windows\system32\msv1_0.dll
2009-06-25 08:48 . 2004-08-17 13:49 723456 ------w- c:\windows\system32\lsasrv.dll
2009-06-25 08:48 . 2004-08-17 13:49 298496 ------w- c:\windows\system32\kerberos.dll
2009-06-22 11:49 . 2004-08-17 13:49 19968 ------w- c:\windows\system32\mqbkup.exe
2009-06-22 11:49 . 2004-08-17 13:49 117248 ------w- c:\windows\system32\mqtgsvc.exe
2009-06-22 11:49 . 2004-08-17 13:49 4608 ------w- c:\windows\system32\mqsvc.exe
2009-06-22 11:48 . 2004-08-03 20:58 91776 ------w- c:\windows\system32\drivers\mqac.sys
2009-06-22 11:34 . 2004-08-03 20:59 92544 ------w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:55 . 2004-08-17 13:49 119808 ------w- c:\windows\system32\t2embed.dll
2009-06-16 14:55 . 2001-10-25 12:00 82432 ------w- c:\windows\system32\fontsub.dll
2009-06-15 11:33 . 2004-08-17 13:49 78336 ------w- c:\windows\system32\telnet.exe
2009-06-15 11:33 . 2004-08-17 13:49 81408 ------w- c:\windows\system32\tlntsess.exe
2009-06-10 14:24 . 2004-08-17 13:49 84992 ------w- c:\windows\system32\avifil32.dll
2009-06-10 06:31 . 2004-08-17 13:49 132096 ------w- c:\windows\system32\wkssvc.dll
2009-06-05 07:46 . 2007-03-24 09:07 655872 ------w- c:\windows\system32\mstscax.dll
2009-06-03 19:27 . 2004-08-17 13:49 1293312 ------w- c:\windows\system32\quartz.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmartRAM"="c:\program files\Advanced SystemCare 3\Sup_SmartRAM.exe" [2009-02-19 202064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"mouseElf"="c:\progra~1\TWINTO~1\MouseElf.EXE" [2004-11-16 196608]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-08-25 1796368]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" -autorun
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
"Google Update"="c:\documents and settings\Morák\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
"OEXPRESS"=c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"SmartRAM"="c:\program files\Advanced SystemCare 3\Sup_SmartRAM.exe" /m

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"nwiz"=nwiz.exe /install
"TrueImageMonitor.exe"=c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe"
"AcronisTimounterMonitor"=c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\ICQ6\\ICQ6.5\\ICQ.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IEPro\\MiniDM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 snapman380;Acronis Snapshots Manager (Build 380);c:\windows\system32\drivers\snman380.sys [27.6.2009 20:45 134272]
R0 tdrpman174;Acronis Try&Decide and Restore Points filter (build 174);c:\windows\system32\drivers\tdrpm174.sys [27.6.2009 20:45 971552]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [24.3.2007 11:44 77312]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [23.8.2009 13:22 132168]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [23.8.2009 13:22 25160]
R3 genmcmnUSB;USB Scroll Mouse Driver;c:\windows\system32\drivers\gflmouhid.sys [21.8.2009 5:49 6656]
S3 CrystalSysInfo;CrystalSysInfo;c:\program files\MediaCoder\SysInfo.sys [25.9.2007 16:59 15152]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [13.4.2008 21:36 13352]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
mSearch Bar = hxxp://www.google.com/ie
IE: &Download FLV by WinAVI... - c:\program files\WinAVI FLV Converter\flv_link.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
TCP: {5A6EC6F1-F981-4E87-BD3C-7EE606CB58ED} = 156.154.70.25,156.154.71.25
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-31 22:16
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-299502267-682003330-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,25,43,cf,3a,92,
d8,c6,4e,c8,28,51,af,b0,29,a3,98,d5,5d,ba,af,b5,3a,47,f0,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,d0,d5,e2,21,57,
4f,e1,70,71,3b,04,66,8b,46,0d,96,1c,56,97,38,6f,10,70,30,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,c6,4d,14,7f,99,
0b,fb,37,25,da,ec,7e,55,20,c9,26,d3,0b,31,93,cd,cb,44,58,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,a9,24,83,bf,37,
32,86,94,3e,1e,9e,e0,57,5a,93,61,f7,0e,11,6a,c8,c6,cf,ee,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,3c,d8,c2,cd,98,
8d,68,d7,cd,44,cd,b9,a6,33,6c,cd,49,d1,bd,eb,29,be,ea,4a,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,80,78,b5,61,d1,
d3,9a,d1,b0,18,ed,a7,3f,8d,37,a4,7a,20,20,a0,dc,d3,85,40,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,94,aa,40,2e,98,
78,f5,0a,31,77,e1,ba,b1,f8,68,02,35,e1,92,77,40,2e,07,e7,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,1c,64,64,8e,d8,
cd,80,44,83,6c,56,8b,a0,85,96,ab,ce,f6,90,f6,08,30,04,30,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:b2,46,9a,e2,1b,fe,1b,94,d3,5e,34,c5,c0,
4b,d6,d4,51,fa,6e,91,28,9e,14,cc,ec,ff,a8,b9,7f,e1,7b,a3,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:37,a4,aa,c3,a6,15,56,0a,1d,b4,24,ac,f2,
32,fd,7e,b1,cd,45,5a,a8,c4,f8,b9,f8,38,ea,3d,d5,da,a9,64,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,2e,c5,42,45,f2,
e5,6f,ca,e3,0e,66,d5,eb,bc,2f,6b,2f,94,c7,03,a1,0b,38,88,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,38,c1,43,6b,ae,
25,cf,4f,fa,ea,66,7f,d4,3b,6b,70,11,7c,60,5a,1b,08,03,6c,6c,43,2d,1e,aa,22,\

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3084)
c:\windows\system32\WhoRU.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\COMODO\COMODO Internet Security\cmdagent.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
.
**************************************************************************
.
Celkový čas: 2009-08-31 22:22 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-08-31 20:22
ComboFix2.txt 2007-11-05 13:18

Před spuštěním: Volných bajtů: 66 630 184 960
Po spuštění: Volných bajtů: 66 504 859 648

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /tutag=bsaxq7 /NoExecute=OptIn

Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5
334 --- E O F --- 2009-08-28 20:54

Máš tam toto:

156.154.70.25
Address: 45980 Center Oak Plaza
Address: Network Operations Center

a toto:
156.154.71.25
Address: 45980 Center Oak Plaza
Address: Network Operations Center

a toto:
217.197.144.4
org-name: NWT Computer s.r.o.
address: NWT Computer s.r.o.
address: Ivo S..... - ONLINE
address: B....
address: 739.......
address: Czech Republic
org-name: NWT Computer s.r.o.
address: NWT Computer s.r.o.


Znáš tyto IP nebo Domény? (tzn tvůj poskytovatel připojení nebo tvůj přístupovej bod) předpokládám, že NWT znáš a to nad tím?
*****************************************************************************************************************************************
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
c:\windows\REGBK04.ZIP

Folder::
c:\windows\system32\runouce.exe

RegNull::
[HKEY_USERS\S-1-5-21-299502267-682003330-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]




Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT a popiš chování počítače

Takže je to v pr... Když jsem dal dle tvé rady kopírovat ten soubot .txt do Combo Fix, vyskočili mi tyto okna antiviráku (příloha)

Log z Combo mi vůbec nejde vytvořit...Při kopírování mi vyskakují okna toho antiviru..






Tak teď nevím co s tím

TO DAMNED:

TOTO Vůbec neznám:

156.154.70.25
Address: 45980 Center Oak Plaza
Address: Network Operations Center

a toto:
156.154.71.25
Address: 45980 Center Oak Plaza
Address: Network Operations Center

Mám připojení přes NWT, nic víc...

Musíš vypnout antivir, po skončení práce s ComboFixem si ho zase zapni. A nejedná se o viry, ale program zasahuje do registru, tak ho tak COMODO hodnotí.

Jo jo já blb.. Tady jsou logy:

ComboFix 09-08-31.03 - Morák 31.08.2009 23:22.3.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.767.526 [GMT 2:00]
Spuštěný z: c:\documents and settings\Morák\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Morák\Plocha\CFScript.txt
AV: COMODO Antivirus *On-access scanning disabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: COMODO Firewall *disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
FW: Outpost Firewall Pro *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}

FILE ::
"c:\windows\REGBK04.ZIP"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\REGBK04.ZIP
c:\windows\system32\runouce.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-07-28 do 2009-08-31 )))))))))))))))))))))))))))))))
.

2009-08-31 19:16 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-31 19:16 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-31 19:16 . 2009-08-31 19:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-28 21:01 . 2009-08-28 21:01 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-08-28 20:59 . 2009-08-28 20:59 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-08-28 20:53 . 2009-08-07 08:48 100352 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-08-28 20:32 . 2009-07-03 16:59 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-08-28 20:32 . 2009-07-03 16:59 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-08-28 20:15 . 2009-08-28 20:30 -------- dc-h--w- c:\windows\ie8
2009-08-27 19:49 . 2009-08-27 19:49 -------- d-----w- c:\program files\proDAD
2009-08-27 19:49 . 2004-03-29 14:23 90112 ----a-w- c:\windows\unvise32.exe
2009-08-27 19:49 . 2009-08-27 19:49 -------- d-----w- c:\program files\LooksBuilderSE
2009-08-27 19:46 . 2003-07-01 14:49 69632 ------w- c:\windows\system32\MtxPreview.dll
2009-08-27 19:46 . 2003-07-01 14:49 49152 ------w- c:\windows\system32\MtxParhBFXPreview.dll
2009-08-27 19:46 . 2003-06-26 08:04 237568 ------w- c:\windows\system32\qtmlClient.dll
2009-08-27 19:46 . 2003-01-20 07:08 49152 ------w- c:\windows\system32\CvoAPI.dll
2009-08-27 19:43 . 2009-08-27 19:45 -------- d-----w- c:\program files\Boris FX, Inc
2009-08-27 19:27 . 2005-09-23 21:18 171520 ------w- c:\windows\system32\drivers\MarvinBus.sys
2009-08-27 19:19 . 2009-08-27 21:16 -------- d-----w- c:\program files\Pinnacle
2009-08-25 20:10 . 2009-08-25 20:11 -------- d-----w- c:\program files\OpenOffice.org 3
2009-08-24 04:41 . 2009-08-30 20:58 -------- d-----w- c:\program files\Advanced SystemCare 3
2009-08-23 12:16 . 2009-08-30 20:57 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat
2009-08-23 11:22 . 2009-08-25 19:02 179792 ------w- c:\windows\system32\guard32.dll
2009-08-23 11:22 . 2009-08-25 19:01 87104 ------w- c:\windows\system32\drivers\inspect.sys
2009-08-23 11:22 . 2009-08-25 19:01 25160 ------w- c:\windows\system32\drivers\cmdhlp.sys
2009-08-23 11:22 . 2009-08-25 19:01 132168 ------w- c:\windows\system32\drivers\cmdguard.sys
2009-08-23 11:22 . 2009-08-23 11:22 -------- d-----w- c:\program files\COMODO
2009-08-23 04:52 . 2009-08-23 04:52 -------- d-----w- c:\program files\FastStone Image Viewer
2009-08-21 03:49 . 2004-07-26 08:01 61440 ------w- c:\windows\system32\KBHook.dll
2009-08-21 03:49 . 2003-12-30 08:02 49152 ------w- c:\windows\system32\TaskKeyHook.dll
2009-08-21 03:49 . 2004-09-15 07:53 8576 ------w- c:\windows\system32\drivers\GMFILTR.SYS
2009-08-21 03:49 . 2004-04-19 05:01 6656 ------w- c:\windows\system32\drivers\gflmouhid.sys
2009-08-21 03:49 . 2009-08-21 03:49 -------- d-----w- c:\program files\TwinTouch Optical Office
2009-08-20 20:33 . 1996-10-30 07:35 32768 ------w- c:\windows\system32\PLUGIN.DLL
2009-08-20 20:33 . 1994-11-17 23:00 210944 ------w- c:\windows\system32\MSVCRT10.DLL
2009-08-12 15:16 . 2009-08-12 15:16 -------- d-----w- c:\windows\ServicePackFiles
2009-08-10 20:02 . 2002-12-10 03:17 45056 ------w- c:\windows\system32\Whoru.dll
2009-08-06 10:28 . 2009-08-06 10:35 -------- d-----w- c:\program files\Microsoft Bootvis

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-31 20:00 . 2007-07-24 10:18 -------- d-----w- c:\program files\ICQToolbar
2009-08-29 12:19 . 2008-06-07 18:37 -------- d-----w- c:\program files\SopCast
2009-08-29 12:11 . 2008-07-26 11:32 -------- d-----w- c:\program files\TVUPlayer
2009-08-29 11:23 . 2008-01-17 20:46 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-08-27 19:43 . 2007-03-27 09:04 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-27 19:36 . 2001-10-25 12:00 90546 ------w- c:\windows\system32\perfc005.dat
2009-08-27 19:36 . 2001-10-25 12:00 458370 ------w- c:\windows\system32\perfh005.dat
2009-08-24 05:01 . 2009-05-19 19:07 -------- d-----w- c:\program files\Sothink Video Encoder for Adobe Flash
2009-08-24 05:01 . 2009-05-17 05:26 -------- d-----w- c:\program files\WinAVI Video Converter 9.0
2009-08-24 05:01 . 2009-02-25 11:48 -------- d-----w- c:\program files\WinHTTrack
2009-08-24 05:01 . 2008-12-07 20:06 -------- d-----w- c:\program files\DVDFab 5
2009-08-24 05:01 . 2008-10-02 18:52 -------- d-----w- c:\program files\TVAnts
2009-08-23 11:13 . 2009-06-24 10:27 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-08-23 09:37 . 2007-03-27 08:45 -------- d-----w- c:\program files\Common Files\ACD Systems
2009-08-16 11:59 . 2009-05-21 19:16 -------- d-----w- c:\program files\Ashampoo
2009-08-05 09:07 . 2004-08-17 13:49 205312 ------w- c:\windows\system32\mswebdvd.dll
2009-08-03 11:26 . 2008-12-18 05:40 -------- d-----w- c:\program files\Microsoft Silverlight
2009-08-02 19:58 . 2008-06-13 03:19 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-17 18:57 . 2004-08-17 13:49 58880 ------w- c:\windows\system32\atl.dll
2009-07-14 19:29 . 2008-11-25 13:58 -------- d-----w- c:\program files\Combined Community Codec Pack
2009-07-13 21:43 . 2004-08-17 13:49 286208 ------w- c:\windows\system32\wmpdxm.dll
2009-07-03 16:59 . 2004-08-17 13:49 915456 ------w- c:\windows\system32\wininet.dll
2009-06-27 18:45 . 2009-06-27 18:45 971552 ------w- c:\windows\system32\drivers\tdrpm174.sys
2009-06-27 18:45 . 2009-06-27 18:45 540000 ------w- c:\windows\system32\drivers\timntr.sys
2009-06-27 18:45 . 2009-06-27 18:45 44704 ------w- c:\windows\system32\drivers\tifsfilt.sys
2009-06-27 18:45 . 2009-06-27 18:45 134272 ------w- c:\windows\system32\drivers\snman380.sys
2009-06-25 18:37 . 2004-08-17 13:49 95744 ------w- c:\windows\system32\mqsec.dll
2009-06-25 18:37 . 2004-08-17 13:49 517120 ------w- c:\windows\system32\mqsnap.dll
2009-06-25 18:37 . 2004-08-17 13:49 489472 ------w- c:\windows\system32\mqutil.dll
2009-06-25 18:37 . 2004-08-17 13:49 48640 ------w- c:\windows\system32\mqupgrd.dll
2009-06-25 18:37 . 2004-08-17 13:49 186880 ------w- c:\windows\system32\mqtrig.dll
2009-06-25 18:37 . 2004-08-17 13:49 123392 ------w- c:\windows\system32\mqrtdep.dll
2009-06-25 18:37 . 2004-08-17 13:49 661504 ------w- c:\windows\system32\mqqm.dll
2009-06-25 18:37 . 2004-08-17 13:49 47104 ------w- c:\windows\system32\mqdscli.dll
2009-06-25 18:37 . 2004-08-17 13:49 225280 ------w- c:\windows\system32\mqoa.dll
2009-06-25 18:37 . 2004-08-17 13:49 177152 ------w- c:\windows\system32\mqrt.dll
2009-06-25 18:37 . 2004-08-17 13:49 16896 ------w- c:\windows\system32\mqise.dll
2009-06-25 18:37 . 2004-08-17 13:49 138240 ------w- c:\windows\system32\mqad.dll
2009-06-25 08:48 . 2004-08-17 13:49 59392 ------w- c:\windows\system32\wdigest.dll
2009-06-25 08:48 . 2004-08-17 13:49 56320 ------w- c:\windows\system32\secur32.dll
2009-06-25 08:48 . 2004-08-17 13:49 168448 ------w- c:\windows\system32\schannel.dll
2009-06-25 08:48 . 2004-08-17 13:49 133632 ------w- c:\windows\system32\msv1_0.dll
2009-06-25 08:48 . 2004-08-17 13:49 723456 ------w- c:\windows\system32\lsasrv.dll
2009-06-25 08:48 . 2004-08-17 13:49 298496 ------w- c:\windows\system32\kerberos.dll
2009-06-22 11:49 . 2004-08-17 13:49 19968 ------w- c:\windows\system32\mqbkup.exe
2009-06-22 11:49 . 2004-08-17 13:49 117248 ------w- c:\windows\system32\mqtgsvc.exe
2009-06-22 11:49 . 2004-08-17 13:49 4608 ------w- c:\windows\system32\mqsvc.exe
2009-06-22 11:48 . 2004-08-03 20:58 91776 ------w- c:\windows\system32\drivers\mqac.sys
2009-06-22 11:34 . 2004-08-03 20:59 92544 ------w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:55 . 2004-08-17 13:49 119808 ------w- c:\windows\system32\t2embed.dll
2009-06-16 14:55 . 2001-10-25 12:00 82432 ------w- c:\windows\system32\fontsub.dll
2009-06-15 11:33 . 2004-08-17 13:49 78336 ------w- c:\windows\system32\telnet.exe
2009-06-15 11:33 . 2004-08-17 13:49 81408 ------w- c:\windows\system32\tlntsess.exe
2009-06-10 14:24 . 2004-08-17 13:49 84992 ------w- c:\windows\system32\avifil32.dll
2009-06-10 06:31 . 2004-08-17 13:49 132096 ------w- c:\windows\system32\wkssvc.dll
2009-06-05 07:46 . 2007-03-24 09:07 655872 ------w- c:\windows\system32\mstscax.dll
2009-06-03 19:27 . 2004-08-17 13:49 1293312 ------w- c:\windows\system32\quartz.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmartRAM"="c:\program files\Advanced SystemCare 3\Sup_SmartRAM.exe" [2009-02-19 202064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"mouseElf"="c:\progra~1\TWINTO~1\MouseElf.EXE" [2004-11-16 196608]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-08-25 1796368]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" -autorun
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
"Google Update"="c:\documents and settings\Morák\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
"OEXPRESS"=c:\documents and settings\All Users\Data aplikací\LangSoft\OETRN.EXE
"ctfmon.exe"=c:\windows\system32\ctfmon.exe
"SmartRAM"="c:\program files\Advanced SystemCare 3\Sup_SmartRAM.exe" /m

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"nwiz"=nwiz.exe /install
"TrueImageMonitor.exe"=c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe"
"AcronisTimounterMonitor"=c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\ICQ6\\ICQ6.5\\ICQ.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IEPro\\MiniDM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 snapman380;Acronis Snapshots Manager (Build 380);c:\windows\system32\drivers\snman380.sys [27.6.2009 20:45 134272]
R0 tdrpman174;Acronis Try&Decide and Restore Points filter (build 174);c:\windows\system32\drivers\tdrpm174.sys [27.6.2009 20:45 971552]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [24.3.2007 11:44 77312]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [23.8.2009 13:22 132168]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [23.8.2009 13:22 25160]
R3 genmcmnUSB;USB Scroll Mouse Driver;c:\windows\system32\drivers\gflmouhid.sys [21.8.2009 5:49 6656]
S3 CrystalSysInfo;CrystalSysInfo;c:\program files\MediaCoder\SysInfo.sys [25.9.2007 16:59 15152]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [13.4.2008 21:36 13352]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
mSearch Bar = hxxp://www.google.com/ie
IE: &Download FLV by WinAVI... - c:\program files\WinAVI FLV Converter\flv_link.htm
IE: {{7E6A20FB-153F-402c-A84B-1A64E1955D3D} - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748449} - {CC963627-B1DC-40E0-B52A-CF21EE748449} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748450} - {CC963627-B1DC-40E0-B52A-CF21EE748450} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748451} - {CC963627-B1DC-40E0-B52A-CF21EE748451} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
IE: {{CC963627-B1DC-40E0-B52A-CF21EE748452} - {CC963627-B1DC-40E0-B52A-CF21EE748452} - c:\documents and settings\All Users\Data aplikací\LangSoft\WebIE.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-31 23:28
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-299502267-682003330-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Celkový čas: 2009-08-31 23:31
ComboFix-quarantined-files.txt 2009-08-31 21:31
ComboFix2.txt 2009-08-31 20:22
ComboFix3.txt 2007-11-05 13:18

Před spuštěním: Volných bajtů: 66 509 295 616
Po spuštění: Volných bajtů: 66 494 574 592

Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5
224 --- E O F --- 2009-08-28 20:54

A teď Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:32:50, on 31.8.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WebTransBHO Class - {2DB66063-BB98-466A-AA0D-3E7ACF5ED853} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: WinAVI FLVSense - {E8DF67A1-B618-4F3F-9E7C-CBE175ADEF5B} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll
O3 - Toolbar: WebTranslator - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [mouseElf] C:\PROGRA~1\TWINTO~1\MouseElf.EXE
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download FLV by WinAVI... - C:\Program Files\WinAVI FLV Converter\flv_link.htm
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: WebTran - {7E6A20FB-153F-402c-A84B-1A64E1955D3D} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Nastavit překladač - {CC963627-B1DC-40E0-B52A-CF21EE748449} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: &Slovník - {CC963627-B1DC-40E0-B52A-CF21EE748450} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &označený text - {CC963627-B1DC-40E0-B52A-CF21EE748451} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: (no name) - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra 'Tools' menuitem: Přeložit &stránku - {CC963627-B1DC-40E0-B52A-CF21EE748452} - C:\Documents and Settings\All Users\Data aplikací\LangSoft\WebIE.dll
O9 - Extra button: WinAVI FLV Manager - {DE365254-2F9B-4908-9E3A-7AAA6EC90BCC} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll
O9 - Extra 'Tools' menuitem: WinAVI FLV Manager - {DE365254-2F9B-4908-9E3A-7AAA6EC90BCC} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ6.5\ICQ.exe
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resour ... se6662.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 5126700015
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDow ... rtScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CS4\Services\Tcpip\..\{5A6EC6F1-F981-4E87-BD3C-7EE606CB58ED}: NameServer = 217.197.144.4,192.168.0.17
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 7759 bytes


Díky moc!!!!

Jsou tam ještě nějaký zbytky po Outpostu (viz hlavička logu z ComboFixu). Tady: http://www.agnitum.com/support/kb/artic ... id=1000159 jsou návody na manuální odstranění.

Spusť HJT (HijackThis), vypni prohlížeče, odpoj se od internetu a fixni (spustit HJT, "Do a system scan only",
zatrhnout políčko před hodnotou, zmáčknout "Fix checked" a poté "Ano"):

O9 - Extra button: (no name) - {BFC32E1D-EE75-4A48-BC60-104E11EE2431} - (no file)
*****************************************************************************************************************************************
Odinstaluj ComboFix.
ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

takže jestli nejsou problémy,tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš->spustíš

(pozn.Pokud máš AVG, avast! nebo Aviru, před stažením T-Cleaneru a po dobu čištění deaktivuj AVG, avast! i Aviru (i rezidenty), následně T-Cleaner smaž a zapni si AVG,avast!, Aviru.)


Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.

ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache,
cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer,
Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Kdyby něco, tak se zastav.
Označ topic za vyřešený (zelená fajfka) a měj se.

To Damned: Prosím, jsem teď zatím u odstraňování zbytku Outpostu..stáhl jsem si dle návodu v odkazu program clean.zip (exe). problém je v tom, že program vyžaduje spuštění v tzv. SAFE Módu (tak jsem to alespoň teda pochopil). Můžeš mi vysvětlit - napovědět, jak Safe mód nastavím? Byl jsem v BIOSU, ale tam jsem nic podoného nenašel.. Díky moc, pak dokončím tvůj návod..