PC-HELP.CZ

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:46:27, on 10.10.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ADS.Services.Main.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\AccelerometerSt.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\NetLimiter\NetLimiter.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [AccelerometerSysTrayApplet] C:\WINDOWS\system32\AccelerometerSt.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - https://kdp.cpas.cz/EXT_FA/modules/smsx.cab
O16 - DPF: {BCCDF398-8835-4A2C-978A-31148A6CC3BE} (KDP400.CsXML XRtData Class) - https://kdp.cpas.cz/EXT_FA/modules/modules.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cpas.cz
O17 - HKLM\Software\..\Telephony: DomainName = cpas.cz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cpas.cz
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = cpas.cz
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: ADS Main Service (ADSMainSvc) - Unknown owner - C:\WINDOWS\system32\ADS.Services.Main.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Firebird Guardian Service (InterBaseGuardian) - FirebirdSQL Project - C:\Program Files\Borland\InterBase\bin\ibguard.exe
O23 - Service: Firebird Server (InterBaseServer) - FirebirdSQL Project - C:\Program Files\Borland\InterBase\bin\ibserver.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe

--
End of file - 6834 bytes

Spusť HJT (HijackThis), vypni prohlížeče, odpoj se od internetu a fixni (spustit HJT, "Do a system scan only",
zatrhnout políčko před hodnotou, zmáčknout "Fix checked" a poté "Ano"):

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
****************************************************************************************************************************************
Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Malwarebytes' Anti-Malware 1.41
Verze databáze: 2935
Windows 5.1.2600 Service Pack 3

10.10.2009 16:53:19
mbam-log-2009-10-10 (16-53-19).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 120088
Uplynulý čas: 17 minute(s), 22 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované adresáře: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
(Nebyly nalezeny žádné škodlivé položky)

sry za prodlevu, nebylo moc casu, takze log z CF:

ComboFix 09-10-13.01 - wasq 13.10.2009 22:59.2.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1015.545 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

Nakažená kopie c:\windows\system32\drivers\AGP440.sys byla nalezena a vyléčena.
Obnovena kopie z - c:\windows\ServicePackFiles\i386\agp440.sys

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-09-13 do 2009-10-13 )))))))))))))))))))))))))))))))
.

2009-10-12 18:18 . 2009-10-12 18:18 -------- d-----w- c:\program files\EA GAMES
2009-10-11 16:55 . 2009-10-11 18:36 -------- d-----w- C:\Gamesky
2009-10-11 16:55 . 2004-08-18 08:34 442368 ----a-r- c:\windows\system32\vp6vfw.dll
2009-10-11 16:52 . 2009-02-24 16:42 116736 ----a-w- c:\windows\system32\drivers\mcdbus.sys
2009-10-11 16:52 . 2009-10-11 16:52 -------- d-----w- c:\program files\MagicDisc
2009-10-11 16:42 . 2009-10-11 16:42 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2009-10-11 16:42 . 2009-10-11 19:06 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-10-11 16:31 . 2009-10-11 16:31 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-10-11 16:25 . 2009-10-11 16:46 -------- d-----w- c:\program files\MagicISO
2009-10-10 11:18 . 2003-06-25 14:05 266360 ----a-w- c:\windows\system32\TweakUI.exe
2009-10-10 11:03 . 2009-10-10 14:37 -------- d-----w- C:\!ANICKY VECICKY
2009-10-10 10:59 . 2009-10-10 10:59 -------- d-----w- C:\WORK
2009-10-10 10:53 . 2009-10-10 10:53 -------- d-----w- C:\Hudba
2009-10-10 10:30 . 2009-10-10 10:30 -------- d-----w- c:\program files\totalcmd
2009-10-10 10:28 . 2009-10-10 10:28 -------- d-----w- c:\program files\Common Files\Stardock
2009-10-10 10:28 . 2009-10-10 10:28 -------- d-----w- c:\program files\Stardock
2009-10-10 10:22 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-10 10:22 . 2009-10-10 10:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-10 10:22 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-10 09:44 . 2009-10-10 09:44 79538 ----a-w- C:\cc_zaloha_registru_20091010_114348.reg
2009-10-10 09:28 . 2009-10-10 09:28 -------- d-----w- c:\program files\CCleaner
2009-10-10 09:27 . 2009-10-12 22:39 -------- d-----w- C:\Downloads
2009-10-10 09:17 . 2009-10-10 09:17 -------- d-----w- c:\program files\ESET
2009-10-07 13:57 . 2009-10-07 13:57 -------- d-----w- c:\program files\CANON
2009-10-04 19:53 . 2005-05-06 19:00 8704 ----a-w- c:\windows\system32\CNMVS7J.DLL
2009-10-04 19:53 . 2005-05-06 19:00 140288 ----a-w- c:\windows\system32\CNMLM7J.DLL
2009-10-04 19:51 . 2009-10-04 19:51 -------- d--h--w- c:\windows\system32\CanonMP Uninstaller Information
2009-10-04 19:51 . 2005-08-04 00:47 49152 ----a-w- c:\windows\system32\cncisco.dll
2009-10-04 19:51 . 2005-08-04 00:46 221184 ----a-w- c:\windows\system32\CNCC170.DLL
2009-10-04 19:51 . 2005-08-04 00:46 69632 ----a-w- c:\windows\system32\CNCI170.DLL
2009-10-04 19:51 . 2005-05-30 09:46 139264 ----a-w- c:\windows\system32\CNCL170.DLL
2009-10-04 19:51 . 2009-10-04 19:51 -------- d-----w- C:\CanonMP
2009-10-04 16:54 . 2009-10-04 19:13 -------- d-----w- c:\program files\QIP
2009-10-03 16:08 . 2009-10-03 16:08 -------- d-----w- c:\program files\Common Files\NSV
2009-10-03 15:58 . 2009-04-28 20:20 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys
2009-10-03 15:58 . 2009-04-28 20:20 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys
2009-10-03 15:58 . 2009-04-28 20:20 129520 ------w- c:\windows\system32\pxafs.dll
2009-10-03 15:58 . 2009-10-03 15:59 -------- d-----w- c:\program files\Winamp
2009-10-02 18:23 . 2005-01-03 15:43 4682 ----a-w- c:\windows\system32\npptNT2.sys
2009-10-02 18:23 . 2009-10-02 18:23 -------- d-----w- c:\program files\Common Files\INCA Shared
2009-10-01 18:03 . 2009-10-01 18:03 -------- d-----w- c:\program files\NetLimiter
2009-10-01 17:39 . 2008-04-14 06:51 21504 ----a-w- c:\windows\system32\hidserv.dll
2009-10-01 17:39 . 2008-04-14 06:51 21504 ----a-w- c:\windows\system32\dllcache\hidserv.dll
2009-10-01 15:17 . 2009-10-01 15:17 0 ----a-w- c:\windows\nsreg.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-10 09:08 . 2006-11-04 00:32 -------- d-----w- c:\program files\Hewlett-Packard
2009-10-10 09:08 . 2009-10-10 09:08 1755 --sha-r- c:\windows\system32\drivers\103C_HP_NTBK_HP Compaq nc2400(#AKB)_YN_0U_QCNF7125LQW_E404583223_46_I30A1_SHP_VKBC Version 53.13_B68YOP Ver. F.0A_T070122_WXP3_L405_M1016_J60_7Intel_8Core Duo U2500_91.2_#060706_N14E4169C_(#AKB)_XMOBILE_CN10_Z.MRK
2009-10-03 18:08 . 2007-10-30 06:54 -------- d-----w- c:\program files\Google
2009-09-03 14:26 . 2004-09-08 09:09 82814 ----a-w- c:\windows\system32\perfc005.dat
2009-09-03 14:26 . 2004-09-08 09:09 442234 ----a-w- c:\windows\system32\perfh005.dat
2009-09-03 14:21 . 2009-09-03 14:21 -------- d-----w- c:\program files\MSBuild
2009-09-03 14:21 . 2009-09-03 14:21 -------- d-----w- c:\program files\Reference Assemblies
2009-09-02 06:32 . 2009-09-02 06:12 -------- d-----w- c:\program files\HP
2009-08-23 16:49 . 2009-08-23 16:42 21840 ----atw- c:\windows\system32\SIntfNT.dll
2009-08-23 16:49 . 2009-08-23 16:42 17212 ----atw- c:\windows\system32\SIntf32.dll
2009-08-23 16:49 . 2009-08-23 16:42 12067 ----atw- c:\windows\system32\SIntf16.dll
2009-08-23 16:41 . 2006-11-04 00:32 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-05 09:01 . 2004-08-18 08:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-17 19:04 . 2004-08-18 08:00 58880 ----a-w- c:\windows\system32\atl.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-10-13_20.33.35 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-28 20:38 . 2008-04-13 23:06 42368 c:\windows\system32\drivers\AGP440.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"AccelerometerSysTrayApplet"="c:\windows\system32\AccelerometerSt.exe" [2006-01-16 53248]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-31 761946]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-14 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-14 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-14 118784]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-05-02 40960]
"Recguard"="c:\windows\Sminst\Recguard.exe" [2005-12-20 1187840]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-08-31 122940]
"NetLimiter"="c:\program files\NetLimiter\NetLimiter.exe" [2004-03-31 823296]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"restorer64_a"="c:\windows\system32\restorer64_a.exe" [BU]
"MsmqIntCert"="mqrt.dll" - c:\windows\system32\mqrt.dll [2008-04-14 177152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2009-10-11 576000]
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2009-10-10 2860792]

c:\documents and settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2009-10-11 576000]
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2009-10-10 2860792]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-2-27 581693]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
2005-01-31 12:13 49152 ----a-w- c:\progra~1\COMMON~1\Stardock\MCPStub.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^DVD Check.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\DVD Check.lnk
backup=c:\windows\pss\DVD Check.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\WINDOWS\\SMINST\\Scheduler.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [14.5.2009 15:49 94360]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [14.5.2009 15:47 731840]
R2 Ethpdrv;Ethernet Packet Driver;c:\windows\system32\drivers\ethpdrv.sys [29.10.2007 14:40 9728]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [28.2.2006 19:05 87808]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [25.4.2006 18:26 36608]
S2 ADSMainSvc;ADS Main Service;c:\windows\system32\ADS.Services.Main.exe [25.10.2007 15:11 40960]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [3.10.2009 20:04 133104]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 IpwP;IPWireless 3G PCMCIA Network Adapter;c:\windows\system32\drivers\ipwpnet.sys [29.10.2007 14:40 43184]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
.
Obsah adresáře 'Naplánované úlohy'

2009-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-03 18:04]

2009-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-03 18:04]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
LSP: c:\program files\NetLimiter\nl_lsp.dll
DPF: {BCCDF398-8835-4A2C-978A-31148A6CC3BE} - hxxps://kdp.cpas.cz/EXT_FA/modules/modules.cab
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\ki95ra1j.default\
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - www.google.com
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-13 23:05
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????,?@? ????[??????R?@?????,?@

skenování skrytých souborů ...


c:\windows\TEMP\NSF1B.tmp 0 bytes

sken byl úspešně dokončen
skryté soubory: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(852)
c:\progra~1\COMMON~1\Stardock\mcpstub.dll

- - - - - - - > 'lsass.exe'(908)
c:\program files\NetLimiter\nl_lsp.dll
c:\windows\system32\nl_msgc.dll

- - - - - - - > 'explorer.exe'(1760)
c:\program files\Stardock\ObjectDock\DockShellHook.dll
c:\progra~1\COMMON~1\Stardock\MCPCore.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\scardsvr.exe
c:\progra~1\COMMON~1\Stardock\SDMCP.exe
c:\program files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
c:\windows\system32\msdtc.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\mqsvc.exe
c:\program files\WIDCOMM\Bluetooth Software\BTStackServer.exe
c:\windows\system32\mqtgsvc.exe
.
**************************************************************************
.
Celkový čas: 2009-10-13 23:11 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-10-13 21:11

Před spuštěním: Volných bajtů: 32 258 519 040
Po spuštění: Volných bajtů: 32 227 684 352

211 --- E O F --- 2009-09-09 13:20

Toto otestuj na Virustotal
c:\windows\system32\restorer64_a.exe
Vlož sem pak odkaz výsledku.

Pak udělám script..

primo tenhle soubor sem nenasel, ale hodne podobnej: RESTORER64_A.EXE-201B2474.pf v C:\WINDOWS\Prefetch. nechal sem ho proskenova virustotalem:

0/40

http://www.virustotal.com/cs/analisis/d ... 1255527742

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

CF:

ComboFix 09-10-14.01 - wasq 14.10.2009 21:34.3.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1015.630 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FILE ::
"c:\windows\nsreg.dat"
"c:\windows\system32\restorer64_a.exe"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\DAEMON Tools Toolbar
c:\windows\nsreg.dat

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-09-14 do 2009-10-14 )))))))))))))))))))))))))))))))
.

2009-10-12 18:18 . 2009-10-12 18:18 -------- d-----w- c:\program files\EA GAMES
2009-10-11 16:55 . 2009-10-14 19:14 -------- d-----w- C:\Gamesky
2009-10-11 16:55 . 2004-08-18 08:34 442368 ----a-r- c:\windows\system32\vp6vfw.dll
2009-10-11 16:52 . 2009-02-24 16:42 116736 ----a-w- c:\windows\system32\drivers\mcdbus.sys
2009-10-11 16:52 . 2009-10-11 16:52 -------- d-----w- c:\program files\MagicDisc
2009-10-11 16:42 . 2009-10-11 19:06 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-10-11 16:31 . 2009-10-11 16:31 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-10-11 16:25 . 2009-10-11 16:46 -------- d-----w- c:\program files\MagicISO
2009-10-10 11:18 . 2003-06-25 14:05 266360 ----a-w- c:\windows\system32\TweakUI.exe
2009-10-10 11:03 . 2009-10-10 14:37 -------- d-----w- C:\!ANICKY VECICKY
2009-10-10 10:59 . 2009-10-10 10:59 -------- d-----w- C:\WORK
2009-10-10 10:53 . 2009-10-10 10:53 -------- d-----w- C:\Hudba
2009-10-10 10:30 . 2009-10-10 10:30 -------- d-----w- c:\program files\totalcmd
2009-10-10 10:28 . 2009-10-10 10:28 -------- d-----w- c:\program files\Common Files\Stardock
2009-10-10 10:28 . 2009-10-10 10:28 -------- d-----w- c:\program files\Stardock
2009-10-10 10:22 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-10 10:22 . 2009-10-10 10:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-10 10:22 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-10 09:44 . 2009-10-10 09:44 79538 ----a-w- C:\cc_zaloha_registru_20091010_114348.reg
2009-10-10 09:28 . 2009-10-10 09:28 -------- d-----w- c:\program files\CCleaner
2009-10-10 09:27 . 2009-10-14 19:11 -------- d-----w- C:\Downloads
2009-10-10 09:17 . 2009-10-10 09:17 -------- d-----w- c:\program files\ESET
2009-10-07 13:57 . 2009-10-07 13:57 -------- d-----w- c:\program files\CANON
2009-10-04 19:53 . 2005-05-06 19:00 8704 ----a-w- c:\windows\system32\CNMVS7J.DLL
2009-10-04 19:53 . 2005-05-06 19:00 140288 ----a-w- c:\windows\system32\CNMLM7J.DLL
2009-10-04 19:51 . 2009-10-04 19:51 -------- d--h--w- c:\windows\system32\CanonMP Uninstaller Information
2009-10-04 19:51 . 2005-08-04 00:47 49152 ----a-w- c:\windows\system32\cncisco.dll
2009-10-04 19:51 . 2005-08-04 00:46 221184 ----a-w- c:\windows\system32\CNCC170.DLL
2009-10-04 19:51 . 2005-08-04 00:46 69632 ----a-w- c:\windows\system32\CNCI170.DLL
2009-10-04 19:51 . 2005-05-30 09:46 139264 ----a-w- c:\windows\system32\CNCL170.DLL
2009-10-04 19:51 . 2009-10-04 19:51 -------- d-----w- C:\CanonMP
2009-10-04 16:54 . 2009-10-04 19:13 -------- d-----w- c:\program files\QIP
2009-10-03 16:08 . 2009-10-03 16:08 -------- d-----w- c:\program files\Common Files\NSV
2009-10-03 15:58 . 2009-04-28 20:20 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys
2009-10-03 15:58 . 2009-04-28 20:20 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys
2009-10-03 15:58 . 2009-04-28 20:20 129520 ------w- c:\windows\system32\pxafs.dll
2009-10-03 15:58 . 2009-10-03 15:59 -------- d-----w- c:\program files\Winamp
2009-10-02 18:23 . 2005-01-03 15:43 4682 ----a-w- c:\windows\system32\npptNT2.sys
2009-10-02 18:23 . 2009-10-02 18:23 -------- d-----w- c:\program files\Common Files\INCA Shared
2009-10-01 18:03 . 2009-10-01 18:03 -------- d-----w- c:\program files\NetLimiter
2009-10-01 17:39 . 2008-04-14 06:51 21504 ----a-w- c:\windows\system32\hidserv.dll
2009-10-01 17:39 . 2008-04-14 06:51 21504 ----a-w- c:\windows\system32\dllcache\hidserv.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-10 09:08 . 2006-11-04 00:32 -------- d-----w- c:\program files\Hewlett-Packard
2009-10-10 09:08 . 2009-10-10 09:08 1755 --sha-r- c:\windows\system32\drivers\103C_HP_NTBK_HP Compaq nc2400(#AKB)_YN_0U_QCNF7125LQW_E404583223_46_I30A1_SHP_VKBC Version 53.13_B68YOP Ver. F.0A_T070122_WXP3_L405_M1016_J60_7Intel_8Core Duo U2500_91.2_#060706_N14E4169C_(#AKB)_XMOBILE_CN10_Z.MRK
2009-10-03 18:08 . 2007-10-30 06:54 -------- d-----w- c:\program files\Google
2009-09-03 14:26 . 2004-09-08 09:09 82814 ----a-w- c:\windows\system32\perfc005.dat
2009-09-03 14:26 . 2004-09-08 09:09 442234 ----a-w- c:\windows\system32\perfh005.dat
2009-09-03 14:21 . 2009-09-03 14:21 -------- d-----w- c:\program files\MSBuild
2009-09-03 14:21 . 2009-09-03 14:21 -------- d-----w- c:\program files\Reference Assemblies
2009-09-02 06:32 . 2009-09-02 06:12 -------- d-----w- c:\program files\HP
2009-08-23 16:49 . 2009-08-23 16:42 21840 ----atw- c:\windows\system32\SIntfNT.dll
2009-08-23 16:49 . 2009-08-23 16:42 17212 ----atw- c:\windows\system32\SIntf32.dll
2009-08-23 16:49 . 2009-08-23 16:42 12067 ----atw- c:\windows\system32\SIntf16.dll
2009-08-23 16:41 . 2006-11-04 00:32 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-05 09:01 . 2004-08-18 08:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-17 19:04 . 2004-08-18 08:00 58880 ----a-w- c:\windows\system32\atl.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-10-13_20.33.35 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-28 20:38 . 2008-04-13 23:06 42368 c:\windows\system32\drivers\AGP440.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"AccelerometerSysTrayApplet"="c:\windows\system32\AccelerometerSt.exe" [2006-01-16 53248]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-31 761946]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-14 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-14 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-14 118784]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-05-02 40960]
"Recguard"="c:\windows\Sminst\Recguard.exe" [2005-12-20 1187840]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-08-31 122940]
"NetLimiter"="c:\program files\NetLimiter\NetLimiter.exe" [2004-03-31 823296]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"MsmqIntCert"="mqrt.dll" - c:\windows\system32\mqrt.dll [2008-04-14 177152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2009-10-11 576000]
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2009-10-10 2860792]

c:\documents and settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2009-10-11 576000]
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2009-10-10 2860792]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-2-27 581693]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
2005-01-31 12:13 49152 ----a-w- c:\progra~1\COMMON~1\Stardock\MCPStub.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^DVD Check.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\DVD Check.lnk
backup=c:\windows\pss\DVD Check.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\WINDOWS\\SMINST\\Scheduler.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [14.5.2009 15:49 94360]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [14.5.2009 15:47 731840]
R2 Ethpdrv;Ethernet Packet Driver;c:\windows\system32\drivers\ethpdrv.sys [29.10.2007 14:40 9728]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [28.2.2006 19:05 87808]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [25.4.2006 18:26 36608]
S2 ADSMainSvc;ADS Main Service;c:\windows\system32\ADS.Services.Main.exe [25.10.2007 15:11 40960]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [3.10.2009 20:04 133104]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 IpwP;IPWireless 3G PCMCIA Network Adapter;c:\windows\system32\drivers\ipwpnet.sys [29.10.2007 14:40 43184]
S3 npkycryp;npkycryp;\??\c:\gamesky\Lineage II\100ka system\npkycryp.sys --> c:\gamesky\Lineage II\100ka system\npkycryp.sys [?]
.
Obsah adresáře 'Naplánované úlohy'

2009-10-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-03 18:04]

2009-10-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-03 18:04]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
LSP: c:\program files\NetLimiter\nl_lsp.dll
DPF: {BCCDF398-8835-4A2C-978A-31148A6CC3BE} - hxxps://kdp.cpas.cz/EXT_FA/modules/modules.cab
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\ki95ra1j.default\
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - www.google.com
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-14 21:41
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????,?@? ????[??????R?@?????,?@

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(996)
c:\progra~1\COMMON~1\Stardock\mcpstub.dll

- - - - - - - > 'lsass.exe'(1052)
c:\program files\NetLimiter\nl_lsp.dll
c:\windows\system32\nl_msgc.dll

- - - - - - - > 'explorer.exe'(2656)
c:\program files\Stardock\ObjectDock\DockShellHook.dll
c:\progra~1\COMMON~1\Stardock\MCPCore.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\progra~1\COMMON~1\Stardock\SDMCP.exe
c:\windows\system32\scardsvr.exe
c:\program files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
c:\windows\system32\msdtc.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\WIDCOMM\Bluetooth Software\BTStackServer.exe
c:\windows\system32\mqsvc.exe
c:\windows\system32\mqtgsvc.exe
.
**************************************************************************
.
Celkový čas: 2009-10-14 21:47 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-10-14 19:47
ComboFix2.txt 2009-10-13 21:11

Před spuštěním: Volných bajtů: 22 059 884 544
Po spuštění: Volných bajtů: 22 033 068 032

208 --- E O F --- 2009-09-09 13:20


**********************************************************************************************************************************************

HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:48:47, on 14.10.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\AccelerometerSt.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
c:\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [AccelerometerSysTrayApplet] C:\WINDOWS\system32\AccelerometerSt.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - https://kdp.cpas.cz/EXT_FA/modules/smsx.cab
O16 - DPF: {BCCDF398-8835-4A2C-978A-31148A6CC3BE} (KDP400.CsXML XRtData Class) - https://kdp.cpas.cz/EXT_FA/modules/modules.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cpas.cz
O17 - HKLM\Software\..\Telephony: DomainName = cpas.cz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cpas.cz
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = cpas.cz
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: ADS Main Service (ADSMainSvc) - Unknown owner - C:\WINDOWS\system32\ADS.Services.Main.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Firebird Guardian Service (InterBaseGuardian) - FirebirdSQL Project - C:\Program Files\Borland\InterBase\bin\ibguard.exe
O23 - Service: Firebird Server (InterBaseServer) - FirebirdSQL Project - C:\Program Files\Borland\InterBase\bin\ibserver.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe

--
End of file - 6458 bytes

instaloval sem tady SIMS a nejaky crack. ma to vliv na nynejsi zavsiveni, nebo to muze pritelka v klidu parit?

Po dobu odvšivení by si neměl nic instalovat. Pokud je šmejdík šikovnej, schová se (injektuje) k nový aplikaci.
A crack... jsou fóra, kde tě nechají nejdříve spustit utilitu, ten ti najde cracky a pak ti na tom fóru řeknou: Sorry, máš tam cracky, odstraň je a já ti pak poradím.

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
c:\windows\system32\Drivers\SSPORT.sys
c:\gamesky\Lineage II\100ka system\npkycryp.sys

Firefox::
FF - prefs.js: browser.search.selectedEngine - DAEMON Search

DDS::
FF - prefs.js: browser.search.selectedEngine - DAEMON Search

Driver::
SSPORT;SSPORT
SSPORT
npkycryp;npkycryp
npkycryp




Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix, oprava může trvat i déle než 10 minut. ! Nech ComboFix dokončit svou práci !
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT a popiš chování počítače

on je to no cd patch - proste nahradni .exe zkousel sem ho nahrat na virustotal, ale ma 45MB, tak smula

CF:

ComboFix 09-10-14.09 - wasq 15.10.2009 13:19.4.2 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1015.717 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FILE ::
"c:\gamesky\Lineage II\100ka system\npkycryp.sys"
"c:\windows\system32\Drivers\SSPORT.sys"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SSPORT
-------\Service_npkycryp
-------\Service_SSPORT


((((((((((((((((((((((((( Soubory vytvořené od 2009-09-15 do 2009-10-15 )))))))))))))))))))))))))))))))
.

2009-10-15 11:27 . 2009-10-15 11:27 114688 ----a-w- c:\windows\system32\chg.exe
2009-10-12 18:18 . 2009-10-12 18:18 -------- d-----w- c:\program files\EA GAMES
2009-10-11 16:55 . 2009-10-14 19:14 -------- d-----w- C:\Gamesky
2009-10-11 16:55 . 2004-08-18 08:34 442368 ----a-r- c:\windows\system32\vp6vfw.dll
2009-10-11 16:52 . 2009-02-24 16:42 116736 ----a-w- c:\windows\system32\drivers\mcdbus.sys
2009-10-11 16:52 . 2009-10-11 16:52 -------- d-----w- c:\program files\MagicDisc
2009-10-11 16:42 . 2009-10-11 19:06 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-10-11 16:31 . 2009-10-11 16:31 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-10-11 16:25 . 2009-10-11 16:46 -------- d-----w- c:\program files\MagicISO
2009-10-10 11:18 . 2003-06-25 14:05 266360 ----a-w- c:\windows\system32\TweakUI.exe
2009-10-10 11:03 . 2009-10-10 14:37 -------- d-----w- C:\!ANICKY VECICKY
2009-10-10 10:59 . 2009-10-10 10:59 -------- d-----w- C:\WORK
2009-10-10 10:53 . 2009-10-10 10:53 -------- d-----w- C:\Hudba
2009-10-10 10:30 . 2009-10-10 10:30 -------- d-----w- c:\program files\totalcmd
2009-10-10 10:28 . 2009-10-10 10:28 -------- d-----w- c:\program files\Common Files\Stardock
2009-10-10 10:28 . 2009-10-10 10:28 -------- d-----w- c:\program files\Stardock
2009-10-10 10:22 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-10 10:22 . 2009-10-10 10:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-10 10:22 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-10 09:44 . 2009-10-10 09:44 79538 ----a-w- C:\cc_zaloha_registru_20091010_114348.reg
2009-10-10 09:28 . 2009-10-10 09:28 -------- d-----w- c:\program files\CCleaner
2009-10-10 09:27 . 2009-10-14 19:48 -------- d-----w- C:\Downloads
2009-10-10 09:17 . 2009-10-10 09:17 -------- d-----w- c:\program files\ESET
2009-10-07 13:57 . 2009-10-07 13:57 -------- d-----w- c:\program files\CANON
2009-10-04 19:53 . 2005-05-06 19:00 8704 ----a-w- c:\windows\system32\CNMVS7J.DLL
2009-10-04 19:53 . 2005-05-06 19:00 140288 ----a-w- c:\windows\system32\CNMLM7J.DLL
2009-10-04 19:51 . 2009-10-04 19:51 -------- d--h--w- c:\windows\system32\CanonMP Uninstaller Information
2009-10-04 19:51 . 2005-08-04 00:47 49152 ----a-w- c:\windows\system32\cncisco.dll
2009-10-04 19:51 . 2005-08-04 00:46 221184 ----a-w- c:\windows\system32\CNCC170.DLL
2009-10-04 19:51 . 2005-08-04 00:46 69632 ----a-w- c:\windows\system32\CNCI170.DLL
2009-10-04 19:51 . 2005-05-30 09:46 139264 ----a-w- c:\windows\system32\CNCL170.DLL
2009-10-04 19:51 . 2009-10-04 19:51 -------- d-----w- C:\CanonMP
2009-10-04 16:54 . 2009-10-04 19:13 -------- d-----w- c:\program files\QIP
2009-10-03 16:08 . 2009-10-03 16:08 -------- d-----w- c:\program files\Common Files\NSV
2009-10-03 15:58 . 2009-04-28 20:20 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys
2009-10-03 15:58 . 2009-04-28 20:20 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys
2009-10-03 15:58 . 2009-04-28 20:20 129520 ------w- c:\windows\system32\pxafs.dll
2009-10-03 15:58 . 2009-10-03 15:59 -------- d-----w- c:\program files\Winamp
2009-10-02 18:23 . 2005-01-03 15:43 4682 ----a-w- c:\windows\system32\npptNT2.sys
2009-10-02 18:23 . 2009-10-02 18:23 -------- d-----w- c:\program files\Common Files\INCA Shared
2009-10-01 18:03 . 2009-10-01 18:03 -------- d-----w- c:\program files\NetLimiter
2009-10-01 17:39 . 2008-04-14 06:51 21504 ----a-w- c:\windows\system32\hidserv.dll
2009-10-01 17:39 . 2008-04-14 06:51 21504 ----a-w- c:\windows\system32\dllcache\hidserv.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-10 09:08 . 2006-11-04 00:32 -------- d-----w- c:\program files\Hewlett-Packard
2009-10-10 09:08 . 2009-10-10 09:08 1755 --sha-r- c:\windows\system32\drivers\103C_HP_NTBK_HP Compaq nc2400(#AKB)_YN_0U_QCNF7125LQW_E404583223_46_I30A1_SHP_VKBC Version 53.13_B68YOP Ver. F.0A_T070122_WXP3_L405_M1016_J60_7Intel_8Core Duo U2500_91.2_#060706_N14E4169C_(#AKB)_XMOBILE_CN10_Z.MRK
2009-10-03 18:08 . 2007-10-30 06:54 -------- d-----w- c:\program files\Google
2009-09-03 14:26 . 2004-09-08 09:09 82814 ----a-w- c:\windows\system32\perfc005.dat
2009-09-03 14:26 . 2004-09-08 09:09 442234 ----a-w- c:\windows\system32\perfh005.dat
2009-09-03 14:21 . 2009-09-03 14:21 -------- d-----w- c:\program files\MSBuild
2009-09-03 14:21 . 2009-09-03 14:21 -------- d-----w- c:\program files\Reference Assemblies
2009-09-02 06:32 . 2009-09-02 06:12 -------- d-----w- c:\program files\HP
2009-08-23 16:49 . 2009-08-23 16:42 21840 ----atw- c:\windows\system32\SIntfNT.dll
2009-08-23 16:49 . 2009-08-23 16:42 17212 ----atw- c:\windows\system32\SIntf32.dll
2009-08-23 16:49 . 2009-08-23 16:42 12067 ----atw- c:\windows\system32\SIntf16.dll
2009-08-23 16:41 . 2006-11-04 00:32 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-05 09:01 . 2004-08-18 08:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-17 19:04 . 2004-08-18 08:00 58880 ----a-w- c:\windows\system32\atl.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-10-13_20.33.35 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-28 20:38 . 2008-04-13 23:06 42368 c:\windows\system32\drivers\AGP440.sys
+ 2009-10-15 11:27 . 2009-10-15 11:27 114688 c:\windows\system32\chg.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"AccelerometerSysTrayApplet"="c:\windows\system32\AccelerometerSt.exe" [2006-01-16 53248]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-31 761946]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-14 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-14 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-14 118784]
"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-05-02 40960]
"Recguard"="c:\windows\Sminst\Recguard.exe" [2005-12-20 1187840]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-08-31 122940]
"NetLimiter"="c:\program files\NetLimiter\NetLimiter.exe" [2004-03-31 823296]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"MsmqIntCert"="mqrt.dll" - c:\windows\system32\mqrt.dll [2008-04-14 177152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2009-10-11 576000]
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2009-10-10 2860792]

c:\documents and settings\Administrator\Nabˇdka Start\Programy\Po spuçtŘnˇ\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2009-10-11 576000]
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2009-10-10 2860792]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-2-27 581693]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
2005-01-31 12:13 49152 ----a-w- c:\progra~1\COMMON~1\Stardock\MCPStub.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^DVD Check.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\DVD Check.lnk
backup=c:\windows\pss\DVD Check.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\WINDOWS\\SMINST\\Scheduler.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [14.5.2009 15:49 94360]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [14.5.2009 15:47 731840]
R2 Ethpdrv;Ethernet Packet Driver;c:\windows\system32\drivers\ethpdrv.sys [29.10.2007 14:40 9728]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [28.2.2006 19:05 87808]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [25.4.2006 18:26 36608]
S2 ADSMainSvc;ADS Main Service;c:\windows\system32\ADS.Services.Main.exe [25.10.2007 15:11 40960]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [3.10.2009 20:04 133104]
S3 IpwP;IPWireless 3G PCMCIA Network Adapter;c:\windows\system32\drivers\ipwpnet.sys [29.10.2007 14:40 43184]
.
Obsah adresáře 'Naplánované úlohy'

2009-10-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-03 18:04]

2009-10-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-03 18:04]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
LSP: c:\program files\NetLimiter\nl_lsp.dll
DPF: {BCCDF398-8835-4A2C-978A-31148A6CC3BE} - hxxps://kdp.cpas.cz/EXT_FA/modules/modules.cab
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\ki95ra1j.default\
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - prefs.js: browser.startup.homepage - www.google.com
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-15 13:26
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????,?@? ????[??????R?@?????,?@

skenování skrytých souborů ...


c:\windows\system32\chg.exe 114688 bytes executable

sken byl úspešně dokončen
skryté soubory: 1

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(992)
c:\progra~1\COMMON~1\Stardock\mcpstub.dll

- - - - - - - > 'lsass.exe'(1048)
c:\program files\NetLimiter\nl_lsp.dll
c:\windows\system32\nl_msgc.dll

- - - - - - - > 'explorer.exe'(1132)
c:\program files\Stardock\ObjectDock\DockShellHook.dll
c:\progra~1\COMMON~1\Stardock\MCPCore.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\progra~1\COMMON~1\Stardock\SDMCP.exe
c:\windows\system32\scardsvr.exe
c:\program files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\msdtc.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\WIDCOMM\Bluetooth Software\BTStackServer.exe
c:\windows\system32\mqsvc.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\mqtgsvc.exe
.
**************************************************************************
.
Celkový čas: 2009-10-15 13:31 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-10-15 11:31
ComboFix2.txt 2009-10-14 19:47
ComboFix3.txt 2009-10-13 21:11

Před spuštěním: Volných bajtů: 21 887 070 208
Po spuštění: Volných bajtů: 21 784 018 944

213 --- E O F --- 2009-09-09 13:20


>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:35:00, on 15.10.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\AccelerometerSt.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
c:\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [AccelerometerSysTrayApplet] C:\WINDOWS\system32\AccelerometerSt.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - https://kdp.cpas.cz/EXT_FA/modules/smsx.cab
O16 - DPF: {BCCDF398-8835-4A2C-978A-31148A6CC3BE} (KDP400.CsXML XRtData Class) - https://kdp.cpas.cz/EXT_FA/modules/modules.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cpas.cz
O17 - HKLM\Software\..\Telephony: DomainName = cpas.cz
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cpas.cz
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = cpas.cz
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: ADS Main Service (ADSMainSvc) - Unknown owner - C:\WINDOWS\system32\ADS.Services.Main.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Firebird Guardian Service (InterBaseGuardian) - FirebirdSQL Project - C:\Program Files\Borland\InterBase\bin\ibguard.exe
O23 - Service: Firebird Server (InterBaseServer) - FirebirdSQL Project - C:\Program Files\Borland\InterBase\bin\ibserver.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe

--
End of file - 6425 bytes