PC-HELP.CZ

České diskuzní fórum o počítačích
https://pc-help.cnews.cz/

Prosím o kontrolu mého LOGU

https://pc-help.cnews.cz/viewtopic.php?f=70&t=47572

Stránka 1 z 2

Prosím o kontrolu mého LOGU

Napsal: 06 pro 2009 11:06
od kvaska
Dobrý den prosím o kontrolu logu posledni dobou mi vyskakuji okna stím že nod4 je smazal..ale chci se přesvědčit jestli tam opravdu už nic není dekuji moc za kontrolu :)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:55:47, on 6.12.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Genius\ioCentre\gTaskBar.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\Genius\ioCentre\gMouseTask.exe
C:\Genius\ioCentre\gKbdTask.exe
C:\Genius\ioCentre\gAutoPan.exe
C:\Genius\ioCentre\gAutoScroll.exe
C:\Genius\ioCentre\gZoom.exe
C:\Genius\ioCentre\gMGlass.exe
C:\Genius\ioCentre\gIMMgm.exe
C:\Genius\ioCentre\gKbStatus.exe
C:\Genius\ioCentre\gDeskMgm.exe
C:\Genius\ioCentre\gTaskSwitch.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jiri\Plocha\HiJackThis\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://search13.net/search.php?clid=486&q=" onclick="window.open(this.href);return false;%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search13.net/" onclick="window.open(this.href);return false;
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search13.net/" onclick="window.open(this.href);return false;
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search13.net/" onclick="window.open(this.href);return false;
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search13.net/" onclick="window.open(this.href);return false;
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search13.net/" onclick="window.open(this.href);return false;
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157" onclick="window.open(this.href);return false;
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896" onclick="window.open(this.href);return false;
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896" onclick="window.open(this.href);return false;
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157" onclick="window.open(this.href);return false;
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search13.net/" onclick="window.open(this.href);return false;
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search13.net/" onclick="window.open(this.href);return false;
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL (file missing)
O2 - BHO: Update it - {751be56d-a6b1-4901-91ba-d62033450b13} - C:\Program Files\Stylish Profile\updaterWin32.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [birepuj] C:\WINDOWS\system32\quoucawu.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [ioCentre] C:\Genius\ioCentre\gTaskBar.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6.5\ICQ.exe" silent
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: siszyd32.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: e&xportovat do aplikace microsoft excel - res://C" onclick="window.open(this.href);return false;:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C" onclick="window.open(this.href);return false;:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000a-7350-4f3c-8081-5663ee0c6c49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000a-7350-4f3c-8081-5663ee0c6c49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: groovelocalgws - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Služba inteligentního přenosu na pozadí (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Google Update Service (gupdate1c98b9ae2e32532) (gupdate1c98b9ae2e32532) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PC Tools Auxiliary Service (sdauxservice) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdcoreservice) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Automatické aktualizace (wuauserv) - Unknown owner - C:\WINDOWS\
O23 - Service: Creative ALchemy AL1 Licensing Service (yuia1eikazoij) - Unknown owner - C:\WINDOWS\system32\summelufy.exe (file missing)

--
End of file - 9698 bytes

diky :crazy:

Re: Prosím o kontrolu mého LOGU

Napsal: 06 pro 2009 13:21
od Damned
To ti toho moc nesmazal.

Spusť HJT (HijackThis), vypni prohlížeče, odpoj se od internetu a fixni (spustit HJT, "Do a system scan only",
zatrhnout políčko před hodnotou, zmáčknout "Fix checked" a poté "Ano"):

O2 - BHO: Groove GFS Browser Helper - {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL (file missing)
O2 - BHO: Update it - {751be56d-a6b1-4901-91ba-d62033450b13} - C:\Program Files\Stylish Profile\updaterWin32.dll
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [birepuj] C:\WINDOWS\system32\quoucawu.exe
O4 - Startup: siszyd32.exe
*****************************************************************************************************************************************
Máš tam MbAM, aktualizuj a spusť Skenování a výsledný log mi sem vlož

Re: Prosím o kontrolu mého LOGU

Napsal: 06 pro 2009 16:33
od kvaska
Malwarebytes' Anti-Malware 1.42
Verze databáze: 3289
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

6.12.2009 16:31:47
mbam-log-2009-12-06 (16-31-42).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 108664
Uplynulý čas: 4 minute(s), 59 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 1
Infikované hodnoty registru: 0
Infikované datové položky registru: 2
Infikované adresáře: 0
Infikované soubory: 6

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\gasfkyyddxddxb (Rootkit.TDSS) -> No action taken.

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BITS\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemRoot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> No action taken.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemroot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> No action taken.

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\WINDOWS\system32\gasfkyxjkdliyb.dll (Rootkit.TDSS) -> No action taken.
C:\WINDOWS\system32\gasfkyywbmfydl.dll (Rootkit.TDSS) -> No action taken.
C:\WINDOWS\system32\drivers\gasfkyohiedekr.sys (Rootkit.TDSS) -> No action taken.
C:\WINDOWS\system32\gasfkylgwxbdaw.dat (Rootkit.TDSS) -> No action taken.
C:\WINDOWS\system32\gasfkyvvkbeefy.dat (Rootkit.TDSS) -> No action taken.
C:\WINDOWS\system32\av_md.exe (Trojan.Dropper) -> No action taken.



tak to je mazec !! tolik sracek :D moc te prosim aby si mi stim pomhol :) :bigups: :bigups: :bigups:

Re: Prosím o kontrolu mého LOGU

Napsal: 06 pro 2009 16:40
od Damned
Takže spusť znovu MbAM a dej Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Odstranit označené
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Konec

Vypni rezidentní štít antiviru (pokud máš tak i antispyware).
Stáhni si ComboFix (by sUBs)
nebo ComboFix (subs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

Re: Prosím o kontrolu mého LOGU

Napsal: 06 pro 2009 17:13
od kvaska
Malwarebytes' Anti-Malware 1.42
Verze databáze: 3289
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

6.12.2009 16:51:01
mbam-log-2009-12-06 (16-51-01).txt

Typ kontroly: Rychlá kontrola
Zkontrolované objekty: 108816
Uplynulý čas: 1 minute(s), 45 second(s)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 1
Infikované hodnoty registru: 0
Infikované datové položky registru: 2
Infikované adresáře: 0
Infikované soubory: 6

Infikované procesy v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované moduly v paměti:
(Nebyly nalezeny žádné škodlivé položky)

Infikované klíče registru:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\gasfkyyddxddxb (Rootkit.TDSS) -> Quarantined and deleted successfully.

Infikované hodnoty registru:
(Nebyly nalezeny žádné škodlivé položky)

Infikované datové položky registru:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BITS\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemRoot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemroot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully.

Infikované adresáře:
(Nebyly nalezeny žádné škodlivé položky)

Infikované soubory:
C:\WINDOWS\system32\gasfkyxjkdliyb.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gasfkyywbmfydl.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\gasfkyohiedekr.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gasfkylgwxbdaw.dat (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gasfkyvvkbeefy.dat (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\av_md.exe (Trojan.Dropper) -> Quarantined and deleted successfully.




ComboFix 09-12-05.06 - Jiri 06.12.2009 17:05.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.3582.3058 [GMT 1:00]
Spuštěný z: c:\documents and settings\Jiri\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\config\systemprofile\av_md.exe

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-11-06 do 2009-12-06 )))))))))))))))))))))))))))))))
.

2009-12-06 15:57 . 2009-12-06 15:57 390144 ----a-w- c:\windows\system32\CF8901.exe
2009-12-05 14:55 . 2009-12-05 14:55 148 ----a-w- c:\windows\system32\fjhdyfhsn.bat
2009-11-16 13:46 . 2008-04-01 16:38 16896 ----a-w- c:\windows\system32\drivers\gHidPnp.sys
2009-11-16 13:46 . 2007-07-20 16:08 9856 ----a-w- c:\windows\system32\drivers\gMouUsb.sys
2009-11-16 13:44 . 2009-11-16 13:44 -------- d-----w- C:\Genius
2009-11-12 19:58 . 2009-12-05 13:24 138504 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-11-12 19:58 . 2009-12-05 13:24 214488 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-11-12 19:58 . 2009-12-05 13:09 75064 ----a-w- c:\windows\system32\PnkBstrA.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-06 15:18 . 2009-10-09 16:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-05 13:09 . 2009-05-03 11:05 2373712 ----a-w- c:\windows\system32\pbsvc.exe
2009-12-04 14:50 . 2009-02-10 16:15 -------- d-----w- c:\program files\Google
2009-12-03 17:59 . 2009-06-21 11:00 -------- d-----w- c:\program files\mIRC
2009-12-03 15:14 . 2009-10-09 16:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-03 15:13 . 2009-10-09 16:38 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-27 13:17 . 2008-04-14 12:00 47206 ----a-w- c:\windows\system32\perfc005.dat
2009-11-27 13:17 . 2008-04-14 12:00 312970 ----a-w- c:\windows\system32\perfh005.dat
2009-11-16 13:44 . 2008-12-04 15:28 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-03 21:49 . 2009-11-03 21:49 -------- d-----w- c:\program files\Stylish Profile
2009-11-02 16:21 . 2009-11-02 16:21 97280 ----a-w- C:\chrome_searchWin32.exe
2009-10-26 21:35 . 2009-09-18 19:10 0 ----a-w- c:\windows\system32\drivers\b4729f3d.sys
2009-10-09 15:15 . 2009-10-09 15:14 -------- d-----w- c:\program files\Spyware Doctor
2009-10-09 15:15 . 2009-10-09 15:14 -------- d-----w- c:\program files\Common Files\PC Tools
2009-10-02 13:58 . 2009-10-02 13:59 390144 ----a-w- c:\windows\system32\CF27641.exe
2009-09-27 11:11 . 2009-07-12 12:00 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ICQ"="c:\program files\ICQ6.5\ICQ.exe silent" [X]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-10 216520]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-13 16857600]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-08-29 1966080]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-10 13758464]
"nwiz"="nwiz.exe" [2009-06-10 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-06-10 86016]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"ioCentre"="c:\genius\ioCentre\gTaskBar.exe" [2007-12-17 61440]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Jiri\Nabˇdka Start\Programy\Po spuçtŘnˇ\
siszyd32.exe [2008-4-14 16896]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Hry\\MotoGP2\\motogp2.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Hry\\COD 2\\CoD2MP_s.exe"=
"c:\\Hry\\ZOO TYCOON 2\\zt.exe"=
"c:\\Hry\\RACE DRIVER-GRID\\GRID.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\Hry\\CSS\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Hry\\COD 4\\iw3mp.exe"=
"c:\\Hry\\Modern Warfare 2\\iw4mp.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [12.7.2009 12:10 64160]
R0 pctcore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [9.10.2009 16:14 206256]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [6.2.2009 13:23 106208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [6.2.2009 13:24 93336]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [6.2.2009 13:23 727720]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3.7.2009 15:49 1028432]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [28.12.2008 11:45 717296]
S1 b4729f3d;b4729f3d;c:\windows\system32\drivers\b4729f3d.sys [18.9.2009 20:10 0]
S2 gupdate1c98b9ae2e32532;Google Update Service (gupdate1c98b9ae2e32532);c:\program files\Google\Update\GoogleUpdate.exe [10.2.2009 17:16 133104]
S2 yuia1eikazoij;Creative ALchemy AL1 Licensing Service;c:\windows\system32\summelufy.exe --> c:\windows\system32\summelufy.exe [?]
S3 gHidPnp;USB Device Enhanced Function Driver;c:\windows\system32\drivers\gHidPnp.sys [16.11.2009 14:46 16896]
S3 gMouUsb;USB Mouse Device Drv;c:\windows\system32\drivers\gMouUsb.sys [16.11.2009 14:46 9856]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [9.7.2009 16:21 136704]
S3 sdauxservice;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [9.10.2009 16:14 348824]
.
------- Doplňkový sken -------
.
uDefault_Search_URL = hxxp://search13.net/" onclick="window.open(this.href);return false;
uStart Page = hxxp://search13.net/" onclick="window.open(this.href);return false;
uInternet Connection Wizard,ShellNext = iexplore
IE: e&xportovat do aplikace microsoft excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Jiri\Data aplikací\Mozilla\Firefox\Profiles\jjtrtyag.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/" onclick="window.open(this.href);return false;
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-Ad-Aware - c:\documents and settings\All Users\Data aplikací\{EF63305C-BAD7-4144-9208-D65528260864}\Ad-AwareAE.exe REMOVE=TRUE MODIFY=FALSE
AddRemove-mIRC - c:\program files\mIRC\uninstall.exe _?=c:\program files\mIRC
AddRemove-NVIDIA Drivers - c:\windows\system32\nvuninst.exe UninstallGUI



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net" onclick="window.open(this.href);return false;
Rootkit scan 2009-12-06 17:08
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
Celkový čas: 2009-12-06 17:09
ComboFix-quarantined-files.txt 2009-12-06 16:09

Před spuštěním: Volných bajtů: 40 556 281 856
Po spuštění: Volných bajtů: 41 783 685 120

WindowsXP-KB310994-SP2-Home-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - B87AA1066A6493FF162790C319229AFF

Re: Prosím o kontrolu mého LOGU

Napsal: 06 pro 2009 17:30
od kvaska
prosimte mel jsem EsetNOD4 a ted už ho tady nikde nevidim neviš proč ? zkusim restart...

Re: Prosím o kontrolu mého LOGU

Napsal: 06 pro 2009 17:35
od kvaska
takže eset už mi naskočil :) tak se mi kukni na ty logy :) až to pořešime diky moc :bigups: :bigups:

Re: Prosím o kontrolu mého LOGU

Napsal: 06 pro 2009 17:41
od Damned
NODa si vypínal (alespoň v logu je to vidět).

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
C:\WINDOWS\system32\av_md.exe
c:\windows\system32\fjhdyfhsn.bat
C:\chrome_searchWin32.exe
c:\windows\system32\drivers\b4729f3d.sys
c:\windows\system32\CF27641.exe
c:\documents and settings\Jiri\Nabˇdka Start\Programy\Po spuçtŘnˇ\siszyd32.exe
c:\documents and settings\Jiri\Nabídka Start\Programy\Po spuštění\siszyd32.exe
c:\windows\system32\summelufy.exe

Folder::
c:\program files\Stylish Profile

Driver::
b4729f3d
yuia1eikazoij;Creative ALchemy AL1 Licensing Service
yuia1eikazoij

Rootkit::
b4729f3d




Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.
Obrázek

- Automaticky se spustí ComboFix, oprava může trvat i déle než 10 minut. ! Nech ComboFix dokončit svou práci !
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT a popiš chování počítače

Re: Prosím o kontrolu mého LOGU

Napsal: 06 pro 2009 17:59
od kvaska
prosimte musim mit vypnuty nod ? a antispyware ? pri kontrole co teedkom budu delat ?

Re: Prosím o kontrolu mého LOGU

Napsal: 06 pro 2009 18:04
od Damned
Ano, musí být vypnutý.
Bezpečnostní aplikace mohou bránit úspěšnému odstranění viru a jiných šmejdů. A nyní ty šmejdy budem odstraňovat.

Re: Prosím o kontrolu mého LOGU

Napsal: 06 pro 2009 18:44
od kvaska
ComboFix 09-12-06.01 - Jiri 06.12.2009 18:21.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.3582.3078 [GMT 1:00]
Spuštěný z: c:\documents and settings\Jiri\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Jiri\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FILE ::
"c:\documents and settings\Jiri\Nabˇdka Start\Programy\Po spuçtŘnˇ\siszyd32.exe"
"c:\documents and settings\Jiri\Nabídka Start\Programy\Po spuštění\siszyd32.exe"
"C:\chrome_searchWin32.exe"
"c:\windows\system32\av_md.exe"
"c:\windows\system32\CF27641.exe"
"c:\windows\system32\drivers\b4729f3d.sys"
"c:\windows\system32\fjhdyfhsn.bat"
"c:\windows\system32\summelufy.exe"
.
Error: Cfiles.dat

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Jiri\Nabídka Start\Programy\Po spuštění\siszyd32.exe
C:\chrome_searchWin32.exe
c:\program files\Stylish Profile
c:\program files\Stylish Profile\updaterWin32.dll
c:\windows\system32\CF27641.exe
c:\windows\system32\drivers\b4729f3d.sys
c:\windows\system32\fjhdyfhsn.bat

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_YUIA1EIKAZOIJ
-------\Service_b4729f3d
-------\Service_yuia1eikazoij


((((((((((((((((((((((((( Soubory vytvořené od 2009-11-06 do 2009-12-06 )))))))))))))))))))))))))))))))
.

2009-12-06 15:57 . 2009-12-06 15:57 390144 ----a-w- c:\windows\system32\CF8901.exe
2009-11-16 13:46 . 2008-04-01 16:38 16896 ----a-w- c:\windows\system32\drivers\gHidPnp.sys
2009-11-16 13:46 . 2007-07-20 16:08 9856 ----a-w- c:\windows\system32\drivers\gMouUsb.sys
2009-11-16 13:44 . 2009-11-16 13:44 -------- d-----w- C:\Genius
2009-11-12 19:58 . 2009-12-05 13:24 138504 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-11-12 19:58 . 2009-12-05 13:24 214488 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-11-12 19:58 . 2009-12-05 13:09 75064 ----a-w- c:\windows\system32\PnkBstrA.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-06 15:18 . 2009-10-09 16:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-05 13:09 . 2009-05-03 11:05 2373712 ----a-w- c:\windows\system32\pbsvc.exe
2009-12-04 14:50 . 2009-02-10 16:15 -------- d-----w- c:\program files\Google
2009-12-03 17:59 . 2009-06-21 11:00 -------- d-----w- c:\program files\mIRC
2009-12-03 15:14 . 2009-10-09 16:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-03 15:13 . 2009-10-09 16:38 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-27 13:17 . 2008-04-14 12:00 47206 ----a-w- c:\windows\system32\perfc005.dat
2009-11-27 13:17 . 2008-04-14 12:00 312970 ----a-w- c:\windows\system32\perfh005.dat
2009-11-16 13:44 . 2008-12-04 15:28 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-09 15:15 . 2009-10-09 15:14 -------- d-----w- c:\program files\Spyware Doctor
2009-10-09 15:15 . 2009-10-09 15:14 -------- d-----w- c:\program files\Common Files\PC Tools
2009-09-27 11:11 . 2009-07-12 12:00 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-09-11 14:19 . 2008-04-14 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-12-06_16.08.39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-12-06 17:28 . 2009-12-06 17:28 16384 c:\windows\Temp\Perflib_Perfdata_1b4.dat
+ 2008-10-16 13:09 . 2009-08-06 18:24 44768 c:\windows\system32\wups2.dll
+ 2008-12-04 15:04 . 2009-08-06 18:24 35552 c:\windows\system32\wups.dll
+ 2008-12-04 15:04 . 2009-08-06 18:24 53472 c:\windows\system32\wuauclt.exe
+ 2008-04-14 12:00 . 2009-06-25 08:27 54272 c:\windows\system32\wdigest.dll
+ 2008-04-14 12:00 . 2009-10-28 15:07 46080 c:\windows\system32\tzchange.exe
- 2008-04-14 12:00 . 2009-07-14 11:03 46080 c:\windows\system32\tzchange.exe
+ 2009-12-06 16:34 . 2009-08-06 18:24 44768 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.4.7600.226\wups2.dll
+ 2009-12-06 16:34 . 2009-08-06 18:24 35552 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.4.7600.226\wups.dll
+ 2008-04-14 12:00 . 2009-06-25 08:27 56832 c:\windows\system32\secur32.dll
- 2008-04-14 12:00 . 2009-02-03 19:58 56832 c:\windows\system32\secur32.dll
+ 2009-03-08 03:31 . 2009-08-29 07:58 55296 c:\windows\system32\msfeedsbs.dll
- 2009-03-08 03:31 . 2009-07-03 16:59 55296 c:\windows\system32\msfeedsbs.dll
+ 2008-04-14 12:00 . 2009-09-04 21:05 58880 c:\windows\system32\msasn1.dll
- 2008-04-14 12:00 . 2009-07-03 16:59 25600 c:\windows\system32\jsproxy.dll
+ 2008-04-14 12:00 . 2009-08-29 07:58 25600 c:\windows\system32\jsproxy.dll
+ 2008-04-14 12:00 . 2009-06-24 11:18 92928 c:\windows\system32\drivers\ksecdd.sys
- 2009-06-10 08:09 . 2009-07-03 16:59 12800 c:\windows\system32\dllcache\xpshims.dll
+ 2009-06-10 08:09 . 2009-08-29 07:58 12800 c:\windows\system32\dllcache\xpshims.dll
+ 2008-12-04 15:04 . 2009-08-06 18:24 35552 c:\windows\system32\dllcache\wups.dll
+ 2008-12-04 15:04 . 2009-08-06 18:24 53472 c:\windows\system32\dllcache\wuauclt.exe
+ 2008-04-14 12:00 . 2009-06-25 08:27 54272 c:\windows\system32\dllcache\wdigest.dll
+ 2008-04-14 12:00 . 2009-06-25 08:27 56832 c:\windows\system32\dllcache\secur32.dll
- 2008-04-14 12:00 . 2009-02-03 19:58 56832 c:\windows\system32\dllcache\secur32.dll
+ 2009-07-28 17:16 . 2009-08-29 07:58 55296 c:\windows\system32\dllcache\msfeedsbs.dll
- 2009-07-28 17:16 . 2009-07-03 16:59 55296 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2008-04-14 12:00 . 2009-09-04 21:05 58880 c:\windows\system32\dllcache\msasn1.dll
+ 2008-04-14 12:00 . 2009-06-24 11:18 92928 c:\windows\system32\dllcache\ksecdd.sys
+ 2008-04-14 12:00 . 2009-08-29 07:58 25600 c:\windows\system32\dllcache\jsproxy.dll
- 2008-04-14 12:00 . 2009-07-03 16:59 25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2008-04-14 12:00 . 2009-08-06 18:24 96480 c:\windows\system32\dllcache\cdm.dll
+ 2008-04-14 12:00 . 2009-08-06 18:24 96480 c:\windows\system32\cdm.dll
+ 2009-12-06 16:45 . 2009-12-06 16:45 32768 c:\windows\Installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}\icon.exe
+ 2009-12-06 16:47 . 2009-07-03 16:59 12800 c:\windows\ie8updates\KB974455-IE8\xpshims.dll
+ 2009-12-06 16:47 . 2009-07-03 16:59 55296 c:\windows\ie8updates\KB974455-IE8\msfeedsbs.dll
+ 2009-12-06 16:47 . 2009-07-03 16:59 25600 c:\windows\ie8updates\KB974455-IE8\jsproxy.dll
+ 2008-12-04 15:04 . 2009-08-06 18:24 209632 c:\windows\system32\wuweb.dll
+ 2008-12-04 15:04 . 2009-08-06 18:24 327896 c:\windows\system32\wucltui.dll
+ 2008-12-04 15:04 . 2009-08-06 18:23 575704 c:\windows\system32\wuapi.dll
+ 2008-04-14 12:00 . 2009-04-01 22:02 604160 c:\windows\system32\wmspdmod.dll
+ 2008-04-14 12:00 . 2009-08-29 07:58 916480 c:\windows\system32\wininet.dll
- 2008-04-14 12:00 . 2008-10-03 10:04 247326 c:\windows\system32\strmdll.dll
+ 2008-04-14 12:00 . 2009-08-26 08:02 247326 c:\windows\system32\strmdll.dll
+ 2008-04-14 12:00 . 2009-06-25 08:27 147456 c:\windows\system32\schannel.dll
+ 2008-04-14 12:00 . 2009-08-29 07:58 206848 c:\windows\system32\occache.dll
- 2008-04-14 12:00 . 2009-07-03 16:59 206848 c:\windows\system32\occache.dll
- 2009-03-08 03:32 . 2009-07-03 16:59 594432 c:\windows\system32\msfeeds.dll
+ 2009-03-08 03:32 . 2009-08-29 07:58 594432 c:\windows\system32\msfeeds.dll
+ 2008-04-14 12:00 . 2009-06-25 08:27 729088 c:\windows\system32\lsasrv.dll
+ 2008-04-14 12:00 . 2009-06-25 08:27 301568 c:\windows\system32\kerberos.dll
- 2008-04-14 12:00 . 2009-07-03 16:59 184320 c:\windows\system32\iepeers.dll
+ 2008-04-14 12:00 . 2009-08-29 07:58 184320 c:\windows\system32\iepeers.dll
+ 2008-04-14 12:00 . 2009-08-29 07:58 387584 c:\windows\system32\iedkcs32.dll
+ 2008-04-14 12:00 . 2009-08-28 10:35 173056 c:\windows\system32\ie4uinit.exe
- 2008-04-14 12:00 . 2009-07-03 11:01 173056 c:\windows\system32\ie4uinit.exe
- 2008-12-04 22:52 . 2009-10-22 13:29 283720 c:\windows\system32\FNTCACHE.DAT
+ 2008-12-04 22:52 . 2009-12-06 16:55 283720 c:\windows\system32\FNTCACHE.DAT
+ 2008-12-04 15:04 . 2009-08-06 18:24 209632 c:\windows\system32\dllcache\wuweb.dll
+ 2008-12-04 15:04 . 2009-08-06 18:24 327896 c:\windows\system32\dllcache\wucltui.dll
+ 2008-12-04 15:04 . 2009-08-06 18:23 575704 c:\windows\system32\dllcache\wuapi.dll
+ 2008-04-14 12:00 . 2009-04-01 22:02 604160 c:\windows\system32\dllcache\wmspdmod.dll
+ 2008-04-14 12:00 . 2009-08-29 07:58 916480 c:\windows\system32\dllcache\wininet.dll
- 2008-04-14 12:00 . 2008-10-03 10:04 247326 c:\windows\system32\dllcache\strmdll.dll
+ 2008-04-14 12:00 . 2009-08-26 08:02 247326 c:\windows\system32\dllcache\strmdll.dll
+ 2008-04-14 12:00 . 2009-06-25 08:27 147456 c:\windows\system32\dllcache\schannel.dll
+ 2008-04-14 12:00 . 2009-08-29 07:58 206848 c:\windows\system32\dllcache\occache.dll
- 2008-04-14 12:00 . 2009-07-03 16:59 206848 c:\windows\system32\dllcache\occache.dll
+ 2008-04-14 12:00 . 2009-09-11 14:19 136192 c:\windows\system32\dllcache\msv1_0.dll
- 2009-07-28 17:16 . 2009-07-03 16:59 594432 c:\windows\system32\dllcache\msfeeds.dll
+ 2009-07-28 17:16 . 2009-08-29 07:58 594432 c:\windows\system32\dllcache\msfeeds.dll
+ 2008-04-14 12:00 . 2009-06-25 08:27 729088 c:\windows\system32\dllcache\lsasrv.dll
+ 2008-04-14 12:00 . 2009-06-25 08:27 301568 c:\windows\system32\dllcache\kerberos.dll
- 2009-06-10 08:09 . 2009-07-03 16:59 246272 c:\windows\system32\dllcache\ieproxy.dll
+ 2009-06-10 08:09 . 2009-08-29 07:58 246272 c:\windows\system32\dllcache\ieproxy.dll
- 2008-04-14 12:00 . 2009-07-03 16:59 184320 c:\windows\system32\dllcache\iepeers.dll
+ 2008-04-14 12:00 . 2009-08-29 07:58 184320 c:\windows\system32\dllcache\iepeers.dll
+ 2008-04-14 12:00 . 2009-08-29 07:58 387584 c:\windows\system32\dllcache\iedkcs32.dll
+ 2008-04-14 12:00 . 2009-08-28 10:35 173056 c:\windows\system32\dllcache\ie4uinit.exe
- 2008-04-14 12:00 . 2009-07-03 11:01 173056 c:\windows\system32\dllcache\ie4uinit.exe
+ 2009-12-06 16:45 . 2009-12-06 16:45 429568 c:\windows\Installer\c4330.msi
+ 2009-12-06 16:47 . 2009-07-03 16:59 915456 c:\windows\ie8updates\KB974455-IE8\wininet.dll
+ 2009-12-06 16:47 . 2009-05-26 11:40 391032 c:\windows\ie8updates\KB974455-IE8\spuninst\updspapi.dll
+ 2009-12-06 16:47 . 2008-07-08 12:59 233848 c:\windows\ie8updates\KB974455-IE8\spuninst\spuninst.exe
+ 2009-12-06 16:47 . 2009-07-03 16:59 206848 c:\windows\ie8updates\KB974455-IE8\occache.dll
+ 2009-12-06 16:47 . 2009-07-03 16:59 594432 c:\windows\ie8updates\KB974455-IE8\msfeeds.dll
+ 2009-12-06 16:47 . 2009-07-03 16:59 246272 c:\windows\ie8updates\KB974455-IE8\ieproxy.dll
+ 2009-12-06 16:47 . 2009-07-03 16:59 184320 c:\windows\ie8updates\KB974455-IE8\iepeers.dll
+ 2009-12-06 16:47 . 2009-07-03 16:59 386048 c:\windows\ie8updates\KB974455-IE8\iedkcs32.dll
+ 2009-12-06 16:47 . 2009-07-03 11:01 173056 c:\windows\ie8updates\KB974455-IE8\ie4uinit.exe
+ 2009-12-06 16:42 . 2009-08-13 13:56 1748992 c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll
+ 2009-07-20 23:03 . 2009-07-20 23:03 1348432 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5\msxml4.dll
+ 2008-12-04 15:04 . 2009-08-06 18:23 1929952 c:\windows\system32\wuaueng.dll
+ 2008-04-14 12:00 . 2009-08-14 15:15 1850624 c:\windows\system32\win32k.sys
- 2008-04-14 12:00 . 2009-07-03 16:59 1208832 c:\windows\system32\urlmon.dll
+ 2008-04-14 12:00 . 2009-08-29 07:58 1208832 c:\windows\system32\urlmon.dll
- 2008-04-14 12:00 . 2008-04-14 12:00 1437696 c:\windows\system32\query.dll
+ 2008-04-14 12:00 . 2009-07-17 16:17 1437696 c:\windows\system32\query.dll
+ 2008-04-14 12:00 . 2009-08-04 17:29 2147328 c:\windows\system32\ntoskrnl.exe
- 2008-04-14 12:00 . 2009-02-09 11:26 2147328 c:\windows\system32\ntoskrnl.exe
- 2008-04-14 08:06 . 2009-02-09 11:26 2025984 c:\windows\system32\ntkrnlpa.exe
+ 2008-04-14 08:06 . 2009-08-04 17:29 2025984 c:\windows\system32\ntkrnlpa.exe
+ 2008-04-14 12:00 . 2009-07-31 09:05 1372672 c:\windows\system32\msxml6.dll
+ 2009-07-20 23:05 . 2009-07-20 23:05 1348432 c:\windows\system32\msxml4.dll
+ 2008-04-14 12:00 . 2009-07-31 04:35 1172480 c:\windows\system32\msxml3.dll
+ 2008-04-14 12:00 . 2009-08-29 07:58 5940224 c:\windows\system32\mshtml.dll
- 2009-03-08 03:32 . 2009-07-03 16:59 1985536 c:\windows\system32\iertutil.dll
+ 2009-03-08 03:32 . 2009-08-29 07:58 1985536 c:\windows\system32\iertutil.dll
+ 2008-12-04 15:04 . 2009-08-06 18:23 1929952 c:\windows\system32\dllcache\wuaueng.dll
+ 2008-04-14 12:00 . 2009-08-14 15:15 1850624 c:\windows\system32\dllcache\win32k.sys
- 2008-04-14 12:00 . 2009-07-03 16:59 1208832 c:\windows\system32\dllcache\urlmon.dll
+ 2008-04-14 12:00 . 2009-08-29 07:58 1208832 c:\windows\system32\dllcache\urlmon.dll
- 2008-04-14 12:00 . 2008-04-14 12:00 1437696 c:\windows\system32\dllcache\query.dll
+ 2008-04-14 12:00 . 2009-07-17 16:17 1437696 c:\windows\system32\dllcache\query.dll
+ 2008-12-24 20:06 . 2009-08-04 21:59 2191360 c:\windows\system32\dllcache\ntoskrnl.exe
- 2008-12-24 20:06 . 2009-02-09 11:26 2025984 c:\windows\system32\dllcache\ntkrpamp.exe
+ 2008-12-24 20:06 . 2009-08-04 17:29 2025984 c:\windows\system32\dllcache\ntkrpamp.exe
- 2008-12-24 20:06 . 2009-02-10 17:09 2068224 c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2008-12-24 20:06 . 2009-08-04 17:29 2068224 c:\windows\system32\dllcache\ntkrnlpa.exe
- 2008-12-24 20:06 . 2009-02-09 11:26 2147328 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2008-12-24 20:06 . 2009-08-04 17:29 2147328 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2008-04-14 12:00 . 2009-07-31 09:05 1372672 c:\windows\system32\dllcache\msxml6.dll
+ 2008-04-14 12:00 . 2009-07-31 04:35 1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2008-04-14 12:00 . 2009-08-29 07:58 5940224 c:\windows\system32\dllcache\mshtml.dll
- 2009-06-10 08:09 . 2009-07-03 16:59 1985536 c:\windows\system32\dllcache\iertutil.dll
+ 2009-06-10 08:09 . 2009-08-29 07:58 1985536 c:\windows\system32\dllcache\iertutil.dll
+ 2009-12-06 16:47 . 2009-07-03 16:59 1208832 c:\windows\ie8updates\KB974455-IE8\urlmon.dll
+ 2009-12-06 16:47 . 2009-07-19 13:16 5937152 c:\windows\ie8updates\KB974455-IE8\mshtml.dll
+ 2009-12-06 16:47 . 2009-07-03 16:59 1985536 c:\windows\ie8updates\KB974455-IE8\iertutil.dll
+ 2008-12-24 20:06 . 2009-08-04 21:59 2191360 c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2008-12-24 20:06 . 2009-08-04 17:29 2025984 c:\windows\Driver Cache\i386\ntkrpamp.exe
- 2008-12-24 20:06 . 2009-02-09 11:26 2025984 c:\windows\Driver Cache\i386\ntkrpamp.exe
- 2008-12-24 20:06 . 2009-02-10 17:09 2068224 c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2008-12-24 20:06 . 2009-08-04 17:29 2068224 c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2008-12-24 20:06 . 2009-08-04 17:29 2147328 c:\windows\Driver Cache\i386\ntkrnlmp.exe
- 2008-12-24 20:06 . 2009-02-09 11:26 2147328 c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2008-12-25 08:43 . 2009-11-05 08:36 26768832 c:\windows\system32\MRT.exe
+ 2009-03-08 03:39 . 2009-08-29 07:58 11069440 c:\windows\system32\ieframe.dll
+ 2009-06-10 08:09 . 2009-08-29 07:58 11069440 c:\windows\system32\dllcache\ieframe.dll
+ 2009-12-06 16:47 . 2009-07-19 16:46 11067392 c:\windows\ie8updates\KB974455-IE8\ieframe.dll
.
-- Snímek resetován k současnému datu --
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ICQ"="c:\program files\ICQ6.5\ICQ.exe silent" [X]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-10 216520]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-13 16857600]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-08-29 1966080]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-10 13758464]
"nwiz"="nwiz.exe" [2009-06-10 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-06-10 86016]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"ioCentre"="c:\genius\ioCentre\gTaskBar.exe" [2007-12-17 61440]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Hry\\MotoGP2\\motogp2.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\Hry\\COD 2\\CoD2MP_s.exe"=
"c:\\Hry\\ZOO TYCOON 2\\zt.exe"=
"c:\\Hry\\RACE DRIVER-GRID\\GRID.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\HLSW\\hlsw.exe"=
"c:\\Hry\\CSS\\Counter-Strike Source\\hl2.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Hry\\COD 4\\iw3mp.exe"=
"c:\\Hry\\Modern Warfare 2\\iw4mp.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [12.7.2009 12:10 64160]
R0 pctcore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [9.10.2009 16:14 206256]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [28.12.2008 11:45 717296]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [6.2.2009 13:23 106208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [6.2.2009 13:24 93336]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [6.2.2009 13:23 727720]
S2 gupdate1c98b9ae2e32532;Google Update Service (gupdate1c98b9ae2e32532);c:\program files\Google\Update\GoogleUpdate.exe [10.2.2009 17:16 133104]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3.7.2009 15:49 1028432]
S3 gHidPnp;USB Device Enhanced Function Driver;c:\windows\system32\drivers\gHidPnp.sys [16.11.2009 14:46 16896]
S3 gMouUsb;USB Mouse Device Drv;c:\windows\system32\drivers\gMouUsb.sys [16.11.2009 14:46 9856]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [9.7.2009 16:21 136704]
S3 sdauxservice;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [9.10.2009 16:14 348824]
.
------- Doplňkový sken -------
.
uDefault_Search_URL = hxxp://search13.net/" onclick="window.open(this.href);return false;
uStart Page = hxxp://search13.net/" onclick="window.open(this.href);return false;
uInternet Connection Wizard,ShellNext = iexplore
IE: e&xportovat do aplikace microsoft excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Jiri\Data aplikací\Mozilla\Firefox\Profiles\jjtrtyag.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/" onclick="window.open(this.href);return false;
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net" onclick="window.open(this.href);return false;
Rootkit scan 2009-12-06 18:28
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net" onclick="window.open(this.href);return false;

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys hal.dll ACPI.sys >>UNKNOWN [0x8A8571F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xb80fcf28
\Driver\ACPI -> ACPI.sys @ 0xb7e67cb8
\Driver\atapi -> atapi.sys @ 0xb7e22b40
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xb7ce1bb0
PacketIndicateHandler -> NDIS.sys @ 0xb7ceea21
SendHandler -> NDIS.sys @ 0xb7ccc87b
user & kernel MBR OK

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(2000)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\genius\ioCentre\gMouseTask.exe
c:\genius\ioCentre\gKbdTask.exe
c:\genius\ioCentre\gDeskMgm.exe
c:\genius\ioCentre\gTaskSwitch.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\PC Connectivity Solution\ServiceLayer.exe
c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\program files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2009-12-06 18:34 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-12-06 17:34
ComboFix2.txt 2009-12-06 16:09

Před spuštěním: Volných bajtů: 41 392 230 400
Po spuštění: Volných bajtů: 41 255 821 312

- - End Of File - - A9A061C2264F41F8D3C51DCAEF8E097F


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:40:45, on 6.12.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Genius\ioCentre\gMouseTask.exe
C:\Genius\ioCentre\gKbdTask.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Genius\ioCentre\gDeskMgm.exe
C:\Genius\ioCentre\gTaskSwitch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jiri\Plocha\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://search13.net/search.php?clid=486&q=" onclick="window.open(this.href);return false;%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search13.net/" onclick="window.open(this.href);return false;
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search13.net/" onclick="window.open(this.href);return false;
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157" onclick="window.open(this.href);return false;
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896" onclick="window.open(this.href);return false;
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896" onclick="window.open(this.href);return false;
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157" onclick="window.open(this.href);return false;
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ioCentre] C:\Genius\ioCentre\gTaskBar.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6.5\ICQ.exe" silent
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: e&xportovat do aplikace microsoft excel - res://C" onclick="window.open(this.href);return false;:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C" onclick="window.open(this.href);return false;:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000a-7350-4f3c-8081-5663ee0c6c49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000a-7350-4f3c-8081-5663ee0c6c49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: groovelocalgws - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Google Update Service (gupdate1c98b9ae2e32532) (gupdate1c98b9ae2e32532) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PC Tools Auxiliary Service (sdauxservice) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdcoreservice) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 7128 bytes


chováni počitače je stejné jako předtím...musím ale dotat že předtím než jsem začal něco řešit, PC se nijak neprojevovalo akorat hlasilo že ma nejake viry v sobě :) tak se na to kouknete a potom napište dalši postup dekuji :bigups:

Re: Prosím o kontrolu mého LOGU

Napsal: 06 pro 2009 19:02
od Damned
Předpokládám, že už nyní ti žádný viry nehlásí.

Odinstaluj ComboFix ( nutné ) .
ComboFix se odinstaluje takto:
Start-Spustit a zadej Combofix[mezera]/uninstall

Vyčisti systém CCleanerem a použij i T-Cleaner ( nutné - smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš->spustíš)

(pozn.Pokud máš AVG, avast! nebo Aviru, před stažením T-Cleaneru a po dobu čištění deaktivuj AVG, avast! i Aviru (i rezidenty), následně T-Cleaner smaž a zapni si AVG,avast!, Aviru.)


Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.


Kdyby se něco zase objevilo, tak se zastav.
Označ topic za vyřešený (zelená fajfka) a měj se. :bigups:
Všechny časy jsou v UTC+01:00
Stránka 1 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz