PC-HELP.CZ

Dobrý deň,
rád by som poprosil o kontrolu logu HJT, počítač je pomalý a dlho sa nepodrobil žiadnej kontrole. Tu je log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:40:22, on 9.4.2012
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\spoolsv.exe
H:\Program Files\Avira\AntiVir Desktop\sched.exe
H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
H:\Program Files\Avira\AntiVir Desktop\avguard.exe
H:\WINDOWS\ATKKBService.exe
H:\Program Files\ICQ6Toolbar\ICQ Service.exe
H:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
H:\Program Files\Java\jre6\bin\jqs.exe
H:\WINDOWS\runservice.exe
H:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
H:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe
H:\Program Files\CDBurnerXP\NMSAccessU.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\Program Files\Avira\AntiVir Desktop\avshadow.exe
H:\WINDOWS\system32\PnkBstrA.exe
H:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
H:\WINDOWS\system32\svchost.exe
H:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
H:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
H:\WINDOWS\Explorer.EXE
H:\PROGRA~1\MEDIAK~1\MagicKey.exe
H:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
H:\Program Files\ASUS\GamerOSD\GamerOSD.exe
H:\WINDOWS\system32\RUNDLL32.EXE
H:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
H:\Program Files\PC Connectivity Solution\ServiceLayer.exe
H:\Program Files\Avira\AntiVir Desktop\avgnt.exe
H:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
H:\hry\warcraft 3\Warcraft III\w3dr.exe
H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
H:\WINDOWS\PixArt\PAC207\Monitor.exe
H:\Program Files\Canon\MyPrinter\BJMyPrt.exe
H:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
H:\WINDOWS\system32\ctfmon.exe
H:\PROGRA~1\MEDIAK~1\OSD.exe
H:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
H:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
H:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
H:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
H:\Program Files\Opera\opera.exe
H:\Documents and Settings\Lenka\Plocha\program.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?AF=108602&tt ... 1fc642eb41
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 77.92.72.198:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - H:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: Movier-media Toolbar - {ce10bf86-da68-441e-91fa-38336363e3cd} - H:\Program Files\Movier-media\prxtbMov2.dll
R3 - URLSearchHook: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - H:\Program Files\uTorrentBar\prxtbuTor.dll
O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - H:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - H:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: FDMIECookiesBHO Class - {7A780B7B-DCF1-4ec4-BB13-2DF92CAD27DB} - H:\Program Files\Light Downloader\ldmie2.dll
O2 - BHO: GamePlayLabsBHO - {984A9162-8891-4D19-8CFE-17648BB4E1EC} - H:\Documents and Settings\Lenka\Local Settings\Data aplikací\GamePlayLabs Plugin\BHO.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - h:\program files\google\googletoolbar1.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - H:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (file missing)
O2 - BHO: uTorrentBar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - H:\Program Files\uTorrentBar\prxtbuTor.dll
O2 - BHO: Movier-media - {ce10bf86-da68-441e-91fa-38336363e3cd} - H:\Program Files\Movier-media\prxtbMov2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - H:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - h:\program files\google\googletoolbar1.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - H:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: Movier-media Toolbar - {ce10bf86-da68-441e-91fa-38336363e3cd} - H:\Program Files\Movier-media\prxtbMov2.dll
O3 - Toolbar: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - H:\Program Files\uTorrentBar\prxtbuTor.dll
O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - H:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll
O4 - HKLM\..\Run: [MagicKey] H:\PROGRA~1\MEDIAK~1\MagicKey.exe
O4 - HKLM\..\Run: [HDAudDeck] H:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [ASUSGamerOSD] H:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [WinampAgent] "H:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PCSuiteTrayApplication] H:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "H:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [avgnt] "H:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Google Desktop Search] "H:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [w3dr.exe] H:\hry\warcraft 3\Warcraft III\w3dr.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [PAC207_Monitor] H:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [Monitor] H:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "H:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [QuickTime Task] "H:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [CanonMyPrinter] H:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [CanonSolutionMenu] H:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [GrooveMonitor] "H:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [IgfxTraySound] %appdata%\igfxtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [QuickTime Task] "H:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [EA Core] "H:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [ICQ] "H:\Program Files\ICQ7.4\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [BitComet] "H:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] H:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = H:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = H:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Service Manager.lnk = H:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: WDDMStatus.lnk = H:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
O4 - Global Startup: WDSmartWare.lnk = H:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://H:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://H:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - H:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - H:\Program Files\ICQ7.5\ICQ.exe
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - H:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (file missing)
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - H:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{41C04E3C-606D-4C4E-8D6C-3E91063BB482}: NameServer = 10.10.10.10,208.67.220.220
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - H:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - H:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - H:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - H:\WINDOWS\system32\browseui.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - H:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Adobe LM Service - Adobe Systems - H:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - H:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - H:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - H:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - H:\WINDOWS\ATKKBService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - H:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - H:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - H:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - H:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ICQ Service - Unknown owner - H:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - H:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - H:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - H:\WINDOWS\runservice.exe
O23 - Service: NMSAccessU - Unknown owner - H:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - H:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - H:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - H:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: WD SmartWare Drive Manager (WDDMService) - WDC - H:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
O23 - Service: WD SmartWare Background Service (WDSmartWareBackgroundService) - Memeo - H:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe

--
End of file - 13781 bytes

Odinstaluj:
Google Toolbar
ICQToolBar
Movier-media Toolbar
uTorrentBar Toolbar
Babylon Toolbar

Proxy 77.92.72.198:80 znáš?

Fixni:
Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
- Pokud používáš Firefox, klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
- Pokud používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
- Pokud používáš Chrome, nic dalšího nevybírej a dej Empty Selected.
Po vyčištění klikni na Exit k zavření programu.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache, cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer, Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Update Malwarebytes' Anti-Malware (Aktualizace Malwarebytes' Anti-Malware) a Launch Malwarebytes' Anti-Malware (Spustit aplikaci Malwarebytes' Anti-Malware), pokud jo tak klikni na tlačítko Finish
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Perform Quick Scan (Provést rychlý sken) a klikni na tlačítko Scan (Skenovat)
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- pak zvol možnost Save Logfile a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(ZATÍM SÁM NIC NEMAŽ!).
Vlož sem pak obsah toho logu.

o tom proxy nic neviem, mam ho fixnut?


tu je log z Anti-Malware:

Malwarebytes Anti-Malware 1.60.1.1000
http://www.malwarebytes.org

Verze databáze: v2012.04.09.05

Windows XP Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.18702
Lenka :: DOMA-FF096F8781 [administrátor]

9.4.2012 18:03:38
mbam-log-2012-04-09 (18-24-36).txt

Typ: Rychlá kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 239536
Uplynulý čas: 20 minut, 40 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7} (Backdoor.Bot) -> Žádná instrukce nebyla provedena.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6} (Backdoor.Bot) -> Žádná instrukce nebyla provedena.

Nalezené hodnoty v registru: 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|IgfxTraySound (Redir.Qooqlle) -> Data: %appdata%\igfxtray.exe -> Žádná instrukce nebyla provedena.

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 1
H:\Documents and Settings\Lenka\Data aplikací\Mozilla\Firefox\Profiles\qooqlle.xml (Redir.Qooqlle) -> Žádná instrukce nebyla provedena.

(konec)

Ta proxy odkazuje nějak do UK. Jsi odtamtud?

- Takže spus znovu MbAM a dej Scan
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Show Results
- ujistit se že máš zatrhnuté všechny vypsané nálezy a klikni na tlačítko Remove Selected
- když skončí odstraňování tak se ti zobrazí log, tak ho sem dej.
- pak zvol v programu OK a pak program ukonči přes Exit

Vypni rezidentní štít antiviru a antispywaru
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

pozrel som to miesto, nemam s nim nic spolocne...

MbAM po mne chcelo restart a nezachoval sa mi log, mam ho spustit este raz? (nalezy som odstranil)

log z combofixu:

ComboFix 12-04-09.05 - Lenka 09.04.2012 21:38:21.5.2 - x86
Spuštěný z: h:\documents and settings\Lenka\Plocha\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
h:\documents and settings\Vilo\WINDOWS
H:\Install.exe
h:\windows\IsUn0405.exe
h:\windows\pkunzip.pif
h:\windows\pkzip.pif
h:\windows\system32\CddbCdda.dll
h:\windows\system32\SET209.tmp
h:\windows\system32\SET20D.tmp
h:\windows\system32\SET215.tmp
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-03-09 do 2012-04-09 )))))))))))))))))))))))))))))))
.
.
2012-04-09 16:02 . 2012-04-09 16:02 -------- d-----w- h:\documents and settings\Lenka\Data aplikací\Malwarebytes
2012-04-04 12:47 . 2012-04-04 13:06 418464 ----a-w- h:\windows\system32\FlashPlayerApp.exe
2012-03-27 19:07 . 2012-03-27 19:07 237 ----a-w- H:\user.js
2012-03-27 19:07 . 2012-03-27 19:07 -------- d-----w- h:\documents and settings\Lenka\Local Settings\Data aplikací\Babylon
2012-03-27 19:07 . 2012-03-27 19:07 -------- d-----w- h:\documents and settings\Lenka\Data aplikací\Babylon
2012-03-27 19:07 . 2012-03-27 19:07 -------- d-----w- h:\documents and settings\All Users\Data aplikací\Babylon
2012-03-24 18:19 . 2012-03-24 18:19 -------- d--h--r- h:\documents and settings\Lenka\Data aplikací\SecuROM
2012-03-24 17:12 . 2012-03-24 17:12 592824 ----a-w- h:\program files\Mozilla Firefox\gkmedias.dll
2012-03-24 17:12 . 2012-03-24 17:12 44472 ----a-w- h:\program files\Mozilla Firefox\mozglue.dll
2012-03-24 16:42 . 2012-03-24 16:42 -------- d-----w- h:\documents and settings\All Users\Data aplikací\EA Core
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-08 23:17 . 2008-07-31 17:44 196608 ----a-w- h:\windows\system32\drivers\nStandard.bin
2012-04-04 13:06 . 2011-12-13 16:01 70304 ----a-w- h:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-24 17:12 . 2012-01-27 11:36 97208 ----a-w- h:\program files\mozilla firefox\components\browsercomps.dll
2010-07-20 09:47 . 2009-11-28 12:29 119808 ----a-w- h:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MagicKey"="h:\progra~1\MEDIAK~1\MagicKey.exe" [2004-03-15 45056]
"HDAudDeck"="h:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-01-14 29753344]
"ASUSGamerOSD"="h:\program files\ASUS\GamerOSD\GamerOSD.exe" [2007-09-13 380928]
"NvCplDaemon"="h:\windows\system32\NvCpl.dll" [2007-09-16 8491008]
"nwiz"="nwiz.exe" [2007-09-16 1626112]
"NvMediaCenter"="h:\windows\system32\NvMcTray.dll" [2007-09-16 81920]
"PCSuiteTrayApplication"="h:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328]
"Adobe Photo Downloader"="h:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"avgnt"="h:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-04 281768]
"Google Desktop Search"="h:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-07-20 30192]
"ArcSoft Connection Service"="h:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"PAC207_Monitor"="h:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"Monitor"="h:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"AdobeCS4ServiceManager"="h:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"CanonMyPrinter"="h:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-10-19 1983816]
"CanonSolutionMenu"="h:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-09-04 767312]
"GrooveMonitor"="h:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="h:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
"Nokia.PCSync"="h:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"h:\\WINDOWS\\system32\\PnkBstrA.exe"=
"h:\\WINDOWS\\system32\\PnkBstrB.exe"=
"h:\\hry\\warcraft 3\\Warcraft III\\war3.exe"=
"h:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"h:\\WINDOWS\\system32\\dplaysvr.exe"=
"h:\\Program Files\\Opera\\opera.exe"=
"h:\\Program Files\\QIP\\qip.exe"=
"h:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"h:\\Program Files\\Sierra\\Homeworld2\\Bin\\Release\\Homeworld2.exe"=
"h:\\WINDOWS\\system32\\dpnsvr.exe"=
"h:\\Documents and Settings\\Vilo\\Plocha\\Age_of_empires_II\\Age of empires\\age2_x1.exe"=
"h:\\Documents and Settings\\Vilo\\Plocha\\Age_of_empires_II\\Age of empires\\empires2.exe"=
"h:\\hry\\warcraft 3\\Warcraft III\\Warcraft III.exe"=
"h:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"h:\\Program Files\\Steam\\Steam.exe"=
"h:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"h:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"h:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"h:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"h:\\Program Files\\ICQ7.5\\ICQ.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list]
"6112:UDP"= 6112:UDP:w3
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"24018:TCP"= 24018:TCP:BitComet 24018 TCP
"24018:UDP"= 24018:UDP:BitComet 24018 UDP
.
R2 gupdate;Google Update Service (gupdate);h:\program files\Google\Update\GoogleUpdate.exe [2009-11-08 135664]
R2 LicCtrlService;LicCtrl Service;h:\windows\runservice.exe [2009-02-24 2560]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;h:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 253600]
R3 androidusb;ADB Interface Driver;h:\windows\system32\Drivers\fxxandroidusb.sys [2010-04-01 25728]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;h:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-07-20 30192]
R3 gupdatem;Služba Google Update (gupdatem);h:\program files\Google\Update\GoogleUpdate.exe [2009-11-08 135664]
R3 qcusbser;Qualcomm USB Device for Legacy Serial Communication;h:\windows\system32\DRIVERS\FXX\qcusbser.sys [2010-04-01 103424]
R3 WDC_SAM;WD SCSI Pass Thru driver;h:\windows\system32\DRIVERS\wdcsam.sys [2009-02-13 11520]
R3 wip0204;Wippien Network Adapter 2.4;h:\windows\system32\DRIVERS\wip0204.sys [2008-12-30 23480]
S0 sptd;sptd;h:\windows\System32\Drivers\sptd.sys [2009-12-13 691696]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;h:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-29 136360]
S2 WDDMService;WD SmartWare Drive Manager;h:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [2010-01-21 110592]
S2 WDSmartWareBackgroundService;WD SmartWare Background Service;h:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [2009-06-16 20480]
S3 PAC207;PC Camer@;h:\windows\system32\DRIVERS\PFC027.SYS [2008-02-13 618112]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;h:\windows\system32\drivers\viahduaa.sys [2008-01-02 215936]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2012-04-09 h:\windows\Tasks\Adobe Flash Player Updater.job
- h:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 13:06]
.
2012-02-01 h:\windows\Tasks\AppleSoftwareUpdate.job
- h:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
2012-04-09 h:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- h:\program files\Google\Update\GoogleUpdate.exe [2009-11-08 18:28]
.
2012-04-09 h:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- h:\program files\Google\Update\GoogleUpdate.exe [2009-11-08 18:28]
.
.
------- Doplňkový sken -------
.
uInternet Settings,ProxyServer = 77.92.72.198:80
IE: E&xport to Microsoft Excel - h:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovať do programu Microsoft Excel - h:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - h:\program files\ICQ7.5\ICQ.exe
TCP: Interfaces\{41C04E3C-606D-4C4E-8D6C-3E91063BB482}: NameServer = 10.10.10.10,208.67.220.220
FF - ProfilePath - h:\documents and settings\Lenka\Data aplikací\Mozilla\Firefox\Profiles\sdsfzrjk.default\
FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
FF - prefs.js: browser.startup.homepage - hxxp://search.babylon.com/?AF=108602&tt ... 1fc642eb41
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?AF=108602&tt ... 642eb41&q=
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
WebBrowser-{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - (no file)
HKCU-Run-AdobeBridge - (no file)
HKCU-Run-ICQ - h:\program files\ICQ7.4\ICQ.exe
HKCU-Run-BitComet - h:\program files\BitComet\BitComet.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-04-09 21:48
Windows 5.1.2600 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = h:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222]
"1"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,04,7d,73,7b,41,5e,94,
fd
"2"=hex:f1,df,16,de,80,08,0e,2a,78,a4,28,cb,d2,56,ff,58,a6,09,d8,fb,43,e9,d5,
e7,16,83,71,61,5d,be,d8,25
"3"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,2b,92,4b,0d,22,14,9d,
cb,e3,f8,73,90,7d,a4,36,0d,7e,db,3a,16,4c,1a,45,81,b1,a5,77,31,f5,50,d6,e8
.
[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222\48236A7EED3B8895E98434D6DCE253AC]
"1"=hex:08,26,de,b9,bd,1e,cc,2a,55,96,fd,b8,7e,1b,23,82,71,bb,5a,5f,e0,12,25,
42,0c,3f,30,d4,d3,b8,cd,35,d5,a9,6f,e0,2c,05,4e,14
"2"=hex:58,92,5a,34,3f,c6,a5,c5
"3"=hex:bc,78,b1,a3,47,20,6e,cb,59,5b,fe,8f,fa,86,5c,7c,8e,b8,65,26,b9,48,67,
85,d2,5f,92,6d,70,fe,55,c9,50,fe,c1,29,80,25,27,2a,5f,7b,5b,cc,03,70,2a,1d,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
"7"=hex:08,26,de,b9,bd,1e,cc,2a,55,96,fd,b8,7e,1b,23,82,71,bb,5a,5f,e0,12,25,
42,0c,3f,30,d4,d3,b8,cd,35,61,5a,c0,6c,22,7e,83,13,6e,44,91,28,69,cc,01,dd
"8"=hex:f2,80,0d,7f,fe,b9,cf,0a,62,bc,95,c6,fe,82,c9,e7,7a,39,50,43,38,08,ae,
25,34,fe,c5,b3,14,04,32,c8
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:70,56,26,33,e3,20,f8,ab
"10"=hex:a7,d5,9c,a7,24,6a,5a,bc
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:81,20,8f,ab,28,6a,52,9c
"13"=hex:81,20,8f,ab,28,6a,52,9c
"14"=hex:81,20,8f,ab,28,6a,52,9c
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:81,20,8f,ab,28,6a,52,9c
"22"=hex:81,20,8f,ab,28,6a,52,9c
.
[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222\B144CCE307E78EB6EE53CA2196E4D0A2]
"1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
b0,36,d7,56,53,fe,9f,3d,f9
"2"=hex:8c,23,2d,03,75,bd,a0,cd
"3"=hex:89,8a,74,86,09,98,71,d4,16,e8,e2,9b,1e,d2,90,60,88,3e,e0,61,4a,a1,c5,
59,3f,e9,d9,46,57,4a,8d,d8,50,05,f4,b6,c1,b6,2d,ee,67,48,fe,54,df,a8,d1,7d,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
"7"=hex:6b,96,68,24,0f,2f,9e,94,e8,ce,54,f3,3b,80,63,3a,1b,c3,e7,ed,44,3a,1d,
97,9f,f9,03,77,68,81,1b,0c,34,a2,88,30,12,be,09,a0
"8"=hex:be,1e,1b,5b,46,ce,bd,af,06,c0,57,de,a3,1c,52,0a,b6,95,00,63,ba,3d,d1,
21,f3,59,b1,30,47,70,f4,7c
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:70,56,26,33,e3,20,f8,ab
"10"=hex:07,96,b3,35,9e,5a,1a,0b
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:81,20,8f,ab,28,6a,52,9c
"13"=hex:81,20,8f,ab,28,6a,52,9c
"14"=hex:81,20,8f,ab,28,6a,52,9c
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:81,20,8f,ab,28,6a,52,9c
"22"=hex:81,20,8f,ab,28,6a,52,9c
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(820)
h:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
Celkový čas: 2012-04-09 21:49:58
ComboFix-quarantined-files.txt 2012-04-09 19:49
.
Před spuštěním: Volných bajtů: 25 631 707 136
Po spuštění: Volných bajtů: 26 791 837 696
.
- - End Of File - - 50341B2DB322671B5E3EBC0D6287B038

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upus.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

Stáhni si aswMBR
na svojí plochu. Uzavři všechna okna , programy a prohlížeče. Poklepej na aswMBR.exe. Pokud se objeví hláška o možnosti stáhnutí databáze Avastu , klikni na NE. Poté klikni na „Scan“ . Po skenu klikni na „Save Log“ a ulož si log na plochu .Zkopíruj sem celý obsah toho logu. Pak klikni na „Exit“ k zavření programu.

co teda s tym proxy? :)

tu je log z combofixu, aswMBR prilozim zachvilku:

ComboFix 12-04-09.05 - Lenka 09.04.2012 22:14:18.6.2 - x86
Spuštěný z: h:\documents and settings\Lenka\Plocha\ComboFix.exe
Použité ovládací přepínače :: h:\documents and settings\Lenka\Plocha\CFScript.txt
.
FILE ::
"h:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"h:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
h:\windows\Tasks\GoogleUpdateTaskMachineCore.job
h:\windows\Tasks\GoogleUpdateTaskMachineUA.job
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-03-09 do 2012-04-09 )))))))))))))))))))))))))))))))
.
.
2012-04-09 16:02 . 2012-04-09 16:02 -------- d-----w- h:\documents and settings\Lenka\Data aplikací\Malwarebytes
2012-04-04 12:47 . 2012-04-04 13:06 418464 ----a-w- h:\windows\system32\FlashPlayerApp.exe
2012-03-27 19:07 . 2012-03-27 19:07 237 ----a-w- H:\user.js
2012-03-27 19:07 . 2012-03-27 19:07 -------- d-----w- h:\documents and settings\Lenka\Local Settings\Data aplikací\Babylon
2012-03-27 19:07 . 2012-03-27 19:07 -------- d-----w- h:\documents and settings\Lenka\Data aplikací\Babylon
2012-03-27 19:07 . 2012-03-27 19:07 -------- d-----w- h:\documents and settings\All Users\Data aplikací\Babylon
2012-03-24 18:19 . 2012-03-24 18:19 -------- d--h--r- h:\documents and settings\Lenka\Data aplikací\SecuROM
2012-03-24 17:12 . 2012-03-24 17:12 592824 ----a-w- h:\program files\Mozilla Firefox\gkmedias.dll
2012-03-24 17:12 . 2012-03-24 17:12 44472 ----a-w- h:\program files\Mozilla Firefox\mozglue.dll
2012-03-24 16:42 . 2012-03-24 16:42 -------- d-----w- h:\documents and settings\All Users\Data aplikací\EA Core
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-08 23:17 . 2008-07-31 17:44 196608 ----a-w- h:\windows\system32\drivers\nStandard.bin
2012-04-04 13:06 . 2011-12-13 16:01 70304 ----a-w- h:\windows\system32\FlashPlayerCPLApp.cpl
2012-03-24 17:12 . 2012-01-27 11:36 97208 ----a-w- h:\program files\mozilla firefox\components\browsercomps.dll
2010-07-20 09:47 . 2009-11-28 12:29 119808 ----a-w- h:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-04-09_19.48.03 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-04-09 20:22 . 2012-04-09 20:22 16384 h:\windows\temp\Perflib_Perfdata_6e4.dat
+ 2012-04-09 20:22 . 2012-04-09 20:22 16384 h:\windows\temp\Perflib_Perfdata_1a4.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MagicKey"="h:\progra~1\MEDIAK~1\MagicKey.exe" [2004-03-15 45056]
"HDAudDeck"="h:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-01-14 29753344]
"ASUSGamerOSD"="h:\program files\ASUS\GamerOSD\GamerOSD.exe" [2007-09-13 380928]
"NvCplDaemon"="h:\windows\system32\NvCpl.dll" [2007-09-16 8491008]
"nwiz"="nwiz.exe" [2007-09-16 1626112]
"NvMediaCenter"="h:\windows\system32\NvMcTray.dll" [2007-09-16 81920]
"PCSuiteTrayApplication"="h:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328]
"Adobe Photo Downloader"="h:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"avgnt"="h:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-04 281768]
"Google Desktop Search"="h:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-07-20 30192]
"ArcSoft Connection Service"="h:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"PAC207_Monitor"="h:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"Monitor"="h:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"AdobeCS4ServiceManager"="h:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"CanonMyPrinter"="h:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-10-19 1983816]
"CanonSolutionMenu"="h:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-09-04 767312]
"GrooveMonitor"="h:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="h:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
"Nokia.PCSync"="h:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"h:\\WINDOWS\\system32\\PnkBstrA.exe"=
"h:\\WINDOWS\\system32\\PnkBstrB.exe"=
"h:\\hry\\warcraft 3\\Warcraft III\\war3.exe"=
"h:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"h:\\WINDOWS\\system32\\dplaysvr.exe"=
"h:\\Program Files\\Opera\\opera.exe"=
"h:\\Program Files\\QIP\\qip.exe"=
"h:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"h:\\Program Files\\Sierra\\Homeworld2\\Bin\\Release\\Homeworld2.exe"=
"h:\\WINDOWS\\system32\\dpnsvr.exe"=
"h:\\Documents and Settings\\Vilo\\Plocha\\Age_of_empires_II\\Age of empires\\age2_x1.exe"=
"h:\\Documents and Settings\\Vilo\\Plocha\\Age_of_empires_II\\Age of empires\\empires2.exe"=
"h:\\hry\\warcraft 3\\Warcraft III\\Warcraft III.exe"=
"h:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"h:\\Program Files\\Steam\\Steam.exe"=
"h:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
"h:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"h:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"h:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"h:\\Program Files\\ICQ7.5\\ICQ.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\globallyopenports\list]
"6112:UDP"= 6112:UDP:w3
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"24018:TCP"= 24018:TCP:BitComet 24018 TCP
"24018:UDP"= 24018:UDP:BitComet 24018 UDP
.
R2 gupdate;Google Update Service (gupdate);h:\program files\Google\Update\GoogleUpdate.exe [2009-11-08 135664]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;h:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 253600]
R3 androidusb;ADB Interface Driver;h:\windows\system32\Drivers\fxxandroidusb.sys [2010-04-01 25728]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;h:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-07-20 30192]
R3 gupdatem;Služba Google Update (gupdatem);h:\program files\Google\Update\GoogleUpdate.exe [2009-11-08 135664]
R3 qcusbser;Qualcomm USB Device for Legacy Serial Communication;h:\windows\system32\DRIVERS\FXX\qcusbser.sys [2010-04-01 103424]
R3 WDC_SAM;WD SCSI Pass Thru driver;h:\windows\system32\DRIVERS\wdcsam.sys [2009-02-13 11520]
R3 wip0204;Wippien Network Adapter 2.4;h:\windows\system32\DRIVERS\wip0204.sys [2008-12-30 23480]
S0 sptd;sptd;h:\windows\System32\Drivers\sptd.sys [2009-12-13 691696]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;h:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-29 136360]
S2 LicCtrlService;LicCtrl Service;h:\windows\runservice.exe [2009-02-24 2560]
S2 WDDMService;WD SmartWare Drive Manager;h:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [2010-01-21 110592]
S2 WDSmartWareBackgroundService;WD SmartWare Background Service;h:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [2009-06-16 20480]
S3 PAC207;PC Camer@;h:\windows\system32\DRIVERS\PFC027.SYS [2008-02-13 618112]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;h:\windows\system32\drivers\viahduaa.sys [2008-01-02 215936]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2012-04-09 h:\windows\Tasks\Adobe Flash Player Updater.job
- h:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 13:06]
.
2012-02-01 h:\windows\Tasks\AppleSoftwareUpdate.job
- h:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Doplňkový sken -------
.
IE: E&xport to Microsoft Excel - h:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovať do programu Microsoft Excel - h:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - h:\program files\ICQ7.5\ICQ.exe
TCP: Interfaces\{41C04E3C-606D-4C4E-8D6C-3E91063BB482}: NameServer = 10.10.10.10,208.67.220.220
FF - ProfilePath - h:\documents and settings\Lenka\Data aplikací\Mozilla\Firefox\Profiles\sdsfzrjk.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-04-09 22:23
Windows 5.1.2600 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = h:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222]
"1"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,04,7d,73,7b,41,5e,94,
fd
"2"=hex:f1,df,16,de,80,08,0e,2a,78,a4,28,cb,d2,56,ff,58,a6,09,d8,fb,43,e9,d5,
e7,16,83,71,61,5d,be,d8,25
"3"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,2b,92,4b,0d,22,14,9d,
cb,e3,f8,73,90,7d,a4,36,0d,7e,db,3a,16,4c,1a,45,81,b1,a5,77,31,f5,50,d6,e8
.
[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222\48236A7EED3B8895E98434D6DCE253AC]
"1"=hex:08,26,de,b9,bd,1e,cc,2a,55,96,fd,b8,7e,1b,23,82,71,bb,5a,5f,e0,12,25,
42,0c,3f,30,d4,d3,b8,cd,35,d5,a9,6f,e0,2c,05,4e,14
"2"=hex:58,92,5a,34,3f,c6,a5,c5
"3"=hex:bc,78,b1,a3,47,20,6e,cb,59,5b,fe,8f,fa,86,5c,7c,8e,b8,65,26,b9,48,67,
85,d2,5f,92,6d,70,fe,55,c9,50,fe,c1,29,80,25,27,2a,5f,7b,5b,cc,03,70,2a,1d,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
"7"=hex:08,26,de,b9,bd,1e,cc,2a,55,96,fd,b8,7e,1b,23,82,71,bb,5a,5f,e0,12,25,
42,0c,3f,30,d4,d3,b8,cd,35,61,5a,c0,6c,22,7e,83,13,6e,44,91,28,69,cc,01,dd
"8"=hex:f2,80,0d,7f,fe,b9,cf,0a,62,bc,95,c6,fe,82,c9,e7,7a,39,50,43,38,08,ae,
25,34,fe,c5,b3,14,04,32,c8
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:70,56,26,33,e3,20,f8,ab
"10"=hex:a7,d5,9c,a7,24,6a,5a,bc
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:81,20,8f,ab,28,6a,52,9c
"13"=hex:81,20,8f,ab,28,6a,52,9c
"14"=hex:81,20,8f,ab,28,6a,52,9c
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:81,20,8f,ab,28,6a,52,9c
"22"=hex:81,20,8f,ab,28,6a,52,9c
.
[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222\B144CCE307E78EB6EE53CA2196E4D0A2]
"1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,
b0,36,d7,56,53,fe,9f,3d,f9
"2"=hex:8c,23,2d,03,75,bd,a0,cd
"3"=hex:89,8a,74,86,09,98,71,d4,16,e8,e2,9b,1e,d2,90,60,88,3e,e0,61,4a,a1,c5,
59,3f,e9,d9,46,57,4a,8d,d8,50,05,f4,b6,c1,b6,2d,ee,67,48,fe,54,df,a8,d1,7d,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
"7"=hex:6b,96,68,24,0f,2f,9e,94,e8,ce,54,f3,3b,80,63,3a,1b,c3,e7,ed,44,3a,1d,
97,9f,f9,03,77,68,81,1b,0c,34,a2,88,30,12,be,09,a0
"8"=hex:be,1e,1b,5b,46,ce,bd,af,06,c0,57,de,a3,1c,52,0a,b6,95,00,63,ba,3d,d1,
21,f3,59,b1,30,47,70,f4,7c
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:70,56,26,33,e3,20,f8,ab
"10"=hex:07,96,b3,35,9e,5a,1a,0b
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:81,20,8f,ab,28,6a,52,9c
"13"=hex:81,20,8f,ab,28,6a,52,9c
"14"=hex:81,20,8f,ab,28,6a,52,9c
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"27"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:81,20,8f,ab,28,6a,52,9c
"22"=hex:81,20,8f,ab,28,6a,52,9c
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(792)
h:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
- - - - - - - > 'explorer.exe'(2144)
h:\windows\system32\msi.dll
h:\windows\system32\ieframe.dll
h:\windows\system32\webcheck.dll
h:\windows\system32\WPDShServiceObj.dll
h:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll
h:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll
h:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_slk.nlr
h:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr
h:\windows\system32\PortableDeviceTypes.dll
h:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
h:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
h:\program files\Avira\AntiVir Desktop\avguard.exe
h:\windows\ATKKBService.exe
h:\program files\Canon\IJPLM\IJPLMSVC.EXE
h:\program files\Avira\AntiVir Desktop\avshadow.exe
h:\program files\Java\jre6\bin\jqs.exe
h:\windows\system32\RUNDLL32.EXE
h:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
h:\program files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe
h:\program files\CDBurnerXP\NMSAccessU.exe
h:\windows\system32\nvsvc32.exe
h:\windows\system32\PnkBstrA.exe
h:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
h:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe
h:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
h:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
h:\program files\PC Connectivity Solution\ServiceLayer.exe
.
**************************************************************************
.
Celkový čas: 2012-04-09 22:29:14 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-04-09 20:29
ComboFix2.txt 2012-04-09 19:49
.
Před spuštěním: Volných bajtů: 26 783 965 184
Po spuštění: Volných bajtů: 26 766 184 448
.
- - End Of File - - 22F9758D434CC7931EBFBF31F4F172E8

log z aswMBR:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-04-09 22:32:44
-----------------------------
22:32:44.937 OS Version: Windows 5.1.2600 Service Pack 2
22:32:44.937 Number of processors: 2 586 0x6B02
22:32:44.937 ComputerName: DOMA-FF096F8781 UserName: Lenka
22:32:48.703 Initialize success
22:32:58.140 Disk 0 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
22:32:58.140 Disk 0 Vendor: ST3160215A 3.AAD Size: 152627MB BusType: 3
22:32:58.140 Device \Driver\usbstor -> DriverStartIo USBSTOR.SYS bab49f26
22:32:58.156 Disk 1 MBR read successfully
22:32:58.156 Disk 1 MBR scan
22:32:58.156 Disk 1 Windows XP default MBR code
22:32:58.156 Disk 1 MBR hidden
22:32:58.156 Disk 1 Partition 1 80 (A) 07 HPFS/NTFS NTFS 152617 MB offset 63
22:32:58.171 Disk 1 scanning sectors +7784448
22:32:58.234 Disk 1 scanning H:\WINDOWS\system32\drivers
22:33:06.781 Service scanning
22:33:25.968 Service sptd H:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32
22:33:32.375 Modules scanning
22:33:48.031 Disk 1 trace - called modules:
22:33:48.031 ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x88892500]<<
22:33:48.031 1 nt!IofCallDriver -> \Device\Harddisk1\DR2[0x898ed330]
22:33:48.031 3 CLASSPNP.SYS[ba8f905b] -> nt!IofCallDriver -> \Device\00000084[0x89730ea0]
22:33:48.046 \Driver\usbstor[0x89895908] -> IRP_MJ_CREATE -> 0x88892500
22:33:48.046 Scan finished successfully
22:34:02.046 Disk 1 MBR has been saved successfully to "H:\Documents and Settings\Lenka\Plocha\MBR.dat"
22:34:02.046 The log file has been saved successfully to "H:\Documents and Settings\Lenka\Plocha\aswMBR.txt"

Už není v logu ta proxy. Tyhle IP adresy znáš?
TCP: Interfaces\{41C04E3C-606D-4C4E-8D6C-3E91063BB482}: NameServer = 10.10.10.10, 208.67.220.220

tieto cisla mam v centre sieti ked mi provider nastavoval net

Uprednostnovany server DNS = 10,10,10,10
nahradny server DNS = 208,67,220,220

A o té proxy nic? Tyhle IP jsou někde z USA... Proxy z UK

o tej IP 77.92.72.198:80 neviem nic, nikde v sietach som sa s nou nestretol
tie zvysne dve mi nastavovali chlapici z firmy od ktorej mam internet

je s tym nejaky problem? nevyznam sa do toho :)