Prosím o kontrolu PC "blbne"

[Fox8]

Zdarec, tak jsem zase zde a prosím o kontrolu. S PC mam problémy ráno se automaticky nezapne, přitov v biosu to nastavené je, strašně pomalé a spouští se programy, které mám při stratu zakázané. Někdy se mi i program spustí jen tak když odejdu. Avast nic nenašel a Ad aware ano a to trojana, dal jsem ho do karantény, tedy alespoň doufám. Dík za rady




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:57:52, on 30.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aktualne.cz/?ms=ae
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aktualne.cz/?ms=ae
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\ETcall.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ\ICQ6\ICQ.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

--
End of file - 7025 bytes

[Reklama]

[Fox8]

Ještě combofix, snad je to dobře udělané a jen dotaz, jestli po combofixu ma naskočit zakázaná ikona internet jen dotaz, mam ji schovanou a po doděláni comba sem musel restartovat a pak byla ta ikona na ploše




ComboFix 08-06-20.4 - LordFox 2008-06-30 12:02:05.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.606 [GMT 2:00]
Running from: C:\Documents and Settings\LordFox\Plocha\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\MSINET.oca

.
((((((((((((((((((((((((( Files Created from 2008-05-28 to 2008-06-30 )))))))))))))))))))))))))))))))
.

2008-06-16 18:12 . 2008-06-16 18:12 <DIR> d-------- C:\totalcmd
2008-06-16 18:12 . 2008-06-25 13:42 687 --a------ C:\WINDOWS\wincmd.ini
2008-06-16 18:12 . 2008-04-22 07:03 545 --a------ C:\WINDOWS\UC.PIF
2008-06-16 18:12 . 2008-04-22 07:03 545 --a------ C:\WINDOWS\RAR.PIF
2008-06-16 18:12 . 2008-04-22 07:03 545 --a------ C:\WINDOWS\PKZIP.PIF
2008-06-16 18:12 . 2008-04-22 07:03 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2008-06-16 18:12 . 2008-04-22 07:03 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2008-06-16 18:12 . 2008-04-22 07:03 545 --a------ C:\WINDOWS\LHA.PIF
2008-06-16 18:12 . 2008-04-22 07:03 545 --a------ C:\WINDOWS\ARJ.PIF
2008-06-15 11:09 . 2008-06-15 11:09 <DIR> d-------- C:\Documents and Settings\LordFox\Data aplikací\Ubisoft
2008-06-15 11:07 . 2008-06-15 11:07 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\Ubisoft
2008-06-13 21:41 . 2008-06-13 21:41 <DIR> d-------- C:\Program Files\LitexMedia
2008-06-10 20:01 . 2003-12-15 12:43 1,871,872 --a------ C:\WINDOWS\system32\NCTAudioFile2.dll
2008-06-10 20:01 . 2003-12-08 12:19 425,984 --a------ C:\WINDOWS\system32\NCTAudioTransform2.dll
2008-06-10 20:01 . 2002-01-05 14:37 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll
2008-06-10 20:01 . 2004-12-01 14:43 315,392 --a------ C:\WINDOWS\system32\NCTAudioPlayer2.dll
2008-06-10 20:01 . 2003-08-07 14:01 237,568 --a------ C:\WINDOWS\system32\lame_enc.dll
2008-06-10 20:01 . 2008-06-10 20:03 121 --a------ C:\WINDOWS\mp3wavcon.ini
2008-06-10 20:01 . 2008-06-10 20:03 5 --a------ C:\WINDOWS\system32\SySMP3OC.dat
2008-06-10 13:47 . 2008-06-10 13:47 1,244,214 --a------ C:\WINDOWS\KMPBitmap.bmp
2008-06-09 07:41 . 2008-06-10 20:20 <DIR> d-------- C:\Program Files\MediaCoder
2008-06-05 20:51 . 2008-06-05 20:51 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-06-05 20:51 . 2008-06-05 20:51 <DIR> d-------- C:\Program Files\D-Tools
2008-06-05 20:51 . 2004-08-22 16:31 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys
2008-06-05 20:51 . 2004-08-22 16:31 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys
2008-06-05 12:07 . 2008-06-05 12:07 <DIR> d-------- C:\Documents and Settings\LordFox\Data aplikací\Ahead
2008-06-04 15:15 . 2008-06-04 15:15 <DIR> d-------- C:\Program Files\QIP
2008-06-03 20:41 . 2008-06-03 20:41 <DIR> d-------- C:\Program Files\miranda
2008-06-02 16:30 . 2008-06-02 16:30 <DIR> d-------- C:\Documents and Settings\LordFox\Data aplikací\InstallShield Installation Information
2008-06-02 16:22 . 2008-06-02 16:22 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2008-06-02 16:22 . 2008-06-02 16:22 <DIR> d-------- C:\Program Files\AGEIA Technologies
2008-05-30 06:57 . 2008-05-30 06:57 <DIR> d-------- C:\Program Files\YouTube Video Downloader
2008-05-29 17:21 . 2008-05-29 18:13 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\Test Drive Unlimited
2008-05-25 20:28 . 2008-05-25 20:28 <DIR> d-------- C:\Program Files\Crystal Player
2008-05-23 15:15 . 2008-05-29 17:17 811 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2008-05-22 20:54 . 2008-05-22 20:54 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-22 20:24 . 2008-05-22 20:24 <DIR> dr-h----- C:\Documents and Settings\LordFox\Data aplikací\SecuROM
2008-05-22 20:24 . 2008-05-22 20:24 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-05-22 20:02 . 2008-05-22 20:54 22,328 --a------ C:\Documents and Settings\LordFox\Data aplikací\PnkBstrK.sys
2008-05-22 19:58 . 2008-05-22 19:58 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-05-22 19:58 . 2008-05-22 20:54 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-05-22 19:58 . 2008-05-22 20:54 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-05-22 19:58 . 2008-05-22 19:58 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-05-18 22:20 . 2008-05-18 22:20 <DIR> d-------- C:\Documents and Settings\LordFox\vypinac
2008-05-18 22:19 . 2008-05-18 22:19 <DIR> d-------- C:\Program Files\AMP WinOFF
2008-05-13 16:34 . 2008-05-13 16:34 <DIR> d-------- C:\Program Files\RivaTuner v2.09
2008-05-12 17:18 . 2007-02-09 16:34 198,144 --------- C:\WINDOWS\system32\_psisdecd.dll
2008-05-11 21:47 . 2008-05-12 17:18 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\CyberLink
2008-05-11 21:46 . 2007-02-09 16:34 1,233,920 --a------ C:\WINDOWS\system32\msxml4.dll
2008-05-11 21:46 . 2007-02-09 16:34 82,432 --a------ C:\WINDOWS\system32\msxml4r.dll
2008-05-11 21:46 . 2007-02-09 16:34 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
2008-05-11 21:37 . 2008-05-12 17:18 <DIR> d-------- C:\Program Files\CyberLink
2008-05-11 19:14 . 2008-05-11 19:14 921,654 --a------ C:\capt0002.bmp
2008-05-11 19:12 . 2008-05-11 19:13 <DIR> d-------- C:\CTV_TEMP
2008-05-09 15:27 . 2008-05-13 15:18 22,536 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT
2008-05-08 21:12 . 2008-06-22 10:57 1,082,880 --a------ C:\WINDOWS\system32\AutoPartNt.exe
2008-05-08 21:12 . 2008-06-22 10:58 1,024 --a------ C:\WINDOWS\system32\AutoPartNt.let
2008-05-08 21:01 . 2008-05-08 21:03 <DIR> d-------- C:\Documents and Settings\LordFox\Data aplikací\LangSoft
2008-05-08 21:01 . 2008-05-08 21:01 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\LangSoft
2008-05-08 20:39 . 2008-05-08 20:39 <DIR> d-------- C:\Program Files\Common Files\Acronis
2008-05-08 20:39 . 2008-05-08 20:39 <DIR> d-------- C:\Program Files\Acronis
2008-05-08 12:26 . 2008-05-08 12:26 <DIR> d-------- C:\Program Files\Sanny Builder 3
2008-05-08 09:35 . 2008-05-08 09:36 <DIR> d-------- C:\Program Files\Winamp
2008-05-08 09:32 . 2008-05-08 09:40 <DIR> d-------- C:\Documents and Settings\LordFox\Data aplikací\Winamp
2008-05-04 22:49 . 2008-05-04 22:49 <DIR> d-------- C:\Program Files\PowerQuest
2008-05-04 16:58 . 2007-03-19 18:05 13,840 --a------ C:\WINDOWS\system32\wnaspi32.dll
2008-05-04 15:15 . 2008-05-04 15:15 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\Acronis
2008-05-04 14:27 . 2008-05-08 20:39 99,776 --a------ C:\WINDOWS\system32\drivers\snapman.sys
2008-05-04 13:28 . 2008-05-04 13:30 <DIR> d-------- C:\Program Files\Infra Recorder
2008-05-03 19:25 . 2008-05-03 19:25 <DIR> d-------- C:\Program Files\BSPlayer
2008-05-03 19:08 . 2008-05-03 23:24 <DIR> d-------- C:\Program Files\Thoosje Sidebar V2.3
2008-05-01 14:54 . 2008-05-01 14:54 <DIR> d-------- C:\Program Files\Lavasoft
2008-05-01 14:54 . 2008-05-01 14:55 <DIR> d-------- C:\Documents and Settings\All Users\Data aplikací\Lavasoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-30 09:00 --------- d-----w C:\Documents and Settings\LordFox\Data aplikací\Spyware Terminator
2008-06-29 22:04 --------- d-----w C:\Program Files\ChrisTV PVR
2008-06-27 13:12 --------- d-----w C:\Documents and Settings\All Users\Data aplikací\Spyware Terminator
2008-06-21 19:36 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-21 19:35 --------- d-----w C:\Program Files\Common Files\Logitech
2008-06-19 18:50 --------- d-----w C:\Documents and Settings\LordFox\Data aplikací\Skype
2008-06-19 18:21 --------- d-----w C:\Documents and Settings\LordFox\Data aplikací\skypePM
2008-06-18 20:37 --------- d-----w C:\Documents and Settings\LordFox\Data aplikací\gtk-2.0
2008-06-18 12:50 --------- d-----w C:\Program Files\Spyware Terminator
2008-06-16 16:48 --------- d-----w C:\Program Files\Opera
2008-06-08 16:04 --------- d-----w C:\Program Files\SpeedFan
2008-06-07 14:21 --------- d-----w C:\Documents and Settings\LordFox\Data aplikací\ICQ
2008-06-05 07:37 --------- d-----w C:\Program Files\Evrsoft First Page 2006
2008-06-02 18:25 --------- d-----w C:\Documents and Settings\LordFox\Data aplikací\Hamachi
2008-06-02 14:22 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-01 16:43 141,312 ----a-w C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
2008-05-01 12:41 --------- d-----w C:\Documents and Settings\LordFox\Data aplikací\Lavasoft
2008-04-29 04:37 --------- d-----w C:\Program Files\Google
2008-04-12 16:20 197,017 ----a-w C:\WINDOWS\San Andreas Tools Uninstaller.exe
2008-03-21 12:40 2,321,408 ----a-w C:\WINDOWS\system32\TUKernel.exe
2008-01-13 14:08 20,064 ----a-w C:\Documents and Settings\LordFox\Data aplikací\GDIPFONTCACHEV1.DAT
2007-12-28 12:10 32 ----a-w C:\Documents and Settings\All Users\Data aplikací\ezsid.dat
.

[Fox8]

No ještě jsem zpoměl, když při přihlášení na PC-help zaškrtnu automatiku, proč při dalším zapnutí netu (PC-HELP-- hlavní strana) se mě to zase ptá na heslo, jako by se mi automat mazalo cookies

[Fox8]

Hážu se do top. Asi je tam opravdu vir, ale nic ho nechce najít.

[zao]

já v logu hjt nevidím

[zlobyl]

Log z CF není kompletní-zkus ho spustit znovu.

Log má na konci informaci E O F a velikost logu.