Prosim znovu o kontrolu logu HJT PC asi neni 100% v poradku

[Damned]

Na kontrole těch souborů na VT máš hlavičku s datumem 17.5.

Soubor DPTJQALLXI-57.pms.exe.SVD přijatý 2009.05.17 18:26:44 (UTC)

Zkus je otestovat znovu. Pokud ti nabídne možnost staré kontroly, chtěj je zkontrolovat znovu.

[Reklama]

[Marek Minkes]

Zde je ten prvni http://www.virustotal.com/cs/analisis/6953af687e204cb0a241416d1780c7c5f112dce23d0d4b193bcfbbc580cb4368-1244210866

[Marek Minkes]

A tu druhy http://www.virustotal.com/cs/analisis/267cb064201c3f284b9602cfc5526b6313d8ac326588d710c5bab0bfd2a36454-1244211255

[Damned]

Vyčisti PC CCleanerem a dej sem znovu log z HJT a ComboFixu.

[Marek Minkes]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:47:27, on 5.6.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\igfxsrvc.exe
C:\Users\vlastnik\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: ::1 localhost
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

--
End of file - 3778 bytes

[Marek Minkes]

ComboFix 09-06-04.04 - vlastnik 05.06.2009 16:49.5 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1250.420.1029.18.1013.339 [GMT 2:00]
Spuštěný z: c:\users\vlastnik\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
PEV Error: CacheFile
PEV Error: CacheFolder

((((((((((((((((((((((((( Soubory vytvořené od 2009-05-05 do 2009-06-05 )))))))))))))))))))))))))))))))
.

2009-06-05 14:53 . 2009-06-05 14:53 -------- d-----w- c:\users\vlastnik\AppData\Local\temp
2009-06-04 13:42 . 2009-05-26 11:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-04 13:42 . 2009-05-26 11:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-04 13:42 . 2009-06-04 13:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-04 12:44 . 2009-06-04 12:44 -------- d-----w- c:\program files\Vodafone
2009-06-01 17:19 . 2009-06-01 17:19 -------- d-----w- c:\users\vlastnik\AppData\Local\Ahead
2009-05-21 14:39 . 2009-05-21 14:39 -------- d-----w- c:\program files\CCleaner

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-05 14:39 . 2009-01-15 08:35 1063247872 --sha-w- \hiberfil.sys
2009-06-05 14:39 . 2009-01-14 17:22 1377042432 --sha-w- \pagefile.sys
2009-06-04 12:43 . 2007-01-08 21:09 598838 ----a-w- c:\windows\system32\perfh005.dat
2009-06-04 12:43 . 2007-01-08 21:09 115014 ----a-w- c:\windows\system32\perfc005.dat
2009-05-21 14:55 . 2009-03-23 19:32 -------- d-----w- c:\program files\Trend Micro
2009-05-13 12:44 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-05-04 13:48 . 2009-05-04 13:48 -------- d-----w- c:\program files\Alwil Software
2009-04-30 15:41 . 2009-01-14 20:31 -------- d-----w- c:\program files\Common Files\InstallShield
2009-04-27 17:58 . 2009-04-27 17:58 -------- d-----w- c:\program files\QIP
2009-04-09 13:59 . 2009-04-09 13:59 958464 ----a-w- c:\windows\system32\drivers\athr.sys
2009-04-06 20:03 . 2009-01-14 20:54 -------- d-----w- c:\program files\Common Files\Adobe
2009-03-17 03:38 . 2009-04-15 13:26 13824 ----a-w- c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-15 13:26 24064 ----a-w- c:\windows\system32\amxread.dll
2009-03-08 11:34 . 2009-04-29 18:34 914944 ----a-w- c:\windows\system32\wininet.dll
2009-03-08 11:34 . 2009-04-29 18:34 43008 ----a-w- c:\windows\system32\licmgr10.dll
2009-03-08 11:33 . 2009-04-29 18:34 18944 ----a-w- c:\windows\system32\corpol.dll
2009-03-08 11:33 . 2009-04-29 18:34 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-03-08 11:33 . 2009-04-29 18:34 109568 ----a-w- c:\windows\system32\PDMSetup.exe
2009-03-08 11:33 . 2009-04-29 18:34 132608 ----a-w- c:\windows\system32\ieUnatt.exe
2009-03-08 11:33 . 2009-04-29 18:34 107520 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2009-03-08 11:33 . 2009-04-29 18:34 107008 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2009-03-08 11:33 . 2009-04-29 18:34 103936 ----a-w- c:\windows\system32\SetDepNx.exe
2009-03-08 11:33 . 2009-04-29 18:34 420352 ----a-w- c:\windows\system32\vbscript.dll
2009-03-08 11:32 . 2009-04-29 18:34 72704 ----a-w- c:\windows\system32\admparse.dll
2009-03-08 11:32 . 2009-04-29 18:34 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-03-08 11:32 . 2009-04-29 18:34 66560 ----a-w- c:\windows\system32\wextract.exe
2009-03-08 11:32 . 2009-04-29 18:34 169472 ----a-w- c:\windows\system32\iexpress.exe
2009-03-08 11:31 . 2009-04-29 18:34 34816 ----a-w- c:\windows\system32\imgutil.dll
2009-03-08 11:31 . 2009-04-29 18:34 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-03-08 11:31 . 2009-04-29 18:34 45568 ----a-w- c:\windows\system32\mshta.exe
2009-03-08 11:22 . 2009-04-29 18:34 156160 ----a-w- c:\windows\system32\msls31.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-06-04_21.41.11 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-01-14 20:15 . 2009-06-05 14:41 45674 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2009-01-14 20:15 . 2009-06-04 21:27 45674 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2006-11-02 13:05 . 2009-06-04 21:27 59328 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-06-05 14:41 59328 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2009-01-14 17:35 . 2009-06-05 14:41 12760 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1665532280-3765707004-3423112412-1000_UserData.bin
- 2009-01-14 17:35 . 2009-06-04 21:27 12760 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1665532280-3765707004-3423112412-1000_UserData.bin
+ 2006-11-02 13:02 . 2009-06-05 14:41 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2006-11-02 13:02 . 2009-06-04 21:29 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2006-11-02 13:02 . 2009-06-04 21:29 98304 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2006-11-02 13:02 . 2009-06-05 14:41 98304 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2006-11-02 13:02 . 2009-06-04 21:29 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2006-11-02 13:02 . 2009-06-05 14:41 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-06-04 21:25 . 2009-06-04 21:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-06-05 14:39 . 2009-06-05 14:39 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-06-05 14:39 . 2009-06-05 14:39 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-06-04 21:25 . 2009-06-04 21:25 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"ISUSPM"="c:\programdata\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-07-12 226904]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2008-06-25 159744]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-11 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-11 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-11 133656]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2009-01-14 4702208]
"Skytel"="Skytel.exe" - c:\windows\SkyTel.exe [2009-01-14 1826816]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1665532280-3765707004-3423112412-1000]
"EnableNotificationsRef"=dword:00000002

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{1D0F92E3-72CD-4A25-8AA6-C990BC1A202C}"= UDP:c:\program files\Alwil Software\Avast4\ashAvast.exe:avast! Antivirus
"{99D25722-5A83-4790-BB74-2C0A43BE7465}"= TCP:c:\program files\Alwil Software\Avast4\ashAvast.exe:avast! Antivirus

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 0 (0x0)

R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [4.5.2009 15:48 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [4.5.2009 15:48 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [4.5.2009 15:48 51792]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [14.1.2009 21:50 180736]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Obsah adresáře 'Naplánované úlohy'

2009-06-05 c:\windows\Tasks\User_Feed_Synchronization-{EC571553-D93E-4DB4-8A75-A55AB36F4F9B}.job
- c:\windows\system32\msfeedssync.exe [2009-04-29 11:31]
.
.
------- Doplňkový sken -------
.
FF - ProfilePath -

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-05 16:53
Windows 6.0.6001 Service Pack 1 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Celkový čas: 2009-06-05 16:55
ComboFix-quarantined-files.txt 2009-06-05 14:55

Před spuštěním: Volných bajtů: 116 110 065 664
Po spuštění: Volných bajtů: 116 084 113 408

147 --- E O F --- 2009-06-05 10:59

[Damned]

Spusť si HJT a fixni:

O4 - HKCU\..\Run: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler

Jinak tam nic nevidím, nech to ještě otevřený a večer, nebo zítra si to zkontroluje ještě jaro3 (nechám mu zprávu). Napiš sem potom ještě jak se chová počítač.

Odinstaluj zatím ComboFix.
ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix[mezera]/u

takže jestli nejsou problémy,tak vyčisti systém CCleanerem
a použij i T-Cleaner
smaže vše po Combu,SDFixu,Avengeru,MWAVu atd.-stáhneš->spustíš

Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni select all found, pak klik empty selected.
Pokud chceš zachovat svoje uložená hesla, klikni na No.
ATF-Cleaner je jednoduchý nástroj na odstranění historie z webového prohlížeče. Program dokáže odstranit cache,
cookies, historii a další stopy po surfování na Internetu. Mezi podporované prohlížeče patří Internet Explorer,
Firefox a Opera. Aplikace navíc umí odstranit dočasné soubory Windows, vysypat koš atd.

[Marek Minkes]

Dekuji moc za kontrolu logu PC se chova v poradku ale dam presne vedet az zitra Zatim to necham otevrene a zitra dam vedet

[Damned]

Zítra tedy dej vědět. Nechám zprávu jaro3.