prosim o kontrolu logu Vyřešeno

[Kotik]

chci jenom pro jistotu zeptat, ten script...to je to samy jak sem delal pred tim ze jo??(abych nahodou neco neposral:-D)...takze zase otevru poznamkac a pak ten soubor pretahnu na combofix...je to tak? :-)
a pak sem jeste nepochopil kde mam vzit dva logy z combofixu, kdyz vyjede only 1 ne? :-)

[Reklama]

[jaro3]

Jo , přesně to samý.Pak zase log z CF a HJT.

[Kotik]

tak tady je ten combofix:
ComboFix 10-03-07.05 - X 08.03.2010 16:15:15.7.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1023.643 [GMT 1:00]
Spuštěný z: c:\documents and settings\X\Dokumenty\Downloads\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\X\Dokumenty\Downloads\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100308-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-02-08 do 2010-03-08 )))))))))))))))))))))))))))))))
.

2010-03-07 16:15 . 2010-03-07 16:16 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2010-03-07 16:15 . 2010-03-07 16:16 -------- d-----w- c:\program files\DVDVideoSoft
2010-03-07 15:58 . 2010-03-07 15:58 -------- d-----w- c:\program files\Common Files\ArcSoft
2010-03-07 15:58 . 2004-05-04 10:53 1645320 ----a-w- c:\windows\system32\gdiplus.dll
2010-03-07 15:58 . 2010-03-07 15:58 -------- d-----w- c:\program files\SanDisk
2010-03-07 15:58 . 2005-06-21 09:29 245408 ----a-w- c:\windows\system32\unicows.dll
2010-03-04 16:55 . 2010-03-04 16:55 -------- d-----w- c:\program files\MSBuild
2010-03-04 16:52 . 2010-03-04 16:52 -------- d-----w- c:\windows\system32\XPSViewer
2010-03-04 16:51 . 2010-03-04 16:51 -------- d-----w- c:\program files\Reference Assemblies
2010-03-04 16:51 . 2010-03-04 17:05 -------- d-----w- c:\program files\Converter
2010-02-13 16:02 . 2010-02-13 16:02 -------- d-----w- c:\program files\GamePark

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-07 16:14 . 2008-11-30 15:50 -------- d-----w- c:\program files\CCleaner
2010-03-07 15:58 . 2007-09-05 11:22 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-06 14:13 . 2008-05-10 15:22 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-03-06 14:13 . 2008-05-10 15:22 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-03-04 16:55 . 2001-10-25 12:00 81286 ----a-w- c:\windows\system32\perfc005.dat
2010-03-04 16:55 . 2001-10-25 12:00 432668 ----a-w- c:\windows\system32\perfh005.dat
2010-02-27 17:16 . 2009-12-25 20:59 -------- d-----w- c:\program files\Richard Burns Rally
2010-02-26 15:19 . 2010-01-18 17:26 -------- d-----w- c:\program files\TeamSpeak 3 Client
2010-02-21 15:17 . 2010-01-24 19:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-21 12:58 . 2009-09-13 17:56 -------- d-----w- c:\program files\DsNET Corp
2010-02-14 19:25 . 2009-12-05 15:56 -------- d-----w- c:\program files\FreeTime
2010-02-13 17:33 . 2010-01-26 15:22 -------- d-----w- c:\program files\ICQ6.5
2010-02-04 18:27 . 2010-02-04 16:57 -------- d-----w- c:\program files\a-squared Free
2010-02-04 17:40 . 2010-02-04 17:40 0 ----a-w- c:\program files\Lavasoft
2010-02-04 17:40 . 2010-02-04 17:40 0 ----a-w- c:\program files\Lavalys1
2010-01-31 08:14 . 2007-09-07 01:33 -------- d-----w- c:\program files\ATITool
2010-01-29 09:18 . 2009-01-15 15:21 -------- d-----w- c:\program files\valve
2010-01-18 19:07 . 2010-01-17 15:03 -------- d-----w- c:\program files\Common Files\Real
2010-01-18 19:07 . 2010-01-18 19:07 -------- d-----w- c:\program files\Common Files\xing shared
2010-01-17 15:03 . 2007-09-06 02:30 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-01-17 15:03 . 2010-01-17 15:03 -------- d-----w- c:\program files\Real
2010-01-10 17:47 . 2009-06-06 16:12 -------- d-----w- c:\program files\Activision
2010-01-10 14:00 . 2009-05-21 17:22 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-29 15:09 . 2009-12-29 15:09 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-12-17 04:53 . 2004-08-17 13:49 1386496 ----a-w- c:\windows\system32\msvbvm60.dll
2009-12-08 17:21 . 2009-12-08 17:21 34 ---ha-w- c:\windows\system32\DVDRipper_sysquict.dat
.

((((((((((((((((((((((((((((( SnapShot_2010-03-05_13.39.46 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-07 12:23 . 2010-03-07 12:23 16384 c:\windows\Temp\Perflib_Perfdata_6a8.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\X\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2009-11-30 135664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-17 2879488]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-15 16270848]
"ATITool"="c:\program files\ATITool\ATITool.exe" [2007-06-21 3119616]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"BMISR"="c:\program files\KYE\WebMate\BM.exe" [2008-08-19 208896]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-21 61440]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-01-18 198160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Empire Interactive\\FlatOut Ultimate Carnage\\Fouc.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8287:TCP"= 8287:TCP:BitComet 8287 TCP
"8287:UDP"= 8287:UDP:BitComet 8287 UDP

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [18.1.2009 18:55 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [18.1.2009 18:55 20560]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [5.9.2007 12:36 35840]
S3 adusbmdm6501;AnyDATA CDMA USB Modem Driver (PID 6501);c:\windows\system32\drivers\adusbmdm65.sys [7.10.2007 13:50 64896]
S3 adusbser6501;AnyDATA CDMA USB Serial Port (PID 6501);c:\windows\system32\drivers\adusbser65.sys [7.10.2007 13:23 64896]
S3 DynCal;Dynamic Calibration Service;c:\windows\system32\drivers\Dyncal.sys [22.4.2006 15:08 8704]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
TCP: {B21E05E9-9AD3-4797-9F13-44ECC7568F96} = 212.80.70.2,212.80.66.7
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-08 16:18
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-73586283-1897051121-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(832)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3200)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2010-03-08 16:20:34
ComboFix-quarantined-files.txt 2010-03-08 15:20
ComboFix2.txt 2010-03-05 13:42

Před spuštěním: Volných bajtů: 92 418 813 952
Po spuštění: Volných bajtů: 92 386 140 160

- - End Of File - - D69968C766416AEB90BC4C3828A7C2BF



A HTJ:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:21:53, on 8.3.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATITool\ATITool.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Documents and Settings\X\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\X\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\X\Local Settings\Data aplikací\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ATITool] "C:\Program Files\ATITool\ATITool.exe" -s
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [BMISR] C:\Program Files\KYE\WebMate\BM.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\X\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Media Player.lnk = C:\Program Files\Adobe Media Player\Adobe Media Player.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{B21E05E9-9AD3-4797-9F13-44ECC7568F96}: NameServer = 212.80.70.2,212.80.66.7
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/X/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg

--
End of file - 6213 bytes


tak snad uz to da pokoj:-D

[jaro3]

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

vyčisti systém CCleanerem

a použij i T-Cleaner
smaže vše po Combu,MWAVu atd.-stáhneš>spustíš

pozn. před stažením T-Cleaneru a po dobu čištění deaktivuj AVG či Avast, následně T-Cleaner smaž a zapni si AVG či Avast.


Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/X/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg


Pokud nejsou problémy , je to vše a můžeš dát vyřešeno , zelenou fajfku.

[Kotik]

ok, diky moc, zase se nekdy ozvu :-)