Pls HJT Log Control + snížení počtu spuštěných procesů

[Jan Pašek]

Tak zas pokračování snad ten PC dnes dovyčistíme..
A) Mrkvosoft pustil aktualizace nainstaloval sem je.
B) Combofix upozorňuje na dostupnost nové verze aktualizaci jsem odmítl.
C) aplikoval jsem CF skript log následuje

ComboFix 10-08-08.02 - Hurt Miroslav 12.08.2010 12:17:27.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.447.241 [GMT 2:00]
Spuštěný z: c:\documents and settings\Hurt Miroslav\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Hurt Miroslav\Plocha\CFScript.txt
AV: F-Secure Profi Antivirus 9.01 *On-access scanning disabled* (Updated) {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
FW: F-Secure Profi Antivirus 9.01 *disabled* {D4747503-0346-49EB-9262-997542F79BF4}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-07-12 do 2010-08-12 )))))))))))))))))))))))))))))))
.

2010-08-10 08:11 . 2009-08-06 17:23 215920 ----a-w- c:\windows\system32\muweb.dll
2010-08-09 13:40 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-09 13:40 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-09 13:40 . 2010-08-09 13:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-06 17:49 . 2010-07-09 11:18 20328 ----a-w- c:\windows\system32\drivers\cpuz134_x32.sys
2010-08-06 17:49 . 2010-08-06 17:49 -------- d-----w- c:\program files\CPU-Z
2010-08-06 15:07 . 2010-08-06 15:07 -------- d-----w- c:\program files\VideoLAN
2010-08-06 14:50 . 2010-08-06 14:50 -------- d-----w- c:\program files\Common Files\Nero
2010-08-06 14:15 . 2010-08-06 14:15 -------- d-----w- c:\program files\Microsoft Silverlight
2010-08-06 12:21 . 2010-08-09 12:40 -------- d-----w- c:\program files\Wise Disk Cleaner
2010-08-06 12:20 . 2010-08-06 12:42 -------- d-----w- c:\program files\Wise Registry Cleaner
2010-08-06 12:04 . 2010-08-06 12:04 -------- d-----w- c:\program files\Common Files\Java
2010-08-06 12:04 . 2010-08-06 12:03 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-08-06 12:03 . 2010-08-06 12:03 -------- d-----w- c:\program files\Java
2010-08-06 11:46 . 2010-08-06 11:46 -------- d-----w- c:\program files\Speccy
2010-08-02 15:00 . 2009-08-05 15:57 80000 ----a-w- c:\windows\system32\drivers\fsdfw.sys
2010-08-02 14:59 . 2010-08-02 15:19 -------- d-----w- c:\program files\F-Secure
2010-08-02 13:59 . 2010-08-02 13:59 -------- d-----w- c:\program files\CCleaner
2010-07-15 11:33 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-12 09:38 . 2004-08-18 12:00 89790 ----a-w- c:\windows\system32\perfc005.dat
2010-08-12 09:38 . 2004-08-18 12:00 454630 ----a-w- c:\windows\system32\perfh005.dat
2010-08-06 17:07 . 2006-04-03 20:48 -------- d-----w- c:\program files\Oberon Media
2010-08-06 17:06 . 2006-02-10 22:48 -------- d-----w- c:\program files\Nero
2010-08-06 12:52 . 2006-02-08 18:50 -------- d-----w- c:\program files\Common Files\Adobe
2010-08-06 11:31 . 2010-07-02 16:36 -------- d-----w- c:\program files\Windows Live
2010-08-06 10:44 . 2006-02-10 22:48 -------- d-----w- c:\program files\Common Files\Ahead
2010-08-06 10:32 . 2006-02-02 12:02 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-08-06 10:31 . 2009-09-27 09:29 -------- d-----w- c:\program files\Common Files\Apple
2010-08-02 15:07 . 2008-10-31 14:28 41256 ----a-w- c:\windows\system32\drivers\fsbts.sys
2010-08-02 14:51 . 2006-02-07 08:06 -------- d-----w- c:\program files\PC Strazce
2010-08-02 13:26 . 2009-07-09 20:48 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-07-27 18:52 . 2007-09-18 17:30 -------- d-----w- c:\program files\Canon
2010-07-15 15:25 . 2007-01-08 21:57 262144 ----a-w- c:\windows\system32\default_user_class.dat
2010-07-10 08:42 . 2010-07-10 08:40 -------- d-----w- c:\program files\iTunes
2010-07-10 08:41 . 2010-07-10 08:41 -------- d-----w- c:\program files\iPod
2010-07-02 16:37 . 2010-07-02 16:37 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2010-07-02 16:32 . 2010-07-02 16:32 -------- d-----w- c:\program files\Common Files\Windows Live
2010-06-30 12:33 . 2004-08-18 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:27 . 2004-08-18 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-24 09:02 . 2004-08-18 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-18 12:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-19 20:08 . 2010-06-19 20:08 -------- d-----w- c:\program files\Common Files\Skype
2010-06-17 14:03 . 2004-08-18 12:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2006-02-02 11:48 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:43 . 2004-08-18 12:00 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-13 20:09 . 2010-06-09 03:09 -------- d-----w- c:\program files\ICQ7.2
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OM_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master\Monitor.exe" [2005-07-19 57344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTrayp"="VTtrayp.exe" [2005-01-10 143360]
"OM_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [2005-07-19 40960]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]
"TO2SSM_McciTrayApp"="c:\program files\TO2SSM\McciTrayApp.exe" [2008-08-15 1473536]
"F-Secure Manager"="c:\program files\F-Secure\Common\FSM32.EXE" [2009-08-05 199264]
"F-Secure TNB"="c:\program files\F-Secure\FSGUI\TNBUtil.exe" [2009-08-05 2349664]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^DSLMON.lnk]
backup=c:\windows\pss\DSLMON.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-06-15 14:33 141624 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
2010-02-24 20:17 385928 ----a-w- c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2006-10-11 10:45 75304 ----a-w- c:\program files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 09:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [31.10.2008 16:28 41256]
R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2.8.2010 17:00 80000]
R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\F-Secure\HIPS\drivers\fshs.sys [2.8.2010 16:59 68064]
R2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [6.8.2010 19:49 20328]
R2 NAUpdate;@c:\program files\Nero\Update\NASvc.exe,-200;c:\program files\Nero\Update\NASvc.exe [4.5.2010 12:07 503080]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\F-Secure\Anti-Virus\minifilter\fsgk.sys [2.8.2010 16:59 124072]
S3 FSORSPClient;F-Secure ORSP Client;c:\program files\F-Secure\ORSP Client\fsorsp.exe [2.8.2010 16:59 56992]
S4 F-Secure Filter;F-Secure File System Filter;c:\program files\F-Secure\Anti-Virus\win2k\fsfilter.sys [2.8.2010 16:59 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\F-Secure\Anti-Virus\win2k\fsrec.sys [2.8.2010 16:59 25184]

--- Ostatní služby/ovladače v paměti ---

*Deregistered* - uphcleanhlp
.
Obsah adresáře 'Naplánované úlohy'

2010-08-12 c:\windows\Tasks\User_Feed_Synchronization-{8979CC6D-05D4-4A4B-8600-9DB61FCF263A}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]

2010-08-12 c:\windows\Tasks\User_Feed_Synchronization-{AFA27604-368A-4033-AA03-14F4D166F2CC}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]

2010-08-12 c:\windows\Tasks\User_Feed_Synchronization-{B0FF42A2-944B-4FB5-81B8-4F98E344A6CD}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Office Excel - d:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint - Náhled - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint - Přidat na seznam k tisku - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint - Tisk - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint - Vysokorychlostní tisk - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
LSP: c:\program files\F-Secure\FSPS\program\FSLSP.DLL
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-12 12:26
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(632)
c:\program files\F-Secure\FWES\Program\fsdc32.dll

- - - - - - - > 'lsass.exe'(688)
c:\program files\F-Secure\FWES\Program\fsdc32.dll

- - - - - - - > 'explorer.exe'(420)
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll

- - - - - - - > 'csrss.exe'(608)
c:\program files\F-Secure\FWES\Program\fsdc32.dll
.
Celkový čas: 2010-08-12 12:31:33
ComboFix-quarantined-files.txt 2010-08-12 10:31
ComboFix2.txt 2010-08-09 15:23

Před spuštěním: Volných bajtů: 21 776 289 792
Po spuštění: Volných bajtů: 21 789 151 232

- - End Of File - - A25C80811631D3B0B372884DE41BFF4A

[Reklama]

[jaro3]

Aktualizaci Combofixu můžeš klidně povolit..

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
c:\windows\system32\perfc005.dat
c:\windows\system32\perfh005.dat

Folder::
c:\program files\Common Files\Symantec Shared

DDS::
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

[Jan Pašek]

ComboFix 10-08-11.05 - Hurt Miroslav 12.08.2010 14:03:22.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.447.261 [GMT 2:00]
Spuštěný z: c:\documents and settings\Hurt Miroslav\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Hurt Miroslav\Plocha\CFScript.txt
AV: F-Secure Profi Antivirus 9.01 *On-access scanning disabled* (Updated) {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
FW: F-Secure Profi Antivirus 9.01 *disabled* {D4747503-0346-49EB-9262-997542F79BF4}

FILE ::
"c:\windows\system32\perfc005.dat"
"c:\windows\system32\perfh005.dat"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Common Files\Symantec Shared
c:\windows\system32\perfc005.dat
c:\windows\system32\perfh005.dat

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-07-12 do 2010-08-12 )))))))))))))))))))))))))))))))
.

2010-08-10 08:11 . 2009-08-06 17:23 215920 ----a-w- c:\windows\system32\muweb.dll
2010-08-09 13:40 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-09 13:40 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-09 13:40 . 2010-08-09 13:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-06 17:49 . 2010-07-09 11:18 20328 ----a-w- c:\windows\system32\drivers\cpuz134_x32.sys
2010-08-06 17:49 . 2010-08-06 17:49 -------- d-----w- c:\program files\CPU-Z
2010-08-06 15:07 . 2010-08-06 15:07 -------- d-----w- c:\program files\VideoLAN
2010-08-06 14:50 . 2010-08-06 14:50 -------- d-----w- c:\program files\Common Files\Nero
2010-08-06 14:15 . 2010-08-06 14:15 -------- d-----w- c:\program files\Microsoft Silverlight
2010-08-06 12:21 . 2010-08-09 12:40 -------- d-----w- c:\program files\Wise Disk Cleaner
2010-08-06 12:20 . 2010-08-06 12:42 -------- d-----w- c:\program files\Wise Registry Cleaner
2010-08-06 12:04 . 2010-08-06 12:04 -------- d-----w- c:\program files\Common Files\Java
2010-08-06 12:04 . 2010-08-06 12:03 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-08-06 12:03 . 2010-08-06 12:03 -------- d-----w- c:\program files\Java
2010-08-06 11:46 . 2010-08-06 11:46 -------- d-----w- c:\program files\Speccy
2010-08-02 15:00 . 2009-08-05 15:57 80000 ----a-w- c:\windows\system32\drivers\fsdfw.sys
2010-08-02 14:59 . 2010-08-02 15:19 -------- d-----w- c:\program files\F-Secure
2010-08-02 13:59 . 2010-08-02 13:59 -------- d-----w- c:\program files\CCleaner
2010-07-15 11:33 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-06 17:07 . 2006-04-03 20:48 -------- d-----w- c:\program files\Oberon Media
2010-08-06 17:06 . 2006-02-10 22:48 -------- d-----w- c:\program files\Nero
2010-08-06 12:52 . 2006-02-08 18:50 -------- d-----w- c:\program files\Common Files\Adobe
2010-08-06 11:31 . 2010-07-02 16:36 -------- d-----w- c:\program files\Windows Live
2010-08-06 10:44 . 2006-02-10 22:48 -------- d-----w- c:\program files\Common Files\Ahead
2010-08-06 10:32 . 2006-02-02 12:02 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-08-06 10:31 . 2009-09-27 09:29 -------- d-----w- c:\program files\Common Files\Apple
2010-08-02 15:07 . 2008-10-31 14:28 41256 ----a-w- c:\windows\system32\drivers\fsbts.sys
2010-08-02 14:51 . 2006-02-07 08:06 -------- d-----w- c:\program files\PC Strazce
2010-07-27 18:52 . 2007-09-18 17:30 -------- d-----w- c:\program files\Canon
2010-07-15 15:25 . 2007-01-08 21:57 262144 ----a-w- c:\windows\system32\default_user_class.dat
2010-07-10 08:42 . 2010-07-10 08:40 -------- d-----w- c:\program files\iTunes
2010-07-10 08:41 . 2010-07-10 08:41 -------- d-----w- c:\program files\iPod
2010-07-02 16:37 . 2010-07-02 16:37 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2010-07-02 16:32 . 2010-07-02 16:32 -------- d-----w- c:\program files\Common Files\Windows Live
2010-06-30 12:33 . 2004-08-18 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:27 . 2004-08-18 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-24 09:02 . 2004-08-18 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-18 12:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-19 20:08 . 2010-06-19 20:08 -------- d-----w- c:\program files\Common Files\Skype
2010-06-17 14:03 . 2004-08-18 12:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2006-02-02 11:48 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:43 . 2004-08-18 12:00 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-13 20:09 . 2010-06-09 03:09 -------- d-----w- c:\program files\ICQ7.2
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OM_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master\Monitor.exe" [2005-07-19 57344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTrayp"="VTtrayp.exe" [2005-01-10 143360]
"OM_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [2005-07-19 40960]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]
"TO2SSM_McciTrayApp"="c:\program files\TO2SSM\McciTrayApp.exe" [2008-08-15 1473536]
"F-Secure Manager"="c:\program files\F-Secure\Common\FSM32.EXE" [2009-08-05 199264]
"F-Secure TNB"="c:\program files\F-Secure\FSGUI\TNBUtil.exe" [2009-08-05 2349664]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^DSLMON.lnk]
backup=c:\windows\pss\DSLMON.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-06-15 14:33 141624 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]
2010-02-24 20:17 385928 ----a-w- c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
2006-10-11 10:45 75304 ----a-w- c:\program files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 09:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [31.10.2008 16:28 41256]
R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2.8.2010 17:00 80000]
R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\F-Secure\HIPS\drivers\fshs.sys [2.8.2010 16:59 68064]
R2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [6.8.2010 19:49 20328]
R2 NAUpdate;@c:\program files\Nero\Update\NASvc.exe,-200;c:\program files\Nero\Update\NASvc.exe [4.5.2010 12:07 503080]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\F-Secure\Anti-Virus\minifilter\fsgk.sys [2.8.2010 16:59 124072]
S3 FSORSPClient;F-Secure ORSP Client;c:\program files\F-Secure\ORSP Client\fsorsp.exe [2.8.2010 16:59 56992]
S4 F-Secure Filter;F-Secure File System Filter;c:\program files\F-Secure\Anti-Virus\win2k\fsfilter.sys [2.8.2010 16:59 39776]
S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\F-Secure\Anti-Virus\win2k\fsrec.sys [2.8.2010 16:59 25184]

--- Ostatní služby/ovladače v paměti ---

*Deregistered* - uphcleanhlp
.
Obsah adresáře 'Naplánované úlohy'

2010-08-12 c:\windows\Tasks\User_Feed_Synchronization-{8979CC6D-05D4-4A4B-8600-9DB61FCF263A}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]

2010-08-12 c:\windows\Tasks\User_Feed_Synchronization-{AFA27604-368A-4033-AA03-14F4D166F2CC}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]

2010-08-12 c:\windows\Tasks\User_Feed_Synchronization-{B0FF42A2-944B-4FB5-81B8-4F98E344A6CD}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xportovat do aplikace Microsoft Office Excel - d:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint - Náhled - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint - Přidat na seznam k tisku - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint - Tisk - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint - Vysokorychlostní tisk - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
LSP: c:\program files\F-Secure\FSPS\program\FSLSP.DLL
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-12 14:10
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(632)
c:\program files\F-Secure\FWES\Program\fsdc32.dll

- - - - - - - > 'lsass.exe'(688)
c:\program files\F-Secure\FWES\Program\fsdc32.dll

- - - - - - - > 'csrss.exe'(608)
c:\program files\F-Secure\FWES\Program\fsdc32.dll
.
Celkový čas: 2010-08-12 14:15:36
ComboFix-quarantined-files.txt 2010-08-12 12:15
ComboFix2.txt 2010-08-12 10:31
ComboFix3.txt 2010-08-09 15:23

Před spuštěním: Volných bajtů: 21 782 904 832
Po spuštění: Volných bajtů: 21 779 189 760

- - End Of File - - 42CB5A78BD86A045D83CC019A38BCB86

[bledulka]

Co počítač?

[Jan Pašek]

Bledulko, zrychlil se. Ono bez výměny HW už to asi lepší nebude .. Stížnosti na chod sem neslyšel žádné pokud již nevidíš žádné problémové soubory asi bychom přistoupili k odinstalaci Combofixu a dočištěn í a téma uzavřeli.

[bledulka]

Jdeme uklízet .

Odinstaluj combofix přes
Start >> Spustit zkopíruj do okénka:
ComboFix /Uninstall

stiskni Enter
-To odinstaluje ComboFix a smaže s ním související soubory a složky.


Stáhni T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

-Spusť,pro potvrzení volby mačkej klávesu A, Enter
-po použití prográmek vymaž.Pozor,antiviry ho mohou falešně označit za vir





Odstranění konzole zotavení
-Stáhni T-Cleaner http://sweb.cz/Marinus/T-Cleaner.exe
-spusť T-Cleaner
- Zmačkni klavesu r a enter
-po restartu znova spusť T-Cleaner
-Zmáčkni klavesu a a Entr potvrď všechny volby na výmaz
-pak jej spust znova ˇ, klavesu p a enter
-restartuj pc


Vlož log z HJT.


Já tu budu zase až večer, možná nakoukne Jaro3 a zkontroluje HJT.

[Jan Pašek]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:09:40, on 12.8.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\TO2SSM\McciTrayApp.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Update\NASvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\F-Secure\Common\FSLAUNCH.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Hurt Miroslav\Plocha\Udržba PC\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Plugin Class - {56CD20F0-7C09-11D5-A768-0050042307CE} - c:\program files\sap\sap tutor\free_playerie.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [TO2SSM_McciTrayApp] C:\Program Files\TO2SSM\McciTrayApp.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint - Náhled - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Přidat na seznam k tisku - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint - Tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Vysokorychlostní tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Autodesk Network Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskNetSrv.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\F-Secure\ORSP Client\fsorsp.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: @C:\Program Files\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files\Nero\Update\NASvc.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 6738 bytes

[jaro3]

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

Pokud nejsou problémy , je to vše a můžeš dát vyřešeno , zelenou fajfku.