Prosím o kontrolo logu - úplně zpomalený PC Vyřešeno

[Žbeky]

Napsané to je správně. Děláš to přesně podle popisu jen s jedním .txt? Vyhodí to nějakou hlášku?

[Reklama]

[havran31]

CF se nakonec spustil, probehl, pak restartoval PC ale log jsem nikde nenasel.

[Žbeky]

C:\ComboFix.txt

[havran31]

Ne,neni. Ale vytvorila se mi na C: slozka Combofix, cca 26 Mba a je v ni spoustu souboru. Co s tim?

[Žbeky]

Zkus v hledání najít soubor combofix.txt

[havran31]

Tak tento soubor jsem nasel v te vytvorene slozce.

ComboFix 11-04-11.01 - vyroba 11.04.2011 21:50:25.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.511.172 [GMT 2:00]
Spuštěný z: C:\Documents and Settings\vyroba\Plocha\ComboFix.exe
Použité ovládací přepínače :: C:\Documents and Settings\vyroba\Plocha\CFScript.txt
AV: Aplikace Symantec Endpoint Protection *Enabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Aplikace Symantec Endpoint Protection *Disabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}

FILE ::
"c:\windows\Tasks\AppleSoftwareUpdate.job"

[Žbeky]

Nedal jsi sem celý log

[havran31]

Vic v logu neni.

[Žbeky]

Tak ho spusť jenom tak bez skriptu, jestli vygeneruje nový log a ten dej případně sem

[havran31]

ComboFix 11-04-11.01 - vyroba 11.04.2011 22:58:57.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.511.242 [GMT 2:00]
Spuštěný z: c:\documents and settings\vyroba\Plocha\ComboFix.exe
AV: Aplikace Symantec Endpoint Protection *Disabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Aplikace Symantec Endpoint Protection *Disabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Předchozí spuštění -------
.
c:\program files\SUPERAntiSpyware
c:\program files\SUPERAntiSpyware\BootSafe.exe
c:\program files\SUPERAntiSpyware\detect.wav
c:\program files\SUPERAntiSpyware\deupx.dll
c:\program files\SUPERAntiSpyware\Language\Čti.txt
c:\program files\SUPERAntiSpyware\Language\Arabic.lng
c:\program files\SUPERAntiSpyware\Language\Bulgarian (BG).lng
c:\program files\SUPERAntiSpyware\Language\Czech (CS).lng
c:\program files\SUPERAntiSpyware\Language\Danish (DK).lng
c:\program files\SUPERAntiSpyware\Language\Dutch (NL).lng
c:\program files\SUPERAntiSpyware\Language\English (US).lng
c:\program files\SUPERAntiSpyware\Language\Estonian (EST).lng
c:\program files\SUPERAntiSpyware\Language\French (FR).lng
c:\program files\SUPERAntiSpyware\Language\German (DE).lng
c:\program files\SUPERAntiSpyware\Language\Hebrew (IL).lng
c:\program files\SUPERAntiSpyware\Language\Hungarian (HU).lng
c:\program files\SUPERAntiSpyware\Language\Chinese Simplified (GB).lng
c:\program files\SUPERAntiSpyware\Language\Italian (IT).lng
c:\program files\SUPERAntiSpyware\Language\Macedonian (MK).lng
c:\program files\SUPERAntiSpyware\Language\Norwegian (NO).lng
c:\program files\SUPERAntiSpyware\Language\Polish (PL).lng
c:\program files\SUPERAntiSpyware\Language\Portuguese (BR).lng
c:\program files\SUPERAntiSpyware\Language\Spanish (ES).lng
c:\program files\SUPERAntiSpyware\Language\Swedish (SE).lng
c:\program files\SUPERAntiSpyware\msvcr71.dll
c:\program files\SUPERAntiSpyware\Plugins\sab_incr.dll
c:\program files\SUPERAntiSpyware\Plugins\sab_mapi.dll
c:\program files\SUPERAntiSpyware\Plugins\sab_wab.dll
c:\program files\SUPERAntiSpyware\PROCESSLIST.DB
c:\program files\SUPERAntiSpyware\PROCESSLISTRELATED.DB
c:\program files\SUPERAntiSpyware\RUNSAS.EXE
c:\program files\SUPERAntiSpyware\SASCore.exe
c:\program files\SUPERAntiSpyware\SASCTXMN.DLL
c:\program files\SUPERAntiSpyware\sasdifsv.sys
c:\program files\SUPERAntiSpyware\SASENUM.SYS
c:\program files\SUPERAntiSpyware\SASINST.EXE
c:\program files\SUPERAntiSpyware\SASKUTIL.SYS
c:\program files\SUPERAntiSpyware\SASREPAIRS.STG
c:\program files\SUPERAntiSpyware\SASSEH.DLL
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\program files\SUPERAntiSpyware\SSUpdate.exe
c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.chm
c:\program files\SUPERAntiSpyware\Uninstall.dat
c:\program files\SUPERAntiSpyware\Uninstall.exe
c:\windows\logo_1.exe
c:\windows\logo1_.exe
c:\windows\RUNDL132.EXE
c:\windows\rundll16.exe
c:\windows\Tasks\AppleSoftwareUpdate.job
c:\windows\VDLL.DLL
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SASDIFSV
-------\Legacy_SASKUTIL
-------\Service_SASDIFSV
-------\Service_SASKUTIL
-------\Legacy_SASDIFSV
-------\Legacy_SASKUTIL
-------\Service_SASDIFSV
-------\Service_SASKUTIL
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-11 do 2011-04-11 )))))))))))))))))))))))))))))))
.
.
2011-04-11 20:49 . 2011-04-11 20:49 -------- d-----w- c:\windows\LastGood.Tmp
2011-04-11 15:51 . 2011-04-11 15:51 388096 ----a-r- c:\documents and settings\vyroba\Data aplikací\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-04-11 15:51 . 2011-04-11 15:51 -------- d-----w- c:\program files\Trend Micro
2011-04-11 15:35 . 2011-04-11 15:50 -------- d-----w- c:\program files\Wise Registry Cleaner
2011-04-08 14:22 . 2011-04-08 14:22 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-04-08 14:22 . 2011-04-08 14:22 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-04-08 14:22 . 2011-04-08 14:22 728024 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-04-08 14:22 . 2011-04-08 14:22 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-04-08 14:22 . 2011-04-08 14:22 142296 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-04-08 14:22 . 2011-04-08 14:22 1893336 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-04-08 14:22 . 2011-04-08 14:22 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-04-08 14:22 . 2011-04-08 14:22 1975768 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-04-08 14:05 . 2011-04-08 14:05 -------- d-----w- c:\documents and settings\All Users\Data aplikací\PC Suite
2011-04-08 13:58 . 2011-04-08 13:58 -------- d-----w- c:\program files\Common Files\PCSuite
2011-04-08 13:57 . 2008-08-26 07:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2011-04-08 13:57 . 2011-04-08 13:57 -------- d-----w- c:\program files\PC Connectivity Solution
2011-04-08 13:50 . 2010-07-30 12:16 8192 ----a-w- c:\windows\system32\drivers\usbser_lowerfltj.sys
2011-04-08 13:50 . 2010-07-30 12:16 8192 ----a-w- c:\windows\system32\drivers\usbser_lowerflt.sys
2011-04-08 13:50 . 2010-07-30 12:16 23040 ----a-w- c:\windows\system32\drivers\ccdcmbo.sys
2011-04-08 13:49 . 2010-07-30 12:17 604160 ----a-w- c:\windows\system32\nmwcdcocls.dll
2011-04-08 13:49 . 2010-07-30 12:16 18048 ----a-w- c:\windows\system32\drivers\ccdcmb.sys
2011-04-08 13:49 . 2010-07-30 12:17 111104 ----a-w- c:\windows\system32\ccdcmbwu.dll
2011-04-08 13:49 . 2010-02-26 12:19 1461992 ----a-w- c:\windows\system32\wdfcoinstaller01009.dll
2011-04-08 13:49 . 2011-04-08 13:58 -------- d-----w- c:\program files\Nokia
2011-04-08 13:36 . 2003-11-16 16:34 991232 ----a-w- c:\windows\system32\W22MLRES.DLL
2011-04-08 13:32 . 2011-04-08 13:32 -------- d-----w- c:\program files\CONEXANT
2011-04-08 13:32 . 2003-12-12 12:10 90112 ----a-w- c:\windows\system32\mdmxsdk.dll
2011-04-08 13:32 . 2003-12-12 12:10 197504 ----a-w- c:\windows\system32\drivers\HSFHWICH.sys
2011-04-08 13:32 . 2003-12-12 12:10 11043 ----a-w- c:\windows\system32\drivers\mdmxsdk.sys
2011-04-08 13:32 . 2003-12-12 12:10 1043072 ----a-w- c:\windows\system32\drivers\HSF_DP.sys
2011-04-08 13:32 . 2003-12-12 12:10 678400 ----a-w- c:\windows\system32\drivers\HSF_CNXT.sys
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-09 13:53 . 1979-12-31 22:00 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 1979-12-31 22:00 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58 . 2004-10-18 06:18 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2004-10-18 06:18 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 1979-12-31 22:00 440320 ----a-w- c:\windows\system32\shimgvw.dll
2011-04-08 14:22 . 2011-04-08 14:22 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2010-11-25 115560]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2009-02-27 1202448]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-12-12 618496]
"PRONoMgr.exe"="c:\program files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe" [2003-12-10 86016]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-12-12 110592]
"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2009-02-27 1368064]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-9-2 604776]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"CompatibleRUPSecurity"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
2003-12-16 14:49 110592 ----a-w- c:\windows\system32\LgNotify.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 09:50 155648 ----a-r- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-05-27 09:50 413696 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IBM\\Client Access\\cwbunnav.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"=
"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"=
"c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"7255:TCP"= 7255:TCP:BitComet 7255 TCP
"7255:UDP"= 7255:UDP:BitComet 7255 UDP
.
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [9.2.2011 20:05 363344]
R3 BTPCH4;Bluetooth H4 Transport;c:\windows\system32\drivers\btpch4.sys [15.8.2009 15:30 31888]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [30.11.2010 11:42 102448]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [9.2.2011 20:05 20952]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [25.11.2010 12:54 23888]
.
Obsah adresáře 'Naplánované úlohy'
.
2011-04-11 c:\windows\Tasks\User_Feed_Synchronization-{FF43FBB7-33A2-427E-95F8-AC7058DAE7B3}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Odeslat do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat do zařízení Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\documents and settings\vyroba\Data aplikací\Mozilla\Firefox\Profiles\83o9gq0g.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-11 23:20
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{0C3EE7CB-EC45-AEBF-6CFA-0D8CAD3D711B}\InProcServer32*]
"oaknpgaocbmlhnlmeilimmecjglemm"=hex:6a,61,6c,69,6c,61,62,6b,67,6e,66,6a,6c,6f,
65,63,70,68,6a,65,00,fa
"naknbfeaajlbcbdabnkfeemhihep"=hex:69,61,63,68,6f,64,65,66,63,6c,6e,66,65,67,
67,62,6e,67,00,00
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{0E9A387A-5701-ACA0-CA45-B7FB57B7078C}\InProcServer32*]
"oamnfhacocalbhdgdhgjggndmddhco"=hex:6a,61,6b,69,69,62,70,6a,6b,62,6a,6e,64,6b,
64,69,67,68,69,64,00,07
"namnpgcmlfkfomdlligghajohkpm"=hex:6a,61,6b,69,69,62,70,6a,6b,62,6a,6e,64,6b,
64,69,67,68,69,64,00,00
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1416)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LgNotify.dll
c:\windows\system32\netprovcredman.dll
.
- - - - - - - > 'explorer.exe'(3432)
c:\windows\system32\btmmhook.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\netprovcredman.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Symantec\Symantec Endpoint Protection\Smc.exe
c:\windows\system32\ZCfgSvc.exe
c:\program files\Common Files\Symantec Shared\ccSvcHst.exe
c:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\HPZipm12.exe
c:\windows\system32\PSIService.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Symantec\Symantec Endpoint Protection\SmcGui.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Celkový čas: 2011-04-11 23:34:29 - počítač byl restartován
ComboFix-quarantined-files.txt 2011-04-11 21:34
ComboFix2.txt 2011-04-11 18:57
.
Před spuštěním: Volných bajtů: 44 322 070 528
Po spuštění: Volných bajtů: 44 311 920 640
.
- - End Of File - - 72C620715F0C1E753F226F78D3831559

[Žbeky]

Super

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

Folder::
c:\windows\LastGood.Tmp

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000000


Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

[havran31]

ComboFix 11-04-11.04 - vyroba 12.04.2011 17:31:41.2.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.511.279 [GMT 2:00]
Spuštěný z: c:\documents and settings\vyroba\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\vyroba\Plocha\CFScript.txt
AV: Aplikace Symantec Endpoint Protection *Enabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Aplikace Symantec Endpoint Protection *Disabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Downloaded Installers
c:\program files\Downloaded Installers\{F88ADE21-8F6C-4A20-96F1-D0CC4FF99FE7}\setup.msi
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-03-12 do 2011-04-12 )))))))))))))))))))))))))))))))
.
.
2011-04-11 15:51 . 2011-04-11 15:51 388096 ----a-r- c:\documents and settings\vyroba\Data aplikací\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-04-11 15:51 . 2011-04-11 15:51 -------- d-----w- c:\program files\Trend Micro
2011-04-11 15:35 . 2011-04-11 15:50 -------- d-----w- c:\program files\Wise Registry Cleaner
2011-04-08 14:22 . 2011-04-08 14:22 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-04-08 14:22 . 2011-04-08 14:22 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-04-08 14:22 . 2011-04-08 14:22 728024 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-04-08 14:22 . 2011-04-08 14:22 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-04-08 14:22 . 2011-04-08 14:22 142296 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-04-08 14:22 . 2011-04-08 14:22 1893336 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-04-08 14:22 . 2011-04-08 14:22 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-04-08 14:22 . 2011-04-08 14:22 1975768 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-04-08 14:05 . 2011-04-08 14:05 -------- d-----w- c:\documents and settings\All Users\Data aplikací\PC Suite
2011-04-08 13:58 . 2011-04-08 13:58 -------- d-----w- c:\program files\Common Files\PCSuite
2011-04-08 13:57 . 2008-08-26 07:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2011-04-08 13:57 . 2011-04-08 13:57 -------- d-----w- c:\program files\PC Connectivity Solution
2011-04-08 13:50 . 2010-07-30 12:16 8192 ----a-w- c:\windows\system32\drivers\usbser_lowerfltj.sys
2011-04-08 13:50 . 2010-07-30 12:16 8192 ----a-w- c:\windows\system32\drivers\usbser_lowerflt.sys
2011-04-08 13:50 . 2010-07-30 12:16 23040 ----a-w- c:\windows\system32\drivers\ccdcmbo.sys
2011-04-08 13:49 . 2010-07-30 12:17 604160 ----a-w- c:\windows\system32\nmwcdcocls.dll
2011-04-08 13:49 . 2010-07-30 12:16 18048 ----a-w- c:\windows\system32\drivers\ccdcmb.sys
2011-04-08 13:49 . 2010-07-30 12:17 111104 ----a-w- c:\windows\system32\ccdcmbwu.dll
2011-04-08 13:49 . 2010-02-26 12:19 1461992 ----a-w- c:\windows\system32\wdfcoinstaller01009.dll
2011-04-08 13:49 . 2011-04-08 13:58 -------- d-----w- c:\program files\Nokia
2011-04-08 13:36 . 2003-11-16 16:34 991232 ----a-w- c:\windows\system32\W22MLRES.DLL
2011-04-08 13:32 . 2011-04-08 13:32 -------- d-----w- c:\program files\CONEXANT
2011-04-08 13:32 . 2003-12-12 12:10 90112 ----a-w- c:\windows\system32\mdmxsdk.dll
2011-04-08 13:32 . 2003-12-12 12:10 197504 ----a-w- c:\windows\system32\drivers\HSFHWICH.sys
2011-04-08 13:32 . 2003-12-12 12:10 11043 ----a-w- c:\windows\system32\drivers\mdmxsdk.sys
2011-04-08 13:32 . 2003-12-12 12:10 1043072 ----a-w- c:\windows\system32\drivers\HSF_DP.sys
2011-04-08 13:32 . 2003-12-12 12:10 678400 ----a-w- c:\windows\system32\drivers\HSF_CNXT.sys
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-09 13:53 . 1979-12-31 22:00 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 1979-12-31 22:00 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58 . 2004-10-18 06:18 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2004-10-18 06:18 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 1979-12-31 22:00 440320 ----a-w- c:\windows\system32\shimgvw.dll
2011-04-08 14:22 . 2011-04-08 14:22 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2010-11-25 115560]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2009-02-27 1202448]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-12-12 618496]
"PRONoMgr.exe"="c:\program files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe" [2003-12-10 86016]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-12-12 110592]
"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2009-02-27 1368064]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-9-2 604776]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"CompatibleRUPSecurity"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
2003-12-16 14:49 110592 ----a-w- c:\windows\system32\LgNotify.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 09:50 155648 ----a-r- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2008-05-27 09:50 413696 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IBM\\Client Access\\cwbunnav.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\ICQ7.2\\ICQ.exe"=
"c:\\Program Files\\ICQ7.2\\aolload.exe"=
"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"=
"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"=
"c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"7255:TCP"= 7255:TCP:BitComet 7255 TCP
"7255:UDP"= 7255:UDP:BitComet 7255 UDP
.
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [9.2.2011 20:05 363344]
R3 BTPCH4;Bluetooth H4 Transport;c:\windows\system32\drivers\btpch4.sys [15.8.2009 15:30 31888]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [30.11.2010 11:42 102448]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [9.2.2011 20:05 20952]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [25.11.2010 12:54 23888]
.
Obsah adresáře 'Naplánované úlohy'
.
2011-04-12 c:\windows\Tasks\User_Feed_Synchronization-{FF43FBB7-33A2-427E-95F8-AC7058DAE7B3}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Odeslat do zařízení &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Odeslat do zařízení Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\documents and settings\vyroba\Data aplikací\Mozilla\Firefox\Profiles\83o9gq0g.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-12 17:46
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{0C3EE7CB-EC45-AEBF-6CFA-0D8CAD3D711B}\InProcServer32*]
"oaknpgaocbmlhnlmeilimmecjglemm"=hex:6a,61,6c,69,6c,61,62,6b,67,6e,66,6a,6c,6f,
65,63,70,68,6a,65,00,fa
"naknbfeaajlbcbdabnkfeemhihep"=hex:69,61,63,68,6f,64,65,66,63,6c,6e,66,65,67,
67,62,6e,67,00,00
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{0E9A387A-5701-ACA0-CA45-B7FB57B7078C}\InProcServer32*]
"oamnfhacocalbhdgdhgjggndmddhco"=hex:6a,61,6b,69,69,62,70,6a,6b,62,6a,6e,64,6b,
64,69,67,68,69,64,00,07
"namnpgcmlfkfomdlligghajohkpm"=hex:6a,61,6b,69,69,62,70,6a,6b,62,6a,6e,64,6b,
64,69,67,68,69,64,00,00
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1308)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\LgNotify.dll
c:\windows\system32\netprovcredman.dll
.
Celkový čas: 2011-04-12 17:51:55
ComboFix-quarantined-files.txt 2011-04-12 15:51
ComboFix2.txt 2011-04-11 21:34
ComboFix3.txt 2011-04-11 18:57
.
Před spuštěním: Volných bajtů: 44 167 073 792
Po spuštění: Volných bajtů: 44 122 107 904
.
- - End Of File - - A816892A36EDE9D0B071E568046C1D4D


stem32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Symantec\LiveUpdate\luall.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Odeslat do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat do zařízení Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 2554931197
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: iSeries Access for Windows Remote Command (Cwbrxd) - IBM Corporation - C:\WINDOWS\CWBRXD.EXE
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Aplikace Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Aplikace Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

--
End of file - 7760 bytes