Při startu se automaticky spouští cmd* Vyřešeno

Sekce věnovaná virům a jiným škodlivým kódům, rovněž ale nástrojům, kterým se lze proti nim bránit…

Moderátoři: Mods_senior, Security team

Uživatelský avatar
bledulka
Level 5
Level 5
Příspěvky: 2242
Registrován: srpen 09
Pohlaví: Žena
Stav:
Offline

Re: Při startu se automaticky spouští cmd*

Příspěvekod bledulka » 24 črc 2011 19:06

Pořád? Vlož mi nový log z OTL - sken.

Reklama
OndrK
nováček
Příspěvky: 35
Registrován: červenec 11
Bydliště: Plzeň
Pohlaví: Muž
Stav:
Offline

Re: Při startu se automaticky spouští cmd*

Příspěvekod OndrK » 24 črc 2011 19:26

OTL logfile created on: 24.7.2011 19:23:16 - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\Počítač\Downloads
An unknown product (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

3,12 Gb Total Physical Memory | 2,11 Gb Available Physical Memory | 67,52% Memory free
6,25 Gb Paging File | 5,15 Gb Available in Paging File | 82,48% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,43 Gb Total Space | 24,28 Gb Free Space | 32,63% Space Free | Partition Type: NTFS
Drive E: | 3,35 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

Computer Name: ADMIN | User Name: Počítač | NOT logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011.07.23 22:54:35 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\Počítač\Downloads\OTL.exe
PRC - [2011.07.09 06:51:19 | 001,012,792 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
PRC - [2011.07.04 13:43:54 | 003,493,720 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2011.04.07 22:43:20 | 000,373,864 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
PRC - [2011.03.21 20:56:16 | 001,230,704 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.01.22 22:36:10 | 000,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2009.07.30 19:10:04 | 000,380,928 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
PRC - [2009.07.14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2007.05.16 10:27:38 | 001,209,904 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
PRC - [2007.05.16 10:27:16 | 000,153,136 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
PRC - [2007.05.15 11:33:30 | 000,204,800 | ---- | M] (A4Tech Co.,Ltd.) -- C:\Program Files\A4Tech\Mouse\Amoumain.exe


========== Modules (SafeList) ==========

MOD - [2011.07.23 22:54:35 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\Počítač\Downloads\OTL.exe
MOD - [2011.07.04 13:43:51 | 000,199,792 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\snxhk.dll
MOD - [2010.08.21 07:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
MOD - [2007.05.15 11:31:52 | 000,036,864 | ---- | M] (A4Tech Co.,Ltd.) -- C:\Windows\System32\Amhooker.dll


========== Win32 Services (SafeList) ==========


========== Driver Services (SafeList) ==========


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-3830634285-3295066948-246257650-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/home?AF=14542
IE - HKU\S-1-5-21-3830634285-3295066948-246257650-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3830634285-3295066948-246257650-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local;*.local


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.448: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Počítač\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird

[2010.01.29 14:06:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Počítač\AppData\Roaming\Mozilla\Extensions
[2010.01.29 14:06:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Počítač\AppData\Roaming\Mozilla\Firefox\Profiles\p0190x5h.default\extensions
[2010.10.15 20:08:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010.06.22 19:12:00 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.06.22 19:11:38 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010.04.22 17:28:09 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Program Files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2010.09.01 12:48:00 | 000,002,226 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml

O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKU\S-1-5-21-3830634285-3295066948-246257650-1001\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-3830634285-3295066948-246257650-1001\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKU\S-1-5-21-3830634285-3295066948-246257650-1001\..\Toolbar\WebBrowser: (no name) - {CE18769B-C7FA-42D2-860D-17C4662C70AD} - No CLSID value found.
O3 - HKU\S-1-5-21-3830634285-3295066948-246257650-1001\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [C6501Sound] File not found
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [ImagePath] C:\Windows\system_32.bat ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NPSStartup] File not found
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe (A4Tech Co.,Ltd.)
O4 - HKU\S-1-5-21-3830634285-3295066948-246257650-1001..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKU\S-1-5-21-3830634285-3295066948-246257650-1001..\Run: [PlayNC Launcher] File not found
O4 - HKU\S-1-5-21-3830634285-3295066948-246257650-1001..\Run: [Sony Ericsson PC Companion] File not found
O4 - HKU\S-1-5-21-3830634285-3295066948-246257650-1001..\Run: [Steam] b:\hry\steam\steam.exe (Valve Corporation)
O4 - HKLM..\RunOnce: [*WerKernelReporting] C:\Windows\System32\WerFault.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [aswAhAScr.dll] C:\Program Files\AVAST Software\Avast\aswRegSvr.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-3830634285-3295066948-246257650-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 178.77.254.254 77.48.100.254
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009.10.07 22:14:39 | 000,000,035 | R--- | M] () - E:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{0009e6e9-8042-11df-a84f-001966465696}\Shell - "" = AutoRun
O33 - MountPoints2\{0009e6e9-8042-11df-a84f-001966465696}\Shell\AutoRun\command - "" = H:\Startme.exe
O33 - MountPoints2\{62424d4e-f59e-11de-bc67-001966465696}\Shell - "" = AutoRun
O33 - MountPoints2\{62424d4e-f59e-11de-bc67-001966465696}\Shell\AutoRun\command - "" = G:\setup\rsrc\Autorun.exe
O33 - MountPoints2\{62424d4e-f59e-11de-bc67-001966465696}\Shell\dinstall\command - "" = G:\Directx\dxsetup.exe
O33 - MountPoints2\{8c73ef2e-f393-11de-afc8-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{8c73ef2e-f393-11de-afc8-806e6f6e6963}\Shell\AutoRun\command - "" = 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.07.24 15:25:23 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{F1E829AA-6A9B-4CFA-82B3-A6E8F26DC931}
[2011.07.23 19:55:16 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{27F1B91F-AEE7-4ABB-A569-9CD3D9B78E04}
[2011.07.23 00:53:21 | 000,000,000 | ---D | C] -- C:\Users\Počítač\Desktop\Metro 2033
[2011.07.22 20:49:44 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{DCF7263A-146A-44EA-966C-560022941476}
[2011.07.22 19:14:15 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Roaming\InstallShield
[2011.07.22 16:12:40 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{14571E99-5115-4DF7-8AD4-7BAC028D43D1}
[2011.07.21 19:41:06 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{90AC51F8-8DEB-4439-86EB-7C8A5BDBDBED}
[2011.07.20 18:33:30 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{07F463EB-FF25-4FBD-97AF-8F3BF881F092}
[2011.07.19 19:57:06 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{B65AD762-6F48-4EDC-99D6-3D732F697D04}
[2011.07.19 18:56:51 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{E43385C9-D835-4CBB-9822-BBD65ADE1F2D}
[2011.07.18 18:54:12 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{19302B0D-4CAF-4207-BDFC-5C890646AA84}
[2011.07.17 22:34:10 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{30347F70-1CF4-46BC-A8C3-8B4615F4C76B}
[2011.07.15 21:18:57 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{2B40B848-B641-4F06-B5A6-C2FD64202FDF}
[2011.07.15 15:19:23 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{ABAE0F0E-4FDE-47AD-9CD8-BF49126B283C}
[2011.07.14 18:27:27 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{BA012542-FB69-45CA-842C-F401F88B01A4}
[2011.07.14 18:27:01 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{3230ED8A-D791-4CFA-BACC-14CCB1ECA39D}
[2011.07.14 11:26:56 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{65955DF0-7B0F-4E6F-A92E-A639ADE2A201}
[2011.07.13 20:19:35 | 000,284,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbport.sys
[2011.07.13 20:19:34 | 000,005,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbd.sys
[2011.07.13 20:19:29 | 001,686,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\esent.dll
[2011.07.13 20:19:29 | 000,146,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\storport.sys
[2011.07.13 20:19:29 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fsutil.exe
[2011.07.13 20:19:22 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2011.07.13 20:19:22 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2011.07.13 20:19:22 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2011.07.13 20:19:22 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2011.07.13 20:19:22 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2011.07.13 20:19:22 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2011.07.13 20:19:22 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2011.07.13 20:19:22 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2011.07.13 20:19:22 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2011.07.13 20:19:22 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2011.07.13 20:19:22 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2011.07.13 20:19:22 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2011.07.13 20:19:22 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2011.07.13 20:19:22 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2011.07.13 20:19:22 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2011.07.13 20:19:22 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011.07.13 20:19:22 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2011.07.13 20:19:22 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2011.07.13 20:19:22 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2011.07.13 20:19:22 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2011.07.13 20:19:22 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2011.07.13 20:19:22 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2011.07.13 20:19:22 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2011.07.13 20:19:22 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2011.07.13 20:19:21 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2011.07.13 20:19:21 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2011.07.13 20:19:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2011.07.13 20:19:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2011.07.13 20:19:20 | 000,271,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
[2011.07.13 20:19:20 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll
[2011.07.13 20:19:18 | 002,332,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011.07.13 20:13:55 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{24CB9554-F980-449A-B697-F83017100CA8}
[2011.07.12 11:34:32 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{038D2F4C-056F-490C-AF40-872F5CC1BEE8}
[2011.07.12 10:25:47 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{411D4883-3CF5-459E-A573-31DF08D31783}
[2011.07.11 23:44:05 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Roaming\gtk-2.0
[2011.07.11 23:43:12 | 000,000,000 | ---D | C] -- C:\Users\Počítač\.thumbnails
[2011.07.11 23:41:45 | 000,000,000 | ---D | C] -- C:\Users\Počítač\.gimp-2.6
[2011.07.11 23:41:44 | 000,000,000 | ---D | C] -- C:\Users\Počítač\Documents\gegl-0.0
[2011.07.11 16:16:21 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{42502E6E-8344-4733-9085-E5A2500C98AE}
[2011.07.10 21:29:52 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{3C86D898-CF08-4228-A677-644E882DDFC5}
[2011.07.10 08:23:03 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{3263C42D-6B34-4D49-BB1B-5D543D034415}
[2011.07.09 17:42:36 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{B38D2FCD-69B2-40BD-8875-91B982B21357}
[2011.07.09 01:37:49 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{51B1CD6E-75BF-4BB7-A1B9-D1EEEA04E2CE}
[2011.07.08 06:21:50 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{7B828190-585D-4D42-9141-476AE69B8A09}
[2011.07.07 17:52:16 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{A1612441-3638-4CBC-A6D4-55B0FA54D00A}
[2011.07.06 22:02:29 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{AB7D7C15-D382-4E71-BFFC-D63FE89631A8}
[2011.07.05 23:05:54 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{16DFE10F-06B1-40DA-B5C9-2B12CEE4C11C}
[2011.07.05 19:05:25 | 000,000,000 | ---D | C] -- C:\Users\Počítač\Documents\BitLord
[2011.07.05 19:05:16 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\BitLord
[2011.07.05 11:05:18 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{959621CA-2FF7-4975-B37E-ABC71167E864}
[2011.07.05 04:17:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2011.07.04 17:27:43 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{9D8927B7-0B23-42EA-B618-18C6DDC35352}
[2011.07.04 05:08:57 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{779A29B6-1E31-4A0A-807D-34EFFAD64E6A}
[2011.07.03 12:14:13 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{FED487F7-F4E9-417B-9C59-C4387C8D24EA}
[2011.07.02 20:55:27 | 000,000,000 | ---D | C] -- C:\Users\Počítač\Documents\4A Games
[2011.07.02 20:54:07 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\4A Games
[2011.07.02 12:02:50 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{14298804-273F-4A53-A89B-7C6C7BE0BA8B}
[2011.07.01 14:30:11 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{50C0A4C6-BEA4-41B4-BCCF-960857887D67}
[2011.06.30 10:20:01 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{0C2E9236-5BD0-4819-A941-742A637680D4}
[2011.06.29 16:05:48 | 001,553,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tquery.dll
[2011.06.29 16:05:48 | 001,401,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssrch.dll
[2011.06.29 16:05:47 | 000,666,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssvp.dll
[2011.06.29 16:05:47 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssph.dll
[2011.06.29 16:05:47 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssphtb.dll
[2011.06.29 16:05:47 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msscntrs.dll
[2011.06.29 16:01:04 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\{47D818F8-0684-4488-AE34-6EEFF54F0593}
[2011.06.28 20:57:21 | 000,000,000 | ---D | C] -- C:\Users\Počítač\AppData\Local\Skype
[2010.10.22 23:52:47 | 001,111,158 | ---- | C] (PC Drivers HeadQuarters ) -- C:\Program Files\DriverDetective-6.4.1.5-TrialVersion.exe
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Počítač\AppData\Local\*.tmp files -> C:\Users\Počítač\AppData\Local\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.07.24 19:21:03 | 000,000,930 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.07.24 19:20:58 | 000,000,278 | -H-- | M] () -- C:\Windows\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
[2011.07.24 19:20:56 | 000,000,242 | -H-- | M] () -- C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2011.07.24 19:20:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.07.24 19:20:18 | 2516,033,536 | -HS- | M] () -- C:\hiberfil.sys
[2011.07.24 16:45:03 | 000,000,470 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for xxx.job
[2011.07.24 16:15:15 | 000,000,934 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.07.24 15:31:49 | 000,014,256 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.07.24 15:31:49 | 000,014,256 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.07.23 23:17:41 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2011.07.19 19:04:29 | 000,001,227 | ---- | M] () -- C:\Users\Počítač\Desktop\Wow – zástupce.lnk
[2011.07.14 19:11:43 | 284,917,044 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011.07.14 03:19:56 | 000,411,696 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.07.05 04:17:39 | 000,002,203 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2011.07.04 13:43:53 | 000,040,112 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2011.07.04 13:43:51 | 000,199,304 | ---- | M] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2011.07.04 13:36:43 | 000,441,176 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2011.07.04 13:36:32 | 000,309,848 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2011.07.04 13:35:23 | 000,043,608 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2011.07.04 13:32:32 | 000,025,432 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2011.07.04 13:32:20 | 000,054,104 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2011.07.04 13:32:12 | 000,019,544 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Počítač\AppData\Local\*.tmp files -> C:\Users\Počítač\AppData\Local\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.07.13 21:58:14 | 000,001,227 | ---- | C] () -- C:\Users\Počítač\Desktop\Wow – zástupce.lnk
[2011.07.05 04:17:39 | 000,002,203 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2011.05.18 17:37:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll
[2011.05.18 17:37:38 | 000,036,608 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys
[2011.01.28 22:26:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asrussian.dll
[2011.01.28 22:26:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\askorean.dll
[2011.01.28 22:26:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asjapan.dll
[2011.01.28 22:26:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\ASCHT.dll
[2011.01.28 22:26:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\aschs.dll
[2011.01.28 22:26:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asgerman.dll
[2011.01.28 22:26:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\asfrench.dll
[2011.01.28 22:26:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\aseng.dll
[2011.01.28 22:26:29 | 000,761,856 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2011.01.28 22:26:29 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2010.10.19 21:40:30 | 000,000,082 | ---- | C] () -- C:\Windows\TweakOblivion.ini
[2010.09.14 21:39:26 | 000,000,507 | ---- | C] () -- C:\Windows\eReg.dat
[2010.09.11 21:53:43 | 000,045,311 | ---- | C] () -- C:\Windows\War3Unin.dat
[2010.09.08 19:40:21 | 000,144,808 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2010.07.05 03:02:30 | 000,450,560 | R--- | C] () -- C:\Windows\System32\Cmeau6501.exe
[2010.07.05 03:02:30 | 000,053,248 | R--- | C] () -- C:\Windows\System32\C6501rm.dll
[2010.07.05 03:02:30 | 000,000,378 | ---- | C] () -- C:\Windows\C6501.ini.cfl
[2010.07.05 02:54:33 | 000,001,882 | R--- | C] () -- C:\Windows\C6501.ini.cfg
[2010.07.05 02:54:33 | 000,000,110 | ---- | C] () -- C:\Windows\C6501.ini.imi
[2010.07.05 02:54:32 | 000,000,293 | R--- | C] () -- C:\Windows\c6501.ini
[2010.07.05 02:38:03 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\SamSfPa.dat
[2010.07.05 02:25:09 | 000,065,536 | R--- | C] () -- C:\Windows\System32\CmiInstallResAll.dll
[2010.07.05 02:25:06 | 000,000,555 | ---- | C] () -- C:\Windows\cmhdav.ini
[2010.07.03 02:07:24 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
[2010.06.29 18:03:19 | 000,278,728 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2010.06.29 18:03:18 | 000,025,416 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2010.05.29 00:23:24 | 000,020,480 | ---- | C] () -- C:\Windows\System32\H@tKeysH@@k.DLL
[2010.04.05 20:17:28 | 000,000,035 | ---- | C] () -- C:\Windows\dice.ini
[2010.03.26 12:31:00 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini
[2010.03.14 05:07:31 | 000,000,525 | ---- | C] () -- C:\Windows\QIII.INI
[2010.03.07 01:53:28 | 001,589,248 | ---- | C] () -- C:\Windows\System32\libmysql_d.dll
[2010.01.31 20:17:21 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat
[2010.01.23 20:48:39 | 000,000,039 | ---- | C] () -- C:\Windows\WININIT.INI
[2010.01.22 22:38:03 | 000,000,025 | ---- | C] () -- C:\Windows\cdplayer.ini
[2010.01.18 22:38:20 | 000,118,784 | ---- | C] () -- C:\Windows\bwUnin-7.2.0.157-8876480SL.exe
[2010.01.15 22:37:46 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2009.07.27 12:13:28 | 000,061,440 | ---- | C] () -- C:\Windows\System32\ASDR.exe
[2009.07.14 10:44:22 | 000,634,308 | ---- | C] () -- C:\Windows\System32\perfh005.dat
[2009.07.14 10:44:22 | 000,292,004 | ---- | C] () -- C:\Windows\System32\perfi005.dat
[2009.07.14 10:44:22 | 000,122,898 | ---- | C] () -- C:\Windows\System32\perfc005.dat
[2009.07.14 10:44:22 | 000,036,232 | ---- | C] () -- C:\Windows\System32\perfd005.dat
[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 06:33:53 | 000,411,696 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 04:05:48 | 000,618,714 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 04:05:48 | 000,107,034 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 02:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2007.10.25 17:26:10 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2007.01.16 09:49:22 | 000,065,536 | R--- | C] () -- C:\Windows\VMix.dll
[2006.10.11 05:33:58 | 000,010,288 | ---- | C] () -- C:\Windows\System32\drivers\ASUSHWIO.SYS
[2004.10.11 12:19:00 | 000,092,672 | ---- | C] () -- C:\Windows\System32\ASUSASV2.DLL

< End of report >

Uživatelský avatar
bledulka
Level 5
Level 5
Příspěvky: 2242
Registrován: srpen 09
Pohlaví: Žena
Stav:
Offline

Re: Při startu se automaticky spouští cmd*

Příspěvekod bledulka » 24 črc 2011 19:42

A fixnul jsi to v tom HJT, tak jsme Ti psala poprvé?

Stáhni na plochu ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- Před použitím vypni všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary
-Zavři všechna aktivní okna a spusť ho pod učtem s právy administrátora
- Po spuštění se zobrazí podmínky použití, potvrď je stiskem tlačítka Ano

- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna

- Po dokončení skenování, se vytvoří log C:\ComboFix.txt, zkopíruj celý jeho obsah sem.

OndrK
nováček
Příspěvky: 35
Registrován: červenec 11
Bydliště: Plzeň
Pohlaví: Muž
Stav:
Offline

Re: Při startu se automaticky spouští cmd*

Příspěvekod OndrK » 24 črc 2011 19:50

Ale na ucet s pravi administratora se nedostanu protoze sem tam mel heslo ale to se mi zmenilo s prichodem toho problemu takze to stim musi nak souviset a ja sem na druhym uctu s omezenymi pravy...

OndrK
nováček
Příspěvky: 35
Registrován: červenec 11
Bydliště: Plzeň
Pohlaví: Muž
Stav:
Offline

Re: Při startu se automaticky spouští cmd*

Příspěvekod OndrK » 24 črc 2011 19:52

a v tom HJT sem to fixnul
ale radsy to zkusim jeste jednou...

OndrK
nováček
Příspěvky: 35
Registrován: červenec 11
Bydliště: Plzeň
Pohlaví: Muž
Stav:
Offline

Re: Při startu se automaticky spouští cmd*

Příspěvekod OndrK » 24 črc 2011 20:04

Tak z toho seznamu co si mi dala:
R3 - URLSearchHook: (no name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - (no file)
R3 - URLSearchHook: (no name) - {ce18769b-c7fa-42d2-860d-17c4662c70ad} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [C6501Sound] RunDll32 C6501.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [ImagePath] C:\windows\system_32.bat
O4 - HKLM\..\RunOnce: [*WerKernelReporting] %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [TOY5KNQ8OC] C:\Users\Počítač\AppData\Local\Temp\Ib2.exe

Sem nasel naky co tam zustali:
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [C6501Sound] RunDll32 C6501.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [ImagePath] C:\windows\system_32.bat
O4 - HKLM\..\RunOnce: [*WerKernelReporting] %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

Oznacil sem je a zmack sem FIx Checked... pak sem dal scan a byli tam porad.

Uživatelský avatar
bledulka
Level 5
Level 5
Příspěvky: 2242
Registrován: srpen 09
Pohlaví: Žena
Stav:
Offline

Re: Při startu se automaticky spouští cmd*

Příspěvekod bledulka » 24 črc 2011 20:09

Musíš restartovat počítač.
Zkus ještě obnovu systému.

OndrK
nováček
Příspěvky: 35
Registrován: červenec 11
Bydliště: Plzeň
Pohlaví: Muž
Stav:
Offline

Re: Při startu se automaticky spouští cmd*

Příspěvekod OndrK » 24 črc 2011 20:24

Jak obnovu systemu ?

OndrK
nováček
Příspěvky: 35
Registrován: červenec 11
Bydliště: Plzeň
Pohlaví: Muž
Stav:
Offline

Re: Při startu se automaticky spouští cmd*

Příspěvekod OndrK » 24 črc 2011 20:25

jo a koukal sem se na ten system_32.bat z tuty adresy O4 - HKLM\..\Run: [ImagePath] C:\windows\system_32.bat
a spustil sme to a votevrelo se cerno okenko s nadpisem C:\windows\system32\cmd.exe
a ukozovalo to stejny veci jako kdys se mi to spusti po startu:
Adresi vsech moznejch slozek v C: př:
C:\Program Files\Bethesda Softworks\Morrowind\Data Files\Sound\Cr\hrkr\scrm.wav
Přístup byl odepřen.
A takhle to tam ukazuje vsechny slozky z cecka a podnima hned Přístup byl odepřen.

Uživatelský avatar
Žbeky
Moderátor
Guru Level 13
Guru Level 13
Příspěvky: 22288
Registrován: květen 08
Bydliště: Vsetín - Pardubice
Pohlaví: Muž
Stav:
Offline

Re: Při startu se automaticky spouští cmd*

Příspěvekod Žbeky » 24 črc 2011 20:31

Otevřit ten bat přes poznámkový blok a dej sem jeho obsah
V SZ řeším jen záležitosti týkající se fóra. Na prosby a žádosti o technickou podporu nereaguji. Díky za pochopení.

HiJackThis + návod - HW Monitor - Jak označit příspěvek za vyřešený - Pravidla fóra

OndrK
nováček
Příspěvky: 35
Registrován: červenec 11
Bydliště: Plzeň
Pohlaví: Muž
Stav:
Offline

Re: Při startu se automaticky spouští cmd*

Příspěvekod OndrK » 24 črc 2011 20:36

Jak ho otevru v poznamokovem bloku?? Ve vyberu se mi neobevilo Otevřít v programu

Uživatelský avatar
Žbeky
Moderátor
Guru Level 13
Guru Level 13
Příspěvky: 22288
Registrován: květen 08
Bydliště: Vsetín - Pardubice
Pohlaví: Muž
Stav:
Offline

Re: Při startu se automaticky spouští cmd*

Příspěvekod Žbeky » 24 črc 2011 20:38

Klikneš na to pravým, otveřít v programu... a tam vybereš poznámkový blok
Nebo otevřeš poznámkový blok - Soubor -> otevřít a vybereš ten bat
V SZ řeším jen záležitosti týkající se fóra. Na prosby a žádosti o technickou podporu nereaguji. Díky za pochopení.

HiJackThis + návod - HW Monitor - Jak označit příspěvek za vyřešený - Pravidla fóra


Zpět na “Viry, antiviry, firewally…”

Kdo je online

Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 0 hostů