svchost.exe - proc. na 100%

[tre-SKA]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:16:03, on 14. 8. 2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PDF\pdfSaver\pdfSaver3.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Spravca\My Documents\Windrop\eggdrop.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Documents and Settings\Spravca\My Documents\Miranda IM\miranda32.exe
C:\BriLAN NMS_52\Bnms.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.fns.uniba.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [RAM Idle Professional] C:\Program Files\RAM Idle LE\RAM_XP.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [rpbrowserrecordplugin.dll OCX] regsvr32.exe /s "C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\PDF\pdfSaver\pdfSaver3.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\RunOnce: [MPlayer2_FixUp] C:\WINDOWS\inf\unregmp2.exe /Fixups
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Program Files\Opera 10 Beta\program\plugins\NPSWF32_FlashUtil.exe -p
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-1292428093-688789844-682003330-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-1292428093-688789844-682003330-1003\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe (User '?')
O4 - HKUS\S-1-5-21-1292428093-688789844-682003330-1003\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" (User '?')
O4 - HKUS\S-1-5-21-1292428093-688789844-682003330-1003\..\RunOnce: [MPlayer2_FixUp] C:\WINDOWS\inf\unregmp2.exe /Fixups (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Vytvořit mobilní oblíbenou položku… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{DC85CB4D-B6DA-4C24-97CB-84702C2B6694}: NameServer = 158.195.40.1,147.213.1.1
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

--
End of file - 6232 bytes

[Reklama]

[tre-SKA]

ComboFix 09-08-10.06 - Spravca 2009-08-14 9:27.2.1 - NTFSx86
Running from: c:\documents and settings\Spravca\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-07-14 to 2009-08-14 )))))))))))))))))))))))))))))))
.

2009-08-14 07:18 . 2008-04-14 00:12 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-08-12 08:14 . 2009-08-12 09:50 -------- d-----w- C:\downloads
2009-08-12 08:14 . 2009-08-12 08:14 -------- d-----w- c:\documents and settings\Spravca\Application Data\FMZilla
2009-08-12 08:14 . 2009-08-12 10:18 -------- d-----w- c:\program files\Free Music Zilla
2009-08-11 10:39 . 2009-08-11 10:38 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-08-11 10:38 . 2009-08-11 10:38 -------- d-----w- c:\program files\Java
2009-08-11 10:38 . 2009-08-11 10:38 152576 ----a-w- c:\documents and settings\Spravca\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-07 09:25 . 2009-08-07 09:25 -------- d-----w- c:\program files\CCleaner
2009-08-04 10:57 . 2009-08-04 10:57 -------- d-----w- c:\windows\ASTULogTemp
2009-08-03 09:12 . 2009-08-03 09:12 -------- d-----w- c:\program files\MSBuild
2009-08-03 09:12 . 2009-08-03 09:12 83736 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-08-03 08:52 . 2009-08-03 08:52 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-03 08:51 . 2009-08-03 08:51 -------- d-----w- c:\program files\Reference Assemblies
2009-08-03 08:50 . 2006-06-29 11:07 14048 ------w- c:\windows\system32\spmsg2.dll
2009-07-23 11:37 . 2008-04-14 00:12 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-07-23 11:33 . 2009-07-23 11:33 -------- d-----w- c:\program files\Windows Media Connect 2
2009-07-23 11:29 . 2009-07-23 11:31 -------- d-----w- c:\windows\system32\drivers\UMDF
2009-07-23 11:29 . 2009-07-23 11:29 -------- d-----w- c:\windows\system32\LogFiles
2009-07-23 07:39 . 2009-07-23 07:39 -------- d-----w- c:\documents and settings\Spravca\Local Settings\Application Data\Opera
2009-07-23 07:39 . 2009-08-14 07:02 -------- d-----w- c:\program files\Opera 10 Beta
2009-07-22 11:23 . 2009-07-22 11:23 -------- d-----w- c:\documents and settings\Spravca\Application Data\dvdcss
2009-07-22 11:23 . 2009-08-12 08:49 -------- d-----w- c:\documents and settings\Spravca\Application Data\vlc
2009-07-22 11:21 . 2009-07-22 11:21 -------- d-----w- c:\program files\VideoLAN
2009-07-21 08:11 . 2009-07-21 08:11 -------- d-----w- c:\program files\Common Files\xing shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-14 07:23 . 2009-03-26 08:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-14 07:22 . 2009-04-17 10:19 3942047 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-08-07 09:31 . 2009-03-20 08:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-04 07:38 . 2007-04-17 14:14 24216 ----a-w- c:\documents and settings\Spravca\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-03 12:16 . 2009-04-06 10:35 -------- d-----w- c:\documents and settings\Spravca\Application Data\FileZilla
2009-08-03 11:36 . 2009-03-26 08:52 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 11:36 . 2009-03-26 08:52 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-03 08:00 . 2007-04-19 13:48 -------- d-----w- c:\program files\Microsoft ActiveSync
2009-07-21 08:10 . 2009-05-22 07:44 -------- d-----w- c:\program files\Common Files\Real
2009-06-18 07:51 . 2009-06-18 07:51 390664 ----a-w- c:\documents and settings\Spravca\Application Data\Real\RealPlayer\Update\realplayer11gold.exe
2009-06-17 08:07 . 2009-06-17 08:04 -------- d-----w- c:\program files\Ashampoo Burning Studio 9
2009-06-17 08:07 . 2009-05-04 11:51 -------- d-----w- c:\documents and settings\Spravca\Application Data\Ashampoo
2009-06-11 07:17 . 2009-06-11 07:17 1878984 ----a-w- c:\documents and settings\Spravca\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
2009-05-22 07:44 . 2003-03-17 21:00 499712 ----a-w- c:\windows\system32\msvcp71.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pdfSaver3"="c:\program files\PDF\pdfSaver\pdfSaver3.exe" [2004-05-19 385024]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Rainlendar2"="c:\program files\Rainlendar2\Rainlendar2.exe" [2008-08-24 4067328]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2007-04-17 949376]
"RAM Idle Professional"="c:\program files\RAM Idle LE\RAM_XP.exe" [2006-01-17 135168]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-21 198160]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-11 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Spravca\\My Documents\\Windrop\\eggdrop.exe"=
"c:\\Documents and Settings\\Spravca\\My Documents\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\Free Music Zilla\\FMZilla.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R2 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [2007-08-10 26488]
S1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2007-04-17 15424]


--- Other Services/Drivers In Memory ---

*NewlyCreated* - CLR_OPTIMIZATION_V2.0.50727_32
*NewlyCreated* - FONTCACHE3.0.0.0
*NewlyCreated* - HTTPFILTER
*NewlyCreated* - JAVAQUICKSTARTERSERVICE
*NewlyCreated* - UPNPHOST
*NewlyCreated* - WMIAPSRV

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
Contents of the 'Scheduled Tasks' folder

2009-05-15 c:\windows\Tasks\eggdrop.job
- c:\documents and settings\Spravca\My Documents\Windrop\eggdrop.exe [2009-02-17 23:52]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-pdfSaver3 - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.fns.uniba.sk/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
TCP: {DC85CB4D-B6DA-4C24-97CB-84702C2B6694} = 158.195.40.1,147.213.1.1
FF - ProfilePath - c:\documents and settings\Spravca\Application Data\Mozilla\Firefox\Profiles\ucu8kt90.default\
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npdsplay.dll
FF - plugin: c:\program files\Opera 10 Beta\program\plugins\NPSWF32.dll
FF - plugin: c:\program files\Opera 10 Beta\program\plugins\npwmsdrm.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-14 09:33
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(712)
c:\windows\system32\imon.dll
c:\program files\Eset\pr_imon.dll

- - - - - - - > 'explorer.exe'(5436)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-08-14 9:35
ComboFix-quarantined-files.txt 2009-08-14 07:35

Pre-Run: 7,550,533,632 bytes free
Post-Run: 7,522,566,144 bytes free

142 --- E O F --- 2009-03-17 07:28

[Damned]

Pokud vím, tak v sekci HijackThis, chceme první log z HijackThis. Přečetl jsi pořádně upozornění před spuštěním COmboFixu? Autor tam totiž píše : Používejte pouze pod dohledem zkušeného odborníka.
Použil jsi, jsi tedy zkušený odborník, tak naco mi sem dáváš log z ComboFixu? Teď když budeš náhodou muset formátovat a ztratíš tak svá data, budeš plakat jako želva a nadávat na pc-help, jaký jsme tu neumětelové.
Budeš všem vyprávět, že ten somár si vlastně ty?

[tre-SKA]

no ja som to myslel v dobrom... :( a chcel som vam ulachcit pracu

[Damned]

Pokud u auta začneš měnit kolo tím, že upálíš šrouby na kole, tak to je jaká pomoc?

Log z HJT.