neustálé a samovolné restarty

[sunday]

Dobrý den,notebook cca každou hodinu samovolně restartuje.Předem děkuji za pomoc. Michal

Logfile of random's system information tool 1.09 (written by random/random)
Run by Roman Haidaš at 2012-02-22 11:56:55
Microsoft Windows XP Home Edition Service Pack 3
System drive D: has 16 GB (64%) free of 25 GB
Total RAM: 1014 MB (49% free)

HijackThis download failed

======Scheduled tasks folder======

D:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - D:\PROGRA~1\AVASTS~1\Avast\aswWebRepIE.dll [2011-09-06 806456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - D:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-02-12 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-02-12 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - D:\PROGRA~1\AVASTS~1\Avast\aswWebRepIE.dll [2011-09-06 806456]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"=D:\WINDOWS\system32\igfxtray.exe [2006-02-07 94208]
"igfxhkcmd"=D:\WINDOWS\system32\hkcmd.exe [2006-02-07 77824]
"igfxpers"=D:\WINDOWS\system32\igfxpers.exe [2006-02-07 118784]
"High Definition Audio Property Page Shortcut"=D:\WINDOWS\system32\CHDAudPropShortcut.exe [2006-01-05 61952]
"SynTPEnh"=D:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-01-13 761946]
"OdTray.exe"=D:\Program Files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\OdTray.exe [2005-05-18 1015871]
"BluetoothAuthenticationAgent"=bthprops.cpl,,BluetoothAuthenticationAgent []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=D:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"MSMSGS"=D:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

D:\Documents and Settings\Roman Haidaš\Nabídka Start\Programy\Po spuštění
OpenOffice.org 3.3.lnk - D:\Program Files\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
D:\WINDOWS\system32\igfxdev.dll [2006-02-07 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\OdysseyClient]
D:\WINDOWS\system32\odyEvent.dll [2010-06-12 106496]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\Program Files\Graphisoft\ArchiCAD 11\ArchiCAD.exe"="D:\Program Files\Graphisoft\ArchiCAD 11\ArchiCAD.exe:*:Enabled:ArchiCAD 11.0.0 Component"
"D:\Program Files\WIBUKEY\Server\WkSvW32.exe"="D:\Program Files\WIBUKEY\Server\WkSvW32.exe:*:Enabled:WIBU-KEY Network Server"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=D:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=D:\WINDOWS\system32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======List of files/folders created in the last 1 month======

2012-02-22 11:56:58 ----D---- D:\Program Files\trend micro
2012-02-22 11:56:55 ----D---- D:\rsit
2012-01-27 10:56:52 ----D---- D:\Documents and Settings\Roman Haidaš\Data aplikací\OpenOffice.org
2012-01-27 10:55:23 ----D---- D:\Program Files\OpenOffice.org 3
2012-01-27 10:52:28 ----A---- D:\Program Files\OOo_3.3.0_Win_x86_install_cs.exe

======List of files/folders modified in the last 1 month======

2012-02-22 11:56:58 ----RD---- D:\Program Files
2012-02-22 11:56:36 ----D---- D:\WINDOWS\Prefetch
2012-02-22 11:55:37 ----D---- D:\WINDOWS\Temp
2012-02-22 10:04:23 ----D---- D:\WINDOWS
2012-02-21 13:34:00 ----A---- D:\WINDOWS\SchedLgU.Txt
2012-02-20 10:54:00 ----D---- D:\WINDOWS\system32
2012-02-20 10:38:40 ----D---- D:\WINDOWS\Minidump
2012-01-29 14:11:34 ----D---- D:\WINDOWS\system32\CatRoot2
2012-01-27 14:54:29 ----SHD---- D:\WINDOWS\Installer
2012-01-27 14:54:09 ----D---- D:\Config.Msi
2012-01-27 10:56:06 ----RSD---- D:\WINDOWS\assembly
2012-01-27 10:55:35 ----D---- D:\WINDOWS\Fonts
2012-01-27 10:54:36 ----D---- D:\WINDOWS\WinSxS

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; D:\WINDOWS\system32\DRIVERS\iaStor.sys [2005-10-12 874240]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI; D:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R1 Aavmker4;avast! Asynchronous Virus Monitor; D:\WINDOWS\system32\drivers\Aavmker4.sys [2011-09-06 30808]
R1 aswRdr;aswRdr; D:\WINDOWS\system32\drivers\aswRdr.sys [2011-09-06 34392]
R1 aswSnx;aswSnx; D:\WINDOWS\system32\drivers\aswSnx.sys [2011-09-06 442200]
R1 aswSP;aswSP; D:\WINDOWS\system32\drivers\aswSP.sys [2011-09-06 320856]
R1 aswTdi;avast! Network Shield Support; D:\WINDOWS\system32\drivers\aswTdi.sys [2011-09-06 52568]
R1 eusk2par;Aladdin SmartKey Parallel Driver; \??\D:\WINDOWS\system32\Drivers\eusk2par.sys []
R1 intelppm;Řadič procesoru Intel; D:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; D:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-18 12032]
R2 aswMon2;aswMon2; D:\WINDOWS\system32\drivers\aswMon2.sys [2011-09-06 110552]
R2 mdmxsdk;mdmxsdk; D:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2005-10-05 12544]
R3 Arp1394;Protokol 1394 ARP Client; D:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 BthEnum;Služba Bluetooth Enumerator; D:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-13 17024]
R3 BTHMODEM;Ovladač komunikace modemu Bluetooth; D:\WINDOWS\system32\DRIVERS\bthmodem.sys [2008-04-13 37888]
R3 BthPan;Bluetooth Device (Personal Area Network); D:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-13 101120]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; D:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-13 18944]
R3 E100B;Intel(R) PRO Network Connection Driver; D:\WINDOWS\system32\DRIVERS\e100b325.sys [2005-03-03 157696]
R3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; D:\WINDOWS\system32\drivers\CHDAud.sys [2006-01-05 561664]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; D:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; D:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 HSF_DPV;HSF_DPV; D:\WINDOWS\system32\DRIVERS\HSX_DPV.sys [2006-01-11 935424]
R3 HSXHWAZL;HSXHWAZL; D:\WINDOWS\system32\DRIVERS\HSXHWAZL.sys [2006-01-11 194048]
R3 ialm;ialm; D:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2006-02-07 1399615]
R3 mouhid;Ovladač myši standardu HID; D:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-18 12160]
R3 NETw3x32;Ovladač adaptéru Intel(R) PRO/Wireless 3945ABG pro Windows XP 32 Bit; D:\WINDOWS\system32\DRIVERS\NETw3x32.sys [2006-09-27 1709696]
R3 NIC1394;1394 Net Driver; D:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 OdysseyIM4;Odyssey Network Agent Miniport; D:\WINDOWS\system32\DRIVERS\odysseyIM4.sys [2005-05-18 173056]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); D:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-13 59136]
R3 rimmptsk;rimmptsk; D:\WINDOWS\system32\DRIVERS\rimmptsk.sys [2005-09-17 28672]
R3 rimsptsk;rimsptsk; D:\WINDOWS\system32\DRIVERS\rimsptsk.sys [2005-09-14 50560]
R3 rismxdp;Ricoh xD-Picture Card Driver; D:\WINDOWS\system32\DRIVERS\rixdptsk.sys [2005-09-30 310016]
R3 sdbus;sdbus; D:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
R3 SynTP;Synaptics TouchPad Driver; D:\WINDOWS\system32\DRIVERS\SynTP.sys [2006-01-13 191936]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; D:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 winachsf;winachsf; D:\WINDOWS\system32\DRIVERS\HSX_CNXT.sys [2006-01-11 671232]
S1 kbdhid;Ovladač klávesnice standardu HID; D:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
S2 aswFsBlk;aswFsBlk; aswFsBlk.sys []
S2 RapidPortM2;RapidPortM2; \??\D:\WINDOWS\system32\Drivers\CAPM2LP.SYS []
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication; D:\WINDOWS\system32\DRIVERS\adusbser.sys []
S3 BTHPORT;Ovladač portu Bluetooth; D:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-14 272128]
S3 catchme;catchme; \??\D:\DOCUME~1\ROMANH~1\LOCALS~1\Temp\catchme.sys []
S3 sffdisk;Ovladač třídy úložiště SFF; D:\WINDOWS\system32\DRIVERS\sffdisk.sys [2008-04-13 11904]
S3 sffp_sd;Ovladač protokolu úložiště SFF pro paměť sběrnici SDBus; D:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2008-04-13 11008]
S3 usbccgp;Obecný nadřazený ovladač Microsoft USB; D:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Třída USB Printer; D:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Ovladač skeneru USB; D:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; D:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; D:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-09-06 44768]
R2 BthServ;Bluetooth Support Service; D:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; D:\Program Files\Java\jre6\bin\jqs.exe [2011-02-12 153376]
R2 odClientService;Odyssey Client for Fujitsu Siemens Computers; D:\Program Files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\odClientService.exe [2005-05-18 208896]
S3 aspnet_state;ASP.NET State Service; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; D:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 GDGLNJWLCTHNH;GDGLNJWLCTHNH; D:\DOCUME~1\ROMANH~1\LOCALS~1\Temp\GDGLNJWLCTHNH.exe []
S3 idsvc;Windows CardSpace; D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 LULHYD;LULHYD; D:\DOCUME~1\ROMANH~1\LOCALS~1\Temp\LULHYD.exe []
S3 TMPX;TMPX; D:\DOCUME~1\ROMANH~1\LOCALS~1\Temp\TMPX.exe []
S3 XNSXFV;XNSXFV; D:\DOCUME~1\ROMANH~1\LOCALS~1\Temp\XNSXFV.exe []
S3 YW;YW; D:\DOCUME~1\ROMANH~1\LOCALS~1\Temp\YW.exe []
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[chodnik74]

Dobrý den

Jděte do složky D:\Windows\Minidump, pokud zde najdete soubory,tak je zabalte( třeba programem winrar) a nahrajte na http://www.leteckaposta.cz , sem mi vložte odkaz na stažení

[vyosek]

Zdravim a pekny den preji

Ja myslim, ze to prvne nejdrive odblesime a pak pripadne mrknem na ovladace a chyby HW

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

[sunday]

Dobrý den,zatím moc děkuji a přikládám log: z ComboFixu

ComboFix 12-02-22.01 - Roman Haidaš 23.02.2012 14:36:31.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1014.513 [GMT 1:00]
Spuštěný z: d:\documents and settings\Roman Haidaš\Plocha\ComboFix.exe
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
d:\documents and settings\KD\cab.dll
d:\documents and settings\KD\d3.dll
d:\documents and settings\KD\dv.dll
d:\documents and settings\KD\gl.dll
d:\documents and settings\KD\kd.exe
d:\documents and settings\KD\kd_app.exe
d:\documents and settings\KD\ok.dll
d:\documents and settings\KD\ord_sch.dll
d:\documents and settings\KD\ord_std.dll
d:\documents and settings\KD\ord_tac.dll
d:\documents and settings\KD\TeamViewerQS.exe
d:\documents and settings\KD\vc4_jpeg.dll
d:\documents and settings\KD\vc4_tiff.dll
d:\documents and settings\KD\vc4_zlib.dll
d:\documents and settings\KD\wd32.wll
d:\windows\system32\drivers\etc\hosts.ics
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-01-23 do 2012-02-23 )))))))))))))))))))))))))))))))
.
.
2012-02-22 10:56 . 2012-02-22 10:57 -------- d-----w- d:\program files\trend micro
2012-02-22 10:56 . 2012-02-22 10:57 -------- d-----w- D:\rsit
2012-01-27 09:56 . 2012-01-27 09:56 -------- d-----w- d:\documents and settings\Roman Haidaš\Data aplikací\OpenOffice.org
2012-01-27 09:55 . 2012-01-27 09:55 -------- d-----w- d:\program files\OpenOffice.org 3
2012-01-27 09:52 . 2012-01-27 09:52 135681640 ----a-w- d:\program files\OOo_3.3.0_Win_x86_install_cs.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-23 11:28 . 2011-10-07 08:45 123191 ----a-w- d:\program files\setup_av_free.exe
2011-09-20 14:34 . 2011-09-20 14:34 935175 ----a-w- d:\program files\RSITx64.exe
2011-09-20 11:44 . 2011-09-20 11:44 3480352 ----a-w- d:\program files\ccsetup310.exe
2011-09-20 10:19 . 2011-09-20 10:19 190826 ----a-w- d:\program files\Avg-Anti-Rootkit-Free_1.1.0.42.exe
2011-06-18 21:05 . 2011-06-18 21:05 53609216 ----a-w- d:\program files\ExcelViewer.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="d:\windows\system32\igfxtray.exe" [2006-02-07 94208]
"igfxhkcmd"="d:\windows\system32\hkcmd.exe" [2006-02-07 77824]
"igfxpers"="d:\windows\system32\igfxpers.exe" [2006-02-07 118784]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-01-05 61952]
"SynTPEnh"="d:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-01-13 761946]
"OdTray.exe"="d:\program files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\OdTray.exe" [2005-05-18 1015871]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="d:\windows\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe" [2010-06-12 231888]
.
d:\documents and settings\Roman Haidaš\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.3.lnk - d:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OdysseyClient]
2010-06-12 19:21 106496 ----a-w- d:\windows\system32\odyEvent.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Graphisoft\\ArchiCAD 11\\ArchiCAD.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R1 aswSnx;aswSnx;d:\windows\system32\drivers\aswSnx.sys [7.10.2011 9:47 442200]
R1 aswSP;aswSP;d:\windows\system32\drivers\aswSP.sys [7.10.2011 9:47 320856]
R1 eusk2par;Aladdin SmartKey Parallel Driver;d:\windows\system32\drivers\eusk2par.sys [14.2.2011 8:02 25680]
S2 aswFsBlk;aswFsBlk;aswFsBlk.sys --> aswFsBlk.sys [?]
S2 RapidPortM2;RapidPortM2;d:\windows\system32\drivers\CAPM2LP.SYS [13.6.2010 9:18 23232]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication;d:\windows\system32\DRIVERS\adusbser.sys --> d:\windows\system32\DRIVERS\adusbser.sys [?]
S3 GDGLNJWLCTHNH;GDGLNJWLCTHNH;d:\docume~1\ROMANH~1\LOCALS~1\Temp\GDGLNJWLCTHNH.exe --> d:\docume~1\ROMANH~1\LOCALS~1\Temp\GDGLNJWLCTHNH.exe [?]
S3 LULHYD;LULHYD;d:\docume~1\ROMANH~1\LOCALS~1\Temp\LULHYD.exe --> d:\docume~1\ROMANH~1\LOCALS~1\Temp\LULHYD.exe [?]
S3 TMPX;TMPX;d:\docume~1\ROMANH~1\LOCALS~1\Temp\TMPX.exe --> d:\docume~1\ROMANH~1\LOCALS~1\Temp\TMPX.exe [?]
S3 XNSXFV;XNSXFV;d:\docume~1\ROMANH~1\LOCALS~1\Temp\XNSXFV.exe --> d:\docume~1\ROMANH~1\LOCALS~1\Temp\XNSXFV.exe [?]
S3 YW;YW;d:\docume~1\ROMANH~1\LOCALS~1\Temp\YW.exe --> d:\docume~1\ROMANH~1\LOCALS~1\Temp\YW.exe [?]
.
Obsah adresáře 'Naplánované úlohy'
.
2012-01-27 d:\windows\Tasks\AppleSoftwareUpdate.job
- d:\program files\Apple Software Update\SoftwareUpdate.exe [2006-08-29 13:21]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Settings,ProxyServer = http=127.0.0.1:6522
uInternet Settings,ProxyOverride = <local>
TCP: DhcpNameServer = 192.168.0.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-02-23 14:45
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
d:\program files\Internet Explorer\iexplore.exe [3988] 0x84F3B020
d:\program files\Internet Explorer\iexplore.exe [2852] 0x84AEA9F8
d:\program files\Internet Explorer\iexplore.exe [2604] 0x84C577A8
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600
.
CreateFile("\\.\PHYSICALDRIVE0"): Proces nemá přístup k souboru, neboť jej právě využívá jiný proces.
device: opened successfully
user: error reading MBR
kernel: MBR read successfully
user != kernel MBR !!!
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3f,41,3a,63,3b,ec,08,4b,b5,44,00,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3f,41,3a,63,3b,ec,08,4b,b5,44,00,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1956)
d:\windows\system32\odyEvent.dll
d:\program files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\odLogin.dll
d:\windows\system32\msi.dll
.
Celkový čas: 2012-02-23 14:48:16
ComboFix-quarantined-files.txt 2012-02-23 13:48
ComboFix2.txt 2011-10-06 10:15
.
Před spuštěním: Volných bajtů: 17 262 653 440
Po spuštění: Volných bajtů: 17 615 163 392
.
- - End Of File - - F41CB924221792D3C205641F54F67EA2

[vyosek]

Tuhle slozku d:\documents and settings\KD jste znal

[sunday]

Ano,měl by to být kitchendraw,grafický program na tvorbu kuchyní.

[vyosek]

Fajn, obnovime...nahlasim kolegovi sUBsovi u nej na TSF foru jako falesnou detekci

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  DeQuarantineB::
  d:\documents and settings\KD
  
  Ignore::
  d:\documents and settings\KD
  
  Registry::
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
  "CTFMON.EXE"=-
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
  "FlashPlayerUpdate"=-
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "AntiVirusOverride"=dword:00000000
  "FirewallOverride"=dword:00000000
  
  Collect::
  d:\docume~1\ROMANH~1\LOCALS~1\Temp\GDGLNJWLCTHNH.exe
  d:\docume~1\ROMANH~1\LOCALS~1\Temp\LULHYD.exe
  d:\docume~1\ROMANH~1\LOCALS~1\Temp\TMPX.exe
  d:\docume~1\ROMANH~1\LOCALS~1\Temp\XNSXFV.exe
  d:\docume~1\ROMANH~1\LOCALS~1\Temp\YW.exe
  
  Driver::
  GDGLNJWLCTHNH
  LULHYD
  TMPX
  XNSXFV
  YW
  
  File::
  d:\windows\Tasks\AppleSoftwareUpdate.job
  
  RegLock::
  [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
  
  ClearJavaCache::
  
  AtJob::
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

[sunday]

tak tady to je,díky

ComboFix 12-02-22.01 - Roman Haidaš 23.02.2012 18:24:07.3.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1014.468 [GMT 1:00]
Spuštěný z: d:\documents and settings\Roman HaidaÜ\Plocha\ComboFix.exe
Použité ovládací přepínače :: d:\documents and settings\Roman HaidaÜ\Plocha\CFScript.txt
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-01-23 do 2012-02-23 )))))))))))))))))))))))))))))))
.
.
2012-02-22 10:56 . 2012-02-22 10:57 -------- d-----w- d:\program files\trend micro
2012-02-22 10:56 . 2012-02-22 10:57 -------- d-----w- D:\rsit
2012-01-27 09:56 . 2012-01-27 09:56 -------- d-----w- d:\documents and settings\Roman Haidaš\Data aplikací\OpenOffice.org
2012-01-27 09:55 . 2012-01-27 09:55 -------- d-----w- d:\program files\OpenOffice.org 3
2012-01-27 09:52 . 2012-01-27 09:52 135681640 ----a-w- d:\program files\OOo_3.3.0_Win_x86_install_cs.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-20 14:34 . 2011-09-20 14:34 935175 ----a-w- d:\program files\RSITx64.exe
2011-09-20 11:44 . 2011-09-20 11:44 3480352 ----a-w- d:\program files\ccsetup310.exe
2011-09-20 10:19 . 2011-09-20 10:19 190826 ----a-w- d:\program files\Avg-Anti-Rootkit-Free_1.1.0.42.exe
2011-06-18 21:05 . 2011-06-18 21:05 53609216 ----a-w- d:\program files\ExcelViewer.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="d:\windows\system32\igfxtray.exe" [2006-02-07 94208]
"igfxhkcmd"="d:\windows\system32\hkcmd.exe" [2006-02-07 77824]
"igfxpers"="d:\windows\system32\igfxpers.exe" [2006-02-07 118784]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-01-05 61952]
"SynTPEnh"="d:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-01-13 761946]
"OdTray.exe"="d:\program files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\OdTray.exe" [2005-05-18 1015871]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="d:\windows\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe" [2010-06-12 231888]
.
d:\documents and settings\Roman Haidaš\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.3.lnk - d:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OdysseyClient]
2010-06-12 19:21 106496 ----a-w- d:\windows\system32\odyEvent.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Graphisoft\\ArchiCAD 11\\ArchiCAD.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R1 aswSnx;aswSnx;d:\windows\system32\drivers\aswSnx.sys [7.10.2011 9:47 442200]
R1 aswSP;aswSP;d:\windows\system32\drivers\aswSP.sys [7.10.2011 9:47 320856]
R1 eusk2par;Aladdin SmartKey Parallel Driver;d:\windows\system32\drivers\eusk2par.sys [14.2.2011 8:02 25680]
S2 aswFsBlk;aswFsBlk;aswFsBlk.sys --> aswFsBlk.sys [?]
S2 RapidPortM2;RapidPortM2;d:\windows\system32\drivers\CAPM2LP.SYS [13.6.2010 9:18 23232]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication;d:\windows\system32\DRIVERS\adusbser.sys --> d:\windows\system32\DRIVERS\adusbser.sys [?]
S3 GDGLNJWLCTHNH;GDGLNJWLCTHNH;d:\docume~1\ROMANH~1\LOCALS~1\Temp\GDGLNJWLCTHNH.exe --> d:\docume~1\ROMANH~1\LOCALS~1\Temp\GDGLNJWLCTHNH.exe [?]
S3 LULHYD;LULHYD;d:\docume~1\ROMANH~1\LOCALS~1\Temp\LULHYD.exe --> d:\docume~1\ROMANH~1\LOCALS~1\Temp\LULHYD.exe [?]
S3 TMPX;TMPX;d:\docume~1\ROMANH~1\LOCALS~1\Temp\TMPX.exe --> d:\docume~1\ROMANH~1\LOCALS~1\Temp\TMPX.exe [?]
S3 XNSXFV;XNSXFV;d:\docume~1\ROMANH~1\LOCALS~1\Temp\XNSXFV.exe --> d:\docume~1\ROMANH~1\LOCALS~1\Temp\XNSXFV.exe [?]
S3 YW;YW;d:\docume~1\ROMANH~1\LOCALS~1\Temp\YW.exe --> d:\docume~1\ROMANH~1\LOCALS~1\Temp\YW.exe [?]
.
Obsah adresáře 'Naplánované úlohy'
.
2012-01-27 d:\windows\Tasks\AppleSoftwareUpdate.job
- d:\program files\Apple Software Update\SoftwareUpdate.exe [2006-08-29 13:21]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Settings,ProxyServer = http=127.0.0.1:6522
uInternet Settings,ProxyOverride = <local>
TCP: DhcpNameServer = 192.168.0.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-02-23 18:31
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
d:\program files\Internet Explorer\iexplore.exe [3436] 0x84B6F550
d:\program files\Internet Explorer\iexplore.exe [3216] 0x85008020
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600
.
CreateFile("\\.\PHYSICALDRIVE0"): Proces nemá přístup k souboru, neboť jej právě využívá jiný proces.
device: opened successfully
user: error reading MBR
kernel: MBR read successfully
user != kernel MBR !!!
.
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3f,41,3a,63,3b,ec,08,4b,b5,44,00,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,3f,41,3a,63,3b,ec,08,4b,b5,44,00,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1948)
d:\windows\system32\odyEvent.dll
d:\program files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\odLogin.dll
d:\windows\system32\msi.dll
.
- - - - - - - > 'explorer.exe'(3112)
d:\windows\system32\msi.dll
d:\windows\system32\webcheck.dll
.
Celkový čas: 2012-02-23 18:33:43
ComboFix-quarantined-files.txt 2012-02-23 17:33
ComboFix2.txt 2012-02-23 13:48
ComboFix3.txt 2011-10-06 10:15
.
Před spuštěním: Volných bajtů: 17 588 011 008
Po spuštění: Volných bajtů: 17 588 834 304
.
- - End Of File - - 6AC3362A4CCCEDCE5777831456383BCE

[vyosek]

Chybka se vloudila, mate diakritiku v nazvu uctu

Presunte ComboFix primo na disk d:\ at neni v zadne slozce, pak tez primo na disku d:\ udelejte znovu skript a aplikujte jej

[sunday]

ještě to vypsalo nějaký log DeQuarantine?

ComboFix 12-02-22.01 - Roman Haidaš 23.02.2012 19:03:13.4.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1014.494 [GMT 1:00]
Spuštěný z: D:\ComboFix.exe
Použité ovládací přepínače :: d:\documents and settings\Roman Haidaš\Plocha\CFScript.txt
.
FILE ::
"d:\windows\Tasks\AppleSoftwareUpdate.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
d:\documents and settings\KD\cab.dll
d:\documents and settings\KD\d3.dll
d:\documents and settings\KD\dv.dll
d:\documents and settings\KD\gl.dll
d:\documents and settings\KD\kd.exe
d:\documents and settings\KD\kd_app.exe
d:\documents and settings\KD\ok.dll
d:\documents and settings\KD\ord_sch.dll
d:\documents and settings\KD\ord_std.dll
d:\documents and settings\KD\ord_tac.dll
d:\documents and settings\KD\TeamViewerQS.exe
d:\documents and settings\KD\vc4_jpeg.dll
d:\documents and settings\KD\vc4_tiff.dll
d:\documents and settings\KD\vc4_zlib.dll
d:\documents and settings\KD\wd32.wll
d:\windows\Tasks\AppleSoftwareUpdate.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_GDGLNJWLCTHNH
-------\Legacy_LULHYD
-------\Legacy_TMPX
-------\Legacy_XNSXFV
-------\Legacy_YW
-------\Service_GDGLNJWLCTHNH
-------\Service_LULHYD
-------\Service_TMPX
-------\Service_XNSXFV
-------\Service_YW
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-01-23 do 2012-02-23 )))))))))))))))))))))))))))))))
.
.
2012-02-22 10:56 . 2012-02-22 10:57 -------- d-----w- d:\program files\trend micro
2012-02-22 10:56 . 2012-02-22 10:57 -------- d-----w- D:\rsit
2012-01-27 09:56 . 2012-01-27 09:56 -------- d-----w- d:\documents and settings\Roman Haidaš\Data aplikací\OpenOffice.org
2012-01-27 09:55 . 2012-01-27 09:55 -------- d-----w- d:\program files\OpenOffice.org 3
2012-01-27 09:52 . 2012-01-27 09:52 135681640 ----a-w- d:\program files\OOo_3.3.0_Win_x86_install_cs.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-20 14:34 . 2011-09-20 14:34 935175 ----a-w- d:\program files\RSITx64.exe
2011-09-20 11:44 . 2011-09-20 11:44 3480352 ----a-w- d:\program files\ccsetup310.exe
2011-09-20 10:19 . 2011-09-20 10:19 190826 ----a-w- d:\program files\Avg-Anti-Rootkit-Free_1.1.0.42.exe
2011-06-18 21:05 . 2011-06-18 21:05 53609216 ----a-w- d:\program files\ExcelViewer.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="d:\windows\system32\igfxtray.exe" [2006-02-07 94208]
"igfxhkcmd"="d:\windows\system32\hkcmd.exe" [2006-02-07 77824]
"igfxpers"="d:\windows\system32\igfxpers.exe" [2006-02-07 118784]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-01-05 61952]
"SynTPEnh"="d:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-01-13 761946]
"OdTray.exe"="d:\program files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\OdTray.exe" [2005-05-18 1015871]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
.
d:\documents and settings\Roman Haidaš\Nabídka Start\Programy\Po spuštění\
OpenOffice.org 3.3.lnk - d:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OdysseyClient]
2010-06-12 19:21 106496 ----a-w- d:\windows\system32\odyEvent.dll
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Graphisoft\\ArchiCAD 11\\ArchiCAD.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R1 aswSnx;aswSnx;d:\windows\system32\drivers\aswSnx.sys [7.10.2011 9:47 442200]
R1 aswSP;aswSP;d:\windows\system32\drivers\aswSP.sys [7.10.2011 9:47 320856]
R1 eusk2par;Aladdin SmartKey Parallel Driver;d:\windows\system32\drivers\eusk2par.sys [14.2.2011 8:02 25680]
S2 aswFsBlk;aswFsBlk;aswFsBlk.sys --> aswFsBlk.sys [?]
S2 RapidPortM2;RapidPortM2;d:\windows\system32\drivers\CAPM2LP.SYS [13.6.2010 9:18 23232]
S3 adusbser;AnyDATA USB Device for Legacy Serial Communication;d:\windows\system32\DRIVERS\adusbser.sys --> d:\windows\system32\DRIVERS\adusbser.sys [?]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Settings,ProxyServer = http=127.0.0.1:6522
uInternet Settings,ProxyOverride = <local>
TCP: DhcpNameServer = 192.168.0.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-02-23 19:11
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
d:\program files\Internet Explorer\iexplore.exe [884] 0x84FCDB30
d:\program files\Internet Explorer\iexplore.exe [3740] 0x84ABD408
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600
.
CreateFile("\\.\PHYSICALDRIVE0"): Proces nemá přístup k souboru, neboť jej právě využívá jiný proces.
device: opened successfully
user: error reading MBR
kernel: MBR read successfully
user != kernel MBR !!!
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1928)
d:\windows\system32\odyEvent.dll
d:\program files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\odLogin.dll
d:\windows\system32\msi.dll
.
- - - - - - - > 'explorer.exe'(2464)
d:\windows\system32\msi.dll
d:\windows\system32\webcheck.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
d:\program files\Fujitsu Siemens Computers\Odyssey Client for Fujitsu Siemens Computers\odClientService.exe
d:\program files\AVAST Software\Avast\AvastSvc.exe
d:\program files\Java\jre6\bin\jqs.exe
d:\windows\system32\wscntfy.exe
d:\windows\system32\CAPM2RSK.EXE
d:\windows\system32\spool\drivers\w32x86\3\CAPM2SWK.EXE
d:\windows\system32\wbem\wmiapsrv.exe
d:\windows\system32\rundll32.exe
d:\program files\OpenOffice.org 3\program\soffice.exe
d:\program files\OpenOffice.org 3\program\soffice.bin
.
**************************************************************************
.
Celkový čas: 2012-02-23 19:16:35 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-02-23 18:16
ComboFix2.txt 2012-02-23 17:33
ComboFix3.txt 2012-02-23 13:48
ComboFix4.txt 2011-10-06 10:15
D:\DeQuarantine.txt
.
Před spuštěním: Volných bajtů: 17 593 712 640
Po spuštění: Volných bajtů: 17 540 620 288
.
- - End Of File - - 2F927BA91D85766A361014320EF691E2

[vyosek]

Mrcha nam jej smazla znovu a to tam byl prikaz at se na nej vykasle

Takze jeste jeden skript pro ComboFix a pak overte, ze slozka je tam kde ma byt - skript i CF musi byt vedle sebe na disku d:\, ted jste mel skript na plose

Kód: Vybrat vše

DeQuarantineB:
d:\documents and settings\KD
Quit::

[sunday]

takže mám udělat nový script se stejným názvem jako předtím,ale s tímto novým obsahem,uložím ho na D/ vedle CF a potom opět vložím do něj? Pochopil jsem to? Děkuji

[vyosek]

Ano, pochopeno presne

[sunday]

ted mi to vypsalo jen toto

D:\Qoobox\Quarantine\d\documents and settings\KD\cab.dll -> D:\documents and settings\KD\cab.dll
D:\Qoobox\Quarantine\d\documents and settings\KD\d3.dll -> D:\documents and settings\KD\d3.dll
D:\Qoobox\Quarantine\d\documents and settings\KD\dv.dll -> D:\documents and settings\KD\dv.dll
D:\Qoobox\Quarantine\d\documents and settings\KD\gl.dll -> D:\documents and settings\KD\gl.dll
D:\Qoobox\Quarantine\d\documents and settings\KD\kd.exe -> D:\documents and settings\KD\kd.exe
D:\Qoobox\Quarantine\d\documents and settings\KD\kd_app.exe -> D:\documents and settings\KD\kd_app.exe
D:\Qoobox\Quarantine\d\documents and settings\KD\ok.dll -> D:\documents and settings\KD\ok.dll
D:\Qoobox\Quarantine\d\documents and settings\KD\ord_sch.dll -> D:\documents and settings\KD\ord_sch.dll
D:\Qoobox\Quarantine\d\documents and settings\KD\ord_std.dll -> D:\documents and settings\KD\ord_std.dll
D:\Qoobox\Quarantine\d\documents and settings\KD\ord_tac.dll -> D:\documents and settings\KD\ord_tac.dll
D:\Qoobox\Quarantine\d\documents and settings\KD\TeamViewerQS.exe -> D:\documents and settings\KD\TeamViewerQS.exe
D:\Qoobox\Quarantine\d\documents and settings\KD\vc4_jpeg.dll -> D:\documents and settings\KD\vc4_jpeg.dll
D:\Qoobox\Quarantine\d\documents and settings\KD\vc4_tiff.dll -> D:\documents and settings\KD\vc4_tiff.dll
D:\Qoobox\Quarantine\d\documents and settings\KD\vc4_zlib.dll -> D:\documents and settings\KD\vc4_zlib.dll
D:\Qoobox\Quarantine\d\documents and settings\KD\wd32.wll -> D:\documents and settings\KD\wd32.wll
15 zkopˇrovaněch soubor…

[vyosek]

Super, programek navracen kde ma byt

Stahnete si TDSSKiller http://support.kaspersky.com/downloads/ ... killer.exe

• Kliknete na volbu Change parametrs
• V obou oknech (Objects to scan i Additional Option) zakliknete vsechny moznosti - ve vsech ctvereccich musi mit fajecka
• Kliknete na OK
• Utilite prikazte, at skenuje - klik na Start Scan
• Po dokonceni skenu se objevi okno, zkontrolujte, zda-li je vsude moznost Skip
• Pokud moznost Skip nebude primarne nastavena, prekliknete ji na Skip
• Pokud mate vsude Skip, kliknete na Continue
• Na disku, kde mate Windows (obvykle c:\) ve tvaru TDSSKiller.nejaka cisilka _log.txt bude log - jeho obsah sem vlozte