Prosím o kontrolu - někdy se restartuje PC

[chodnik74]

Zkuste: http://www.appremover.com/download-appremover

[ultrakb]

Program našel pouze Comodo, které používám. O Sunbeltu ani památky. Existují ještě nějaké jiné aplikace?

[chodnik74]

Jedině firewall znovu nainstalovat a odinstalovat Sunbelt nemá nebo jsem nenašel žádnou jejich utilitu na odinstalování zbytků.

Pokud se nepodaří, tak poprosím kolegu natvrdo vymazat ovladač:

R1 sbhips;Sunbelt HIPS Driver; C:\WINDOWS\system32\drivers\sbhips.sys [2008-06-21 66600]

[ultrakb]

Odinstalovat a znova nainstalovat Comodo? V registrech (regedit) jsem našel ještě nějaké klíče, ty bych mohl asi taky odstranit?? (HKEY_LOCAL_MACHINE-SOFTWARE, HKEY_USERS-.DEFAULT-Software-Sunbelt Software)

[chodnik74]

Bavíme se o Sunbelt, takže nainstalovat a odinstalovat Sunbelt. Nic v registru nedělejte

[ultrakb]

Hotovo, odinstalováno pomocí programu AppRemover.

[chodnik74]

Zkuste nyní pokračovat s Combofixem, jak psal kolega

[ultrakb]

Nepomohlo, opět se objevila modrá obrazovka a vyskočila chybová hláška s tím ovladačem sbhips.sys.

[chodnik74]

Poprosím kolegu o odpal ovladače

[ultrakb]

Díky

[Mc_Murphy]

OK, zkusíme to zatím jemně. Když to nezabere, sáhneme na tvrdší metody.


Takže stáhni utilitu OTM z jednoho z těchto odkazů:

• http://oldtimer.geekstogo.com/OTM.exe
• http://oldtimer.geekstogo.com/OTM.com
• http://oldtimer.geekstogo.com/OTM.scr

Ulož ji na Plochu a dvojklikem spusť.

Do levého okna Paste Instructions for Items to be Moved zkopíruj tento script (pouze zelená písmenka v bílém poli!):

Kód: Vybrat vše

:Commands
[ClearAllRestorePoints]
[ResetHosts]
[Purity]
[EmptyTemp]
[EmptyFlash]

:Services
sbhips

:Files
C:\WINDOWS\system32\drivers\sbhips.sys
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp /s

Nyní klikni na tlačítko [MoveIt!], čímž vše spustíš.
Po restartu mi sem hoď log, který najdeš v C:\_OTM\MovedFiles\

A znova, pokud bude problém, tak ještě jednou, ale v Nouzovém režimu.

[ultrakb]

All processes killed
========== COMMANDS ==========

Restore points cleared and new OTM Restore Point set!
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 62163990 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 321 bytes

User: LocalService
->Temp folder emptied: 2042812 bytes
->Temporary Internet Files folder emptied: 49554 bytes

User: NetworkService
->Temp folder emptied: 4460262 bytes
->Temporary Internet Files folder emptied: 33237 bytes

User: Petr
->Temp folder emptied: 664444 bytes
->Temporary Internet Files folder emptied: 98706 bytes
->FireFox cache emptied: 49317080 bytes
->Flash cache emptied: 41516 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2504 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 76796 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 142159761 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 405069 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 249,00 mb


[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: Petr
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb

========== SERVICES/DRIVERS ==========
Service sbhips stopped successfully!
Service sbhips deleted successfully!
========== FILES ==========
C:\WINDOWS\system32\drivers\sbhips.sys moved successfully.
File/Folder C:\WINDOWS\system32\*.tmp.dll not found.
File/Folder C:\WINDOWS\system32\SET*.tmp not found.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP11.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP181.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1E2.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1E8.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP1FE.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP270.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP2FB.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP322.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP365.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP3B8.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP3BD.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP3D9.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP418.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP44.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP456.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4DF.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP4E6.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP5C.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP5D.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP5F3.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP656.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP7A8.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP7C4.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP7D1.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP8.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP8AB.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP8D0.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP969.tmp folder moved successfully.
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAPA4B.tmp folder moved successfully.
C:\WINDOWS\Installer\MSI4F.tmp moved successfully.
C:\WINDOWS\Installer\{FD8E178D-8B4E-42DA-B434-EFF270329B1C}\upd81.tmp moved successfully.

OTM by OldTimer - Version 3.1.19.0 log created on 06052012_161747

Files moved on Reboot...
C:\WINDOWS\temp\MpCmdRun.log moved successfully.

Registry entries deleted on Reboot...

[Mc_Murphy]

Služba i driver jsou podle logu odpáleny. Zkus ten ComboFix přesně podle návodu, jak jsem Ti psal.

[ultrakb]

ComboFix 12-06-05.01 - Petr 05.06.2012 17:15:33.4.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1013.527 [GMT 2:00]
Spuštěný z: c:\documents and settings\Petr\Plocha\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: COMODO Firewall *Disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
FW: Sunbelt Personal Firewall *Disabled* {82B1150E-9B37-49FC-83EB-D52197D900D0}
SP: COMODO Defense+ *Disabled/Updated* {043803A4-4F86-4ef7-AFC5-F6E02A79969B}
SP: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7094}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\regedit.com
c:\windows\system32\avisynth.dll
c:\windows\system32\devil.dll
c:\windows\system32\taskmgr.com
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2012-05-05 do 2012-06-05 )))))))))))))))))))))))))))))))
.
.
2012-06-05 14:39 . 2012-06-05 14:39 56200 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{78559346-9A17-4A09-A578-8A2752404B26}\offreg.dll
2012-06-05 14:39 . 2012-06-05 14:39 29904 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{78559346-9A17-4A09-A578-8A2752404B26}\MpKslf227b6e9.sys
2012-06-05 14:37 . 2012-05-08 16:40 6737808 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{78559346-9A17-4A09-A578-8A2752404B26}\mpengine.dll
2012-06-05 14:17 . 2012-06-05 14:17 -------- d-----w- C:\_OTM
2012-06-05 11:24 . 2012-05-08 16:40 6737808 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-06-04 17:20 . 2012-06-04 17:20 -------- d-----w- c:\program files\Sunbelt Software
2012-06-02 12:13 . 2012-06-02 12:13 -------- d-----w- c:\documents and settings\Petr\Local Settings\Data aplikací\GHISLER
2012-06-02 11:47 . 2012-06-02 11:47 -------- d-----w- c:\documents and settings\Petr\Data aplikací\GHISLER
2012-06-01 12:35 . 2012-06-01 12:36 -------- d-----w- c:\program files\trend micro
2012-06-01 12:35 . 2012-06-01 12:36 -------- d-----w- C:\rsit
2012-06-01 12:24 . 2012-06-01 12:24 -------- d-----w- c:\documents and settings\Petr\Data aplikací\Pointstone
2012-06-01 12:17 . 2012-06-01 12:17 -------- d-----w- c:\program files\Pointstone
2012-06-01 12:13 . 2012-06-01 12:13 -------- d-----w- c:\documents and settings\Petr\EurekaLog
2012-06-01 11:46 . 2012-06-01 12:17 -------- d-----w- c:\program files\Common Files\Pointstone
2012-05-28 18:26 . 2012-05-28 18:31 -------- d-----w- c:\documents and settings\All Users\Data aplikací\PrevxCSI
2012-05-25 16:33 . 2012-05-25 16:33 -------- d--h--r- c:\documents and settings\Petr\Data aplikací\SecuROM
2012-05-25 13:56 . 2012-05-28 08:28 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Spybot - Search & Destroy
2012-05-16 17:28 . 2012-05-16 17:28 -------- d-----w- c:\program files\Mozilla Maintenance Service
2012-05-16 17:28 . 2012-05-16 17:28 129976 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-05-16 17:28 . 2012-05-16 17:28 157352 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-31 13:22 . 2010-05-04 11:38 602112 ----a-w- c:\windows\system32\crypt32.dll
2012-05-05 08:54 . 2012-05-05 08:55 572928 ----a-w- c:\windows\system32\msvcp90.dll
2012-05-05 08:54 . 2012-05-05 08:54 655872 ----a-w- c:\windows\system32\msvcr90.dll
2012-05-05 08:06 . 2012-03-30 12:53 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-05 08:06 . 2011-05-15 12:46 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-05 08:06 . 2012-03-30 13:06 4126880 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
2012-04-11 13:55 . 2008-04-14 08:06 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-04-11 13:55 . 2010-05-04 11:38 1862272 ----a-w- c:\windows\system32\win32k.sys
2012-04-11 13:55 . 2008-04-14 08:06 2150400 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-20 18:44 . 2011-04-18 11:18 171064 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2012-03-11 21:13 . 2011-06-30 07:38 97760 ----a-w- c:\windows\system32\drivers\inspect.sys
2012-03-11 21:13 . 2011-06-30 07:38 31704 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2012-03-11 21:13 . 2011-06-30 07:38 494968 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2012-03-11 21:13 . 2011-06-30 07:38 18056 ----a-w- c:\windows\system32\drivers\cmderd.sys
2012-03-11 21:13 . 2011-10-27 04:01 33984 ----a-w- c:\windows\system32\cmdcsr.dll
2012-03-11 21:13 . 2011-06-30 07:37 301224 ----a-w- c:\windows\system32\guard32.dll
2012-05-16 17:28 . 2011-03-27 08:10 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-11-16 141336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-11-16 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-11-16 141336]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"RTHDCPL"="RTHDCPL.EXE" [2010-03-12 19521056]
"AzMixerSel"="c:\program files\Realtek\Audio\Drivers\AzMixerSel.exe" [2009-12-11 59936]
"LManager"="c:\program files\Launch Manager\LManager.exe" [2010-04-08 908368]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-05 1692968]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Firewall\COMODO\COMODO Internet Security\cfp.exe" [2012-03-11 6749512]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2011-07-27 434080]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CLPSLS]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Gizmo.lnk]
backup=c:\windows\pss\Gizmo.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GizmoDriveDelegate
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-07-28 23:08 1259376 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2010-04-12 08:40 180224 ----a-w- c:\program files\PowerISO\PWRISOVM.EXE
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [30.6.2011 9:38 494968]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [30.6.2011 9:38 31704]
R1 MpKslf227b6e9;MpKslf227b6e9;c:\documents and settings\All Users\Data aplikací\Microsoft\Microsoft Antimalware\Definition Updates\{78559346-9A17-4A09-A578-8A2752404B26}\MpKslf227b6e9.sys [5.6.2012 16:39 29904]
R2 CLPSLS;COMODO livePCsupport Service;c:\program files\COMODO\COMODO GeekBuddy\CLPSLS.exe [26.5.2011 5:43 154424]
R2 DsiWMIService;Dritek WMI Service;c:\program files\Launch Manager\dsiwmis.exe [4.5.2010 13:39 312400]
R2 SbPF.Launcher;SbPF.Launcher;c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [31.10.2008 7:24 95528]
R2 Updater Service;Updater Service;c:\program files\eMachines\eMachines Updater\UpdaterService.exe [4.5.2010 5:39 243232]
R3 L1c;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [4.5.2010 13:39 60456]
R3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [5.3.2011 18:52 47360]
R3 S6000KNT;S6000KNT_WebCam Driver;c:\windows\system32\drivers\S6000KNT.sys [17.1.2011 17:20 3221120]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\drivers\SbFwIm.sys [14.8.2011 9:47 65576]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.3.2010 13:16 130384]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [31.3.2011 6:42 136176]
S2 SPF4;Sunbelt Personal Firewall 4;c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [31.10.2008 7:24 1365288]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [30.3.2012 14:53 257696]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [4.5.2010 5:22 1691480]
S3 EUCR;EUCR;c:\windows\system32\drivers\EUCR6SK.sys [4.5.2010 5:25 108752]
S3 gupdatem;Služba Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [31.3.2011 6:42 136176]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [16.5.2012 19:28 129976]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [4.5.2010 13:38 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.3.2010 13:16 753504]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MPKSLF227B6E9
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Obsah adresáře 'Naplánované úlohy'
.
2012-06-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 08:06]
.
2012-06-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-03-31 16:55]
.
2012-06-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-03-31 16:55]
.
2012-06-05 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-03-26 15:03]
.
2012-06-05 c:\windows\Tasks\MpIdleTask.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-03-26 15:03]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
uInternet Connection Wizard,ShellNext = "c:\program files\Outlook Express\msimn.exe" //mailurl:mailto:?body=http%3A%2F%2Fwww.stesti.cz%2Fmsg_show.php%3Fid%3D378%26first%3D0&subject=%C4%8Cten%C3%AD%20vzkazu%20%7C%20seznamka%20%C5%A1t%C4%9Bst%C3%AD.cz
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\documents and settings\Petr\Data aplikací\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: WikiKomentáře Google...
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
TCP: Interfaces\{4289970B-8781-46BA-8EFE-292DA39CFA5E}: NameServer = 8.26.56.26,156.154.70.22
TCP: Interfaces\{F29436D6-9FB3-4E02-8819-4C6128E1D037}: NameServer = 8.26.56.26,156.154.70.22
FF - ProfilePath - c:\documents and settings\Petr\Data aplikací\Mozilla\Firefox\Profiles\azc6wgiz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - DVDVideoSoftTB Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-06-05 17:24
Windows 5.1.2600 Service Pack 3 NTFS
.
detected NTDLL code modification:
ZwClose
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'lsass.exe'(784)
c:\windows\system32\MPR.dll
c:\windows\system32\guard32.dll
.
- - - - - - - > 'csrss.exe'(700)
c:\windows\system32\cmdcsr.dll
.
Celkový čas: 2012-06-05 17:29:38
ComboFix-quarantined-files.txt 2012-06-05 15:29
.
Před spuštěním: Volných bajtů: 38 098 378 752
Po spuštění: Volných bajtů: 38 053 851 136
.
- - End Of File - - E82285F6F9F7431190F6E8BC235F5A9B

[Mc_Murphy]

Mno, jsem z Tebe mírně zmaten, protože píšeš, žes všechno odebral, ale v logu ComboFixu pořád vidím dva firewally a dva antispy.

FW: COMODO Firewall *Disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
FW: Sunbelt Personal Firewall *Disabled* {82B1150E-9B37-49FC-83EB-D52197D900D0}
SP: COMODO Defense+ *Disabled/Updated* {043803A4-4F86-4ef7-AFC5-F6E02A79969B}
SP: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7094}

Co vlastně z toho používáš a co už ne? Odinstaloval jsi opravdu vše, co Ti říkal kolega chodnik74 ? Jeden firewall a jeden antispy musí jít pryč kompletně.

Něco mi k tomu napiš a já znovu poprosím kolegu chodnik74, zda-li nemá kromě scriptu, který napíšu nějaký nápad, jak to odpálit, pak budeme pokračovat.