prosím o kontrolu

[marianek]

ahojte borci, prosím o kontrolu, díkec


ComboFix 10-01-25.05 - Marian 2010-01-26 7:56.15.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.1.1029.18.1535.1033 [GMT 1:00]
Spuštěný z: h:\documents and settings\Marian\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100125-2] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: ActiveArmor Firewall *disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

h:\windows\system32\SIntf16.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-12-26 do 2010-01-26 )))))))))))))))))))))))))))))))
.

2010-01-24 17:19 . 2010-01-24 17:19 -------- d-----w- h:\program files\JPEG Resampler

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-26 06:00 . 2007-09-26 05:30 -------- d-----w- h:\program files\Mozilla Thunderbird
2010-01-15 20:47 . 2008-02-21 14:00 -------- d-----w- h:\program files\Burn4Free
2010-01-13 20:52 . 2009-06-27 16:25 -------- d-----w- h:\program files\ICQ6.5
2009-12-31 22:07 . 2009-03-26 17:14 -------- d-----w- h:\program files\Spyware Terminator
2009-12-26 20:52 . 2009-12-26 20:50 -------- d-----w- h:\program files\TuneUp Utilities 2009
2009-12-26 20:50 . 2009-05-21 20:41 603904 ----a-w- h:\windows\system32\TUProgSt.exe
2009-12-26 20:50 . 2009-12-26 20:50 360192 ----a-w- h:\windows\system32\TuneUpDefragService.exe
2009-12-05 21:53 . 2008-06-14 19:58 -------- d-----w- h:\program files\Google
2009-11-24 23:54 . 2009-12-04 22:31 1280480 ----a-w- h:\windows\system32\aswBoot.exe
2009-11-24 23:51 . 2009-12-04 22:31 93424 ----a-w- h:\windows\system32\drivers\aswmon.sys
2009-11-24 23:49 . 2009-12-04 22:31 48560 ----a-w- h:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2009-12-04 22:31 23120 ----a-w- h:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2009-12-04 22:31 27408 ----a-w- h:\windows\system32\drivers\aavmker4.sys
2009-11-24 23:47 . 2009-12-04 22:31 97480 ----a-w- h:\windows\system32\AvastSS.scr
2009-12-23 12:17 . 2008-06-14 19:59 119808 ----a-w- h:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2009-06-14 18:10 . 2009-06-13 10:15 67688 ----a-w- h:\program files\mozilla firefox\components\jar50.dll
2009-06-14 18:10 . 2009-06-13 10:15 54368 ----a-w- h:\program files\mozilla firefox\components\jsd3250.dll
2009-06-14 18:10 . 2009-06-13 10:15 34944 ----a-w- h:\program files\mozilla firefox\components\myspell.dll
2009-06-14 18:10 . 2009-06-13 10:15 46712 ----a-w- h:\program files\mozilla firefox\components\spellchk.dll
2009-06-14 18:10 . 2009-06-13 10:15 172136 ----a-w- h:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((( SnapShot_2009-07-04_06.34.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-26 07:02 . 2010-01-26 07:02 16384 h:\windows\Temp\Perflib_Perfdata_7ec.dat
+ 2010-01-26 06:52 . 2010-01-26 06:52 16384 h:\windows\Temp\Perflib_Perfdata_238.dat
+ 2009-12-26 20:50 . 2008-12-11 12:31 27904 h:\windows\system32\uxtuneup.dll
- 2009-05-21 20:41 . 2008-12-11 11:31 27904 h:\windows\system32\uxtuneup.dll
+ 2006-03-02 12:00 . 2009-10-25 07:25 60760 h:\windows\system32\perfc009.dat
- 2006-03-02 12:00 . 2009-04-15 01:14 60760 h:\windows\system32\perfc009.dat
+ 2006-03-02 12:00 . 2009-10-25 07:25 71746 h:\windows\system32\perfc005.dat
- 2006-03-02 12:00 . 2009-04-15 01:14 71746 h:\windows\system32\perfc005.dat
+ 2009-12-04 22:31 . 2009-09-15 11:56 94160 h:\windows\system32\drivers\aswmon2.sys
+ 2009-12-04 22:31 . 2009-09-15 11:55 20560 h:\windows\system32\drivers\aswFsBlk.sys
- 2008-04-02 14:54 . 2009-02-05 21:07 20560 h:\windows\system32\drivers\aswFsBlk.sys
+ 2008-04-14 03:22 . 2008-04-14 03:22 11325 h:\windows\system32\dllcache\vchnt5.dll
+ 2008-04-14 03:21 . 2008-04-14 03:21 15423 h:\windows\system32\dllcache\ch7xxnt5.dll
+ 2008-04-14 03:21 . 2008-04-14 03:21 17279 h:\windows\system32\dllcache\atv10nt5.dll
+ 2008-04-14 03:21 . 2008-04-14 03:21 25471 h:\windows\system32\dllcache\atv04nt5.dll
+ 2008-04-14 03:21 . 2008-04-14 03:21 11359 h:\windows\system32\dllcache\atv02nt5.dll
+ 2009-12-05 21:35 . 2009-12-05 21:35 25214 h:\windows\Installer\{9074AFC0-CFDA-11DE-B484-005056806466}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74_1.exe
+ 2008-04-14 03:21 . 2008-04-14 03:21 3901 h:\windows\system32\dllcache\siint5.dll
+ 2008-04-14 03:21 . 2008-04-14 03:21 3647 h:\windows\system32\dllcache\adv07nt5.dll
+ 2008-04-14 03:21 . 2008-04-14 03:21 3967 h:\windows\system32\dllcache\adv02nt5.dll
+ 2008-04-14 03:21 . 2008-04-14 03:21 4255 h:\windows\system32\dllcache\adv01nt5.dll
+ 2006-03-02 12:00 . 2009-10-25 07:25 400600 h:\windows\system32\perfh009.dat
- 2006-03-02 12:00 . 2009-04-15 01:14 400600 h:\windows\system32\perfh009.dat
- 2006-03-02 12:00 . 2009-04-15 01:14 398316 h:\windows\system32\perfh005.dat
+ 2006-03-02 12:00 . 2009-10-25 07:25 398316 h:\windows\system32\perfh005.dat
- 2008-04-02 14:54 . 2009-02-05 21:07 114768 h:\windows\system32\drivers\aswSP.sys
+ 2009-12-04 22:31 . 2009-09-15 11:55 114768 h:\windows\system32\drivers\aswSP.sys
+ 2008-01-14 16:35 . 2009-12-04 19:13 249856 h:\windows\system32\config\systemprofile\ntuser.dat
- 2008-01-14 16:35 . 2008-01-14 16:35 249856 h:\windows\system32\config\systemprofile\ntuser.dat
+ 2009-12-26 20:50 . 2009-12-26 20:50 814592 h:\windows\Installer\1c20f9.msi
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="h:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-06-14 171448]
"DAEMON Tools Lite"="h:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"RTHDCPL"="RTHDCPL.EXE" [2006-08-01 16049664]
"FLMOFFICE4DMOUSE"="h:\program files\Trust\MI-4500X WIRELESS OPTICAL MOUSE\Mouse32a.exe" [2007-09-25 370176]
"tsnpstd3"="h:\windows\tsnpstd3.exe" [2005-12-20 94208]
"snpstd3"="h:\windows\vsnpstd3.exe" [2005-09-05 339968]
"AtiPTA"="atiptaxx.exe" [2006-02-22 344064]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 76304]
"StartCCC"="h:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"VirtualCloneDrive"="h:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2006-04-29 94208]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 76304]
"Google Desktop Search"="h:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-12-23 30192]
"GrooveMonitor"="h:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"SpywareTerminator"="h:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2009-03-26 1783808]
"avast!"="h:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="h:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

h:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Logitech Desktop Messenger.lnk - h:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-11-9 67128]
Logitech SetPoint.lnk - h:\program files\Logitech\SetPoint\SetPoint.exe [2008-5-28 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 00:42 72208 ----a-w- h:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="h:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"h:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"h:\\Program Files\\Ubisoft\\Divoké Vlny\\System\\surfsupgame.exe"=
"h:\\Program Files\\Ubisoft\\Lost Via Domus\\Yeti_Final_Win32.exe"=
"h:\\Program Files\\Ubisoft\\Lost Via Domus\\gu.exe"=
"h:\\Program Files\\Ubisoft\\Lost Via Domus\\detection\\Launcher.exe"=
"h:\\totalcmd\\TOTALCMD.EXE"=
"h:\\Program Files\\TmNationsForever\\TmForever.exe"=
"h:\\Program Files\\BitLord\\BitLord.exe"=
"h:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"h:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"h:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"h:\\Program Files\\FlashGet\\flashget.exe"=
"h:\\Program Files\\Skype\\Phone\\Skype.exe"=
"h:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"h:\\Program Files\\ICQ6.5\\ICQ.exe"=

R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);h:\windows\system32\drivers\sfsync03.sys [2005-12-06 35328]
R0 sptd;sptd;h:\windows\system32\drivers\sptd.sys [2007-09-25 717296]
R1 aswSP;avast! Self Protection;h:\windows\system32\drivers\aswSP.sys [2009-12-04 114768]
R1 sp_rsdrv2;Spyware Terminator Driver 2;h:\windows\system32\drivers\sp_rsdrv2.sys [2009-03-26 141312]
R2 aswFsBlk;aswFsBlk;h:\windows\system32\drivers\aswFsBlk.sys [2009-12-04 20560]
R2 ICQ Service;ICQ Service;h:\program files\ICQ6Toolbar\ICQ Service.exe [2009-06-27 222456]
S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;h:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-06-14 30192]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'

2010-01-26 h:\windows\Tasks\1-Click Maintenance.job
- h:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 20:36]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.centrum.cz/skinit/icq/
mStart Page = hxxp://www.aktualne.cz/?ms=ae
uInternet Settings,ProxyOverride = <local>;localhost
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Stáhnout &vše FlashGetem - h:\program files\FlashGet\jc_all.htm
IE: &Stáhnout FlashGetem - h:\program files\FlashGet\jc_link.htm
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Excel - h:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {D73C7F82-B05F-4201-9BD7-9006EDA1B9A9} = 192.168.1.1,212.80.66.7
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - h:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - h:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - h:\documents and settings\Marian\Data aplikací\Mozilla\Firefox\Profiles\ahj2hdvv.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - component: h:\program files\Crawler\Toolbar\firefox\components\xshared.dll
FF - component: h:\program files\Crawler\Toolbar\firefox\components\xsupport.dll
FF - component: h:\program files\Crawler\Toolbar\firefox\components\xwsg.dll
FF - component: h:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: h:\program files\Mozilla Firefox\components\xpinstal.dll

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-26 08:02
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll prosync1.sys sfsync03.sys sfsync02.sys >>UNKNOWN [0x89A531F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf74ebf28
\Driver\ACPI -> ACPI.sys @ 0xf7246cb8
\Driver\atapi -> prosync1.sys @ 0xf798f6c1
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022
ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xf70cabb0
PacketIndicateHandler -> NDIS.sys @ 0xf70b9a0d
SendHandler -> NDIS.sys @ 0xf70cdb40
user & kernel MBR OK

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(1004)
h:\windows\system32\Ati2evxx.dll
h:\program files\common files\logitech\bluetooth\LBTWlgn.dll
h:\program files\common files\logitech\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(2948)
h:\program files\Logitech\SetPoint\lgscroll.dll
h:\program files\Trust\MI-4500X WIRELESS OPTICAL MOUSE\MOUDL32A.DLL
h:\windows\system32\WPDShServiceObj.dll
h:\windows\system32\PortableDeviceTypes.dll
h:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
h:\windows\system32\Ati2evxx.exe
h:\windows\system32\Ati2evxx.exe
h:\program files\Alwil Software\Avast4\aswUpdSv.exe
h:\program files\Alwil Software\Avast4\ashServ.exe
h:\windows\RTHDCPL.EXE
h:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
h:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
h:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
h:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
h:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
h:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
h:\program files\Spyware Terminator\sp_rsser.exe
h:\windows\System32\TUProgSt.exe
h:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
h:\program files\Alwil Software\Avast4\ashMaiSv.exe
h:\program files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Celkový čas: 2010-01-26 08:06:43 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-01-26 07:06
ComboFix2.txt 2009-12-04 22:01
ComboFix3.txt 2009-10-20 17:17
ComboFix4.txt 2009-09-20 06:08
ComboFix5.txt 2010-01-26 06:55

Před spuštěním: Volných bajtů: 69,510,639,616
Po spuštění: Volných bajtů: 69,613,195,264

- - End Of File - - 8662C44DC95E513B492A5421A4818843

[Caroprd111]

Zdravím

Na logu se pracuje, prosím o strpení.

Nepoužívejte COMBOFIX bez doporučení rádce! Při špatné manipulaci může dojít k poškození systému !

[Caroprd111]

Doporučuji odinstalovat (pokud nepoužíváte) toolbary (lišty) v Přidat nebo odebrat programy.

Doporučuji aktualizovat Adobe Reader http://www.stahuj.centrum.cz/podnikani_ ... batreader/

Odinstalujte combofix přes:
Start >> Spustit zkopírujte do okénka:

ComboFix /Uninstall

stiskněte Enter


Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

- Spusťte, pro potvrzení volby mačkejte klávesu A, Enter
- Po použití program vymažte. Pozor,antiviry ho mohou falešně označit za vir.


Stáhněte Ccleaner http://viry.cz/forum/viewtopic.php?t=7478
- Nainstalujte a v průběhu instalace odškrtněte, že chcete instalovat yahoo toolbar.

Záložka Čistič
- Dejte analyzovat, po dokončení dejte Spustit Ccleaner.

Záložka Registry
- Klikněte na Hledej problémy, po dokončení klikněte na Opravit problémy, zálohu dělat nemusíte, potom dejte Opravit všechny problémy.
OK Zavřít


Jsou s PC nějaké problémy

[marianek]

vse ok, diky moc

[Caroprd111]

Není zač