Kontrola

[HonzaD]

PC obcas zamrzava, pomuze jen restart. Zatez procesoru 100% (svhost).
Chova se to proste divne, po pouziti combofixu se to fujnguje, ale nevim jeslti to vydrzi..


ComboFix 10-03-10.08 - Kami 11.03.2010 16:31:15.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1562 [GMT 1:00]
Spuštěný z: c:\documents and settings\Kami\Plocha\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100311-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Data aplikací\hpe629.dll

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-02-11 do 2010-03-11 )))))))))))))))))))))))))))))))
.

2010-03-11 15:22 . 2010-03-11 15:22 -------- dc----w- c:\program files\Revo Uninstaller
2010-03-03 14:31 . 2010-03-03 14:31 -------- dc----w- c:\program files\HD Tune
2010-03-03 14:06 . 2010-03-03 14:11 -------- dc----w- c:\program files\SUPERAntiSpyware
2010-03-02 19:56 . 2010-03-02 19:56 -------- dcsh--w- c:\documents and settings\Administrator\IETldCache
2010-02-23 20:17 . 2008-01-09 11:28 27632 ----a-w- c:\windows\system32\drivers\seehcri.sys
2010-02-23 20:17 . 2010-02-23 20:18 -------- d-----w- c:\windows\system32\drivers\UMDF
2010-02-23 20:17 . 2010-02-23 20:17 -------- d-----w- c:\windows\system32\LogFiles
2010-02-12 14:44 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-12 14:44 . 2010-02-12 14:45 -------- dc----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-12 14:44 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-10 19:40 . 2010-02-10 19:40 -------- dc----r- c:\program files\Skype

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-06 09:08 . 2010-01-28 10:01 -------- dc----w- c:\program files\EurotelSMS
2010-03-05 14:00 . 2009-07-20 19:10 -------- dc----w- c:\program files\Common Files\Symantec Shared
2010-03-03 14:17 . 2009-06-11 13:43 -------- dc----w- c:\program files\Common Files\Adobe
2010-03-03 14:12 . 2009-07-20 19:09 -------- dc----w- c:\program files\WinClamAVShield
2010-03-03 14:05 . 2009-05-01 10:32 -------- dc----w- c:\program files\Common Files\Wise Installation Wizard
2010-03-03 13:58 . 2009-05-13 20:43 -------- dc----w- c:\program files\CrossLoop
2010-02-23 20:17 . 2010-02-23 20:11 -------- dc----w- c:\program files\Sony Ericsson
2010-02-23 20:17 . 2009-04-30 19:01 -------- dc-h--w- c:\program files\InstallShield Installation Information
2010-02-23 20:15 . 2010-02-23 20:11 -------- dc----w- c:\program files\Avanquest update
2010-02-08 21:40 . 2010-02-08 20:34 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-01-17 19:30 . 2009-04-30 19:05 -------- dc----w- c:\program files\ATI Technologies
2010-01-11 18:06 . 2010-01-11 18:06 -------- dc----w- c:\program files\rajce
2009-12-31 16:50 . 2001-10-25 14:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:08 . 2002-09-20 18:05 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-17 07:42 . 2009-04-30 18:32 343552 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:10 . 2002-09-20 18:03 33280 ----a-w- c:\windows\system32\csrsrv.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2009-02-19 1262888]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-04-24 203928]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-20 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-06-14 77824]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-16 148888]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"ATIModeChange"="Ati2mdxx.exe" [2009-07-21 26112]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-21 61440]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-01-07 1394000]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Kami\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Z stupce - ashDisp.lnk - c:\program files\Alwil Software\Avast4\ashDisp.exe [2009-7-21 81000]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
BDARemote.lnk - c:\program files\USB TV\EM28XX\BDARemote.exe [2009-11-26 81997]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21 548352 -c--a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\CrossLoop\\CrossLoopConnect.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\X-Lite\\X-Lite.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"e:\\Hry\\Dragon Age\\bin_ship\\daorigins.exe"=
"e:\\Hry\\Dragon Age\\DAOriginsLauncher.exe"=
"e:\\Hry\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"=
"e:\\Hry\\Tzar\\Tzar.exe"=
"e:\\Hry\\NWN2\\nwn2main.exe"=
"e:\\Hry\\NWN2\\nwn2main_amdxp.exe"=
"e:\\Hry\\NWN2\\nwupdate.exe"=
"e:\\Hry\\NWN2\\nwn2server.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\NVIDIA\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [21.7.2009 6:22 114768]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17.2.2010 10:25 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [17.2.2010 10:15 66632]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [20.7.2009 20:09 142592]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [21.7.2009 6:22 20560]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\Hamachi\hamachi-2.exe [29.10.2009 12:27 1074568]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [23.2.2010 21:17 27632]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [30.4.2009 20:23 721904]
S2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [23.2.2010 21:17 90112]
S3 DAUpdaterSvc;Dragon Age: Prameny - aktualizace obsahu;e:\hry\Dragon Age\bin_ship\daupdatersvc.service.exe [28.11.2009 16:07 25832]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Home Edition\kerneld.wnt [17.8.2005 23:00 7168]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [17.2.2010 10:15 12872]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-23 15:34 451872 -c--a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Obsah adresáře 'Naplánované úlohy'

2010-03-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-14 19:08]

2010-03-05 c:\windows\Tasks\Norton Security Scan for Kami.job
- c:\program files\Norton Security Scan\Engine\2.3.0.44\Nss.exe [2009-07-20 14:45]
.
.
------- Doplňkový sken -------
.
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Kami\Data aplikací\Mozilla\Firefox\Profiles\5xhexatu.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - Winamp Search
FF - prefs.js: browser.startup.homepage - hxxp://seznam.cz/
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF - component: c:\documents and settings\Kami\Data aplikací\Mozilla\Firefox\Profiles\5xhexatu.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\DictionaryCompressionFF.dll
FF - component: c:\documents and settings\Kami\Data aplikací\Mozilla\Firefox\Profiles\5xhexatu.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-11 16:34
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Home Edition\kerneld.wnt"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-2000478354-630328440-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:fd,f8,5a,1b,da,82,d7,ad,ef,09,3a,c1,ff,48,17,51,c3,2a,7d,fd,12,
55,0c,ba,81,a3,7b,cf,36,a1,58,8d,70,b0,31,88,01,f3,45,b0,57,99,db,78,10,e0,\
"rkeysecu"=hex:b2,55,c8,8f,4b,92,38,05,ce,95,c6,d1,49,c8,87,c1
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(724)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
Celkový čas: 2010-03-11 16:36:27
ComboFix-quarantined-files.txt 2010-03-11 15:36

Před spuštěním: 8 970 989 568
Po spuštění: 9 037 774 848

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 83ACCEA2277DD21883B9630E3089A045

[Caroprd111]

Zdravím

Odstraňte log z "code" a já se na to podívám.

Nedoporučuji používat ComboFix z vlastní iniciativy, může dojít k poškození systému!