Nemohu se zbavit viru - prosim o pomoc

[van]

prikladam log s combofixu
a predem dekuji

ComboFix 10-04-19.07 - Administrator 20.04.2010 16:55:18.3.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1015.611 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-03-20 do 2010-04-20 )))))))))))))))))))))))))))))))
.

2010-04-20 15:02 . 2010-04-20 15:02 -------- d-----w- c:\temp\WPDNSE
2010-04-20 15:02 . 2010-04-20 15:02 53248 ----a-w- c:\temp\catchme.dll
2010-04-12 13:55 . 2010-04-12 13:55 -------- d-sh--w- c:\documents and settings\samkova\IECompatCache
2010-04-09 14:06 . 2001-10-24 10:25 5632 ----a-w- c:\windows\system32\ptpusb.dll
2010-04-09 14:06 . 2008-04-14 02:21 159232 ----a-w- c:\windows\system32\ptpusd.dll
2010-04-09 08:06 . 2010-04-09 08:06 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-03-30 12:48 . 2010-04-20 15:01 -------- d-----w- c:\temp\serverovycertifikat
2010-03-30 12:23 . 2010-03-30 12:23 -------- d-sh--w- c:\documents and settings\samkova\PrivacIE
2010-03-30 12:22 . 2010-03-30 12:22 -------- d-sh--w- c:\documents and settings\samkova\IETldCache
2010-03-30 12:09 . 2010-03-30 12:09 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2010-03-30 12:09 . 2010-03-30 12:09 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache
2010-03-30 12:07 . 2010-03-30 12:07 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-03-30 12:06 . 2010-03-30 12:06 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-03-30 12:03 . 2010-03-30 12:14 -------- d-----w- c:\windows\ie8updates
2010-03-30 12:01 . 2009-12-21 19:08 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-03-30 12:00 . 2009-12-21 19:08 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-03-30 11:57 . 2010-03-30 12:00 -------- dc-h--w- c:\windows\ie8
2010-03-30 11:38 . 2010-03-30 11:38 -------- d-----w- C:\dc7d62f1340f7e2bbf898a43cd
2010-03-30 11:35 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-30 11:35 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-03-30 11:27 . 2010-04-20 14:52 -------- d-----w- c:\temp\hsperfdata_Administrator
2010-03-30 09:58 . 2010-03-30 09:58 -------- d-----w- c:\program files\I.CA
2010-03-24 15:31 . 2010-04-20 15:01 -------- d-----w- c:\temp\Google Toolbar
2010-03-24 15:24 . 2010-03-24 15:25 -------- d-----w- C:\Opera

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-12 14:38 . 2009-09-01 15:18 -------- d-----w- c:\program files\Google
2010-04-12 12:18 . 2004-08-18 12:00 885830 ----a-w- c:\windows\system32\perfh005.dat
2010-04-12 12:18 . 2004-08-18 12:00 305658 ----a-w- c:\windows\system32\perfc005.dat
2010-04-09 08:09 . 2005-06-17 06:42 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-18 14:34 . 2010-03-18 14:34 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-03-18 14:31 . 2010-03-18 14:31 -------- d-----w- c:\program files\Common Files\Skype
2010-03-18 14:31 . 2007-06-07 11:28 -------- d-----r- c:\program files\Skype
2010-03-02 07:32 . 2008-06-30 15:37 -------- d-----w- c:\program files\Microsoft Silverlight
.

((((((((((((((((((((((((((((( SnapShot_2010-04-20_14.39.49 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-04-20 14:45 . 2010-04-20 14:45 16384 c:\windows\Temp\Perflib_Perfdata_6c8.dat
+ 2010-04-20 14:47 . 2010-04-20 14:54 12066 c:\windows\SoftwareDistribution\EventCache\{7E519072-F3E1-4C8E-9B30-27AD0765BCBF}.bin
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinVNC"="c:\program files\ORL\VNC\WinVNC.exe" [1999-10-07 200704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-09-30 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-09-30 126976]
"OpwareSE2"="c:\program files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-10-06 53248]
"gemstrmw"="c:\windows\system32\gemstrmw.exe" [2003-08-29 24576]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640]
"SMSTray"="c:\program files\Samsung\EmoDio\SMSTray.exe" [2009-04-16 479232]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\klecakovak\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Z stupce - miranda32.lnk - c:\program files\Miranda IM\miranda32.exe [2006-4-3 411217]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Mˇstnˇ vyhled v nˇ.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2007-2-5 118784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Docházka\\Docházka.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:VNC
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [14.5.2009 15:49 94360]
R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 Licensing Service;c:\program files\ABBYY FineReader 9.0\NetworkLicenseServer.exe [24.9.2007 19:11 566560]
R2 CA_LIC_CLNT;CA License Client;c:\program files\CA\SharedComponents\CA_LIC\lic98rmt.exe [12.10.2003 22:20 143360]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [14.5.2009 15:47 731840]
R2 LogWatch;Event Log Watch;c:\program files\CA\SharedComponents\CA_LIC\LogWatNT.exe [20.9.2002 19:29 53248]
R3 GTwinUSB;GTwinUSB;c:\windows\system32\drivers\GTwinUSB.sys [25.3.2008 17:03 61776]
S2 sxeiza;sxeiza;c:\windows\system32\svchost.exe -k netsvcs [18.8.2004 14:00 14336]
S3 CA_LIC_SRVR;CA License Server;c:\program files\CA\SharedComponents\CA_LIC\lic98rmtd.exe [7.4.2003 18:45 151552]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [18.8.2004 14:00 14336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
WINRM REG_MULTI_SZ WINRM

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
sxeiza
hehuq
.
Obsah adresáře 'Naplánované úlohy'

2010-04-20 c:\windows\Tasks\User_Feed_Synchronization-{699081D9-5272-488F-92EB-26EDF04C4DF4}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://intranet/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
Trusted Zone: petra
DPF: {4C3CEE0B-4F2F-44C3-9586-4368F3200143} - hxxp://download.ica.cz/icapki.cab
FF - ProfilePath -
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-20 17:02
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-699043581-3274784994-2500235419-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,33,f0,6a,18,d5,3c,3f,41,94,ff,ad,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,33,f0,6a,18,d5,3c,3f,41,94,ff,ad,\
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(1044)
c:\program files\ScanSoft\OmniPageSE2.0\ophookSE2.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\cs-cz\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\cs-cz\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2010-04-20 17:05:00
ComboFix-quarantined-files.txt 2010-04-20 15:04
ComboFix2.txt 2010-03-24 15:49

Před spuštěním: Volných bajtů: 34 268 803 072
Po spuštění: Volných bajtů: 38 752 501 760

- - End Of File - - 890E7FBCD1DF34D19B3ED0A60F8DAD9A

[stell]

zdravim
Pri tejto akcii je nutné mať ComboFix na ploche.

Vypni>FIREWALL>Antivir>Antispyware>vsetko rezidentne.

Otvor Notepad (Poznámkový blok) a zkopíruj do neho celý zeleny tex:

Kód: Vybrat vše

KILLALL::

Driver::
sxeiza
hehuq
NetSvc::
sxeiza
hehuq
RegLock::
[HKEY_USERS\S-1-5-21-699043581-3274784994-2500235419-500\Software\Microsoft\Internet Explorer\User Preferences]

Potom klik na Subor -> Uložiť ako.. .. -> Ako je Názov souboru tak do toho riadku napiš:CFScript.txt
Typ súboru tak tam vyberies *všetky súbory
A ulož ho na plochu.> Pozor CFScript.txt>Neotvarat a nemoze byt ani>CFScript.txt.txt A Urobis Toto :


Po skonceni skenu vlož log čo ComboFix vytvorí

[van]

dekuji mooooc!
uz bezim testovat...

[stell]

nemas zaco.

[van]

jak nemam..mam mam mam za co ))))))
tak kontrolu provedl a ted ten log vypada tak (je to ok?)

ComboFix 10-04-21.01 - Administrator 28.04.2010 13:27:10.4.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1015.627 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Data aplikací\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Data aplikací\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Možné infikované stránky -----

hxxp://eda.kl.kbprogres.cz
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SXEIZA
-------\Service_sxeiza


((((((((((((((((((((((((( Soubory vytvořené od 2010-03-28 do 2010-04-28 )))))))))))))))))))))))))))))))
.

2010-04-28 11:27 . 2010-04-28 11:27 -------- d-----w- c:\temp\WPDNSE
2010-04-12 13:55 . 2010-04-12 13:55 -------- d-sh--w- c:\documents and settings\samkova\IECompatCache
2010-04-09 14:06 . 2001-10-24 10:25 5632 ----a-w- c:\windows\system32\ptpusb.dll
2010-04-09 14:06 . 2008-04-14 02:21 159232 ----a-w- c:\windows\system32\ptpusd.dll
2010-04-09 08:06 . 2010-04-09 08:06 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-03-30 12:48 . 2010-04-20 15:01 -------- d-----w- c:\temp\serverovycertifikat
2010-03-30 12:23 . 2010-03-30 12:23 -------- d-sh--w- c:\documents and settings\samkova\PrivacIE
2010-03-30 12:22 . 2010-03-30 12:22 -------- d-sh--w- c:\documents and settings\samkova\IETldCache
2010-03-30 12:09 . 2010-03-30 12:09 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2010-03-30 12:09 . 2010-03-30 12:09 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache
2010-03-30 12:07 . 2010-03-30 12:07 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-03-30 12:06 . 2010-03-30 12:06 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-03-30 12:03 . 2010-03-30 12:14 -------- d-----w- c:\windows\ie8updates
2010-03-30 12:01 . 2009-12-21 19:08 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-03-30 12:00 . 2009-12-21 19:08 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-03-30 11:57 . 2010-03-30 12:00 -------- dc-h--w- c:\windows\ie8
2010-03-30 11:38 . 2010-03-30 11:38 -------- d-----w- C:\dc7d62f1340f7e2bbf898a43cd
2010-03-30 11:35 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-30 11:35 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-03-30 09:58 . 2010-03-30 09:58 -------- d-----w- c:\program files\I.CA

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-20 15:06 . 2009-09-01 15:18 -------- d-----w- c:\program files\Google
2010-04-12 12:18 . 2004-08-18 12:00 885830 ----a-w- c:\windows\system32\perfh005.dat
2010-04-12 12:18 . 2004-08-18 12:00 305658 ----a-w- c:\windows\system32\perfc005.dat
2010-04-09 08:09 . 2005-06-17 06:42 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-18 14:34 . 2010-03-18 14:34 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-03-18 14:31 . 2010-03-18 14:31 -------- d-----w- c:\program files\Common Files\Skype
2010-03-18 14:31 . 2007-06-07 11:28 -------- d-----r- c:\program files\Skype
2010-03-02 07:32 . 2008-06-30 15:37 -------- d-----w- c:\program files\Microsoft Silverlight
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-03-09 26100520]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-09-30 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-09-30 126976]
"OpwareSE2"="c:\program files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-10-06 53248]
"gemstrmw"="c:\windows\system32\gemstrmw.exe" [2003-08-29 24576]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640]
"SMSTray"="c:\program files\Samsung\EmoDio\SMSTray.exe" [2009-04-16 479232]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\klecakovak\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Z stupce - miranda32.lnk - c:\program files\Miranda IM\miranda32.exe [2006-4-3 411217]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Mˇstnˇ vyhled v nˇ.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2007-2-5 118784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Docházka\\Docházka.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:VNC
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [14.5.2009 15:49 94360]
R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 Licensing Service;c:\program files\ABBYY FineReader 9.0\NetworkLicenseServer.exe [24.9.2007 19:11 566560]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [14.5.2009 15:47 731840]
R2 LogWatch;Event Log Watch;c:\program files\CA\SharedComponents\CA_LIC\LogWatNT.exe [20.9.2002 19:29 53248]
R3 GTwinUSB;GTwinUSB;c:\windows\system32\drivers\GTwinUSB.sys [25.3.2008 17:03 61776]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [18.8.2004 14:00 14336]
S4 CA_LIC_CLNT;CA License Client;c:\program files\CA\SharedComponents\CA_LIC\lic98rmt.exe [12.10.2003 22:20 143360]
S4 CA_LIC_SRVR;CA License Server;c:\program files\CA\SharedComponents\CA_LIC\lic98rmtd.exe [7.4.2003 18:45 151552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
WINRM REG_MULTI_SZ WINRM
.
Obsah adresáře 'Naplánované úlohy'

2010-04-28 c:\windows\Tasks\User_Feed_Synchronization-{699081D9-5272-488F-92EB-26EDF04C4DF4}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Doplňkový sken -------
.
uInternet Connection Wizard,ShellNext = hxxp://www.skype.com/go/help.guides.ieaddon?lang=en
DPF: {4C3CEE0B-4F2F-44C3-9586-4368F3200143} - hxxp://download.ica.cz/icapki.cab
FF - ProfilePath - c:\documents and settings\samkova\Data aplikací\Mozilla\Firefox\Profiles\xuu1v2ah.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - prefs.js: network.proxy.type - 4
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-28 13:38
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(2992)
c:\program files\ScanSoft\OmniPageSE2.0\ophookSE2.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\System32\SCardSvr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\ORL\VNC\WinVNC.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\SearchProtocolHost.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\windows\system32\SearchFilterHost.exe
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Celkový čas: 2010-04-28 13:43:57 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-04-28 11:43
ComboFix2.txt 2010-04-20 15:05
ComboFix3.txt 2010-03-24 15:49

Před spuštěním: Volných bajtů: 38 215 282 688
Po spuštění: Volných bajtů: 38 167 613 440

- - End Of File - - 6CD22F956F70BF6523805623F30CCF12

[stell]

spust este Malwarebytes uplny skan,inak nevidim nic podozriveho.

[van]

diky mooooc...myslim se ted uz to bude v poradku.
nic spatneho v tom nebylo jedine zlobil Explorer kteri obcas
prestaval otvirat stranky. Ted uz je to dobre )
P/S/ Jedine jestli mohu poprosit poradte prosim jeste s tim pocitacem
http://www.viry.cz/forum/viewtopic.php?f=13&t=100541
a predem dekuji moc za pomoc

[stell]

ok,nemas zaco
tam to mas tiez zasvinene
otestuj na www.virustotal.com
c:\windows\system32\drivers\WDICA.sys
a idem sa na to pozriet.

[van]

sorry dlouhodobe to bylo v poradku ale dneska zase prestal fungovat internet (ping funguje, icq funguje,skype take - problem pouze v exploreru a mozille)

prikladam log

ComboFix 10-05-16.01 - Administrator 17.05.2010 12:01:24.5.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1015.618 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Data aplikací\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Data aplikací\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Možné infikované stránky -----

hxxp://xxx.kl.xxx.cz
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-04-17 do 2010-05-17 )))))))))))))))))))))))))))))))
.

2010-04-28 11:47 . 2010-04-12 15:29 411368 ----a-w- c:\windows\system32\deployJava1.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-17 09:46 . 2004-08-18 12:00 887062 ----a-w- c:\windows\system32\perfh005.dat
2010-05-17 09:46 . 2004-08-18 12:00 306270 ----a-w- c:\windows\system32\perfc005.dat
2010-04-28 11:48 . 2008-12-30 08:43 -------- d-----w- c:\program files\Common Files\Java
2010-04-28 11:47 . 2008-12-30 08:43 -------- d-----w- c:\program files\Java
2010-04-20 15:06 . 2009-09-01 15:18 -------- d-----w- c:\program files\Google
2010-04-09 08:09 . 2005-06-17 06:42 -------- d-----w- c:\program files\Common Files\Adobe
2010-04-09 08:06 . 2010-04-09 08:06 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-03-30 09:58 . 2010-03-30 09:58 -------- d-----w- c:\program files\I.CA
2010-03-18 14:34 . 2010-03-18 14:34 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-03-18 14:31 . 2010-03-18 14:31 -------- d-----w- c:\program files\Common Files\Skype
2010-03-18 14:31 . 2007-06-07 11:28 -------- d-----r- c:\program files\Skype
.

((((((((((((((((((((((((((((( SnapShot_2010-04-20_14.39.49 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-17 09:53 . 2010-05-17 09:53 16384 c:\windows\temp\Perflib_Perfdata_6a4.dat
+ 2004-08-18 12:00 . 2010-05-17 09:46 790738 c:\windows\system32\perfh009.dat
+ 2004-08-18 12:00 . 2010-05-17 09:46 254570 c:\windows\system32\perfc009.dat
+ 2010-04-28 11:47 . 2010-04-12 15:29 153376 c:\windows\system32\javaws.exe
+ 2010-04-28 11:47 . 2010-04-12 15:29 145184 c:\windows\system32\javaw.exe
- 2009-11-04 07:45 . 2009-10-11 03:17 145184 c:\windows\system32\javaw.exe
+ 2010-04-28 11:47 . 2010-04-12 15:29 145184 c:\windows\system32\java.exe
- 2009-11-04 07:45 . 2009-10-11 03:17 145184 c:\windows\system32\java.exe
+ 2004-11-02 12:41 . 2004-11-02 12:41 516832 c:\windows\system32\capicom.dll
+ 2010-04-28 11:48 . 2010-04-28 11:48 180224 c:\windows\Installer\7fdf4.msi
+ 2005-06-17 07:00 . 2010-04-06 08:52 31971272 c:\windows\system32\MRT.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinVNC"="c:\program files\ORL\VNC\WinVNC.exe" [1999-10-07 200704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-09-30 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-09-30 126976]
"OpwareSE2"="c:\program files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-10-06 53248]
"gemstrmw"="c:\windows\system32\gemstrmw.exe" [2003-08-29 24576]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640]
"SMSTray"="c:\program files\Samsung\EmoDio\SMSTray.exe" [2009-04-16 479232]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Mˇstnˇ vyhled v nˇ.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2007-2-5 118784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Docházka\\Docházka.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:VNC
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [14.5.2009 15:49 94360]
R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 Licensing Service;c:\program files\ABBYY FineReader 9.0\NetworkLicenseServer.exe [24.9.2007 19:11 566560]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [14.5.2009 15:47 731840]
R2 LogWatch;Event Log Watch;c:\program files\CA\SharedComponents\CA_LIC\LogWatNT.exe [20.9.2002 19:29 53248]
R3 GTwinUSB;GTwinUSB;c:\windows\system32\drivers\GTwinUSB.sys [25.3.2008 17:03 61776]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [18.8.2004 14:00 14336]
S4 CA_LIC_CLNT;CA License Client;c:\program files\CA\SharedComponents\CA_LIC\lic98rmt.exe [12.10.2003 22:20 143360]
S4 CA_LIC_SRVR;CA License Server;c:\program files\CA\SharedComponents\CA_LIC\lic98rmtd.exe [7.4.2003 18:45 151552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
WINRM REG_MULTI_SZ WINRM
.
Obsah adresáře 'Naplánované úlohy'

2010-05-17 c:\windows\Tasks\User_Feed_Synchronization-{699081D9-5272-488F-92EB-26EDF04C4DF4}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://intranet/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
Trusted Zone: petra
DPF: {4C3CEE0B-4F2F-44C3-9586-4368F3200143} - hxxp://download.ica.cz/icapki.cab
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\73wtyjd7.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

Toolbar-Locked - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-17 12:05
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
Celkový čas: 2010-05-17 12:07:26
ComboFix-quarantined-files.txt 2010-05-17 10:07
ComboFix2.txt 2010-04-20 15:05
ComboFix3.txt 2010-03-24 15:49

Před spuštěním: Volných bajtů: 39 525 703 680
Po spuštění: Volných bajtů: 39 513 554 944

- - End Of File - - EB68BAF428ACD0E4D43A1A174ABDC1D3

[stell]

aky problem v exploreru a mozille?/ci uz je ok??

[van]

neslo otevrit internet. proste prazdna stranka.
ping google.com funguje s prikazoveho radku
ale otevrit ho nejde. a ostatni take. nevim proc se to stalo...
po oprave jak minule to delali vsechno bylo super do dneska...
a dneska to zase zacalo zlobit. Restartovani PC pomohlo...Proto
udelal log a poslal ho sem...nevidis nic zasadniho v logu?
Predem dik za odpoved

[stell]

nie nevidim nic..log je ok,,precisti to CCLEANEROM a ATF-Cleanerom.

[van]

ok diky moc

[stell]

Ak budes mat este problem,tak napis,,, a pozrieme sa hlbsie,,
Nemas zaco.

[van]

ok prosel jsem ccleanerem a pak uvidime
zatim je to funguje bez problemu...
diky jeste jednou - jsi hodny