prosim o kontrolu spomaleny comp asi po cisteni winXp toolom

[radoslav]

Logfile of random's system information tool 1.07 (written by random/random)
Run by TOSHIBA at 2010-06-13 21:01:08
Systém Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 2 GB (6%) free of 30 GB
Total RAM: 1014 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:01:11, on 13.6.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Microcom\ADSL DeskPorte USB\CnxDslTb.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\WinSplit Revolution\WinSplit.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\TOSHIBA\Local Settings\Temporary Internet Files\Content.IE5\S0MBN47U\RSIT[1].exe
C:\Program Files\trend micro\TOSHIBA.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\Microcom\ADSL DeskPorte USB\CnxDslTb.exe" "Microcom\ADSL DeskPorte USB"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Winsplit] C:\Program Files\WinSplit Revolution\WinSplit.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (file missing)
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 4351 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{7887480C-488E-4875-A2A6-57B31C8D13CE}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2008-01-25 141848]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2008-01-25 137752]
"TPSMain"=C:\WINDOWS\system32\TPSMain.exe [2008-01-28 268152]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2008-07-19 78008]
"CnxDslTaskBar"=C:\Program Files\Microcom\ADSL DeskPorte USB\CnxDslTb.exe [2004-06-16 233472]
"RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2004-11-02 32768]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Winsplit"=C:\Program Files\WinSplit Revolution\WinSplit.exe [2009-02-27 3958784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2007-12-19 208896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 239616]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\ICQ6\ICQ.exe"="C:\Program Files\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"C:\Documents and Settings\TOSHIBA\Local Settings\Temp\Rar$EX01.172\StrongDC.exe"="C:\Documents and Settings\TOSHIBA\Local Settings\Temp\Rar$EX01.172\StrongDC.exe:*:Enabled:StrongDC++"
"C:\Documents and Settings\TOSHIBA\Local Settings\Temp\Rar$EX00.297\StrongDC.exe"="C:\Documents and Settings\TOSHIBA\Local Settings\Temp\Rar$EX00.297\StrongDC.exe:*:Enabled:StrongDC++"
"C:\Program Files\StrongDC.exe"="C:\Program Files\StrongDC.exe:*:Enabled:StrongDC++"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe"="C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe:*:Enabled:Sunbelt Kerio Firewall GUI"
"C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe"="C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Enabled:Nokia Software Updater"
"C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe"="C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process "
"C:\Documents and Settings\TOSHIBA\Local Settings\Temp\Rar$EX02.766\StrongDC.exe"="C:\Documents and Settings\TOSHIBA\Local Settings\Temp\Rar$EX02.766\StrongDC.exe:*:Enabled:StrongDC++"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\StrongDC++\StrongDC.exe"="C:\Program Files\StrongDC++\StrongDC.exe:*:Enabled:StrongDC++"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{013f3df1-8fe5-11dd-b905-001b9e884f34}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
shell\Open(0)\command - Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{10bc24ce-749c-11dd-b8a3-001b9e884f34}]
shell\AutoRun\command - svchost.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a40a783d-8c4f-11dd-b8fb-001b9e884f34}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled.exe


======List of files/folders created in the last 1 months======

2010-06-13 21:01:08 ----D---- C:\rsit
2010-06-13 08:35:08 ----A---- C:\WINDOWS\system32\rpcnetp.dll
2010-06-13 08:34:21 ----A---- C:\WINDOWS\system32\rpcnetp.exe
2010-06-11 16:14:06 ----HDC---- C:\WINDOWS\$NtUninstallKB980218$
2010-06-11 16:13:59 ----HDC---- C:\WINDOWS\$NtUninstallKB980195$
2010-06-11 16:13:52 ----HDC---- C:\WINDOWS\$NtUninstallKB979559$
2010-06-11 16:11:28 ----HDC---- C:\WINDOWS\$NtUninstallKB978695_WM9$
2010-06-11 16:11:24 ----HDC---- C:\WINDOWS\$NtUninstallKB979482$
2010-06-11 16:11:15 ----HDC---- C:\WINDOWS\$NtUninstallKB975562$
2010-06-10 21:37:42 ----D---- C:\Program Files\Yamicsoft
2010-06-10 21:36:41 ----D---- C:\Program Files\WinXP Manager 2010 + Keygen
2010-06-07 19:19:34 ----D---- C:\Documents and Settings\TOSHIBA\Application Data\CyberLink
2010-06-07 19:11:54 ----D---- C:\Documents and Settings\All Users\Application Data\CyberLink
2010-06-07 19:10:05 ----D---- C:\Program Files\CyberLink
2010-06-07 19:06:00 ----D---- C:\Program Files\Power DVD 6
2010-06-03 19:29:17 ----HD---- C:\WINDOWS\PIF
2010-06-01 23:05:06 ----D---- C:\Documents and Settings\TOSHIBA\Application Data\Winamp
2010-06-01 23:05:01 ----D---- C:\Program Files\Winamp
2010-06-01 23:05:00 ----D---- C:\Program Files\Webteh
2010-06-01 23:03:47 ----D---- C:\Program Files\Common Files\Skype
2010-06-01 23:03:39 ----D---- C:\Documents and Settings\TOSHIBA\Application Data\Skype
2010-05-29 20:32:35 ----D---- C:\totalcmd
2010-05-29 20:10:09 ----D---- C:\Documents and Settings\TOSHIBA\Application Data\Skype(2)
2010-05-29 19:07:41 ----D---- C:\Program Files\CONEXANT
2010-05-29 18:42:04 ----A---- C:\Program Files\Toshiba-Satellite-M300-L310-Audio-Driver-For-XP_-_www.getpcmemory.com.zip
2010-05-26 16:06:55 ----D---- C:\Documents and Settings\TOSHIBA\Application Data\vlc
2010-05-26 16:05:23 ----D---- C:\Program Files\VideoLAN
2010-05-24 18:42:54 ----D---- C:\Documents and Settings\TOSHIBA\Application Data\Winsplit Revolution
2010-05-24 18:42:45 ----D---- C:\Program Files\WinSplit Revolution
2010-05-24 14:14:51 ----A---- C:\Documents and Settings\All Users\Application Data\xml25.tmp
2010-05-24 14:14:51 ----A---- C:\Documents and Settings\All Users\Application Data\xml24.tmp
2010-05-24 14:14:50 ----A---- C:\Documents and Settings\All Users\Application Data\xml23.tmp
2010-05-24 14:14:12 ----D---- C:\Program Files\SiSoftware
2010-05-18 16:33:30 ----D---- C:\Program Files\Winamp(2)
2010-05-15 10:46:42 ----D---- C:\VIS
2010-05-14 10:56:50 ----D---- C:\Program Files\Tcomwebcamdriver
2010-05-14 10:43:40 ----D---- C:\Program Files\IC209S

======List of files/folders modified in the last 1 months======

2010-06-13 21:01:11 ----D---- C:\Program Files\Trend Micro
2010-06-13 21:01:09 ----D---- C:\WINDOWS\Prefetch
2010-06-13 20:16:43 ----D---- C:\Documents and Settings\TOSHIBA\Application Data\uTorrent
2010-06-13 19:54:00 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-06-13 19:09:23 ----D---- C:\WINDOWS\Temp
2010-06-13 16:05:10 ----D---- C:\Documents and Settings\TOSHIBA\Application Data\skypePM
2010-06-13 13:26:55 ----D---- C:\WINDOWS\Debug
2010-06-13 13:26:55 ----D---- C:\WINDOWS
2010-06-13 08:35:08 ----D---- C:\WINDOWS\system32
2010-06-12 22:47:41 ----A---- C:\WINDOWS\system32\agremove.exe
2010-06-12 19:19:09 ----D---- C:\WINDOWS\system32\CatRoot2
2010-06-11 16:49:55 ----D---- C:\Program Files\Internet Explorer
2010-06-11 16:14:09 ----HD---- C:\WINDOWS\inf
2010-06-11 16:14:08 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-06-11 16:13:58 ----HD---- C:\WINDOWS\$hf_mig$
2010-06-11 16:13:29 ----D---- C:\WINDOWS\ie8updates
2010-06-10 22:23:13 ----RSD---- C:\WINDOWS\assembly
2010-06-10 22:23:13 ----D---- C:\WINDOWS\Microsoft.NET
2010-06-10 21:51:39 ----SHD---- C:\WINDOWS\Installer
2010-06-10 21:37:49 ----SHD---- C:\Config.Msi
2010-06-10 21:37:49 ----SD---- C:\Documents and Settings\TOSHIBA\Application Data\Microsoft
2010-06-10 21:37:42 ----RD---- C:\Program Files
2010-06-10 21:24:09 ----D---- C:\Program Files\CCleaner
2010-06-10 19:18:45 ----SD---- C:\WINDOWS\Tasks
2010-06-10 19:15:53 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-06-10 19:13:28 ----D---- C:\WINDOWS\WinSxS
2010-06-10 19:12:37 ----D---- C:\WINDOWS\system32\mui
2010-06-07 19:10:22 ----HD---- C:\Program Files\InstallShield Installation Information
2010-06-05 21:41:33 ----D---- C:\Program Files\Settings
2010-06-02 20:24:19 ----D---- C:\Program Files\Outlook Express
2010-06-02 20:24:17 ----HDC---- C:\WINDOWS\$NtUninstallKB978542$
2010-06-02 06:39:06 ----D---- C:\Program Files\Google
2010-06-01 23:14:24 ----D---- C:\WINDOWS\system32\CatRoot
2010-06-01 23:06:10 ----D---- C:\WINDOWS\system32\config
2010-06-01 23:05:47 ----D---- C:\WINDOWS\system32\wbem
2010-06-01 23:05:47 ----D---- C:\WINDOWS\Registration
2010-06-01 23:04:57 ----D---- C:\Program Files\uTorrent
2010-06-01 23:03:47 ----RD---- C:\Program Files\Skype
2010-06-01 23:03:29 ----D---- C:\WINDOWS\system32\drivers
2010-05-30 09:20:53 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-05-29 20:09:59 ----D---- C:\Program Files\Common Files
2010-05-29 20:09:46 ----D---- C:\Documents and Settings\All Users\Application Data\Skype
2010-05-28 21:37:34 ----A---- C:\WINDOWS\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2008-07-19 26944]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2008-07-19 42912]
R1 fwdrv;Firewall Driver; C:\WINDOWS\system32\drivers\fwdrv.sys [2007-02-20 302000]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 khips;Kerio HIPS Driver; C:\WINDOWS\system32\drivers\khips.sys [2007-02-20 71088]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2008-07-19 94416]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
R3 AR5416;Atheros AR5008 Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\athw.sys [2008-01-17 1331136]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2008-07-19 23152]
R3 BoiHwsetup;Access 32bits INT15 routine; C:\WINDOWS\system32\drivers\BoiHwSetup.sys [2005-06-10 5504]
R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 CnxtHdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\CHDAud.sys [2008-02-01 732160]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2007-11-01 989696]
R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2007-11-01 211456]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2007-12-19 5854688]
R3 O2MDRDR;O2MDRDR; C:\WINDOWS\system32\DRIVERS\o2media.sys [2008-01-15 48472]
R3 QIOMem;Generic IO & Memory Access; C:\WINDOWS\system32\DRIVERS\QIOMem.sys [2007-05-29 6912]
R3 qkbfiltr;Quanta HotKey Keyboard Filter Driver; C:\WINDOWS\system32\drivers\qkbfiltr.sys [2006-01-13 31872]
R3 qmofiltr;Quanta HotKey Mouse Filter Driver; C:\WINDOWS\system32\drivers\qmofiltr.sys [2005-05-05 7936]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2007-11-01 731520]
R3 WSIMD;wsimd Service; C:\WINDOWS\system32\DRIVERS\wsimd.sys [2007-12-14 57408]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2007-12-28 285952]
S3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
S3 CnxEtP;Conexant AccessRunner USB ADSL Adapter Filter Driver; C:\WINDOWS\system32\DRIVERS\CnxEtP.sys [2004-06-16 131072]
S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver; C:\WINDOWS\system32\DRIVERS\CnxEtU.sys [2004-06-16 614272]
S3 CnxTgNP;Conexant AccessRunner ADSL WAN PPPoE Adapter Driver; C:\WINDOWS\system32\DRIVERS\CnxTgNP.sys [2004-06-16 60416]
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2010-01-21 18048]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2009-12-30 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 Ser2pl;Prolific2 Serial port driver; C:\WINDOWS\system32\DRIVERS\ser2pl.sys [2005-07-25 48640]
S3 sffdisk;SFF Storage Class Driver; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2008-04-13 11904]
S3 sffp_sd;SFF Storage Protocol Driver for SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2008-04-13 11008]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 tunmp;Microsoft Tun Miniport Adapter Driver; C:\WINDOWS\system32\DRIVERS\tunmp.sys [2008-04-13 12288]
S3 TVICHW32;TVICHW32; \??\C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS []
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2009-12-30 7936]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-13 26112]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2009-12-30 7936]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-01-18 83328]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2008-07-19 16056]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2008-07-19 147640]
R2 KPF4;Sunbelt Kerio Personal Firewall 4; C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-02-20 1222192]
R2 o2flash;O2Micro Flash Memory Card Service; C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe [2007-02-12 65536]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2008-07-19 250040]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-04-24 136176]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2008-07-23 348344]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-10-17 168432]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-26 65824]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe []
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2010-01-26 652800]

-----------------EOF-----------------

[Roli]

Zdravím, tohle fixni v HJT :

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

HJT najdeš zde :

C:\Program Files\trend micro\TOSHIBA.exe

Fix znamená že spustíš HJT

v okně které se ti otevře klikneš na Do a system scan only

v dalším okně najdeš řádky které jsem ti vypsal,

vedle nich je čtvereček do kterého uděláš zatržítko,

pak klikneš na Fix checked které je vlevo dole,

program se ti zeptá zda opravdu ANO s tím samozřejmě souhlasíš a je hotovo.


Přes Start >> Spustit >> napiš - services.msc >> OK. Najdi službu :

Google Update Service (gupdate)

Google Updater Service (gusvc)

klikni na ni pravým myšítkem, zvol vlastnosti, na další kartě nejprve službu zastav tlačítkem Zastavit a u položky Typ spouštění zvol Zakázáno.


Smaž nepotřebné soubory

pomocí CCleaneru

návod :

Čistič - tady vyčistíš PC od nepotřebných souborů a vysypeš Koš

Registry - tady vyčistíš registry (před použitím doporučuji udělat jejich zálohu kterou CCleaner nabízí)

Čištění registru je třeba několikrát zopakovat !


Nakonec použij Mbam z mého podpisu.

[radoslav]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:57:52, on 13.6.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Microcom\ADSL DeskPorte USB\CnxDslTb.exe
C:\Program Files\WinSplit Revolution\WinSplit.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\Microcom\ADSL DeskPorte USB\CnxDslTb.exe" "Microcom\ADSL DeskPorte USB"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Winsplit] C:\Program Files\WinSplit Revolution\WinSplit.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (file missing)
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 3428 bytes

[radoslav]

vsetko som urobil podla navodu.....comp je evidentne pohotovejsi.....ale nacitavanie webovych stranok sa nezmenilo......stale pomaly,resp.len po viacnasobnom obnovovani

[Roli]

A log z Mbam který si sem měl dát je kde ?

[radoslav]

no ten som neprikladal,pretoze ziandny subor nebol infikovany......

[Roli]

Dobře použijeme tedy větší kalibr tak že pozorně číst, protože tenhle softík netoleruje chyby.


Stáhni a ulož na plochu ComboFix,

spusť aplikaci jako Administrátor a povol instalaci Konzole pro zotavení - Recovery Console.

Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,

pak ještě jednou klik na ANO a už to jede.

Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.

Při skenovaní může být PC i restartováno nelekat se.

Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,

protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.

Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na C:/Combofix.txt

(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.

[radoslav]

ComboFix 10-06-14.02 - TOSHIBA 14.06.2010 22:20:09.1.2 - x86
Systém Microsoft Windows XP Home Edition 5.1.2600.3.1250.421.1033.18.1014.515 [GMT 2:00]
Running from: c:\documents and settings\TOSHIBA\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1229 [VPS 100614-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Sunbelt Kerio Personal Firewall *enabled* {E659E0EE-10E6-49B7-8696-60F38D0EB174}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\TOSHIBA\My Documents\BackupRegistry(20100610).reg

.
((((((((((((((((((((((((( Files Created from 2010-05-14 to 2010-06-14 )))))))))))))))))))))))))))))))
.

2010-06-13 19:46 . 2010-06-13 19:46 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\Malwarebytes
2010-06-13 19:46 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-13 19:45 . 2010-06-13 19:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-06-13 19:45 . 2010-06-13 19:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-06-13 19:45 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-06-13 19:01 . 2010-06-13 19:01 -------- d-----w- C:\rsit
2010-06-11 11:12 . 2010-05-06 10:41 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-10 19:36 . 2008-11-27 20:33 -------- d-----w- c:\program files\WinXP Manager 2010 + Keygen
2010-06-10 19:07 . 2010-06-10 19:08 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2010-06-07 17:19 . 2010-06-07 17:19 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\CyberLink
2010-06-07 17:11 . 2010-06-07 17:11 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2010-06-07 17:10 . 2010-06-07 17:10 -------- d-----w- c:\program files\CyberLink
2010-06-07 17:06 . 2009-10-15 06:43 -------- d-----w- c:\program files\Power DVD 6
2010-06-03 17:29 . 2010-06-03 17:29 -------- d--h--w- c:\windows\PIF
2010-06-02 04:34 . 2010-06-02 04:38 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
2010-06-01 21:05 . 2010-06-01 21:05 -------- d-----w- c:\windows\system32\wbem\Repository
2010-06-01 21:05 . 2010-06-03 17:40 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\Winamp
2010-06-01 21:05 . 2010-06-01 21:05 -------- d-----w- c:\program files\Winamp
2010-06-01 21:05 . 2010-06-01 21:05 -------- d-----w- c:\program files\Webteh
2010-06-01 21:03 . 2010-06-01 21:03 -------- d-----w- c:\program files\Common Files\Skype
2010-06-01 21:03 . 2010-06-14 18:54 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\Skype
2010-06-01 20:54 . 2010-06-01 20:54 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-05-29 18:32 . 2010-06-01 21:03 -------- d-----w- C:\totalcmd
2010-05-29 18:10 . 2010-06-01 21:03 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\Skype(2)
2010-05-29 17:07 . 2010-06-01 21:03 -------- d-----w- c:\program files\CONEXANT
2010-05-29 16:42 . 2010-05-29 16:42 7874535 ----a-w- c:\program files\Toshiba-Satellite-M300-L310-Audio-Driver-For-XP_-_www.getpcmemory.com.zip
2010-05-26 14:06 . 2010-06-01 21:03 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\vlc
2010-05-26 14:05 . 2010-05-26 14:05 -------- d-----w- c:\program files\VideoLAN
2010-05-24 16:42 . 2010-05-25 16:31 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\Winsplit Revolution
2010-05-24 16:42 . 2010-06-11 19:31 -------- d-----w- c:\program files\WinSplit Revolution
2010-05-24 12:14 . 2010-05-24 12:14 -------- d-----w- c:\program files\SiSoftware
2010-05-18 14:33 . 2010-06-01 21:04 -------- d-----w- c:\program files\Winamp(2)

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-14 19:45 . 2008-10-15 01:54 351708 ----a-w- c:\windows\system32\drivers\fwdrv.err
2010-06-14 18:36 . 2010-03-20 16:38 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\uTorrent
2010-06-14 16:41 . 2008-10-30 00:11 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\skypePM
2010-06-14 04:42 . 2008-12-14 02:21 44544 ----a-w- c:\windows\system32\agremove.exe
2010-06-13 19:57 . 2008-08-28 01:07 -------- d-----w- c:\program files\Trend Micro
2010-06-13 17:51 . 2008-08-31 01:36 47944 ---ha-w- c:\windows\system32\mlfcache.dat
2010-06-10 19:24 . 2008-08-28 06:22 -------- d-----w- c:\program files\CCleaner
2010-06-07 17:10 . 2008-08-27 05:53 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-05 19:41 . 2008-09-10 04:27 -------- d-----w- c:\program files\Settings
2010-06-02 04:39 . 2008-08-27 05:59 -------- d-----w- c:\program files\Google
2010-06-01 21:05 . 2010-05-14 08:43 -------- d-----w- c:\program files\IC209S
2010-06-01 21:04 . 2010-03-20 16:39 -------- d-----w- c:\program files\uTorrent
2010-06-01 21:03 . 2008-08-28 03:15 -------- d-----r- c:\program files\Skype
2010-05-29 18:09 . 2008-08-28 03:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-05-24 12:14 . 2010-05-24 12:14 2316 ----a-w- c:\documents and settings\All Users\Application Data\xml25.tmp
2010-05-24 12:14 . 2010-05-24 12:14 13451 ----a-w- c:\documents and settings\All Users\Application Data\xml24.tmp
2010-05-24 12:14 . 2010-05-24 12:14 9521 ----a-w- c:\documents and settings\All Users\Application Data\xml23.tmp
2010-05-14 08:57 . 2010-05-14 08:56 -------- d-----w- c:\program files\Tcomwebcamdriver
2010-05-06 10:41 . 2006-02-28 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 05:22 . 2006-02-28 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-04-27 17:19 . 2010-04-27 17:19 -------- d-----w- c:\program files\Ashampoo
2010-04-27 17:18 . 2010-04-27 17:18 8611720 ----a-w- c:\program files\ashampoo_burning_studio_6_free_6.77_4312.exe
2010-04-24 10:00 . 2010-04-24 10:00 0 ---ha-w- c:\windows\msds.dat
2010-04-22 07:15 . 2010-04-22 07:15 -------- d-----w- c:\program files\StrongDC++
2010-04-22 07:13 . 2010-04-22 07:13 5866718 ----a-w- c:\program files\sdc241-32.exe
2010-04-22 06:48 . 2010-04-22 06:48 -------- d-----w- c:\program files\EDDICA
2010-04-20 05:30 . 2006-02-28 12:00 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-18 15:18 . 2010-04-18 15:02 -------- d-----w- c:\program files\The KMPlayer
2010-04-18 15:01 . 2010-04-18 14:57 14913925 ----a-w- c:\program files\kmp.exe
2010-03-18 00:51 . 2010-03-18 00:51 12212040 -c--a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMFDist11-WindowsXP-X86-ENU.exe
2010-03-18 00:51 . 2010-03-18 00:51 13930312 -c--a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMFDist11-WindowsXP-X64-ENU.exe
2010-03-18 00:51 . 2010-03-18 00:51 77824 -c--a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\Run_XML6_SP1.exe
2010-03-18 00:51 . 2010-03-18 00:51 61440 -c--a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMF11Runx86.exe
2010-03-18 00:51 . 2010-03-18 00:51 58880 -c--a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMF11Runx64.exe
2010-03-18 00:51 . 2010-03-18 00:51 50000 ----a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\pcswpc.exe
2010-03-18 00:47 . 2010-03-18 00:47 98366952 ----a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Nokia_Ovi_Suite_PCS_Update.exe
2009-08-28 08:03 . 2008-09-10 04:26 3480576 ----a-w- c:\program files\StrongDC.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Winsplit"="c:\program files\WinSplit Revolution\WinSplit.exe" [2009-02-27 3958784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CnxDslTaskBar"="c:\program files\Microcom\ADSL DeskPorte USB\CnxDslTb.exe Microcom\ADSL DeskPorte USB" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-25 141848]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-25 137752]
"TPSMain"="TPSMain.exe" [2008-01-28 268152]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\StrongDC.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\StrongDC++\\StrongDC.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8601:TCP"= 8601:TCP:BitComet 8601 TCP
"8601:UDP"= 8601:UDP:BitComet 8601 UDP

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [28.8.2008 3:12 78416]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [20.2.2007 19:34 302000]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [20.2.2007 19:34 71088]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [28.8.2008 3:12 20560]
R3 CnxtHdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service;c:\windows\system32\drivers\CHDAud.sys [27.8.2008 7:00 732160]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [27.8.2008 7:55 48472]
R3 QIOMem;Generic IO & Memory Access;c:\windows\system32\drivers\QIOMem.sys [29.5.2007 12:01 6912]
S3 CnxEtP;Conexant AccessRunner USB ADSL Adapter Filter Driver;c:\windows\system32\drivers\CnxEtP.sys [8.12.2008 3:32 131072]
S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\drivers\CnxEtU.sys [8.12.2008 3:32 614272]
S3 CnxTgNP;Conexant AccessRunner ADSL WAN PPPoE Adapter Driver;c:\windows\system32\drivers\CnxTgNP.sys [8.12.2008 3:33 60416]
S3 TVICHW32;TVICHW32;c:\windows\system32\drivers\TVICHW32.SYS [27.7.2009 18:26 23600]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [24.4.2010 23:13 136176]
.
Contents of the 'Scheduled Tasks' folder

2010-06-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-24 21:12]

2010-06-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-24 21:12]

2010-06-14 c:\windows\Tasks\User_Feed_Synchronization-{7887480C-488E-4875-A2A6-57B31C8D13CE}.job
- c:\windows\system32\msfeedssync.exe [2010-02-14 03:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-14 22:25
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\windows\system32\autochk(5).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(50).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(51).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(6).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(7).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(8).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(9).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(10).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(11).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(12).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(13).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(14).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(15).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(17).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(18).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(19).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(20).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(21).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(22).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(23).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(24).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(25).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(26).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(27).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(28).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(29).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(3).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(30).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(31).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(32).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(33).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(34).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(35).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(36).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(37).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(38).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(39).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(4).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(40).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(41).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(42).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(43).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(44).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(45).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(46).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(47).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(48).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(49).exe:BAK 22528 bytes executable

scan completed successfully
hidden files: 48

**************************************************************************
.
Completion time: 2010-06-14 22:28:40
ComboFix-quarantined-files.txt 2010-06-14 20:28

Pre-Run: 4 814 880 768 bytes free
Post-Run: 4 857 503 744 voľných bajtov

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - E447C5FBE3ACA7369C22605955B2E803

[Roli]

Vůbec se mi nelíbí :

WinXP Manager 2010 + Keygen

StrongDC++

.........

pak se nemůžeš divit že máš problémy + nesprávné použití právě XP Manageru.


Pokud jsi tak ještě neučinil, přesuň Combofix na plochu

otevři si Poznámkový blok

do něj zkopíruj skript z následujícího okna:

Kód: Vybrat vše

File::  
c:\documents and settings\All Users\Application Data\xml25.tmp
c:\documents and settings\All Users\Application Data\xml24.tmp
c:\documents and settings\All Users\Application Data\xml23.tmp

ulož Tebou vytvořený TXT soubor jako CFScript.txt na plochu,

po uložení uchop vytvořený skript levým myšítkem a přesuň ho nad ikonu Combofixu, kde ho upustíš:



Po aplikaci na Tebe vypadne další log, zkopíruj ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou,

v tom případě znovu restartuj a přitom mačkej F8 poté zvol Poslední známou funkční konfiguraci

[radoslav]

ComboFix 10-06-15.02 - TOSHIBA 15.06.2010 22:29:06.2.2 - x86
Systém Microsoft Windows XP Home Edition 5.1.2600.3.1250.421.1033.18.1014.596 [GMT 2:00]
Running from: c:\documents and settings\TOSHIBA\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\TOSHIBA\Desktop\cfscript.txt
AV: avast! antivirus 4.8.1229 [VPS 100615-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Sunbelt Kerio Personal Firewall *enabled* {E659E0EE-10E6-49B7-8696-60F38D0EB174}
.

((((((((((((((((((((((((( Files Created from 2010-05-15 to 2010-06-15 )))))))))))))))))))))))))))))))
.

2010-06-15 19:54 . 2010-06-15 19:54 -------- d-----w- c:\windows\system32\wbem\Repository
2010-06-13 19:45 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-06-13 19:01 . 2010-06-13 19:01 -------- d-----w- C:\rsit
2010-06-11 11:12 . 2010-05-06 10:41 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-10 19:07 . 2010-06-10 19:08 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2010-06-07 17:19 . 2010-06-15 19:50 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\CyberLink
2010-06-07 17:11 . 2010-06-07 17:11 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2010-06-07 17:10 . 2010-06-07 17:10 -------- d-----w- c:\program files\CyberLink
2010-06-01 21:05 . 2010-06-15 19:53 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\Winamp
2010-06-01 21:03 . 2010-06-15 20:09 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\Skype
2010-06-01 20:54 . 2010-06-01 20:54 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-05-29 18:32 . 2010-06-15 19:30 -------- d-----w- C:\totalcmd
2010-05-29 18:10 . 2010-06-15 19:47 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\Skype(2)
2010-05-29 17:07 . 2010-06-15 19:47 -------- d-----w- c:\program files\CONEXANT
2010-05-29 16:42 . 2010-05-29 16:42 7874535 ----a-w- c:\program files\Toshiba-Satellite-M300-L310-Audio-Driver-For-XP_-_www.getpcmemory.com.zip
2010-05-26 14:06 . 2010-06-15 19:31 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\vlc
2010-05-26 14:05 . 2010-05-26 14:05 -------- d-----w- c:\program files\VideoLAN
2010-05-24 16:42 . 2010-05-25 16:31 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\Winsplit Revolution
2010-05-24 16:42 . 2010-06-15 19:52 -------- d-----w- c:\program files\WinSplit Revolution
2010-05-24 12:14 . 2010-05-24 12:14 -------- d-----w- c:\program files\SiSoftware
2010-05-18 14:33 . 2010-06-15 19:48 -------- d-----w- c:\program files\Winamp(2)

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-15 20:23 . 2008-10-15 01:54 356191 ----a-w- c:\windows\system32\drivers\fwdrv.err
2010-06-15 19:59 . 2008-12-14 02:21 44544 ----a-w- c:\windows\system32\agremove.exe
2010-06-15 19:53 . 2010-03-20 16:38 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\uTorrent
2010-06-15 19:53 . 2008-08-28 01:07 -------- d-----w- c:\program files\Trend Micro
2010-06-15 19:53 . 2010-06-13 19:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-06-15 19:51 . 2010-06-10 19:37 -------- d-----w- c:\program files\Yamicsoft
2010-06-15 19:51 . 2010-06-15 19:51 -------- d-----w- c:\program files\WinXP Manager 2010 + Keygen
2010-06-15 19:51 . 2008-08-28 06:22 -------- d-----w- c:\program files\CCleaner
2010-06-15 19:50 . 2010-06-15 19:50 -------- d-----w- c:\program files\Power DVD 6
2010-06-15 19:49 . 2008-08-27 05:59 -------- d-----w- c:\program files\Google
2010-06-15 19:48 . 2010-06-15 19:48 -------- d-----w- c:\program files\Webteh
2010-06-15 19:48 . 2010-03-20 16:39 -------- d-----w- c:\program files\uTorrent
2010-06-15 19:47 . 2008-08-28 03:15 -------- d-----r- c:\program files\Skype
2010-06-15 19:47 . 2008-08-28 03:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-06-15 19:47 . 2010-06-15 19:47 -------- d-----w- c:\program files\Common Files\Skype
2010-06-15 19:45 . 2010-05-14 08:43 -------- d-----w- c:\program files\IC209S
2010-06-15 16:00 . 2008-10-30 00:11 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\skypePM
2010-06-13 19:46 . 2010-06-13 19:46 -------- d-----w- c:\documents and settings\TOSHIBA\Application Data\Malwarebytes
2010-06-13 19:45 . 2010-06-13 19:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-06-13 17:51 . 2008-08-31 01:36 47944 ---ha-w- c:\windows\system32\mlfcache.dat
2010-06-07 17:10 . 2008-08-27 05:53 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-06-05 19:41 . 2008-09-10 04:27 -------- d-----w- c:\program files\Settings
2010-05-24 12:14 . 2010-05-24 12:14 2316 ----a-w- c:\documents and settings\All Users\Application Data\xml25.tmp
2010-05-24 12:14 . 2010-05-24 12:14 13451 ----a-w- c:\documents and settings\All Users\Application Data\xml24.tmp
2010-05-24 12:14 . 2010-05-24 12:14 9521 ----a-w- c:\documents and settings\All Users\Application Data\xml23.tmp
2010-05-14 08:57 . 2010-05-14 08:56 -------- d-----w- c:\program files\Tcomwebcamdriver
2010-05-06 10:41 . 2006-02-28 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 05:22 . 2006-02-28 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-04-29 13:39 . 2010-06-13 19:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-27 17:19 . 2010-04-27 17:19 -------- d-----w- c:\program files\Ashampoo
2010-04-27 17:18 . 2010-04-27 17:18 8611720 ----a-w- c:\program files\ashampoo_burning_studio_6_free_6.77_4312.exe
2010-04-24 10:00 . 2010-04-24 10:00 0 ---ha-w- c:\windows\msds.dat
2010-04-22 07:15 . 2010-04-22 07:15 -------- d-----w- c:\program files\StrongDC++
2010-04-22 07:13 . 2010-04-22 07:13 5866718 ----a-w- c:\program files\sdc241-32.exe
2010-04-22 06:48 . 2010-04-22 06:48 -------- d-----w- c:\program files\EDDICA
2010-04-20 05:30 . 2006-02-28 12:00 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-18 15:18 . 2010-04-18 15:02 -------- d-----w- c:\program files\The KMPlayer
2010-04-18 15:01 . 2010-04-18 14:57 14913925 ----a-w- c:\program files\kmp.exe
2010-03-18 00:51 . 2010-03-18 00:51 12212040 -c--a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMFDist11-WindowsXP-X86-ENU.exe
2010-03-18 00:51 . 2010-03-18 00:51 13930312 -c--a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMFDist11-WindowsXP-X64-ENU.exe
2010-03-18 00:51 . 2010-03-18 00:51 77824 -c--a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\Run_XML6_SP1.exe
2010-03-18 00:51 . 2010-03-18 00:51 61440 -c--a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMF11Runx86.exe
2010-03-18 00:51 . 2010-03-18 00:51 58880 -c--a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\WMF11Runx64.exe
2010-03-18 00:51 . 2010-03-18 00:51 50000 ----a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Installer\CommonCustomActions\pcswpc.exe
2010-03-18 00:47 . 2010-03-18 00:47 98366952 ----a-w- c:\documents and settings\All Users\Application Data\OviInstallerCache\{DEE1E2E5-B553-4F88-9DE7-23CBEA5D739C}\Nokia_Ovi_Suite_PCS_Update.exe
2009-08-28 08:03 . 2008-09-10 04:26 3480576 ----a-w- c:\program files\StrongDC.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Winsplit"="c:\program files\WinSplit Revolution\WinSplit.exe" [2009-02-27 3958784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CnxDslTaskBar"="c:\program files\Microcom\ADSL DeskPorte USB\CnxDslTb.exe Microcom\ADSL DeskPorte USB" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-25 141848]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-25 137752]
"TPSMain"="TPSMain.exe" [2008-01-28 268152]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\StrongDC.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\StrongDC++\\StrongDC.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8601:TCP"= 8601:TCP:BitComet 8601 TCP
"8601:UDP"= 8601:UDP:BitComet 8601 UDP

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [28.8.2008 3:12 78416]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [20.2.2007 19:34 302000]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [20.2.2007 19:34 71088]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [28.8.2008 3:12 20560]
R3 CnxtHdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service;c:\windows\system32\drivers\CHDAud.sys [27.8.2008 7:00 732160]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [27.8.2008 7:55 48472]
R3 QIOMem;Generic IO & Memory Access;c:\windows\system32\drivers\QIOMem.sys [29.5.2007 12:01 6912]
S3 CnxEtP;Conexant AccessRunner USB ADSL Adapter Filter Driver;c:\windows\system32\drivers\CnxEtP.sys [8.12.2008 3:32 131072]
S3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;c:\windows\system32\drivers\CnxEtU.sys [8.12.2008 3:32 614272]
S3 CnxTgNP;Conexant AccessRunner ADSL WAN PPPoE Adapter Driver;c:\windows\system32\drivers\CnxTgNP.sys [8.12.2008 3:33 60416]
S3 TVICHW32;TVICHW32;c:\windows\system32\drivers\TVICHW32.SYS [27.7.2009 18:26 23600]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [24.4.2010 23:13 136176]
.
Contents of the 'Scheduled Tasks' folder

2010-06-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-24 21:12]

2010-06-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-24 21:12]

2010-06-15 c:\windows\Tasks\User_Feed_Synchronization-{7887480C-488E-4875-A2A6-57B31C8D13CE}.job
- c:\windows\system32\msfeedssync.exe [2010-02-14 03:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-15 22:34
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\windows\system32\autochk(5).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(6).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(50).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(51).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(53).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(10).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(11).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(12).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(13).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(14).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(15).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(17).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(18).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(19).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(20).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(21).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(22).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(23).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(24).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(25).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(26).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(27).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(28).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(29).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(3).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(30).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(31).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(32).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(33).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(34).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(35).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(36).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(37).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(38).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(39).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(4).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(40).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(41).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(42).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(43).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(44).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(45).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(46).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(47).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(48).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(49).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(7).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(8).exe:BAK 22528 bytes executable
c:\windows\system32\autochk(9).exe:BAK 22528 bytes executable

scan completed successfully
hidden files: 49

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(708)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\hnetcfg.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\TPwrCfg.DLL
c:\windows\system32\TPwrReg.dll
c:\windows\system32\TPSTrace.DLL
.
Completion time: 2010-06-15 22:36:52
ComboFix-quarantined-files.txt 2010-06-15 20:36
ComboFix2.txt 2010-06-15 20:22
ComboFix3.txt 2010-06-14 20:28

Pre-Run: 2 782 420 992 bytes free
Post-Run: 2 773 856 256 voľných bajtov

- - End Of File - - 9201602ABFA7530222ED06F459BB423A

[radoslav]

no nic sa nezmenilo.....kazdopadne musim napisat zw som asi pred dvoma tyzdnami sa pripajal na LAN siet a kedze sa mi to stale nedarilo,robilo som rozne hokusy pokusy s interne tovym nastavenim....tu vidim psa zakopaneho.robil som vsak aj obnovovanie systemu viac krat ,ale neviem ci to prepiuje internetove nastavenia....

[Roli]

No ono se ani nic nesmazalo, tak že jinak.

Přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Stáhni a spusť OTMoveIt

do levého okna aplikace pod Paste Instructions for Items to be Moved zkopíruj tento text:

Kód: Vybrat vše

:processes
explorer.exe       

:files 
c:\*.tmp
c:\WINDOWS\System32\*.tmp
c:\WINDOWS\*.tmp
c:\documents and settings\All Users\Application Data\*.tmp

:commands
[purity]
[emptytemp]
[start explorer]

klikni na MoveIt! a v pravém zeleném okně aplikace se Ti objeví info o provedene akci, obsah okna zkopíruj sem,

pokud aplikace bude požadovat restart, klikni na YES

v tom případě sem chci zkopírovat obsah logu uloženého na C:\_OTMoveIt\MovedFiles\

[radoslav]

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File/Folder c:\*.tmp not found.
c:\WINDOWS\System32\CONFIG.TMP moved successfully.
c:\WINDOWS\002622_.tmp moved successfully.
c:\WINDOWS\SET25.tmp moved successfully.
c:\WINDOWS\SET3.tmp moved successfully.
c:\WINDOWS\SET4.tmp moved successfully.
c:\WINDOWS\SET8.tmp moved successfully.
c:\documents and settings\All Users\Application Data\xml23.tmp moved successfully.
c:\documents and settings\All Users\Application Data\xml24.tmp moved successfully.
c:\documents and settings\All Users\Application Data\xml25.tmp moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 65748 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: TOSHIBA
->Temp folder emptied: 71607868 bytes
->Temporary Internet Files folder emptied: 41993000 bytes
->Flash cache emptied: 2715 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 148098 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 4431117 bytes

Total Files Cleaned = 113,00 mb


OTM by OldTimer - Version 3.1.12.2 log created on 06162010_200715

Files moved on Reboot...
File C:\Documents and Settings\TOSHIBA\Local Settings\Temp\~DF5488.tmp not found!
File C:\Documents and Settings\TOSHIBA\Local Settings\Temp\~DF549A.tmp not found!
File C:\Documents and Settings\TOSHIBA\Local Settings\Temp\~DF551D.tmp not found!
File C:\Documents and Settings\TOSHIBA\Local Settings\Temp\~DF5533.tmp not found!
C:\Documents and Settings\TOSHIBA\Local Settings\Temporary Internet Files\Content.IE5\NKPB4UE4\afr[2].htm moved successfully.
File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
File C:\WINDOWS\temp\Perflib_Perfdata_2c8.dat not found!

Registry entries deleted on Reboot...

[Roli]

Nepořádek je smazán.

Použij T-Cleaner, který smaže případné zbytky po aplikacích které jsme použili.

Jen před jeho stažením a při použití stopni antivir, protože ho muže detekovat jako vir ale není tomu tak.

Pak dej vědět jaký je stav PC.

[radoslav]

Takze problem je vyrieseni.............

spomalene nacitavanie www stranok sposobuje rezidentna ochrana antiviru Avast........presiel som k prehliadacu Mozilla a vypol Avast.
Stranky sa stahuju bleskovo......ovsem!!!!

Mozem fungovat bez antiviru?????!!!!!!