Restartuje PC

[van]

restartuje PC a prosim o pomoc...
provedl skenovani combofixem.
V logu je toto

ComboFix 10-07-11.03 - Administrator 12.07.2010 11:40:15.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.1013.480 [GMT 2:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Data aplikací\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Data aplikací\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\_000010_.tmp.dll
c:\windows\system32\_000011_.tmp.dll
c:\windows\system32\GroupPolicy\User\Scripts\scripts.ini

----- BITS: Možné infikované stránky -----

hxxp://192.168.55.16:8530
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-06-12 do 2010-07-12 )))))))))))))))))))))))))))))))
.

2010-06-23 09:41 . 2010-06-23 09:41 -------- d-sh--w- c:\documents and settings\pokladna\IECompatCache
2010-06-23 09:41 . 2010-06-23 09:41 -------- d-sh--w- c:\documents and settings\pokladna\PrivacIE
2010-06-17 12:41 . 2008-04-14 02:21 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll
2010-06-17 12:41 . 2008-04-14 02:21 21504 ----a-w- c:\windows\system32\hidserv.dll
2010-06-17 08:18 . 2010-06-17 08:18 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache
2010-06-17 08:15 . 2010-06-17 08:15 -------- d-----w- c:\windows\ie8updates
2010-06-17 08:15 . 2010-05-06 10:35 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-06-17 08:15 . 2010-05-06 10:35 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-06-17 08:15 . 2010-05-06 10:35 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-17 08:14 . 2010-04-16 11:43 41984 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-06-17 08:10 . 2010-06-17 08:10 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2010-06-17 08:10 . 2010-06-17 08:10 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2010-06-16 11:52 . 2010-06-16 11:52 -------- d-sh--w- c:\documents and settings\pokladna\IETldCache
2010-06-16 10:29 . 2010-07-12 09:41 -------- d-----w- c:\temp\NDP1.1sp1-KB979906-X86
2010-06-16 10:25 . 2010-06-16 10:26 -------- dc-h--w- c:\windows\ie8
2010-06-16 09:14 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-06-16 09:13 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-28 07:49 . 2007-10-29 12:00 484466 ----a-w- c:\windows\system32\perfh005.dat
2010-06-28 07:49 . 2007-10-29 12:00 100466 ----a-w- c:\windows\system32\perfc005.dat
2010-06-17 08:19 . 2008-06-30 18:57 -------- d-----w- c:\program files\Microsoft Silverlight
2010-05-06 10:35 . 2007-10-29 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 17:18 . 2010-05-04 17:18 78336 ------w- c:\windows\system32\ieencode.dll
2010-05-02 08:09 . 2007-10-29 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-04-20 05:32 . 2007-10-29 12:00 285696 ----a-w- c:\windows\system32\atmfd.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-28 8466432]
"nwiz"="nwiz.exe" [2007-08-28 1626112]
"LayoutM"="KLayMgr.exe" [2004-08-26 45056]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-06-15 49152]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2007-10-30 13801]
"TSClientAXDisabler"="c:\windows\Installer\TSClientMsiTrans\tscdsbl.bat" [2008-01-18 2247]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
APC UPS Status.lnk - c:\program files\APC\APC PowerChute Personal Edition\Display.exe [2008-4-17 221247]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleStartMenu"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\C:\0autocheck autochk *

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3182756405-1602495291-529609785-1017\Scripts\Logon\0\0]
"Script"=c:\install\_skripty\mapdisk.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3182756405-1602495291-529609785-1018\Scripts\Logon\0\0]
"Script"=c:\install\_skripty\mapdisk.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3182756405-1602495291-529609785-500\Scripts\Logon\0\0]
"Script"=c:\install\_skripty\mapdisk.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-796845957-220523388-839522115-500\Scripts\Logon\0\0]
"Script"=c:\install\_skripty\mapdisk.cmd

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"5900:TCP"= 5900:TCP:VNC
"123:UDP"= 123:UDP:NTP
"4807:TCP"= 4807:TCP:WWW
"5985:TCP"= 5985:TCP:*:Disabled:Vzdálená správa systému Windows

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14.5.2009 15:47 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [14.5.2009 15:49 94360]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [14.5.2009 15:47 731840]
R2 MSSQL$MYCASH;SQL Server (MYCASH);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [27.5.2009 4:27 29262680]
S3 elomoufiltr;ELO TouchSystems-SRV2;c:\windows\system32\drivers\elofiltr.sys [16.4.2008 12:11 53248]
S3 EloUsb;ELO TouchSystems-SRV;c:\windows\system32\drivers\EloUsb.Sys [16.4.2008 12:11 92032]
S3 HPKBCCID;HP Keyboard Smart Card Driver;c:\windows\system32\drivers\HPKBCCID.sys [16.4.2008 11:47 46976]
S3 STC2DFU;STCII DFU Adapter;c:\windows\system32\drivers\Stc2Dfu.sys [25.10.2004 0:04 7796]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [29.10.2007 14:00 14336]
S4 POSPerformanceCounters;Point Of Service Performance Counters;c:\program files\Microsoft Point Of Service\Microsoft.PointOfService.Service.exe [2.2.2007 0:14 42352]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - ALERTER

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
jupssfoog
.
.
------- Doplňkový sken -------
.
uStart Page = about:blank
TCP: {9F30B67F-1435-4AE8-94EE-5448F2E26187} = 194.228.41.113,194.228.2.61
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-EloTouchscreen - c:\program files\elotouchsystems\EloSetup



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-12 11:42
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-3182756405-1602495291-529609785-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,86,af,93,f7,e9,ce,54,49,94,9a,86,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,86,af,93,f7,e9,ce,54,49,94,9a,86,\
.
Celkový čas: 2010-07-12 11:43:06
ComboFix-quarantined-files.txt 2010-07-12 09:43

Před spuštěním: Volných bajtů: 233 300 389 888
Po spuštění: Volných bajtů: 233 382 105 088

- - End Of File - - BEB286545913FA3A49FE0A5B438A3DEF

[Rudy]

5 položek bylo smazáno. Nastala nějaká změna?

[van]

ano ted uz je to v poradku...navic vymenil ramky a ted je to funguje bez problem
diky diky diky %)

[Rudy]

Nemáte zač!