VIRY.CZ

Dobry den,
zdravim po te ctyrdenni pauze, vyplnenou cestou do Cech. Pokud je vam to mozne, prosim o kontrolu noveho logu z CF.
CF jsem stahl novy a jel doporucenou operaci.
Novy log z CF je tento:
ComboFix 10-09-24.03 - jiri urvalek 25.09.2010 0:13.5.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.47.1044.18.3071.2291 [GMT 2:00]
Kjører fra: c:\documents and settings\jiri urvalek\Skrivebord\ComboFix.exe
Command switches brukt :: c:\documents and settings\jiri urvalek\Skrivebord\CFScript.txt
AV: Norman Security Suite *On-access scanning disabled* (Updated) {EB9EFB40-AE72-4C43-B204-0FCD0E92D5F1}
FW: Norman Security Suite *enabled* {83B29CE9-9DE2-2CB5-9AB3-780D70FF12B0}

ADVARSEL -DENNE MASKINEN HAR IKKE GJENOPPRETTINGSKONSOLLEN INSTALLERT !!

file zipped: c:\programfiler\Norman\Npm\Bin\NmchInjDrv.sys
.

((((((((((((((((((((((((((((((((((((((( Andre slettinger )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programfiler\Norman\Npm\Bin\NmchInjDrv.sys

.
((((((((((((((((((((((((((( Filer Opprettet Fra 2010-08-24 til 2010-09-24 )))))))))))))))))))))))))))))))))
.

2010-09-19 06:14 . 2010-09-19 06:14 -------- d-----w- C:\rsit
2010-09-18 19:27 . 2010-09-18 19:27 -------- d-----w- c:\programfiler\Trend Micro
2010-09-16 05:00 . 2010-09-01 13:52 35136 ----a-w- c:\documents and settings\jiri urvalek\Programdata\Mozilla\Firefox\Profiles\zfgzra06.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2010-09-16 05:00 . 2010-09-01 13:52 32032 ----a-w- c:\documents and settings\jiri urvalek\Programdata\Mozilla\Firefox\Profiles\zfgzra06.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2010-09-16 04:40 . 2010-09-16 04:40 0 ----a-w- c:\windows\nsreg.dat
2010-09-16 04:40 . 2010-09-16 04:40 -------- d-----w- c:\documents and settings\jiri urvalek\Lokale innstillinger\Programdata\Mozilla
2010-09-16 03:39 . 2010-08-19 07:12 68176 ----a-w- c:\windows\system32\drivers\ale_nf64.sys
2010-09-16 03:39 . 2010-08-19 07:12 61472 ----a-w- c:\windows\system32\drivers\ale_nf.sys
2010-09-14 05:16 . 2010-09-24 22:07 -------- d--h--r- c:\documents and settings\jiri urvalek\Siste
2010-09-14 03:25 . 2010-09-14 03:25 -------- d-----w- c:\programfiler\CCleaner
2010-09-13 21:50 . 2010-09-13 21:50 -------- d-----w- c:\programfiler\Alwil Software
2010-09-13 21:50 . 2010-09-13 21:50 -------- d-----w- c:\documents and settings\All Users\Programdata\Alwil Software

.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-18 12:27 . 2005-09-05 15:16 97180 ----a-w- c:\windows\system32\perfc014.dat
2010-09-18 12:27 . 2005-09-05 15:16 491052 ----a-w- c:\windows\system32\perfh014.dat
2010-09-16 05:05 . 2008-09-27 07:56 -------- d-----w- c:\documents and settings\All Users\Programdata\NOS
2010-09-14 05:32 . 2009-12-27 18:42 -------- d-----w- c:\documents and settings\All Users\Programdata\Spybot - Search & Destroy
2010-09-13 18:09 . 2010-05-25 21:43 1 ----a-w- c:\documents and settings\jiri urvalek\Programdata\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-09-08 20:34 . 2010-04-24 19:31 -------- d-----w- c:\documents and settings\jiri urvalek\Programdata\Skype
2010-09-08 17:47 . 2010-04-24 19:39 -------- d-----w- c:\documents and settings\jiri urvalek\Programdata\skypePM
2010-08-26 14:41 . 2010-04-17 18:43 -------- d-----w- c:\programfiler\SureThing Express Labeler
2010-08-25 17:06 . 2010-08-25 17:06 -------- d-----w- c:\documents and settings\Administrator\Programdata\Share-to-Web-opplastingsmappe
2010-08-25 05:40 . 2010-08-24 18:56 -------- dc-h--w- c:\documents and settings\All Users\Programdata\{92E7A367-8E12-4830-AA70-29C32E331A81}
2010-08-24 19:04 . 2010-08-24 19:00 -------- d-----w- c:\programfiler\Spybot - Search & Destroy
2010-08-24 18:57 . 2010-08-24 18:57 -------- d-----w- c:\documents and settings\jiri urvalek\Programdata\Uniblue
2010-08-19 18:53 . 2010-06-15 21:10 -------- d-----w- c:\programfiler\YouTube Downloader
2010-08-17 13:17 . 2005-09-05 15:16 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-07-22 15:46 . 2005-09-05 15:16 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 06:19 . 2008-05-05 05:25 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2010-07-07 17:38 . 2010-07-07 17:38 501936 ----a-w- c:\documents and settings\All Users\Programdata\Google\Google Toolbar\Update\gtb15.tmp.exe
2010-06-30 12:33 . 2005-09-05 15:16 149504 ----a-w- c:\windows\system32\schannel.dll
2003-01-13 09:20 . 2005-09-06 09:57 278528 ----a-w- c:\programfiler\internet explorer\plugins\PanoViewer.dll
1999-04-30 14:00 . 2005-09-06 09:57 98304 ----a-w- c:\programfiler\internet explorer\plugins\UPjpeg.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-09-19_13.39.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-09-24 20:53 . 2010-09-24 20:53 16384 c:\windows\Temp\Perflib_Perfdata_798.dat
.
(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\programfiler\Windows Media Player\WMPNSCFG.exe" [2006-11-15 204288]
"SpybotSD TeaTimer"="c:\programfiler\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2005-01-17 84480]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 77824]
"CARPService"="carpserv.exe" [2003-03-18 4608]
"CHotkey"="mHotkey.exe" [2004-12-08 550912]
"ledpointer"="CNYHKey.exe" [2004-03-02 5576704]
"PCMService"="c:\programfiler\CyberLink\PowerCinema\PCMService.exe" [2005-07-08 127118]
"SunJavaUpdateSched"="c:\programfiler\Fellesfiler\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Norman ZANDA"="c:\programfiler\Norman\Npm\Bin\ZLH.EXE" [2010-01-29 189824]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-03-16 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-03-16 13670504]
"Adobe Reader Speed Launcher"="c:\programfiler\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\programfiler\Fellesfiler\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"Share-to-Web Namespace Daemon"="c:\programfiler\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 57344]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-06-13 127036]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\jiri urvalek\Start-meny\Programmer\Oppstart\
OpenOffice.org 3.2.lnk - c:\programfiler\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]
Picture Motion Browser Media Check Tool.lnk - c:\programfiler\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2010-4-28 385024]

c:\documents and settings\All Users\Start-meny\Programmer\Oppstart\
Adobe Gamma Loader.lnk - c:\programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe [2010-5-8 113664]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programfiler\\CyberLink\\PowerCinema\\PowerCinema.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programfiler\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Programfiler\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Programfiler\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Programfiler\\Spotify\\spotify.exe"=
"c:\\Programfiler\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programfiler\\AVS4YOU\\Registration.exe"=
"c:\\Programfiler\\Skype\\Phone\\Skype.exe"=
"c:\\Programfiler\\Mozilla Firefox\\firefox.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 NGS;Norman General Security Driver;c:\programfiler\Norman\Ngs\Bin\ngs.sys [01.06.2010 22:28 26744]
R1 NPROSEC;Norman Security driver;c:\programfiler\Norman\Ngs\Bin\nprosec.sys [01.06.2010 22:28 72392]
R1 tdi_nf;Norman Network Filter TDIL driver;c:\windows\system32\drivers\tdi_nf.sys [01.06.2010 22:28 376136]
R2 Application Updater;Application Updater;c:\programfiler\Application Updater\ApplicationUpdater.exe [19.02.2010 19:43 380928]
R2 MamutSyncService;Mamut Synchronization Service;c:\programfiler\Mamut\Synchronization\Mamut.SynchronizationService.SynchronizationWindowsService.exe [22.01.2010 08:26 16384]
R2 MSSQL$MAMUT;SQL Server (MAMUT);c:\programfiler\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [10.02.2007 05:29 29178224]
R2 Ndiskio;Ndiskio;c:\programfiler\Norman\Nse\Bin\Ndiskio.sys [05.04.2010 21:56 22880]
R2 NNFSVC;Norman Network Filtering service;c:\programfiler\Norman\Ngs\Bin\nnf.exe [01.06.2010 22:28 219904]
R2 NPFSvc32;Norman Personal Firewall Service;c:\programfiler\Norman\Npf\Bin\npfsvc32.exe [16.09.2010 05:39 288936]
R2 NPROSECSVC;Norman Security service;c:\programfiler\Norman\Ngs\Bin\nprosec.exe [01.06.2010 22:28 103016]
R2 nregsec;Norman Registry Security driver;c:\programfiler\Norman\Ngs\Bin\nregsec.sys [01.06.2010 22:28 40384]
R2 NVOY;Norman Resource Provider;c:\programfiler\Norman\Npm\Bin\nvoy.exe [05.04.2010 21:57 98776]
R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [06.09.2005 10:51 799744]
R3 IMT0521;Inmax USB IMT-0521 Smartcard Reader;c:\windows\system32\drivers\IMT0521.sys [06.09.2005 11:06 34825]
R3 nnetsec;Norman Network Security service;c:\windows\system32\drivers\nnetsec.sys [01.06.2010 22:28 48272]
R3 NNetSecC;Norman Network Filter NDIS common driver;c:\programfiler\Norman\Ngs\Bin\nnetsecc.sys [01.06.2010 22:28 29968]
R3 nsesvc;Norman Scanner Engine Service;c:\programfiler\Norman\Nse\Bin\Nsesvc.exe [17.06.2010 20:59 282624]
R3 NvcMFlt;NvcMFlt;c:\windows\system32\drivers\nvcw32mf.sys [05.04.2010 21:56 21832]
R3 nvcoas;Norman Virus Control on-access component;c:\programfiler\Norman\nvc\bin\Nvcoas.exe [17.08.2010 00:10 210248]
R3 Scheduler;Norman Scheduler Service;c:\programfiler\Norman\Npm\Bin\scheduler.exe [05.04.2010 21:57 133272]
S2 gupdate;Googles oppdateringstjeneste (gupdate);c:\programfiler\Google\Update\GoogleUpdate.exe [05.04.2010 20:49 135664]
S3 nosGetPlusHelper;getPlus(R) Helper 3004;c:\windows\System32\svchost.exe -k nosGetPlusHelper [05.09.2005 17:16 14336]
S3 SCR33X USB Smart Card Reader;SCR33X USB Smart Card Reader;c:\windows\system32\drivers\SCR33X2K.sys [06.09.2005 11:06 63608]

--- Andre tjenester/drivere lastet i minnet ---

*Deregistered* - mchInjDrv

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver)

2010-09-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programfiler\Google\Update\GoogleUpdate.exe [2010-04-05 18:49]

2010-09-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programfiler\Google\Update\GoogleUpdate.exe [2010-04-05 18:49]
.
.
------- Tilleggsskanning -------
.
uStart Page = hxxp://www.gmx.net/
uInternet Connection Wizard,ShellNext = hxxp://www.targa.co.uk/
IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki - c:\programfiler\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
LSP: c:\programfiler\Norman\ngs\bin\nlf.dll
FF - ProfilePath - c:\documents and settings\jiri urvalek\Programdata\Mozilla\Firefox\Profiles\zfgzra06.default\
FF - prefs.js: browser.startup.homepage - hxxp://gmx.de
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\documents and settings\jiri urvalek\Programdata\Mozilla\Firefox\Profiles\zfgzra06.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\programfiler\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\programfiler\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\programfiler\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\programfiler\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\programfiler\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".no");
c:\programfiler\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-25 00:17
Windows 5.1.2600 Service Pack 3 NTFS

skanner skjulte prosesser ...

skanner skjulte autostart-oppføringer ...

skanner skjulte filer ...

skanning vellykket
skjulte filer: 0

**************************************************************************
.
--------------------- LÅSTE REGISTERNØKLER ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Tidspunkt ferdig: 2010-09-25 00:19:09
ComboFix-quarantined-files.txt 2010-09-24 22:19
ComboFix2.txt 2010-09-19 18:36
ComboFix3.txt 2010-09-19 16:21
ComboFix4.txt 2010-09-19 15:56
ComboFix5.txt 2010-09-24 22:12

Pre-Run: 160 043 814 912 byte ledig
Post-Run: 160 044 687 360 byte ledig

- - End Of File - - 53E137988CA545B845A000325251E02E
Opplasting vellykket

Smazáno. Nastala nějaká změna?

Jak IE tak Fire Fox ukazuji zlepseni. Ale stejne po naskoceni te ktere webove stranky a pokusu poklepem mysi na nejaky dalsi odkaz, se objevi hlaseni chyby- nemuze najit adresu. Avsak po nekolikerem opakovani (5-10x) odkaz prece jenom naskoci.
Tuto odpoved jsem take startoval asi 10x ...

Restartujte modem, příp další sít. prvek v datové cestě. Také můžete smazat cache prohlížeče.