VIRY.CZ

vy jste vlastne v nouzovem rezimu, tam by mela byt Avira neaktivni...Takze CF spustte, pokud bude kricet, ze je aktivni, tak ignorujte a odkliknete

ComboFix 12-01-26.01 - Administrator 26.01.2012 12:20:17.1.2 - x86 NETWORK
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3032.2607 [GMT 1:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\program files\AVG Antivirus 2011
c:\program files\Common Files\Temp
c:\windows\EventSystem.log
c:\windows\msmqinst.log
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\ST6UNST.000
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\ICAutoUpdate.log
c:\windows\system32\Thumbs.db
c:\windows\unin0407.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-12-26 do 2012-01-26 )))))))))))))))))))))))))))))))
.
.
2012-01-26 10:39 . 2012-01-26 10:39 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Avira
2012-01-26 10:00 . 2012-01-26 10:00 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Mozilla
2012-01-24 22:12 . 2012-01-24 22:13 -------- d-----w- c:\program files\trend micro
2012-01-24 22:12 . 2012-01-24 22:13 -------- d-----w- C:\rsit
2012-01-23 23:09 . 2012-01-23 23:09 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2012-01-23 23:09 . 2005-10-14 21:42 46592 ----a-w- c:\windows\system32\hpzll43a.dll
2012-01-23 23:09 . 2005-10-14 21:41 72192 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzpp43a.dll
2012-01-23 23:09 . 2008-04-13 23:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2012-01-23 23:09 . 2008-04-13 23:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2012-01-23 23:08 . 2005-03-14 12:39 65536 ----a-w- c:\windows\system32\HPZinw12.exe
2012-01-23 23:08 . 2005-03-14 11:05 204800 ----a-w- c:\windows\system32\HPZipr12.dll
2012-01-23 23:08 . 2005-03-14 11:05 69632 ----a-w- c:\windows\system32\HPZipm12.exe
2012-01-23 23:08 . 2005-03-14 11:03 278584 ----a-w- c:\windows\system32\HPZidr12.dll
2012-01-23 23:08 . 2005-03-08 10:55 57344 ----a-w- c:\windows\system32\HPZisn12.dll
2012-01-23 23:08 . 2005-03-08 10:55 94208 ----a-w- c:\windows\system32\HPZipt12.dll
2012-01-23 23:08 . 1998-10-29 15:45 306688 ----a-w- c:\windows\IsUninst.exe
2012-01-23 23:08 . 2012-01-23 23:08 -------- d-----w- c:\program files\HP
2012-01-23 23:07 . 2005-10-28 01:24 21568 ----a-w- c:\windows\system32\drivers\HPZius12.sys
2012-01-23 23:07 . 2005-10-28 01:24 16496 ----a-w- c:\windows\system32\drivers\HPZipr12.sys
2012-01-23 23:07 . 2005-10-28 01:24 49664 ----a-w- c:\windows\system32\drivers\HPZid412.sys
2012-01-23 23:07 . 2005-09-09 23:28 98304 ----a-w- c:\windows\system32\hpzjsn01.dll
2012-01-23 23:07 . 2005-10-28 23:11 602112 ----a-w- c:\windows\system32\hpowiax2.dll
2012-01-23 23:07 . 2005-10-28 23:11 614400 ----a-w- c:\windows\system32\hpotscl2.dll
2012-01-23 23:07 . 2005-10-28 23:11 254026 ----a-w- c:\windows\system32\hpovst09.dll
2012-01-23 23:07 . 2005-10-28 01:23 77824 ----a-w- c:\windows\system32\hpzids01.dll
2012-01-23 23:07 . 2005-10-28 01:23 282624 ----a-w- c:\windows\system32\HPZc3212.dll
2012-01-23 22:34 . 2008-04-13 23:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2012-01-23 22:34 . 2008-04-13 23:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2012-01-22 11:26 . 2012-01-22 11:26 -------- d-----w- c:\program files\WMHelp Software
2012-01-19 14:08 . 2012-01-19 14:08 -------- d-----w- c:\documents and settings\Guest\Local Settings\Data aplikací\Google
2012-01-17 12:15 . 2012-01-17 12:17 -------- d-----w- c:\program files\KompoZer 0.7.10
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-08 17:57 . 2011-11-24 19:06 134856 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-11-25 21:57 . 2008-08-06 13:30 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-11-23 14:40 . 2008-08-06 13:30 1859584 ------w- c:\windows\system32\win32k.sys
2011-11-20 08:00 . 2011-08-19 14:17 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-20 06:12 . 2008-08-06 13:30 60416 ------w- c:\windows\system32\packager.exe
2011-11-16 14:21 . 2008-08-06 13:30 354816 ----a-w- c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2008-08-06 13:30 152064 ----a-w- c:\windows\system32\schannel.dll
2011-11-03 15:29 . 2008-08-06 13:30 386560 ------w- c:\windows\system32\qdvd.dll
2011-11-03 15:29 . 2008-08-06 13:30 1294848 ------w- c:\windows\system32\quartz.dll
2011-11-01 16:07 . 2008-08-06 13:30 1288192 ----a-w- c:\windows\system32\ole32.dll
2011-10-31 23:37 . 2008-08-06 13:30 832512 ----a-w- c:\windows\system32\wininet.dll
2011-10-31 23:37 . 2008-08-06 13:30 1830912 ------w- c:\windows\system32\inetcpl.cpl
2011-10-31 23:37 . 2008-08-06 13:29 78336 ------w- c:\windows\system32\ieencode.dll
2011-10-31 23:37 . 2008-08-06 13:29 17408 ------w- c:\windows\system32\corpol.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-09-23 258512]
"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2008-08-08 10:14 28672 ------w- c:\program files\Lenovo\HOTKEY\tphklock.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^McAfee Security Scan Plus.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Remote Control.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\Remote Control.lnk
backup=c:\windows\pss\Remote Control.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^VPN Client.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\VPN Client.lnk
backup=c:\windows\pss\VPN Client.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Lenka Procházková^Nabídka Start^Programy^Po spuštění^OpenOffice.org 2.0.lnk]
path=c:\documents and settings\Lenka Procházková\Nabídka Start\Programy\Po spuštění\OpenOffice.org 2.0.lnk
backup=c:\windows\pss\OpenOffice.org 2.0.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-07 22:58 37296 ------w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
2008-03-26 12:58 163840 ------w- c:\program files\Apoint2K\Apoint.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
2007-08-16 11:24 167368 ------w- c:\program files\DAEMON Tools\daemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-08-15 07:06 178712 ------w- c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-08-15 07:06 150040 ------w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LPManager]
2007-04-26 17:10 120368 ------w- c:\progra~1\Lenovo\LENOVO~2\LPMGR.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 12:57 153136 ------w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-08-15 07:06 150040 ------w- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMHandler]
2008-09-23 08:56 83240 ------w- c:\progra~1\Lenovo\PMDriver\PMHandler.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-07-05 16:36 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2008-04-25 06:15 244208 ------w- c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartAudio]
2008-07-21 03:19 2701880 ------w- c:\program files\CONEXANT\SmartAudio\SmAudio.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 09:43 248040 ------w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TiVme Agent]
2010-01-25 20:16 114688 ----a-w- c:\program files\GIGABYTE\vivoTV\ScheduleAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2009-10-30 16:16 198160 ------w- c:\program files\Common Files\Real\Update_OB\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPFNF7]
2008-07-30 19:00 60192 ------w- c:\program files\Lenovo\NPDIRECT\tpfnf7sp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPWAUDAP]
2008-03-11 04:33 54560 ------w- c:\program files\Lenovo\HOTKEY\TpWAudAp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TVT Scheduler Proxy]
2008-11-24 13:42 487424 ------w- c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2009-07-01 16:37 37888 ------w- c:\program files\Winamp\winampa.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"stllssvr"=3 (0x3)
"RoxWatch10"=2 (0x2)
"RoxMediaDB10"=3 (0x3)
"RoxLiveShare10"=2 (0x2)
"Roxio Upnp Server 10"=2 (0x2)
"Roxio UPnP Renderer 10"=3 (0x3)
"McComponentHostService"=3 (0x3)
"Bonjour Service"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [29.8.2009 20:52 685816]
R1 PMHler;PMHler;c:\windows\system32\drivers\PMHler.sys [24.5.2006 10:48 10240]
S1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [24.11.2011 20:06 36000]
S1 tvtumon;tvtumon;c:\windows\system32\drivers\tvtumon.sys [9.5.2008 16:50 46144]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [24.11.2011 20:06 86224]
S2 FNF5SVC;Fn+F5 Service;c:\program files\Lenovo\HOTKEY\FnF5svc.exe [11.9.2008 7:49 54560]
S2 SessionLauncher;SessionLauncher;c:\docume~1\ADMINI~1\LOCALS~1\Temp\DX9\SessionLauncher.exe --> c:\docume~1\ADMINI~1\LOCALS~1\Temp\DX9\SessionLauncher.exe [?]
S2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe [24.11.2008 14:34 520192]
S2 TVT_UpdateMonitor;TVT Windows Update Monitor;c:\program files\Lenovo\Rescue and Recovery\UpdateMonitor.exe [9.5.2008 16:50 360448]
S3 602SQL 8 FastCGI Client;602SQL 8 FastCGI Client;c:\program files\Software602\602SQL95\602FSVC8.EXE --> c:\program files\Software602\602SQL95\602FSVC8.EXE [?]
S3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [24.5.2009 10:40 97536]
S3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys [3.12.2011 13:06 143264]
S3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\drivers\RTL2832UUSB.sys [3.12.2011 13:06 32800]
S3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [22.2.2008 14:54 37312]
S3 vm331avs;Lenovo EasyCamera;c:\windows\system32\drivers\vm331avs.sys [24.5.2009 10:39 974336]
S4 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [25.4.2008 7:18 313840]
S4 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files\Roxio\Digital Home 10\RoxioUpnpService10.exe [25.4.2008 7:18 362992]
S4 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [25.4.2008 7:16 309744]
S4 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [25.4.2008 7:15 1120752]
S4 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [25.4.2008 7:15 166384]
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MDMXSDK
.
Obsah adresáře 'Naplánované úlohy'
.
2012-01-25 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-02-12 13:54]
.
2011-03-14 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PCDR5\pcdr5cuiw32.exe [2008-12-12 23:32]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://lenovo.live.com
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
TCP: DhcpNameServer = 192.168.1.254
Handler: wmh - {A1428E78-2D00-4590-A071-0CC9700A7768} - c:\program files\WMHelp Software\WMHelp XmlPad\WmhASPP.dll
FF - ProfilePath - c:\documents and settings\Administrator\Data aplikací\Mozilla\Firefox\Profiles\84l5vwf5.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\program files\Real\RealPlayer\browserrecord\firefox\ext
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
MSConfigStartUp-ApnUpdater - c:\program files\Ask.com\Updater\Updater.exe
MSConfigStartUp-D211STRT - c:\program files\Nokia\Nokia D211\D211STRT.EXE
AddRemove-Kalender - c:\windows\Uninstall_tkexe -kalender
AddRemove-PC-Bibliothek Express - c:\windows\unin0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-26 12:23
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1256)
c:\program files\Lenovo\HOTKEY\tphklock.dll
.
Celkový čas: 2012-01-26 12:24:52
ComboFix-quarantined-files.txt 2012-01-26 11:24
.
Před spuštěním: Volných bajtů: 69 264 089 088
Po spuštění: Volných bajtů: 70 176 792 576
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - B406B7B8E177094A5A4AC05060D0F66B

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Registry::
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "UpdatePDRShortCut"=-
  "UpdatePPShortCut"=-
  [-HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^McAfee Security Scan Plus.lnk]
  [-HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^Remote Control.lnk]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
  
  Driver::
  SessionLauncher
  gusvc
  
  File::
  c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
  C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3019881454-4033070896-1918892937-1008Core.job
  C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3019881454-4033070896-1918892937-1008UA.job
  
  Folder::
  C:\Program Files\Winamp Toolbar
  
  ClearJavaCache::
  
  AtJob::
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

windows nabehl. uz nejsem v nouzovem rezimu. A tady je ten log:

ComboFix 12-01-26.01 - Administrator 26.01.2012 13:12:51.2.2 - x86 NETWORK
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3032.2679 [GMT 1:00]
Spuštěný z: c:\documents and settings\Administrator\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Administrator\Plocha\CFScript.txt
AV: Avira Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
FILE ::
"c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-3019881454-4033070896-1918892937-1008Core.job"
"c:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-3019881454-4033070896-1918892937-1008UA.job"
"c:\windows\Tasks\Check Updates for Windows Live Toolbar.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Winamp Toolbar
c:\program files\Winamp Toolbar\apopup.dll
c:\program files\Winamp Toolbar\install.log
c:\program files\Winamp Toolbar\msvcr71.dll
c:\program files\Winamp Toolbar\uninstall.exe
c:\program files\Winamp Toolbar\winamptb.dll
c:\program files\Winamp Toolbar\winampTbServer.exe
c:\program files\Winamp Toolbar\winamptbServerPS.dll
c:\program files\Winamp Toolbar\xprt5.dll
c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_GUSVC
-------\Legacy_SESSIONLAUNCHER
-------\Service_gusvc
-------\Service_SessionLauncher
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-12-26 do 2012-01-26 )))))))))))))))))))))))))))))))
.
.
2012-01-26 10:39 . 2012-01-26 10:39 -------- d-----w- c:\documents and settings\Administrator\Data aplikací\Avira
2012-01-26 10:00 . 2012-01-26 10:00 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Data aplikací\Mozilla
2012-01-24 22:12 . 2012-01-24 22:13 -------- d-----w- c:\program files\trend micro
2012-01-24 22:12 . 2012-01-24 22:13 -------- d-----w- C:\rsit
2012-01-23 23:09 . 2012-01-23 23:09 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2012-01-23 23:09 . 2005-10-14 21:42 46592 ----a-w- c:\windows\system32\hpzll43a.dll
2012-01-23 23:09 . 2005-10-14 21:41 72192 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzpp43a.dll
2012-01-23 23:09 . 2008-04-13 23:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2012-01-23 23:09 . 2008-04-13 23:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2012-01-23 23:08 . 2005-03-14 12:39 65536 ----a-w- c:\windows\system32\HPZinw12.exe
2012-01-23 23:08 . 2005-03-14 11:05 204800 ----a-w- c:\windows\system32\HPZipr12.dll
2012-01-23 23:08 . 2005-03-14 11:05 69632 ----a-w- c:\windows\system32\HPZipm12.exe
2012-01-23 23:08 . 2005-03-14 11:03 278584 ----a-w- c:\windows\system32\HPZidr12.dll
2012-01-23 23:08 . 2005-03-08 10:55 57344 ----a-w- c:\windows\system32\HPZisn12.dll
2012-01-23 23:08 . 2005-03-08 10:55 94208 ----a-w- c:\windows\system32\HPZipt12.dll
2012-01-23 23:08 . 1998-10-29 15:45 306688 ----a-w- c:\windows\IsUninst.exe
2012-01-23 23:08 . 2012-01-23 23:08 -------- d-----w- c:\program files\HP
2012-01-23 23:07 . 2005-10-28 01:24 21568 ----a-w- c:\windows\system32\drivers\HPZius12.sys
2012-01-23 23:07 . 2005-10-28 01:24 16496 ----a-w- c:\windows\system32\drivers\HPZipr12.sys
2012-01-23 23:07 . 2005-10-28 01:24 49664 ----a-w- c:\windows\system32\drivers\HPZid412.sys
2012-01-23 23:07 . 2005-09-09 23:28 98304 ----a-w- c:\windows\system32\hpzjsn01.dll
2012-01-23 23:07 . 2005-10-28 23:11 602112 ----a-w- c:\windows\system32\hpowiax2.dll
2012-01-23 23:07 . 2005-10-28 23:11 614400 ----a-w- c:\windows\system32\hpotscl2.dll
2012-01-23 23:07 . 2005-10-28 23:11 254026 ----a-w- c:\windows\system32\hpovst09.dll
2012-01-23 23:07 . 2005-10-28 01:23 77824 ----a-w- c:\windows\system32\hpzids01.dll
2012-01-23 23:07 . 2005-10-28 01:23 282624 ----a-w- c:\windows\system32\HPZc3212.dll
2012-01-23 22:34 . 2008-04-13 23:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2012-01-23 22:34 . 2008-04-13 23:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2012-01-22 11:26 . 2012-01-22 11:26 -------- d-----w- c:\program files\WMHelp Software
2012-01-19 14:08 . 2012-01-19 14:08 -------- d-----w- c:\documents and settings\Guest\Local Settings\Data aplikací\Google
2012-01-17 12:15 . 2012-01-17 12:17 -------- d-----w- c:\program files\KompoZer 0.7.10
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-08 17:57 . 2011-11-24 19:06 134856 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-11-25 21:57 . 2008-08-06 13:30 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-11-23 14:40 . 2008-08-06 13:30 1859584 ------w- c:\windows\system32\win32k.sys
2011-11-20 08:00 . 2011-08-19 14:17 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-20 06:12 . 2008-08-06 13:30 60416 ------w- c:\windows\system32\packager.exe
2011-11-16 14:21 . 2008-08-06 13:30 354816 ----a-w- c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2008-08-06 13:30 152064 ----a-w- c:\windows\system32\schannel.dll
2011-11-03 15:29 . 2008-08-06 13:30 386560 ------w- c:\windows\system32\qdvd.dll
2011-11-03 15:29 . 2008-08-06 13:30 1294848 ------w- c:\windows\system32\quartz.dll
2011-11-01 16:07 . 2008-08-06 13:30 1288192 ----a-w- c:\windows\system32\ole32.dll
2011-10-31 23:37 . 2008-08-06 13:30 832512 ----a-w- c:\windows\system32\wininet.dll
2011-10-31 23:37 . 2008-08-06 13:30 1830912 ------w- c:\windows\system32\inetcpl.cpl
2011-10-31 23:37 . 2008-08-06 13:29 78336 ------w- c:\windows\system32\ieencode.dll
2011-10-31 23:37 . 2008-08-06 13:29 17408 ------w- c:\windows\system32\corpol.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-01-26_11.23.46 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-01-26 12:16 . 2012-01-26 12:16 16384 c:\windows\temp\Perflib_Perfdata_50c.dat
+ 2008-08-06 13:30 . 2012-01-26 12:18 89364 c:\windows\system32\perfc009.dat
+ 2008-08-06 13:30 . 2012-01-26 12:18 488614 c:\windows\system32\perfh009.dat
+ 2008-08-06 13:30 . 2012-01-26 12:18 485226 c:\windows\system32\perfh005.dat
+ 2008-08-06 13:30 . 2012-01-26 12:18 100720 c:\windows\system32\perfc005.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-09-23 258512]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2008-08-08 10:14 28672 ------w- c:\program files\Lenovo\HOTKEY\tphklock.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Nabídka Start^Programy^Po spuštění^VPN Client.lnk]
path=c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\VPN Client.lnk
backup=c:\windows\pss\VPN Client.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^Lenka Procházková^Nabídka Start^Programy^Po spuštění^OpenOffice.org 2.0.lnk]
path=c:\documents and settings\Lenka Procházková\Nabídka Start\Programy\Po spuštění\OpenOffice.org 2.0.lnk
backup=c:\windows\pss\OpenOffice.org 2.0.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
2008-03-26 12:58 163840 ------w- c:\program files\Apoint2K\Apoint.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-08-15 07:06 178712 ------w- c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-08-15 07:06 150040 ------w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LPManager]
2007-04-26 17:10 120368 ------w- c:\progra~1\Lenovo\LENOVO~2\LPMGR.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-08-15 07:06 150040 ------w- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMHandler]
2008-09-23 08:56 83240 ------w- c:\progra~1\Lenovo\PMDriver\PMHandler.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartAudio]
2008-07-21 03:19 2701880 ------w- c:\program files\CONEXANT\SmartAudio\SmAudio.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TiVme Agent]
2010-01-25 20:16 114688 ----a-w- c:\program files\GIGABYTE\vivoTV\ScheduleAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPFNF7]
2008-07-30 19:00 60192 ------w- c:\program files\Lenovo\NPDIRECT\tpfnf7sp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPWAUDAP]
2008-03-11 04:33 54560 ------w- c:\program files\Lenovo\HOTKEY\TpWAudAp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TVT Scheduler Proxy]
2008-11-24 13:42 487424 ------w- c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"stllssvr"=3 (0x3)
"RoxWatch10"=2 (0x2)
"RoxMediaDB10"=3 (0x3)
"RoxLiveShare10"=2 (0x2)
"Roxio Upnp Server 10"=2 (0x2)
"Roxio UPnP Renderer 10"=3 (0x3)
"McComponentHostService"=3 (0x3)
"Bonjour Service"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [29.8.2009 20:52 685816]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [24.11.2011 20:06 36000]
R1 PMHler;PMHler;c:\windows\system32\drivers\PMHler.sys [24.5.2006 10:48 10240]
R1 tvtumon;tvtumon;c:\windows\system32\drivers\tvtumon.sys [9.5.2008 16:50 46144]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [24.11.2011 20:06 86224]
R2 FNF5SVC;Fn+F5 Service;c:\program files\Lenovo\HOTKEY\FnF5svc.exe [11.9.2008 7:49 54560]
R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe [24.11.2008 14:34 520192]
R2 TVT_UpdateMonitor;TVT Windows Update Monitor;c:\program files\Lenovo\Rescue and Recovery\UpdateMonitor.exe [9.5.2008 16:50 360448]
R3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [24.5.2009 10:40 97536]
R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [22.2.2008 14:54 37312]
R3 vm331avs;Lenovo EasyCamera;c:\windows\system32\drivers\vm331avs.sys [24.5.2009 10:39 974336]
S3 602SQL 8 FastCGI Client;602SQL 8 FastCGI Client;c:\program files\Software602\602SQL95\602FSVC8.EXE --> c:\program files\Software602\602SQL95\602FSVC8.EXE [?]
S3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys [3.12.2011 13:06 143264]
S3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\drivers\RTL2832UUSB.sys [3.12.2011 13:06 32800]
S4 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [25.4.2008 7:18 313840]
S4 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files\Roxio\Digital Home 10\RoxioUpnpService10.exe [25.4.2008 7:18 362992]
S4 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [25.4.2008 7:16 309744]
S4 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [25.4.2008 7:15 1120752]
S4 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [25.4.2008 7:15 166384]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ef57eaac-94d4-11de-842d-0022fadd0ea4}]
\Shell\AutoRun\command - E:\WDSetup.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ef5eba77-52ed-11df-8543-00235a1a8da4}]
\Shell\AutoRun\command - opdux.exe
\Shell\open\Command - opdux.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2011-03-14 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PCDR5\pcdr5cuiw32.exe [2008-12-12 23:32]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://lenovo.live.com
uInternet Settings,ProxyOverride = *.local
IE: &Winamp Search - c:\documents and settings\All Users\Data aplikací\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Open with XmlPad - c:\program files\WMHelp Software\WMHelp XmlPad\WmhASPP.dll/101
TCP: DhcpNameServer = 192.168.1.254
Handler: wmh - {A1428E78-2D00-4590-A071-0CC9700A7768} - c:\program files\WMHelp Software\WMHelp XmlPad\WmhASPP.dll
FF - ProfilePath - c:\documents and settings\Lenka Procházková\Data aplikací\Mozilla\Firefox\Profiles\pmxqx596.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - prefs.js: network.proxy.type - 4
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: HashColouredTabs+: hashcolouredtabs@bristol.ac.uk - %profile%\extensions\hashcolouredtabs@bristol.ac.uk
FF - Ext: EBrary Reader Plugin: reader_plugin@ebrary.com - %profile%\extensions\reader_plugin@ebrary.com
FF - Ext: ColorfulTabs: {0545b830-f0aa-4d7e-8820-50a4629a56fe} - %profile%\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
FF - Ext: Winamp Toolbar: {0b38152b-1b20-484d-a11f-5e04a9b0661f} - %profile%\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Scribblies Kids: {33A8946C-B859-4f7d-8382-ADAB29623DEE} - %profile%\extensions\{33A8946C-B859-4f7d-8382-ADAB29623DEE}
FF - Ext: Scribblies Plain: {558D3F58-1E89-4fe2-A1F1-5EADC7BC77CB} - %profile%\extensions\{558D3F58-1E89-4fe2-A1F1-5EADC7BC77CB}
FF - Ext: Citavi Picker: {8AA36F4F-6DC7-4c06-77AF-5035170634FE} - %profile%\extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}
FF - Ext: Red Cats (green flavor): {dd30bf68-268a-4815-ad48-8740b774c764} - %profile%\extensions\{dd30bf68-268a-4815-ad48-8740b774c764}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\program files\Real\RealPlayer\browserrecord\firefox\ext
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
URLSearchHooks-{57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - c:\program files\Winamp Toolbar\winamptb.dll
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-Winamp Toolbar - c:\program files\Winamp Toolbar\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-26 13:17
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
.
- - - - - - - > 'winlogon.exe'(1368)
c:\program files\Lenovo\HOTKEY\tphklock.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Lenovo\PMDriver\PMSveH.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
c:\program files\Lenovo\Rescue and Recovery\rrservice.exe
c:\program files\Common Files\Lenovo\Scheduler\tvtsched.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\lenovo\system update\suservice.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2012-01-26 13:21:03 - počítač byl restartován
ComboFix-quarantined-files.txt 2012-01-26 12:21
ComboFix2.txt 2012-01-26 11:24
.
Před spuštěním: Volných bajtů: 70 188 498 944
Po spuštění: Volných bajtů: 66 791 796 736
.
- - End Of File - - 20720BCA34527D7856185A0E7086ED2D

A jak se chova nas pacient

bohuzel se jeste nevylecil. Kdyz otevru nejakou windows aplikaci (jako treba tento pocitac), tak mi blika radek s adresou

Jak to myslite "radek s adresou"?? pripadne dejte screen

no radkem s adresou jsem myslela "panel adresa" -> to, kde se objevuje nabídka na Tento počítač, Disk C, Disk D, Dokumenty, Plocha, Koš atd. Problem je v tom, ze kdyz otevru jakou koliv aplikaci, ktera tento rozbalovaci radek ma (napr. Tento pocitac, internetovy prohlizec) nebo kdyz si chci dokumenty ulozi, tak se ten panel porad otvira a zavira a pak zacne strasne rychle blikat a vlastne mi tim znemoznuje temer jakoukoliv praci s aplikaci...

Bohuzel mi neslo primo vlozit prilohu (viz to popsane blikani), takze tady prikladam link na webalbum. Snad je to z tech obrazku pochopitelne
https://picasaweb.google.com/lenny.proc ... directlink

Jasny, pochopeno

Stahnete Malwarebytes' Anti-Malware (zkracene MBAM) (viz muj podpis)

• Provedte aktualizaci
• Provedte uplny sken - nic nemazte
• MBAM miva obcas falesne detekce, proto vlozte log do prispevku a pockejte na posouzeni

ok. dobre. provedu. Jenom jsem se chtela zepat, mam se zase presunout do nouzoveho rezimu? Nebo muzu mit zapnute "normalni" windows.

Muzete "normalni"

Dobry den,
tady je log z mbam:

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware) 1.60.1.1000
www.malwarebytes.org

Verze databáze: v2012.01.13.04

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 7.0.5730.13
Lenka Procházková :: LENNIWO [administrátor]

Ochrana: Povolena

5.2.2012 13:47:47
mbam-log-2012-02-05 (17-08-59).txt

Typ: Úplná kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 405255
Uplynulý čas: 3 hodin, 14 minut, 18 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 2
C:\Documents and Settings\Lenka Procházková\Local Settings\Temp\ICReinstall\cnet2_XmlPad3_02a_zip.exe (PUP.CNET.Adware.Bundle) -> Žádná instrukce nebyla provedena.
C:\Documents and Settings\Lenny P\Dokumenty\Stažené soubory\cnet2_XmlPad3_02a_zip.exe (PUP.CNET.Adware.Bundle) -> Žádná instrukce nebyla provedena.

(konec)

Nalezy smazte a popiste soucastne problemy

Dobry den,

vypada to, ze je pocitac vylecen.

Moc dekuji za pomoc!

Fajn, tak uklidime

Odinstalujte Combofix

• Prejmenujte ComboFix na Uninstall
• Spustte jej
• Tohle smaze Combofix a jeho slozky

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden