VIRY.CZ

Dobrý den,
tak se mi asi zase povedlo dostat do PC vir. Tedy možná to vir není, ale vrátil jsem bod obnovení a projel systém antivirem a je to pořád stejné. Při práci s WM makerem se za několik minut prostě program zastaví a přestane odpovídat. Potom nezbývá než jej ukončit přes task managera.

Situace vznikla po stáhnutí programu na http://camstudio.org/, který po spuštění nic neudělal (jen probliklo to okno příkazového řádku). Ale má to stránku na sourceforge, takže by tam vir asi být neměl. A taky to může být tím codecem, co jsem nainstaloval z toho webu (camstudio loseless codec). Ale ten už by v systému být neměl, po tom obnovení.

Ale to zpomalení se asi projevuje jenom v tom movie makeru, tak bych se chtěl zeptat, co by s tím šlo dělat. Právě dokončuji jedno video a tenhle problém přišel dost nevhod.

Díky moc

Radši sem teda ještě dám ten RSIT log:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Jonas at 2010-06-15 00:23:00
Microsoft Windows XP Professional Service Pack 3
System drive C: has 3 GB (7%) free of 38 GB
Total RAM: 503 MB (24% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:23:02, on 15.6.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\COMODO\COMODO livePCsupport\CLPSLS.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PHPWebServer\apache\bin\apache.exe
C:\PHPWebServer\mysql\bin\mysqld.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\PHPWebServer\apache\bin\apache.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\Freecorder\FLVSrvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Movie Maker\moviemk.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Jonas\My Documents\různé\programy\anti-viry\RSIT.exe
C:\Documents and Settings\Jonas\My Documents\různé\programy\anti-viry\Jonas.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\IEPro.dll
O2 - BHO: IexploreOmea - {09628AAA-66AD-4FA2-82E2-698185B66463} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll
O2 - BHO: del.icio.us Toolbar Helper - {7AA07AE6-01EF-44EC-93CA-9D7CD41CCDB6} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: del.icio.us - {981FE6A8-260C-4930-960F-C3BC82746CB0} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O3 - Toolbar: Omea - {35402C01-1777-4159-9ABA-3480BA70D90A} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [Freecorder FLV Service] "C:\Program Files\Freecorder\FLVSrvc.exe" /run
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Clip and Edit - res://C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll/1000
O8 - Extra context menu item: Clip and Save - res://C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll/1001
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout Free Download Managerem - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Stáhnout video Free Download Managerem - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Stáhnout vybrané Free Download Managerem - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Stáhnout vše Free Download Managerem - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Subscribe to Feed - res://C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll/1002
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\IEPro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - C:\Program Files\IEPro\IEPro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\IEPro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\IEPro.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {35402C01-1777-4159-9ABA-3480BA70D901} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll (HKCU)
O9 - Extra 'Tools' menuitem: Omea Add-on Options… - {35402C01-1777-4159-9ABA-3480BA70D901} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll (HKCU)
O9 - Extra button: Subscribe to Feed - {35402C01-1777-4159-9ABA-3480BA70D903} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll (HKCU)
O9 - Extra button: Clip and Edit - {35402C01-1777-4159-9ABA-3480BA70D905} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll (HKCU)
O9 - Extra button: Clip and Save - {35402C01-1777-4159-9ABA-3480BA70D907} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll (HKCU)
O9 - Extra button: Annotate - {35402C01-1777-4159-9ABA-3480BA70D909} - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll (HKCU)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net ... plugin.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... oader5.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.cz/buxus/docs/OnlineScanner.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: COMODO livePCsupport Service (CLPSLS) - COMODO - C:\Program Files\COMODO\COMODO livePCsupport\CLPSLS.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: CWS_Apache_80 - Apache Software Foundation - C:\PHPWebServer\apache\bin\apache.exe
O23 - Service: CWS_MySQL_3306 - Unknown owner - C:\PHPWebServer\mysql\bin\mysqld.exe
O23 - Service: G - Unknown owner - C:\DOCUME~1\Jonas\LOCALS~1\Temp\G.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 9193 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\shutdown.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{71CBF2D2-6AA9-4C67-A052-66C9A39A8F2A}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00011268-E188-40DF-A514-835FCD78B1BF}]
IE7Pro BHO - C:\Program Files\IEPro\IEPro.dll [2008-12-08 752744]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{09628AAA-66AD-4FA2-82E2-698185B66463}]
COmeaHelper Object - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll [2007-02-02 591360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7AA07AE6-01EF-44EC-93CA-9D7CD41CCDB6}]
del.icio.us Toolbar Helper - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll [2006-09-26 271864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC59E0F9-7E43-44FA-9FAA-8377850BF205}]
FDMIECookiesBHO Class - C:\Program Files\Free Download Manager\iefdm2.dll [2008-12-30 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-05-03 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-05-03 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{981FE6A8-260C-4930-960F-C3BC82746CB0} - del.icio.us - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll [2006-09-26 271864]
{35402C01-1777-4159-9ABA-3480BA70D90A} - Omea - C:\Program Files\JetBrains\Omea Reader\IexploreOmeaW.dll [2007-02-02 591360]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"DrvLsnr"=C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe [2003-05-08 69632]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2005-06-22 126976]
"avast!"=C:\PROGRA~1\Avast4\ashDisp.exe [2009-11-25 81000]
"QuickTime Task"=C:\qttask.exe [2009-05-26 413696]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2010-06-09 2039240]
"Freecorder FLV Service"=C:\Program Files\Freecorder\FLVSrvc.exe [2009-11-15 158752]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ComplexWebServer]
C:\PHPWebServer\bin\ServiceDirect.exe [2006-09-17 686080]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINDOWS\system32\igfxtray.exe [2005-06-22 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe [2003-05-05 143360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"=" C:\WINDOWS\system32\guard32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2005-06-22 348160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CLPSLS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CLPSLS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\IEPro\MiniDM.exe"="C:\Program Files\IEPro\MiniDM.exe:*:Enabled:MiniDM"
"C:\Program Files\Miranda IM\miranda32.exe"="C:\Program Files\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\VLC Player\vlc.exe"="C:\Program Files\VLC Player\vlc.exe:*:Enabled:VLC media player"
"C:\PHPWebServer\apache\bin\Apache.exe"="C:\PHPWebServer\apache\bin\Apache.exe:*:Enabled:Apache HTTP Server"
"C:\Program Files\WinSCP\WinSCP.exe"="C:\Program Files\WinSCP\WinSCP.exe:*:Enabled:SFTP, FTP and SCP client"
"C:\Program Files\Free Download Manager\fdm.exe"="C:\Program Files\Free Download Manager\fdm.exe:*:Enabled:Free Download Manager"
"C:\Program Files\Metin2_TESTER\metin2.bin"="C:\Program Files\Metin2_TESTER\metin2.bin:*:Enabled:metin2"
"C:\Program Files\Maxthon2\Modules\MxDownloader\MxDownloadServer.exe"="C:\Program Files\Maxthon2\Modules\MxDownloader\MxDownloadServer.exe:*:Enabled:MxDownloadServer"
"C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-06-14 21:15:32 ----D---- C:\rsit
2010-06-14 21:09:02 ----D---- C:\WINDOWS\ERDNT
2010-06-14 21:07:07 ----D---- C:\Qoobox
2010-06-11 17:26:37 ----HDC---- C:\WINDOWS\$NtUninstallKB980218$
2010-06-11 17:26:01 ----HDC---- C:\WINDOWS\$NtUninstallKB980195$
2010-06-11 17:20:08 ----HDC---- C:\WINDOWS\$NtUninstallKB979559$
2010-06-11 17:12:45 ----HDC---- C:\WINDOWS\$NtUninstallKB978695_WM9$
2010-06-11 17:12:12 ----HDC---- C:\WINDOWS\$NtUninstallKB979482$
2010-06-11 17:10:28 ----HDC---- C:\WINDOWS\$NtUninstallKB975562$
2010-05-29 11:06:31 ----D---- C:\WINDOWS\Freecorder
2010-05-29 11:06:31 ----D---- C:\Program Files\Freecorder
2010-05-26 17:00:33 ----HDC---- C:\WINDOWS\$NtUninstallKB981793$
2010-05-18 19:20:52 ----A---- C:\WINDOWS\system32\javaws.exe
2010-05-18 19:20:52 ----A---- C:\WINDOWS\system32\javaw.exe
2010-05-18 19:20:52 ----A---- C:\WINDOWS\system32\java.exe
2010-05-18 19:20:52 ----A---- C:\WINDOWS\system32\deployJava1.dll
2010-05-16 12:02:09 ----D---- C:\Program Files\Common Files\DESIGNER
2010-05-16 12:01:09 ----D---- C:\Program Files\Microsoft.NET
2010-05-16 11:57:40 ----D---- C:\WINDOWS\SHELLNEW
2010-05-16 11:56:25 ----D---- C:\Program Files\Microsoft Office
2010-05-16 11:54:57 ----RHD---- C:\MSOCache

======List of files/folders modified in the last 1 months======

2010-06-15 00:11:01 ----D---- C:\WINDOWS\Prefetch
2010-06-14 23:57:31 ----D---- C:\WINDOWS\Temp
2010-06-14 23:57:31 ----D---- C:\WINDOWS\Debug
2010-06-14 23:57:31 ----D---- C:\WINDOWS
2010-06-14 21:09:59 ----D---- C:\WINDOWS\system32\CatRoot2
2010-06-14 21:07:56 ----N---- C:\WINDOWS\SchedLgU.Txt
2010-06-14 20:56:15 ----D---- C:\WINDOWS\system32\config
2010-06-14 20:55:46 ----D---- C:\WINDOWS\system32\wbem
2010-06-14 20:55:44 ----D---- C:\WINDOWS\Registration
2010-06-14 20:55:16 ----D---- C:\WINDOWS\system32
2010-06-14 19:17:10 ----D---- C:\Program Files\Firefox
2010-06-14 15:37:29 ----D---- C:\Documents and Settings\Jonas\Application Data\OpenOffice.org2
2010-06-13 20:11:54 ----D---- C:\WINDOWS\Microsoft.NET
2010-06-13 20:11:47 ----RSD---- C:\WINDOWS\assembly
2010-06-11 17:26:43 ----HD---- C:\WINDOWS\inf
2010-06-11 17:26:40 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-06-11 17:25:10 ----HD---- C:\WINDOWS\$hf_mig$
2010-06-11 17:24:46 ----SHD---- C:\WINDOWS\Installer
2010-06-11 17:24:43 ----D---- C:\Config.Msi
2010-06-11 17:23:10 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2010-06-11 17:19:32 ----D---- C:\Program Files\Internet Explorer
2010-06-11 17:19:15 ----D---- C:\WINDOWS\ie8updates
2010-06-11 17:07:34 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-06-11 17:06:52 ----D---- C:\WINDOWS\WinSxS
2010-06-10 19:44:03 ----A---- C:\WINDOWS\AviSplitter.INI
2010-06-10 16:38:23 ----D---- C:\Program Files\Avidemux 2.5
2010-06-09 16:05:30 ----A---- C:\WINDOWS\system32\guard32.dll
2010-06-07 20:15:18 ----D---- C:\Documents and Settings\Jonas\Application Data\dvdcss
2010-06-04 19:41:20 ----D---- C:\Program Files\Microsoft Silverlight
2010-06-04 17:02:31 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2010-06-03 14:12:37 ----D---- C:\Documents and Settings\Jonas\Application Data\.purple
2010-05-29 11:06:31 ----RD---- C:\Program Files
2010-05-28 21:37:34 ----A---- C:\WINDOWS\system32\MRT.exe
2010-05-18 19:20:49 ----D---- C:\Program Files\Java
2010-05-18 17:07:31 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-05-17 19:34:49 ----D---- C:\WINDOWS\system32\Restore
2010-05-16 13:28:12 ----SD---- C:\Documents and Settings\Jonas\Application Data\Microsoft
2010-05-16 12:02:09 ----D---- C:\Program Files\Common Files
2010-05-16 12:01:44 ----RSD---- C:\WINDOWS\Fonts

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-25 27408]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-11-25 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-25 48560]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [2010-06-09 229312]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\WINDOWS\System32\DRIVERS\cmdhlp.sys [2010-06-09 25240]
R1 Ext2fs;Ext2fs; C:\WINDOWS\system32\DRIVERS\ext2fs.sys [2008-01-20 179584]
R1 IfsMount;IfsMount; C:\WINDOWS\system32\DRIVERS\ifsmount.sys [2007-12-29 49536]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-11-25 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-11-25 94160]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2003-03-14 100224]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-25 23120]
R3 E100B;Intel(R) PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2007-03-14 165760]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-06-22 807998]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2003-05-28 578304]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfo.sys []
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 JakNDisMP;JakNDisMP; C:\WINDOWS\system32\DRIVERS\JakNDis.sys []
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 nm;Network Monitor Driver; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2008-04-13 40320]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2008-09-15 17664]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2008-09-15 22016]
S3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2007-11-06 34064]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2008-09-15 8064]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-13 26112]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2008-09-15 8064]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2008-03-27 503008]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688]
S4 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-04-03 691696]
S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-02-28 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Avast4\aswUpdSv.exe [2009-11-25 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Avast4\ashServ.exe [2009-11-25 138680]
R2 CLPSLS;COMODO livePCsupport Service; C:\Program Files\COMODO\COMODO livePCsupport\CLPSLS.exe [2010-02-12 148744]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2010-06-09 1778480]
R2 CWS_Apache_80;CWS_Apache_80; C:\PHPWebServer\apache\bin\apache.exe [2005-10-09 20541]
R2 CWS_MySQL_3306;CWS_MySQL_3306; C:\PHPWebServer\mysql\bin\mysqld.exe [2005-12-02 3526656]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-04-12 153376]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-21 45056]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Avast4\ashMaiSv.exe [2009-11-25 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Avast4\ashWebSv.exe [2009-11-25 352920]
S2 Brother XP spl Service;BrSplService; C:\WINDOWS\system32\brsvc01a.exe [2002-04-12 57344]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 G;G; C:\DOCUME~1\Jonas\LOCALS~1\Temp\G.exe []
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2007-11-06 92792]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Hezké odpoledne
Vidím že jste použil combofix, ale nevidím log, vytvořil se vám?
Jinak přečtěte si varování v mém podpise

no spustil jsem ho omylem, spletl jsem si to s tím rsit. ale pak jsem to myslím nějak odstranil, snad se nestalo nic vážného. mám to pustit tedy ještě znovu?

Když si ho takhle spouštíte, tak maskuje stopy v registru po havěti, a já pak nevím, co smazal .

Prosím složku Qoobox, je na disku C, dejte do zipu nebo raru a pošlete na www.leteckaposta.cz. Link k souboru mi pošlete do sz, děkuji

já jsem to asi nespustil naostro (hlásilo mi to ta upozornění na antivir a virtuální CD). v té složce Qoobox nic není (v těch složkách tam), takže to asi ani nemá cenu posílat.
nerad to takhle komplikuji, ale co mám tedy dělat dál? znovu ten combo fix spustit?

Když už ho tam máte

Tady je návod::
Stáhněte na plochu, ukončete všechna aktivní okna a spusťte ComboFix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-souhlaste s instalací konzole pro zotavení

- ComboFix je třeba spustit pod účtem s právy administrátora

- Před použitím vypněte všechny rezidentní bezpečnostní programy - antiviry, firewally, antispywary

- Po spuštění se zobrazí podmínky užití, potvrďte je stiskem tlačítka Ano

- Dále postupujte dle pokynů, během aplikování ComboFixu neklikejte do zobrazujícího se okna

- Po dokončení skenování, trvajícího maximálně 10 minut, by měl program vytvořit log - C:\ComboFix.txt, zkopírujte celý jeho obsah sem

díky za trpělivost, tady je ten log:

ComboFix 10-06-15.04 - Jonas 16.06.2010 20:06:35.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.420.1033.18.503.297 [GMT 2:00]
Spuštěný z: c:\documents and settings\Jonas\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100616-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-05-16 do 2010-06-16 )))))))))))))))))))))))))))))))
.

2010-06-14 18:55 . 2010-06-14 18:55 -------- d-----w- c:\windows\system32\wbem\Repository
2010-06-14 17:33 . 2010-06-14 17:33 1070 ----a-w- c:\windows\system32\unins000.dat
2010-06-11 12:36 . 2010-05-06 10:41 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-01 15:45 . 2010-06-04 18:33 -------- d-----w- c:\documents and settings\Honza\Local Settings\Application Data\FLVService
2010-05-29 09:06 . 2010-05-29 09:06 -------- d-----w- c:\program files\Freecorder
2010-05-29 09:06 . 2010-05-29 09:06 -------- d-----w- c:\windows\Freecorder
2010-05-24 18:29 . 2010-05-24 18:29 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-05-18 17:20 . 2010-04-12 15:29 411368 ----a-w- c:\windows\system32\deployJava1.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-16 13:07 . 2009-01-04 21:41 -------- d-----w- c:\documents and settings\Jonas\Application Data\Free Download Manager
2010-06-16 08:20 . 2008-03-10 20:21 -------- d-----w- c:\documents and settings\Jonas\Application Data\OpenOffice.org2
2010-06-16 08:07 . 2009-06-06 11:03 -------- d-----w- c:\program files\Firefox
2010-06-16 07:33 . 2008-03-10 18:38 -------- d-----w- c:\program files\Avast4
2010-06-15 17:01 . 2009-06-28 12:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-06-10 14:38 . 2009-08-24 13:22 -------- d-----w- c:\program files\Avidemux 2.5
2010-06-09 14:05 . 2010-03-03 18:54 278288 ----a-w- c:\windows\system32\guard32.dll
2010-06-09 14:05 . 2010-03-03 18:54 87824 ----a-w- c:\windows\system32\drivers\inspect.sys
2010-06-09 14:05 . 2010-03-03 18:54 25240 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2010-06-09 14:05 . 2010-03-03 18:54 15464 ----a-w- c:\windows\system32\drivers\cmderd.sys
2010-06-09 14:05 . 2010-03-03 18:54 229312 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2010-06-07 18:15 . 2008-03-14 11:25 -------- d-----w- c:\documents and settings\Jonas\Application Data\dvdcss
2010-06-04 17:41 . 2008-04-08 12:31 -------- d-----w- c:\program files\Microsoft Silverlight
2010-06-03 12:12 . 2009-05-02 16:52 -------- d-----w- c:\documents and settings\Jonas\Application Data\.purple
2010-05-18 17:20 . 2008-03-11 19:52 -------- d-----w- c:\program files\Java
2010-05-16 11:50 . 2008-03-08 04:59 71152 -c--a-w- c:\documents and settings\Jonas\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-16 10:01 . 2010-05-16 10:01 -------- d-----w- c:\program files\Microsoft.NET
2010-05-06 10:41 . 2006-02-28 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 13:45 . 2009-06-06 10:56 -------- d-----w- c:\program files\Opera
2010-05-02 05:22 . 2006-02-28 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-05-01 16:09 . 2009-05-02 17:31 -------- d-----w- c:\documents and settings\Jonas\Application Data\gtk-2.0
2010-04-22 18:03 . 2009-01-04 15:46 -------- d-----w- c:\documents and settings\Jonas\Application Data\uTorrent
2010-04-20 05:30 . 2006-02-28 12:00 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-11 09:03 . 2009-10-11 16:12 25 ----a-w- c:\windows\popcinfot.dat
2010-04-02 22:04 . 2010-04-02 22:04 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DrvLsnr"="c:\program files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 69632]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-22 126976]
"avast!"="c:\progra~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"QuickTime Task"="C:\qttask.exe" [2009-05-26 413696]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-06-09 2039240]
"Freecorder FLV Service"="c:\program files\Freecorder\FLVSrvc.exe" [2009-11-15 158752]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CLPSLS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ComplexWebServer]
2006-09-17 20:55 686080 -c--a-w- c:\phpwebserver\bin\ServiceDirect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2005-06-22 00:48 155648 -c----w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
2003-05-05 16:57 143360 -c----w- c:\program files\Analog Devices\SoundMAX\SMTray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\IEPro\\MiniDM.exe"=
"c:\\Program Files\\VLC Player\\vlc.exe"=
"c:\\PHPWebServer\\apache\\bin\\Apache.exe"=
"c:\\Program Files\\WinSCP\\WinSCP.exe"=
"c:\\Program Files\\Free Download Manager\\fdm.exe"=
"c:\\Program Files\\Maxthon2\\Modules\\MxDownloader\\MxDownloadServer.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2.4.2008 16:41 114768]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [3.3.2010 20:54 229312]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [3.3.2010 20:54 25240]
R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [23.6.2009 18:37 179584]
R1 IfsMount;IfsMount;c:\windows\system32\drivers\ifsmount.sys [23.6.2009 18:37 49536]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2.4.2008 16:41 20560]
R2 CLPSLS;COMODO livePCsupport Service;c:\program files\COMODO\COMODO livePCsupport\CLPSLS.exe [12.2.2010 20:23 148744]
R2 CWS_Apache_80;CWS_Apache_80;c:\phpwebserver\apache\bin\Apache.exe [25.3.2008 18:01 20541]
S2 CWS_MySQL_3306;CWS_MySQL_3306;c:\phpwebserver\mysql\bin\mysqld.exe --defaults-file=c:\phpwebserver\mysql\conf\mysqld.conf CWS_MySQL_3306 --> c:\phpwebserver\mysql\bin\mysqld.exe --defaults-file=c:\phpwebserver\mysql\conf\mysqld.conf CWS_MySQL_3306 [?]
S3 G;G;c:\docume~1\Jonas\LOCALS~1\Temp\G.exe --> c:\docume~1\Jonas\LOCALS~1\Temp\G.exe [?]
S3 JakNDisMP;JakNDisMP;c:\windows\system32\DRIVERS\JakNDis.sys --> c:\windows\system32\DRIVERS\JakNDis.sys [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6.11.2007 22:22 34064]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3.4.2010 0:04 691696]
.
Obsah adresáře 'Naplánované úlohy'

2009-01-04 c:\windows\Tasks\shutdown.job
- c:\windows\system32\shutdown.exe [2006-02-28 00:12]

2010-06-15 c:\windows\Tasks\User_Feed_Synchronization-{71CBF2D2-6AA9-4C67-A052-66C9A39A8F2A}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
IE: Clip and Edit - c:\program files\JetBrains\Omea Reader\IexploreOmeaW.dll/1000
IE: Clip and Save - c:\program files\JetBrains\Omea Reader\IexploreOmeaW.dll/1001
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Stáhnout Free Download Managerem - file://c:\program files\Free Download Manager\dllink.htm
IE: Stáhnout video Free Download Managerem - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Stáhnout vybrané Free Download Managerem - file://c:\program files\Free Download Manager\dlselected.htm
IE: Stáhnout vše Free Download Managerem - file://c:\program files\Free Download Manager\dlall.htm
IE: Subscribe to Feed - c:\program files\JetBrains\Omea Reader\IexploreOmeaW.dll/1002
FF - ProfilePath - c:\documents and settings\Jonas\Application Data\Mozilla\Firefox\Profiles\f9aakado.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\Firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-16 20:18
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1923132299-448257100-619329731-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(760)
c:\windows\system32\guard32.dll

- - - - - - - > 'lsass.exe'(816)
c:\windows\system32\guard32.dll

- - - - - - - > 'explorer.exe'(2388)
c:\windows\system32\WININET.dll
c:\documents and settings\Jonas\Local Settings\Application Data\FLVService\lib\FLVSrvLib.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2010-06-16 20:26:09
ComboFix-quarantined-files.txt 2010-06-16 18:26

Před spuštěním: 2 415 181 824 bytes free
Po spuštění: 2 527 752 192 bytes free

- - End Of File - - 2D51151E171AFB544EBD46538B123722

Otestujte na www.virustotal.com

c:\docume~1\Jonas\LOCALS~1\Temp\G.exe
c:\windows\system32\DRIVERS\JakNDis.sys
c:\windows\system32\drivers\npf.sys

-Do okénka zkopírujte cestu k souboru , pokud napíše, že soubor byl už testován, dejte otestovat znovu.
-Sem vložte link s výsledky.

ty první dva soubory tam asi nejsou, nešlo to otestovat. píše to 0 bytes size received. a když to vyberu ručně tak to tam taky prostě není.
tady je odkaz na ten npf.sys: http://www.virustotal.com/cs/analisis/e ... 1276719292

Pokud nemáte, přesuňte Combofix na plochu
-otevřete si Poznámkový blok
-Do něj zkopírujte text z tohoto okénka
-uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
-po uložení uchopte vámi vytvořený skript levým myšítkem a -přesuňte ho nad ikonu Combofixu, kde ho upustíte:




-po aplikaci na Vás vypadne další log,vložte ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

dobrý den, tady to je:

ComboFix 10-06-15.04 - Jonas 17.06.2010 13:47:02.4.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1250.420.1033.18.503.216 [GMT 2:00]
Spuštěný z: c:\documents and settings\Jonas\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Jonas\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100617-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
* Vytvořen nový Bod Obnovení

FILE ::
"c:\docume~1\Jonas\LOCALS~1\Temp\G.exe"
"c:\windows\system32\DRIVERS\JakNDis.sys"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_G
-------\Service_G
-------\Service_JakNDisMP


((((((((((((((((((((((((( Soubory vytvořené od 2010-05-17 do 2010-06-17 )))))))))))))))))))))))))))))))
.

2010-06-14 18:55 . 2010-06-14 18:55 -------- d-----w- c:\windows\system32\wbem\Repository
2010-06-14 17:33 . 2010-06-14 17:33 1070 ----a-w- c:\windows\system32\unins000.dat
2010-06-11 12:36 . 2010-05-06 10:41 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-01 15:45 . 2010-06-04 18:33 -------- d-----w- c:\documents and settings\Honza\Local Settings\Application Data\FLVService
2010-05-29 09:06 . 2010-05-29 09:06 -------- d-----w- c:\program files\Freecorder
2010-05-29 09:06 . 2010-05-29 09:06 -------- d-----w- c:\windows\Freecorder
2010-05-24 18:29 . 2010-05-24 18:29 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-05-18 17:20 . 2010-04-12 15:29 411368 ----a-w- c:\windows\system32\deployJava1.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-16 13:07 . 2009-01-04 21:41 -------- d-----w- c:\documents and settings\Jonas\Application Data\Free Download Manager
2010-06-16 08:20 . 2008-03-10 20:21 -------- d-----w- c:\documents and settings\Jonas\Application Data\OpenOffice.org2
2010-06-16 08:07 . 2009-06-06 11:03 -------- d-----w- c:\program files\Firefox
2010-06-16 07:33 . 2008-03-10 18:38 -------- d-----w- c:\program files\Avast4
2010-06-15 17:01 . 2009-06-28 12:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-06-10 14:38 . 2009-08-24 13:22 -------- d-----w- c:\program files\Avidemux 2.5
2010-06-09 14:05 . 2010-03-03 18:54 278288 ----a-w- c:\windows\system32\guard32.dll
2010-06-09 14:05 . 2010-03-03 18:54 87824 ----a-w- c:\windows\system32\drivers\inspect.sys
2010-06-09 14:05 . 2010-03-03 18:54 25240 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2010-06-09 14:05 . 2010-03-03 18:54 15464 ----a-w- c:\windows\system32\drivers\cmderd.sys
2010-06-09 14:05 . 2010-03-03 18:54 229312 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2010-06-07 18:15 . 2008-03-14 11:25 -------- d-----w- c:\documents and settings\Jonas\Application Data\dvdcss
2010-06-04 17:41 . 2008-04-08 12:31 -------- d-----w- c:\program files\Microsoft Silverlight
2010-06-03 12:12 . 2009-05-02 16:52 -------- d-----w- c:\documents and settings\Jonas\Application Data\.purple
2010-05-18 17:20 . 2008-03-11 19:52 -------- d-----w- c:\program files\Java
2010-05-16 11:50 . 2008-03-08 04:59 71152 -c--a-w- c:\documents and settings\Jonas\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-16 10:01 . 2010-05-16 10:01 -------- d-----w- c:\program files\Microsoft.NET
2010-05-06 10:41 . 2006-02-28 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 13:45 . 2009-06-06 10:56 -------- d-----w- c:\program files\Opera
2010-05-02 05:22 . 2006-02-28 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-05-01 16:09 . 2009-05-02 17:31 -------- d-----w- c:\documents and settings\Jonas\Application Data\gtk-2.0
2010-04-22 18:03 . 2009-01-04 15:46 -------- d-----w- c:\documents and settings\Jonas\Application Data\uTorrent
2010-04-20 05:30 . 2006-02-28 12:00 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-11 09:03 . 2009-10-11 16:12 25 ----a-w- c:\windows\popcinfot.dat
2010-04-02 22:04 . 2010-04-02 22:04 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DrvLsnr"="c:\program files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 69632]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-22 126976]
"avast!"="c:\progra~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"QuickTime Task"="C:\qttask.exe" [2009-05-26 413696]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-06-09 2039240]
"Freecorder FLV Service"="c:\program files\Freecorder\FLVSrvc.exe" [2009-11-15 158752]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CLPSLS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ComplexWebServer]
2006-09-17 20:55 686080 -c--a-w- c:\phpwebserver\bin\ServiceDirect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2005-06-22 00:48 155648 -c----w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
2003-05-05 16:57 143360 -c----w- c:\program files\Analog Devices\SoundMAX\SMTray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\IEPro\\MiniDM.exe"=
"c:\\Program Files\\VLC Player\\vlc.exe"=
"c:\\PHPWebServer\\apache\\bin\\Apache.exe"=
"c:\\Program Files\\WinSCP\\WinSCP.exe"=
"c:\\Program Files\\Free Download Manager\\fdm.exe"=
"c:\\Program Files\\Maxthon2\\Modules\\MxDownloader\\MxDownloadServer.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2.4.2008 16:41 114768]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [3.3.2010 20:54 229312]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [3.3.2010 20:54 25240]
R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [23.6.2009 18:37 179584]
R1 IfsMount;IfsMount;c:\windows\system32\drivers\ifsmount.sys [23.6.2009 18:37 49536]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2.4.2008 16:41 20560]
R2 CLPSLS;COMODO livePCsupport Service;c:\program files\COMODO\COMODO livePCsupport\CLPSLS.exe [12.2.2010 20:23 148744]
R2 CWS_Apache_80;CWS_Apache_80;c:\phpwebserver\apache\bin\Apache.exe [25.3.2008 18:01 20541]
R2 CWS_MySQL_3306;CWS_MySQL_3306;c:\phpwebserver\mysql\bin\mysqld.exe --defaults-file=c:\phpwebserver\mysql\conf\mysqld.conf CWS_MySQL_3306 --> c:\phpwebserver\mysql\bin\mysqld.exe --defaults-file=c:\phpwebserver\mysql\conf\mysqld.conf CWS_MySQL_3306 [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6.11.2007 22:22 34064]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3.4.2010 0:04 691696]
.
Obsah adresáře 'Naplánované úlohy'

2009-01-04 c:\windows\Tasks\shutdown.job
- c:\windows\system32\shutdown.exe [2006-02-28 00:12]

2010-06-16 c:\windows\Tasks\User_Feed_Synchronization-{71CBF2D2-6AA9-4C67-A052-66C9A39A8F2A}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 02:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.cz/
IE: Clip and Edit - c:\program files\JetBrains\Omea Reader\IexploreOmeaW.dll/1000
IE: Clip and Save - c:\program files\JetBrains\Omea Reader\IexploreOmeaW.dll/1001
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Stáhnout Free Download Managerem - file://c:\program files\Free Download Manager\dllink.htm
IE: Stáhnout video Free Download Managerem - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Stáhnout vybrané Free Download Managerem - file://c:\program files\Free Download Manager\dlselected.htm
IE: Stáhnout vše Free Download Managerem - file://c:\program files\Free Download Manager\dlall.htm
IE: Subscribe to Feed - c:\program files\JetBrains\Omea Reader\IexploreOmeaW.dll/1002
FF - ProfilePath - c:\documents and settings\Jonas\Application Data\Mozilla\Firefox\Profiles\f9aakado.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/
FF - component: c:\program files\Free Download Manager\Firefox\Extension\components\vmsfdmff.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-17 14:02
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_USERS\S-1-5-21-1923132299-448257100-619329731-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3572)
c:\windows\system32\WININET.dll
c:\documents and settings\Jonas\Local Settings\Application Data\FLVService\lib\FLVSrvLib.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_cze.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\program files\WinSCP\DragExt.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\COMODO\COMODO Internet Security\cmdagent.exe
c:\program files\Avast4\aswUpdSv.exe
c:\program files\Avast4\ashServ.exe
c:\windows\system32\brss01a.exe
c:\phpwebserver\mysql\bin\mysqld.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Avast4\ashMaiSv.exe
c:\program files\Avast4\ashWebSv.exe
.
**************************************************************************
.
Celkový čas: 2010-06-17 14:12:05 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-06-17 12:12
ComboFix2.txt 2010-06-16 18:26

Před spuštěním: 2 470 268 928 bytes free
Po spuštění: 2 403 864 576 bytes free

- - End Of File - - 489AEB480D6E7B1DEFE4002C14A5A4B7

Jak to vypadá s počítačem?

Tohle máte schválně, víte o tom?
2009-01-04 c:\windows\Tasks\shutdown.job
- c:\windows\system32\shutdown.exe [2006-02-28 00:12]

no asi to o moc lepší není, ten movie maker zase za chvíli přestane fungovat. ale asi to nebude vir, takže fakt nevím.

a o tom shutdown nevím, dá se to smazat?

Ten soubor normálně najděte a smažte, když ho neznáte .

Odinstalujte combofix přes Start - Spustit
- zkopírujte do okénka:

ComboFix /Uninstall

-stiskněte Enter
-To odinstaluje ComboFix a smaže s ním související soubory a složky.


***********


Stáhněte T-Cleaner
http://sweb.cz/Marinus/T-Cleaner.exe

-Spusťte,pro potvrzení volby mačkejte klávesu A, Enter
-po použití prográmek vymažte.Pozor,antiviry ho mohou falešně označit za vir



***********


Z mého podpisu stahněte Ccleaner
- nainstalujte, při výběru, co se má nainstalovat, dejte pryč fajfku u instalace yahoo toolbaru

záložka čistič
- nechejte v levém sloupečku zatrhnuté vše jak je, klikněte na analyzovat
- po analýze klikněte na Spustit Ccleaner

záložka Registry
- klikněte na hledej problémy
- pak klikněte na opravit vybrané problémy -- udělat zálohu registrů - nemusíte
- kliknete opravit všechny problémy ok zavřít

Záložka Nástroje
- zde můžete odinstalovat programy. Je to důkladnější odinstalace než u přidat/odebrat programy ve Windows.

Ccleaner - čistič doporučuji používat, krásně pročistí pc od dočasných souborů.
Registry pročistí třeba po odinstalaci nějakého programu.


***********



Stahněte OTC a použijte
http://oldtimer.geekstogo.com/OTC.exe
-vyčistí tempy a po použitých programech



***********

Vložte nový log ze RSIT a řekněte co počítač, jak se chová, už je vše v pořádku?

***********

K tomu windows movie makeru - našla jsem, že by to padání programu mohlo dělat, pokud máte v pc nainstalovaných víc balíků kodeků. Ponechejte jen jeden, třeba
DiVX.

dobrý den, doufám že se nebudete zlobit, ale já jsem to ještě nestihl udělat a zítra jedu pryč. tak do týdne to ale udělat určitě stihnu, takže mě prosím ještě neopouštějte . díky