Vytížení 100% CPU schvost.exe

[MartinSur]

Dobrý den,
prosím o pomoc - po prishlasení do uzivatelského profilu jede CPU na 100% - schvost.exe
Tady je log:

Logfile of random's system information tool 1.08 (written by random/random)
Run by Administrator at 2010-07-17 10:51:57
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 7 GB (18%) free of 38 GB
Total RAM: 511 MB (28% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:53:09, on 17.7.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\NetworkAgent 8\klnagent.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlservr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe
C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\RealVNC\WinVNC\WinVNC.exe
C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Temp\RSIT.exe
C:\Program Files\trend micro\Administrator.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://chsxont17/its
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O1 - Hosts: 172.46.211.2 CHBERNA2
O1 - Hosts: 172.46.211.21 CHSXONT8
O1 - Hosts: 172.46.211.22 CHSXONT9
O1 - Hosts: 172.46.211.23 CHSXONT10
O1 - Hosts: 172.46.211.25 CHSXONT11
O1 - Hosts: 172.46.211.27 CHSXONT12
O1 - Hosts: 172.46.211.28 CHSXONT13
O1 - Hosts: 172.46.211.29 CHSXONT14
O1 - Hosts: 172.46.211.26 CHSXOAD1
O1 - Hosts: 172.46.211.17 CHSXONT17
O1 - Hosts: 172.46.211.19 CHSXONT18
O1 - Hosts: 172.46.211.32 CHSXONT19
O1 - Hosts: 172.46.211.20 CHSXONT20
O1 - Hosts: 172.46.211.14 CHSXONT21
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Burn4Free Toolbar Helper - {D187A56B-A33F-4CBE-9D77-459FC0BAE012} - C:\Program Files\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll (file missing)
O3 - Toolbar: Burn4Free Toolbar - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - C:\Program Files\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll (file missing)
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1997696987-338696842-1435325219-2073\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'lhanus')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-1997696987-338696842-1435325219-2073 Startup: syscoj32.exe (User 'lhanus')
O4 - S-1-5-21-1997696987-338696842-1435325219-2073 User Startup: syscoj32.exe (User 'lhanus')
O4 - Global Startup: Akcelerátor spuštìní AutoCADu.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: EdgeCLS9.75.lnk = C:\Program Files\EdgeCAM\Cam\edgecls.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PSIPENTA PerFORMer Monitor.lnk = ?
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://chsxont17/its
O16 - DPF: CW App KB R9 - https://www.mojebanka.cz/jars/cwapp.cab
O16 - DPF: IB App KB R9 - https://www.mojebanka.cz/jars/ibapp.cab
O16 - DPF: KTPro SP KB R9 - https://www.mojebanka.cz/jars/ktpsp.cab
O16 - DPF: SH App KB R9 - https://www.mojebanka.cz/jars/shapp.cab
O16 - DPF: {461A37E7-17B3-40E3-B6BB-7CAEC732C9E4} (CSOBEnroll Class) - https://ib24.csob.cz/Comp/CSOBEnroll.dll
O16 - DPF: {50E43D86-A74D-11D0-98CE-004005249458} (AnimatedGif Control) - https://www.mojebanka.cz/jars/confwiz/MVSGif.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\Acadm 6\AcDcToday.ocx
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\Acadm 6\InstBanr.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\Acadm 6\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\Acadm 6\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = BERNEX.COM
O17 - HKLM\Software\..\Telephony: DomainName = BERNEX.COM
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = BERNEX.COM
O20 - AppInit_DLLs: ddefix.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipamìti kategorií souèástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Automation License Manager Service (almservice) - SIEMENS AG - C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: Kaspersky Lab Network Agent (klnagent) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\NetworkAgent 8\klnagent.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SIMATIC IEPG Help Service (s7oiehsx) - SIEMENS AG - C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe
O23 - Service: S7TraceServiceX - SIEMENS AG - C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: VNC Server (winvnc) - RealVNC Ltd. - C:\Program Files\RealVNC\WinVNC\WinVNC.exe

--
End of file - 9159 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 501400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D187A56B-A33F-4CBE-9D77-459FC0BAE012}]
Burn4Free Toolbar Helper - C:\Program Files\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - Burn4Free Toolbar - C:\Program Files\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll []
{CCC7A320-B3CA-4199-B1A6-9F516DD69829}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"PCTVOICE"=C:\WINDOWS\system32\pctspk.exe [2002-07-18 163840]
"Apoint"=C:\Program Files\Apoint\Apoint.exe [2002-08-22 143360]
"NvCplDaemon"=NvQTwk,NvCplDaemon initialize []
"WinVNC"=C:\Program Files\RealVNC\WinVNC\WinVNC.exe [2003-03-05 335872]
"AdaptecDirectCD"=C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe [2001-09-04 655360]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe [2007-03-14 83608]
"PCSuiteTrayApplication"=C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE [2006-04-26 237568]
"ISUSPM Startup"=C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe [2005-08-11 249856]
"ISUSScheduler"=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2005-08-11 81920]
"PWRISOVM.EXE"=C:\Program Files\PowerISO\PWRISOVM.EXE [2009-03-15 180224]
"LogMeIn GUI"=C:\Program Files\LogMeIn\x86\LogMeInSystray.exe [2008-08-11 63048]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštìní
Akcelerátor spuštìní AutoCADu.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
EdgeCLS9.75.lnk - C:\Program Files\EdgeCAM\Cam\edgecls.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE
PSIPENTA PerFORMer Monitor.lnk - C:\Program Files\PerFORMer Monitor\PerformLog.exe
Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="ddefix.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LMIinit]
C:\WINDOWS\system32\LMIinit.dll [2010-06-10 87424]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\PerFORMer Monitor\PerformLog.exe"="C:\Program Files\PerFORMer Monitor\PerformLog.exe:*:Disabled:PerFORMer Monitor"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\PerFORMer Monitor\PerformLog.exe"="C:\Program Files\PerFORMer Monitor\PerformLog.exe:*:Enabled:PerFORMer Monitor"
"C:\Program Files\Common Files\PSIPENTA\programs\exe\nt\psipenta.exe"="C:\Program Files\Common Files\PSIPENTA\programs\exe\nt\psipenta.exe:*:Enabled:PSIPENTA.COM Automation Server"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"\\CZXS01\PSIPENTA_601000900-2003-06-02\cus\programs\gui\hlp\StartEpos.exe"="\\CZXS01\PSIPENTA_601000900-2003-06-02\cus\programs\gui\hlp\StartEpos.exe:*:Enabled:Psipenta ePoS"
"C:\PSIPENTA\VCOM6.0.1\cus\programs\gui\html\login.html"="C:\PSIPENTA\VCOM6.0.1\cus\programs\gui\html\login.html:*:Enabled:login"
"C:\Program Files\RealVNC\WinVNC\winvnc.exe"="C:\Program Files\RealVNC\WinVNC\winvnc.exe:*:Enabled:winvnc"
"C:\Program Files\RealVNC\vncviewer.exe"="C:\Program Files\RealVNC\vncviewer.exe:*:Enabled:vncviewer"
"C:\Program Files\LogMeIn\x86\LogMeInToolkit.exe"="C:\Program Files\LogMeIn\x86\LogMeInToolkit.exe:*:Enabled:LogMeIn"
"C:\Program Files\LogMeIn\x86\LogMeIn.exe"="C:\Program Files\LogMeIn\x86\LogMeIn.exe:*:Enabled:LogMeIn"
"C:\WINDOWS\explorer.exe"="C:\WINDOWS\explorer.exe:*:Disabled:Prùzkumník Windows"

======File associations======

.scr - open -
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2010-07-17 10:51:59 ----D---- C:\Program Files\trend micro
2010-07-17 10:51:57 ----D---- C:\rsit
2010-07-12 17:58:14 ----D---- C:\Documents and Settings\Administrator\Data aplikací\Malwarebytes
2010-07-12 17:57:50 ----A---- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2010-07-12 17:57:48 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-07-12 17:57:48 ----D---- C:\Documents and Settings\All Users\Data aplikací\Malwarebytes
2010-07-12 17:57:48 ----A---- C:\WINDOWS\system32\drivers\mbam.sys

======List of files/folders modified in the last 1 months======

2010-07-17 10:51:59 ----RD---- C:\Program Files
2010-07-17 10:49:55 ----D---- C:\WINDOWS\Prefetch
2010-07-17 10:49:14 ----D---- C:\Temp
2010-07-17 10:35:18 ----A---- C:\Documents and Settings\All Users\Data aplikací\DirectCDUserName.txt
2010-07-17 10:27:58 ----D---- C:\WINDOWS
2010-07-17 10:26:34 ----D---- C:\WINDOWS\Temp
2010-07-17 10:24:48 ----D---- C:\WINDOWS\security
2010-07-17 10:24:39 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-07-17 07:58:11 ----D---- C:\Program Files\LogMeIn
2010-07-13 08:05:25 ----D---- C:\WINDOWS\system32\drivers
2010-07-12 19:22:33 ----D---- C:\WINDOWS\system32
2010-07-12 19:22:15 ----SD---- C:\Documents and Settings\Administrator\Data aplikací\Microsoft
2010-07-12 19:19:13 ----D---- C:\WINDOWS\AppPatch
2010-07-09 11:25:14 ----D---- C:\Program Files\Internet Explorer
2010-07-09 11:24:54 ----D---- C:\WINDOWS\system32\CatRoot2
2010-07-08 14:51:49 ----A---- C:\WINDOWS\wincmd.ini
2010-06-28 07:54:17 ----D---- C:\Documents and Settings\All Users\Data aplikací\Adobe
2010-06-21 08:06:50 ----A---- C:\WINDOWS\BRWMARK.INI
2010-06-21 08:06:50 ----A---- C:\WINDOWS\BRPP2KA.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 agp440;Filtr Intel sbìrnice AGP; C:\WINDOWS\System32\DRIVERS\agp440.sys [2004-08-03 42368]
R0 ohci1394;Hostitelský øadiè IEEE 1394 dle standardu OHCI Texas Instruments; C:\WINDOWS\System32\DRIVERS\ohci1394.sys [2004-08-03 61056]
R0 Vmodem;W2k Vmodem; C:\WINDOWS\System32\DRIVERS\vmodem.sys [2002-11-06 689821]
R0 Vpctcom;W2k Vpctcom; C:\WINDOWS\System32\DRIVERS\vpctcom.sys [2002-11-22 476955]
R0 Vvoice;W2k Vvoice; C:\WINDOWS\System32\DRIVERS\vvoice.sys [2002-11-06 66111]
R1 Cdr4_xp;Cdr4_xp; C:\WINDOWS\system32\drivers\Cdr4_xp.sys [2007-10-19 55216]
R1 Cdralw2k;Cdralw2k; C:\WINDOWS\system32\drivers\Cdralw2k.sys [2007-10-19 22713]
R1 cdudf_xp;cdudf_xp; C:\WINDOWS\system32\drivers\cdudf_xp.sys [2001-09-04 233344]
R1 intelppm;Øadiè procesoru Intel; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-17 39936]
R1 OMCI;OMCI; C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632]
R1 pwd_2K;pwd_2K; C:\WINDOWS\system32\drivers\pwd_2K.sys [2001-09-04 78454]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2009-03-15 56268]
R1 UdfReadr_xp;UdfReadr_xp; C:\WINDOWS\system32\drivers\UdfReadr_xp.sys [2001-09-10 205824]
R2 dk2drv;DK2 WindowsNT Driver; \??\C:\WINDOWS\system32\Drivers\dk2drv.sys []
R2 Hardlock;Hardlock; \??\C:\WINDOWS\system32\drivers\hardlock.sys []
R2 Haspnt;Haspnt; \??\C:\WINDOWS\System32\drivers\Haspnt.sys []
R2 irda;Protokol IrDA; C:\WINDOWS\System32\DRIVERS\irda.sys [2004-08-03 87424]
R2 LMIInfo;LogMeIn Kernel Information Provider; \??\C:\Program Files\LogMeIn\x86\RaInfo.sys []
R2 LMIRfsDriver;LogMeIn Remote File System Driver; \??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys []
R2 s7odpx2x;SIMATIC MPI/PROFIBUS DPX2 Driver; C:\WINDOWS\System32\Drivers\S7odpx2x.sys [2007-10-05 78408]
R2 s7osmcax;s7osmcax; C:\WINDOWS\System32\Drivers\s7osmcax.sys [2007-10-05 194120]
R2 s7otranx;s7otranx; C:\WINDOWS\System32\Drivers\s7otranx.sys [2007-10-05 516168]
R2 scpdrv;scpdrv; \??\C:\Program Files\Common Files\Siemens\SWS\PlugIns\SCP\scpdrv.sys []
R2 Sentinel;Sentinel; C:\WINDOWS\System32\Drivers\SENTINEL.SYS [2006-12-21 90688]
R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows 2000/XP; C:\WINDOWS\System32\DRIVERS\Apfiltr.sys [2002-11-29 88040]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2004-08-03 60800]
R3 cs429x;Cirrus WDM Audio Codec Driver; C:\WINDOWS\system32\drivers\cwawdm.sys [2002-04-30 89600]
R3 EL90XBC;3Com 3C90X-BC Family PCI EtherLink Adapter; C:\WINDOWS\System32\DRIVERS\el90xbc5.sys [2002-04-05 73827]
R3 hidusb;Ovladaè tøídy standardu HID; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2002-10-10 9600]
R3 lmimirr;lmimirr; C:\WINDOWS\system32\DRIVERS\lmimirr.sys [2008-08-11 10144]
R3 mmc_2K;mmc_2K; C:\WINDOWS\system32\drivers\mmc_2K.sys [2001-09-04 19702]
R3 mouhid;Ovladaè myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2002-10-10 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2004-08-03 61824]
R3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2002-03-11 909501]
R3 Ptserial;W2K Pctel Serial Device Driver; C:\WINDOWS\System32\DRIVERS\ptserial.sys [2002-11-06 135260]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\System32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 SMCIRDA;SMC IrCC Miniport Device Driver; C:\WINDOWS\System32\DRIVERS\smcirda.sys [2001-10-24 35913]
R3 usbuhci;Ovladaè Microsoft univerzálního hostitelského øadièe USB od spoleènosti Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S3 dvd_2K;dvd_2K; C:\WINDOWS\system32\drivers\dvd_2K.sys [2001-09-04 17990]
S3 FTDIBUS;Suunto Sports Instrument Driver; C:\WINDOWS\system32\drivers\ftdibus.sys [2007-06-27 53184]
S3 FTSER2K;Suunto USB Serial Port Driver; C:\WINDOWS\system32\drivers\ftser2k.sys [2007-06-27 71488]
S3 MSIRCOMM;Microsoft IR Communications Driver; C:\WINDOWS\System32\DRIVERS\MSIRCOMM.sys [2004-08-03 22016]
S3 Nokia USB Generic;Nokia USB Generic; C:\WINDOWS\system32\drivers\nmwcdc.sys [2006-03-24 8704]
S3 Nokia USB Modem;Nokia USB Modem; C:\WINDOWS\system32\drivers\nmwcdcm.sys [2006-03-24 13312]
S3 Nokia USB Phone Parent;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\nmwcd.sys [2006-03-24 127488]
S3 Nokia USB Port;Nokia USB Port; C:\WINDOWS\system32\drivers\nmwcdcj.sys [2006-03-24 13312]
S3 Pcouffin;Low level access layer for CD devices; C:\WINDOWS\System32\Drivers\Pcouffin.sys []
S3 s7oupc2x;SIMATIC PC Adapter USB Driver; C:\WINDOWS\system32\DRIVERS\s7oupc2x.sys [2007-08-29 12333]
S3 skeyusb;SmartKey USB; C:\WINDOWS\System32\Drivers\skeyusb.sys [2004-09-10 45277]
S3 usbscan;Ovladaè skeneru USB; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;Ovladaè velkokapacitního pamìového zaøízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S4 LMIRfsClientNP;LMIRfsClientNP; C:\WINDOWS\system32\drivers\LMIRfsClientNP.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 almservice;Automation License Manager Service; C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe [2005-06-20 622654]
R2 Irmon;Sledování infraèerveného pøenosu; C:\WINDOWS\System32\svchost.exe [2004-08-17 14336]
R2 klnagent;Kaspersky Lab Network Agent; C:\Program Files\Kaspersky Lab\NetworkAgent 8\klnagent.exe [2009-09-18 138792]
R2 LMIMaint;LogMeIn Maintenance Service; C:\Program Files\LogMeIn\x86\RaMaint.exe [2010-06-10 116104]
R2 LogMeIn;LogMeIn; C:\Program Files\LogMeIn\x86\LogMeIn.exe [2008-08-11 63040]
R2 LogWatch;Event Log Watch; C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe [2002-09-20 53248]
R2 MSSQL$INVENTORCONTENT;MSSQL$INVENTORCONTENT; C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlservr.exe [2002-12-17 7520337]
R2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\System32\nvsvc32.exe [2002-03-11 61440]
R2 s7oiehsx;SIMATIC IEPG Help Service; C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe [2007-10-05 208968]
R2 S7TraceServiceX;S7TraceServiceX; C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe [2007-08-31 163840]
R2 winvnc;VNC Server; C:\Program Files\RealVNC\WinVNC\WinVNC.exe [2003-03-05 335872]
R3 ServiceLayer;ServiceLayer; C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe [2006-04-12 176640]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2009-05-25 85096]
S3 CA_LIC_CLNT;CA License Client; C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe [2002-09-20 77824]
S3 CA_LIC_SRVR;CA License Server; C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe [2002-09-20 77824]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 MSSQLServerADHelper;MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe [2002-12-17 66112]
S3 SolidWorks Licensing Service;SolidWorks Licensing Service; C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe [2009-01-26 72704]
S3 SQLAgent$INVENTORCONTENT;SQLAgent$INVENTORCONTENT; C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlagent.EXE [2002-12-17 311872]

-----------------EOF-----------------

[Rudy]

Dejte log z ComboFix.

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware

[MartinSur]

ComboFix 10-07-15.05 - Administrator 17.07.2010 11:53:39.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.511.186 [GMT 2:00]
Spuštìný z: c:\documents and settings\lhanus\Plocha\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\lhanus\Data aplikací\Esebe
c:\documents and settings\lhanus\Data aplikací\Esebe\uhaml.exe
c:\windows\system32\setup.ini

.
((((((((((((((((((((((((( Soubory vytvoøené od 2010-06-17 do 2010-07-17 )))))))))))))))))))))))))))))))
.

2010-07-17 08:51 . 2010-07-17 08:53 -------- d-----w- c:\program files\trend micro
2010-07-17 08:51 . 2010-07-17 08:53 -------- d-----w- C:\rsit
2010-07-17 08:49 . 2010-07-17 08:49 339991 ----a-w- c:\temp\RSIT.exe
2010-07-12 15:57 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-12 15:57 . 2010-07-12 15:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-12 15:57 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-12 15:56 . 2010-07-12 15:56 6153352 ----a-w- c:\temp\mbam-setup-1.46.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-17 05:58 . 2009-10-22 06:26 -------- d-----w- c:\program files\LogMeIn
2010-06-10 05:09 . 2009-10-22 06:28 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2010-06-10 05:09 . 2009-10-22 06:28 29568 ----a-w- c:\windows\system32\LMIport.dll
2010-06-10 05:09 . 2009-10-22 06:27 87424 ----a-w- c:\windows\system32\LMIinit.dll
2010-06-02 06:20 . 2008-05-15 08:44 -------- d-----w- c:\program files\TRADUTTORE WEING. - SAPORITI SIEMENS
2009-01-14 15:56 . 2009-01-14 15:56 0 ----a-w- c:\program files\[selca].dmp
.

(((((((((((((((((((((((((((((((((( Spouštìcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="NvQTwk" [X]
"PCTVOICE"="pctspk.exe" [2002-07-18 163840]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2002-08-22 143360]
"WinVNC"="c:\program files\RealVNC\WinVNC\WinVNC.exe" [2003-03-05 335872]
"AdaptecDirectCD"="c:\program files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" [2001-09-04 655360]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 83608]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2009-03-15 180224]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-17 15360]

c:\documents and settings\lhanus\Nab¡dka Start\Programy\Po spuçtØn¡\
syscoj32.exe [2004-8-17 26624]

c:\documents and settings\All Users\Nab¡dka Start\Programy\Po spuçtØn¡\
Akceler tor spuçtØn¡ AutoCADu.lnk - c:\program files\Common Files\Autodesk Shared\acstart16.exe [2005-3-5 10872]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2010-06-10 05:09 87424 ----a-w- c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\ddefix.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\PerFORMer Monitor\\PerformLog.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"15000:UDP"= 15000:UDP:Kaspersky Administration Kit

R2 almservice;Automation License Manager Service;c:\program files\Common Files\Siemens\sws\almsrv\almsrvx.exe [20.6.2005 9:37 622654]
R2 dk2drv;DK2 WindowsNT Driver;c:\windows\system32\drivers\dk2drv.sys [4.6.2008 14:34 42624]
R2 klnagent;Kaspersky Lab Network Agent;c:\program files\Kaspersky Lab\NetworkAgent 8\klnagent.exe [18.9.2009 18:03 138792]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [11.8.2008 12:41 12856]
R2 LogWatch;Event Log Watch;c:\program files\CA\SharedComponents\CA_LIC\LogWatNT.exe [20.9.2002 18:29 53248]
R2 MSSQL$INVENTORCONTENT;MSSQL$INVENTORCONTENT;c:\program files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlservr.exe -sINVENTORCONTENT --> c:\program files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlservr.exe -sINVENTORCONTENT [?]
R2 s7odpx2x;SIMATIC MPI/PROFIBUS DPX2 Driver;c:\windows\system32\drivers\s7odpx2x.sys [5.10.2007 11:40 78408]
R2 s7oiehsx;SIMATIC IEPG Help Service;c:\program files\Common Files\Siemens\S7IEPG\s7oiehsx.exe [5.10.2007 11:51 208968]
R2 s7osmcax;s7osmcax;c:\windows\system32\drivers\s7osmcax.sys [5.10.2007 11:44 194120]
R2 S7TraceServiceX;S7TraceServiceX;c:\program files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe [31.8.2007 11:32 163840]
R2 scpdrv;scpdrv;c:\program files\Common Files\Siemens\sws\plugins\scp\scpdrv.sys [14.10.2003 1:44 26944]
S3 CA_LIC_CLNT;CA License Client;c:\program files\CA\SharedComponents\CA_LIC\lic98rmt.exe [20.9.2002 18:27 77824]
S3 CA_LIC_SRVR;CA License Server;c:\program files\CA\SharedComponents\CA_LIC\lic98rmtd.exe [20.9.2002 18:41 77824]
S3 s7oupc2x;SIMATIC PC Adapter USB Driver;c:\windows\system32\drivers\s7oupc2x.sys [9.10.2009 18:15 12333]
S3 skeyusb;SmartKey USB;c:\windows\system32\drivers\skeyusb.sys [15.5.2008 10:48 45277]
S3 SQLAgent$INVENTORCONTENT;SQLAgent$INVENTORCONTENT;c:\program files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlagent.EXE -i INVENTORCONTENT --> c:\program files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlagent.EXE -i INVENTORCONTENT [?]
.
.
------- Doplòkový sken -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: CW App KB R9 - hxxps://www.mojebanka.cz/jars/cwapp.cab
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: IB App KB R9 - hxxps://www.mojebanka.cz/jars/ibapp.cab
DPF: KTPro SP KB R9 - hxxps://www.mojebanka.cz/jars/ktpsp.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: SH App KB R9 - hxxps://www.mojebanka.cz/jars/shapp.cab
DPF: {461A37E7-17B3-40E3-B6BB-7CAEC732C9E4} - hxxps://ib24.csob.cz/Comp/CSOBEnroll.dll
DPF: {50E43D86-A74D-11D0-98CE-004005249458} - hxxps://www.mojebanka.cz/jars/confwiz/MVSGif.cab
.
- - - - NEPLATNÉ POLOŽKY ODSTRANÌNÉ Z REGISTRU - - - -

BHO-{D187A56B-A33F-4CBE-9D77-459FC0BAE012} - c:\program files\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll
Toolbar-{4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - c:\program files\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-17 12:06
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesù ...

skenování skrytých položek 'Po spuštìní' ...

skenování skrytých souborù ...

sken byl úspešnì dokonèen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na bìžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(788)
c:\windows\system32\ddefix.dll
c:\windows\system32\LMIinit.dll
c:\program files\RealVNC\WinVNC\VNCHooks.dll
c:\windows\system32\LMIRfsClientNP.dll

- - - - - - - > 'lsass.exe'(848)
c:\windows\system32\ddefix.dll
.
Celkový èas: 2010-07-17 12:13:54
ComboFix-quarantined-files.txt 2010-07-17 10:13

Pøed spuštìním: 7 096 381 440
Po spuštìní: 9 332 199 424

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 56090EB25FDB2EB1267EB75866FF3274

[Rudy]

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

Collect::
c:\documents and settings\lhanus\Nabídka Start\Programy\Po spuštění\syscoj32.exe

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nafd ikonu ComboFix a pusťte. CF se spustí a vykoná příkaz ze skriptu.

[MartinSur]

Achjo, několikrát jsem zkoušel pečlivě znovu vytvořit i uložit ten txt soubor, ale pokaždé mi to po spuštění Combofixu přetažením toho txt souboru po chvíli : "název CFScript se zdá být nespávně hláskovaný" ... prošel jsem zda tam nemám nějaké zbytečné mezery, jak v názvu souboru, tak v samotném txt. Zkoušel jsem to asi 10x a porad stejná chyba ...

nejde se toho syscoj32.exe, který je asi tím problémem zbavit nějak jinak?

[Rudy]

Zkuste Avenger: http://www.viry.cz/forum/viewtopic.php?f=15&t=19832 se skriptem:

Files to delete:
c:\documents and settings\lhanus\Nabídka Start\Programy\Po spuštění\syscoj32.exe

[MartinSur]

nepomohlo, vypada to na spatnou cestu k inkriminovanému souboru:

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: could not open file "c:\documents and settings\lhanus\Nabídka Start\Programy\Po spuštení\syscoj32.exe"
Deletion of file "c:\documents and settings\lhanus\Nabídka Start\Programy\Po spuštení\syscoj32.exe" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Completed script processing.

*******************

Finished! Terminate.

[Rudy]

No asi takhle. Pokud CF píše, že skript je špatně hláskován, je to pravda. Budete to muset zkusit znovu, příp. použít nouz. režim.

[MartinSur]

Tak vyřešeno, nakonec to bylo je tím, že v cestě k souboru musel být velké písmena v c:\Documents and Settings

po 2 testovacích restartech už OK

Díky

[Rudy]

To je novinka i pro mne. Nemáte zač!