zpomalené PC a otvírání aplikací
Napsal: 12 lis 2010 20:43
Ahojte, prosím o kontrolu logů. Nějak se mi ukrutně zpomalil Pc a otvírání jakékoliv aplikace nebo okna trvá ukrutně dlouho a hlavně pak bere skoro 100 % procesoru.
PC není žádný rychlík, ale přesto je to o hodně horší než před tím.
Díky za pomoc
Win XP profesional - SP3
Celeron 3.06GHz
1,99 B RAM
log hjt
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:50:13, on 12.11.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\PixArt\PAC7302\Monitor.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NetSoftware\NetSoftware.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\totalcmd\TOTALCMD.EXE
c:\Documents and Settings\Johny\Dokumenty\Stažené soubory\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\NetSoftware\IEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NetSoftware] "C:\Program Files\NetSoftware\Starter.exe" /path="C:\Program Files\NetSoftware"
O4 - HKLM\..\Run: [PAC7302_Monitor] C:\WINDOWS\PixArt\PAC7302\Monitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... ader55.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1216971A-9E0E-4A5D-B6C6-443B8BCB1E9F}: NameServer = 10.12.0.1,10.6.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{936A79EE-05A3-4865-BDFD-B6D28A7C4DAC}: NameServer = 10.12.0.1,10.6.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{1216971A-9E0E-4A5D-B6C6-443B8BCB1E9F}: NameServer = 10.12.0.1,10.6.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{1216971A-9E0E-4A5D-B6C6-443B8BCB1E9F}: NameServer = 10.12.0.1,10.6.0.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{1216971A-9E0E-4A5D-B6C6-443B8BCB1E9F}: NameServer = 10.12.0.1,10.6.0.1
O17 - HKLM\System\CS4\Services\Tcpip\..\{1216971A-9E0E-4A5D-B6C6-443B8BCB1E9F}: NameServer = 10.12.0.1,10.6.0.1
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2010.SP1d\RpcAgentSrv.exe
O23 - Service: WD SmartWare Drive Manager (WDDMService) - WDC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
O23 - Service: WD SmartWare Background Service (WDSmartWareBackgroundService) - Memeo - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
--
End of file - 8828 bytes
log Combofix
ComboFix 10-11-12.01 - Johny 12.11.2010 19:55:46.1.1 - x86
SystÚm Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2039.1442 [GMT 1:00]
SpuÜtýnř z: c:\documents and settings\Johny\Plocha\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
ADS - WINDOWS: deleted 48 bytes in 1 streams.
((((((((((((((((((((((((((((((((((((((( OstatnÝ vřmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Johny\Dokumenty\cc_20101106_120510.reg
C:\Thumbs.db
.
((((((((((((((((((((((((( Soubory vytvo°enÚ od 2010-10-12 do 2010-11-12 )))))))))))))))))))))))))))))))
.
2010-11-12 18:03 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-12 18:03 . 2010-11-12 18:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-12 18:03 . 2010-11-12 18:03 -------- d-----w- c:\documents and settings\All Users\Data aplikacÝ\Malwarebytes
2010-11-12 18:03 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-12 18:03 . 2010-11-12 18:36 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-11-12 18:03 . 2010-11-12 18:26 -------- d-----w- c:\documents and settings\All Users\Data aplikacÝ\Spybot - Search & Destroy
2010-11-12 16:40 . 2010-11-12 16:42 -------- d-----w- C:\foto taŁka mobil
2010-11-12 16:34 . 2010-11-12 16:34 -------- d-----w- c:\program files\SEMC
2010-11-06 18:39 . 2010-11-06 18:39 45056 ----a-w- c:\windows\NCUNINST.EXE
2010-11-06 18:33 . 2010-11-06 18:33 -------- d-----w- c:\program files\Common Files\SWF Studio
2010-11-06 18:29 . 2010-11-07 07:31 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-11-06 17:09 . 2010-09-18 06:53 974848 -c----w- c:\windows\system32\dllcache\mfc42.dll
2010-11-06 17:09 . 2010-09-18 06:53 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
2010-11-06 17:09 . 2010-08-23 16:12 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll
2010-11-05 20:37 . 2010-11-11 19:14 81920 ----a-w- c:\windows\ALCFDRTM.VER
2010-11-05 20:37 . 2010-11-05 20:37 81920 ----a-w- c:\windows\ALCFDRTM.EXE
2010-11-05 20:24 . 2010-09-10 05:52 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-11-05 20:24 . 2010-09-10 05:52 602112 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-11-05 20:24 . 2010-09-10 05:52 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-11-05 20:24 . 2010-09-10 05:52 1986560 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-11-05 20:24 . 2010-09-10 05:52 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-11-05 20:24 . 2010-09-10 05:52 11080192 -c----w- c:\windows\system32\dllcache\ieframe.dll
2010-11-05 20:24 . 2010-09-10 05:52 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-11-05 19:54 . 2004-08-03 21:29 1897408 ------w- c:\windows\system32\drivers\nv4_mini.sys
2010-11-05 19:54 . 2008-04-14 02:30 80896 -c----w- c:\windows\system32\dllcache\msxml6r.dll
2010-11-05 19:54 . 2008-04-14 03:21 81920 ------w- c:\windows\system32\ieencode.dll
2010-11-05 19:54 . 2008-04-14 03:22 294912 -c----w- c:\windows\system32\dllcache\dlimport.exe
2010-11-05 19:39 . 2010-11-05 19:39 -------- d-----w- c:\windows\system32\Lang
2010-11-05 19:36 . 2006-08-01 14:02 49152 ----a-w- c:\windows\system32\ChCfg.exe
2010-11-05 19:36 . 2010-11-05 19:36 -------- d-----w- c:\windows\system32\RTCOM
2010-11-05 19:31 . 2008-06-14 17:35 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-11-05 19:30 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2010-11-05 19:28 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2010-11-05 19:26 . 2008-10-15 16:38 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2010-11-05 19:26 . 2010-08-26 13:39 357248 -c----w- c:\windows\system32\dllcache\srv.sys
2010-11-05 19:26 . 2010-02-24 13:11 455680 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-11-05 19:20 . 2010-07-16 11:58 219136 -c----w- c:\windows\system32\dllcache\wordpad.exe
2010-11-05 18:58 . 2006-02-07 07:40 143360 ----a-w- c:\windows\system32\igfxres.dll
2010-11-05 18:55 . 2010-11-05 18:55 -------- d-----w- c:\program files\Common Files\NewTech Infosystems
2010-11-05 18:55 . 2010-11-11 19:16 -------- d-----w- c:\program files\NewTech Infosystems
2010-11-05 18:55 . 2010-11-05 18:55 1024 ---h--r- c:\windows\system32\NTIBUN4.dll
2010-11-05 18:55 . 2010-11-05 18:55 6144 ----a-w- c:\windows\system32\drivers\NTIDrvr.sys
2010-11-05 18:54 . 2010-11-05 18:54 -------- d-----w- c:\program files\Executive Software
2010-11-05 18:54 . 2010-11-05 18:54 -------- d-----w- c:\windows\Downloaded Installations
2010-11-05 18:54 . 2010-11-05 18:54 -------- d-----w- c:\documents and settings\Johny\Data aplikacÝ\Intel
2010-11-05 18:54 . 2010-11-05 18:54 -------- d-----w- c:\documents and settings\Johny\Data aplikacÝ\Avocent AdminWorks
2010-11-05 18:54 . 2010-11-05 18:54 -------- d-----w- c:\documents and settings\All Users\Data aplikacÝ\Avocent AdminWorks
2010-11-05 18:52 . 2010-11-05 18:52 -------- d-----w- c:\windows\Drivers
2010-11-05 18:52 . 2005-03-15 15:04 21248 ----a-w- c:\windows\system32\drivers\intelsmb.sys
2010-11-05 18:52 . 2010-11-05 18:52 7424 ----a-w- c:\windows\system32\drivers\SIODRV.SYS
2010-11-05 18:52 . 2003-11-03 15:39 36484 ----a-w- c:\windows\system32\drivers\SMBios.sys
2010-11-05 17:59 . 2007-07-26 15:15 53248 ----a-w- c:\windows\system32\CSVer.dll
2010-11-05 17:59 . 2010-11-11 19:16 -------- d-----w- c:\program files\Intel
2010-11-05 17:58 . 2010-11-05 18:51 -------- d-----w- C:\Intel
2010-11-05 17:43 . 2001-10-24 11:25 23040 -c--a-w- c:\windows\system32\dllcache\EXCH_regtrace.exe
2010-11-05 17:42 . 2004-08-18 12:00 10129408 -c--a-w- c:\windows\system32\dllcache\hwxkor.dll
2010-11-05 17:41 . 2004-08-18 12:00 29184 -c--a-w- c:\windows\system32\dllcache\asptxn.dll
2010-11-05 17:38 . 2004-08-18 12:00 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe
2010-11-05 17:38 . 2004-08-18 12:00 16384 ----a-w- c:\program files\Internet Explorer\Connection Wizard\isignup.exe
2010-11-05 17:31 . 2008-04-14 02:25 5504 ----a-w- c:\windows\system32\drivers\intelide.sys
2010-11-05 17:28 . 2004-08-18 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2010-11-05 17:28 . 2004-08-18 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2010-11-05 17:28 . 2004-08-18 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2010-11-05 17:28 . 2004-08-18 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2010-11-05 17:27 . 2004-08-18 12:00 14043 ----a-r- c:\windows\SETF5.tmp
2010-11-05 17:27 . 2004-08-18 12:00 1086058 ----a-r- c:\windows\SETE9.tmp
2010-11-05 17:27 . 2004-08-18 12:00 1014483 ----a-r- c:\windows\SETE6.tmp
2010-11-02 14:23 . 2010-11-02 14:25 -------- d-----w- C:\ChytrÚ dÝtý-Slabikß°
2010-10-15 13:29 . 2010-09-07 14:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-10-15 13:29 . 2010-09-07 14:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-10-15 13:29 . 2010-09-07 14:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-10-15 13:29 . 2010-09-07 14:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-10-15 13:29 . 2010-09-07 14:47 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-10-15 13:29 . 2010-09-07 14:47 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-10-15 13:29 . 2010-09-07 14:46 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-10-15 13:26 . 2010-09-07 15:12 38848 ----a-w- c:\windows\avastSS.scr
2010-10-15 13:26 . 2010-09-07 15:11 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-10-15 13:26 . 2010-10-15 13:26 -------- d-----w- c:\program files\Alwil Software
2010-10-15 13:26 . 2010-10-15 13:26 -------- d-----w- c:\documents and settings\All Users\Data aplikacÝ\Alwil Software
2010-10-15 11:49 . 2007-04-12 12:19 129024 ----a-w- c:\windows\system32\AVERM.dll
2010-10-15 11:49 . 2006-09-26 11:57 28672 ----a-w- c:\windows\system32\AVEQT.dll
2010-10-15 11:49 . 2010-10-15 11:50 -------- d-----w- c:\program files\Ultra MKV Converter
.
(((((((((((((((((((((((((((((((((((((((( Find3M vřpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-06 14:57 . 2009-06-20 14:43 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-09-18 11:23 . 2004-08-18 12:00 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-18 12:00 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-18 12:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-18 12:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-15 03:50 . 2010-06-22 14:59 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-15 01:29 . 2009-06-27 16:38 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-09-10 05:52 . 2004-08-18 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:52 . 2004-08-18 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:52 . 2004-08-18 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:52 . 2004-08-18 12:00 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-09-01 07:57 . 2004-08-18 12:00 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:03 . 2004-08-18 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:54 . 2004-08-18 12:00 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-27 01:43 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-26 13:39 . 2004-08-18 12:00 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-23 16:12 . 2004-08-18 12:00 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2004-08-18 12:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45 . 2004-08-18 12:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2008-08-16 15:42 . 2008-08-16 15:42 13112 ----a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
2008-08-16 15:42 . 2008-08-16 15:42 70456 ----a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
2008-08-16 15:42 . 2008-08-16 15:42 91448 ----a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
2008-08-16 15:42 . 2008-08-16 15:42 20800 ----a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
2008-08-16 15:43 . 2008-08-16 15:43 206136 ----a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
2008-08-16 15:42 . 2008-08-16 15:42 31032 ----a-w- c:\program files\mozilla firefox\plugins\icafile.dll
2008-08-16 15:42 . 2008-08-16 15:42 40248 ----a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
2008-05-21 06:41 . 2008-05-21 06:41 479232 ----a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
2008-05-21 06:41 . 2008-05-21 06:41 548864 ----a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
2008-05-21 06:41 . 2008-05-21 06:41 626688 ----a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
2008-06-05 11:58 . 2008-06-05 11:58 648504 ----a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
2008-08-16 15:42 . 2008-08-16 15:42 23864 ----a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
.
(((((((((((((((((((((((((((((((((( SpouÜtýcÝ body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznßmka* prßzdnÚ zßznamy a legitimnÝ vřchozÝ ˙daje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"NetSoftware"="c:\program files\NetSoftware\Starter.exe" [2010-03-12 139264]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-02-07 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-02-07 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-02-07 118784]
"DiskeeperSystray"="c:\program files\Executive Software\Diskeeper\DkIcon.exe" [2005-04-30 196696]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"SoundMan"="SOUNDMAN.EXE" [2006-07-21 86016]
"AlcWzrd"="ALCWZRD.EXE" [2006-05-04 2808832]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
VPN Client.lnk - c:\windows\Installer\{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}\Icon3E5562ED7.ico [2009-7-27 6144]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^NabÝdka Start^Programy^Po spuÜtýnÝ^Adobe Gamma Loader.exe.lnk]
path=c:\documents and settings\All Users\NabÝdka Start\Programy\Po spuÜtýnÝ\Adobe Gamma Loader.exe.lnk
backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^NabÝdka Start^Programy^Po spuÜtýnÝ^Citrix XenApp.lnk]
path=c:\documents and settings\All Users\NabÝdka Start\Programy\Po spuÜtýnÝ\Citrix XenApp.lnk
backup=c:\windows\pss\Citrix XenApp.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^NabÝdka Start^Programy^Po spuÜtýnÝ^WDDMStatus.lnk]
path=c:\documents and settings\All Users\NabÝdka Start\Programy\Po spuÜtýnÝ\WDDMStatus.lnk
backup=c:\windows\pss\WDDMStatus.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^NabÝdka Start^Programy^Po spuÜtýnÝ^WDSmartWare.lnk]
path=c:\documents and settings\All Users\NabÝdka Start\Programy\Po spuÜtýnÝ\WDSmartWare.lnk
backup=c:\windows\pss\WDSmartWare.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^NabÝdka Start^Programy^Po spuÜtýnÝ^Windows Search.lnk]
path=c:\documents and settings\All Users\NabÝdka Start\Programy\Po spuÜtýnÝ\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 02:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2005-12-16 10:57 94208 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\MOette\\Wake On Lan Tool\\wol.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"c:\\Documents and Settings\\Johny\\Data aplikacÝ\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Macmillan\\Inside Out\\Pre-intermediate\\data\\fscommand\\flashex.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2010.SP1d\\RpcAgentSrv.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2010.SP1d\\WNt500x86\\RpcSandraSrv.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [20.6.2009 15:43 721904]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [15.10.2010 14:29 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [15.10.2010 14:29 17744]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [18.8.2004 13:00 3584]
S2 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [21.1.2010 15:24 110592]
S2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [16.6.2009 7:58 20480]
S3 s916bus;Sony Ericsson Device 916 driver (WDM);c:\windows\system32\drivers\s916bus.sys [2.11.2007 10:47 83496]
S3 s916mdfl;Sony Ericsson Device 916 USB WMC Modem Filter;c:\windows\system32\drivers\s916mdfl.sys [2.11.2007 10:47 15016]
S3 s916mdm;Sony Ericsson Device 916 USB WMC Modem Driver;c:\windows\system32\drivers\s916mdm.sys [2.11.2007 10:47 109992]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2010.SP1d\RpcAgentSrv.exe [28.5.2010 11:21 93336]
S3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys [20.6.2009 15:45 223128]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [27.9.2010 17:11 11520]
.
Obsah adresß°e 'NaplßnovanÚ ˙lohy'
2010-11-12 c:\windows\Tasks\Registry Reviver-Johny-Startup.job
- c:\program files\ReviverSoft\Registry Reviver\RegistryReviver.exe [2010-05-27 10:33]
.
.
------- Dopl˛kovř sken -------
.
uStart Page = hxxp://www.google.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: {1216971A-9E0E-4A5D-B6C6-443B8BCB1E9F} = 10.12.0.1,10.6.0.1
TCP: {936A79EE-05A3-4865-BDFD-B6D28A7C4DAC} = 10.12.0.1,10.6.0.1
FF - ProfilePath - c:\documents and settings\Johny\Data aplikacÝ\Mozilla\Firefox\Profiles\2p40lc4s.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL -
FF - component: c:\program files\NetSoftware\gemgecko\components\gemgecko.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npicaN.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- NASTAVEN═ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATN╔ POLOÄKY ODSTRAN╠N╔ Z REGISTRU - - - -
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
Notify-AtiExtEvent - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-12 20:06
Windows 5.1.2600 Service Pack 3 NTFS
skenovßnÝ skrytřch proces¨ ...
skenovßnÝ skrytřch polo×ek 'Po spuÜtýnÝ' ...
skenovßnÝ skrytřch soubor¨ ...
sken byl ˙speÜný dokonŔen
skrytÚ soubory: 0
**************************************************************************
.
--------------------- ZAMKNUT╔ KL═╚E V REGISTRU ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="36BB7E96625BCEA9C55DCC957C30940260B214CB23A5B947A87831D84E3B816994FC2382DAD54F14AF60419B506D96C5E72A7B3AB18C6E296DB02D456C16274C1E477EC74BEAF69B09CAD91CFA4DB234766CE96321229A088CDF32D005FEB247FAC92ABDC6032E27B887F6152103EAEDD3BF2A8AC48BF8D64F4A9125BC25384293E52113E27982B2E9365E5AEAB963210B9F67C777DCE59B43E8033D3CABED3817AE424ABA2022CF0CA7B792040D65946FBC340693A0FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808FEBC9E127BECC74CA9C6AECB7A5D1407BA7FD869164D6794C2D8EADA5D5A99271850BA66046C444D77874C735C8BDE206039B7EE0E118FACBFEBF7A5E1F1732268093CE00D76F8CF1E35C4C17F48C6F02C0AD07EC5C42DCB150D1E5DFDA9B118CB08F511590A25C3FBA3D05CAD1AC47965DD7D8198487AFC49C4E20B339F1A5D618A50DFD188B96AE9E3DAA6D94B9F86BFBBC7F921692FBE092F936EE34971BBED6276E7432CB37AE61C8D3859F6215C91BEFD1D604904FEA37C3DFAD9EA07EDDB73D978DFFE0C1D14085BDFE88D1531D61532D337DFB7A30DF035D442A1A6A7B7382D943C62C470B7747A9C25564E31AC043BBC6F740F025D659058AB5A270E313F69755208E286BBC3E1A21168237A586132A8B2264EE851C5AB140C585E371FA74B857FF96F66ADEB51DA13306B20BD99F59C1265C118C69226C8B9B1A7B2F727D165059175884179C76276EE872A6A2B28D3FEF9B74243DE62EEF3536402DA07C0E6880107DB49088A8967B955920B2A2F3A53FB8110EE5487B05979779707A5A1921349B7C2414B245579F73E48F43CB571485A779C93AE806BEE38C75E63F2C02312C5A1924889617CA3692A2E9D9D294F7E56F3F9A3BEFCB29BF642B27774AC0AD71F5F159D9CD1EC409B061D201E3B5EF806D4AA31E870CC2E6FD466EF443B6898569389A973CCC70CF4C45F3BA0E2DB9E537D2675A411355530F43E9E8F04176EBFE221758EE9DF2CAE5C32529CDAB7BB7AD3D9CBFDD998269D19F17716E2225603F381AE0687BE24D4C4CA6B9C2098FE0F43A533160B5A196CBDB093AEF6C7321B74C526834522E0487DCE32BFF5D77C763ADC51A0A7118B296298B04326FB475716FA53C58977AF3D865975BAE003AAE92BC8ECE6F5873B310AC1AE4E9867BDDD8C23509E7DE5C1BC667AA754AC5CE5F78D24724302BB4EB73D3413E339E3252491B45A738DC4AFA4A7B4DF6767D7ED01DA1FF0A89A60CDC4076C8728B981ED75DE1AD241EAA1F2A456FEDA62E121643C92DD9D98D2DC2431F65BD6540C83EC74B831C0138CBB694204C3F34BB213D234B6F8CF2D824AA22DA0E5F3356AE25C9361CBCD0D288856D448E2B1B6"
.
Celkovř Ŕas: 2010-11-12 20:18:42
ComboFix-quarantined-files.txt 2010-11-12 19:18
P°ed spuÜtýnÝm: 8á207á454á208
Po spuÜtýnÝ: 8á595á185á664
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - D4A7A79CFD9C9D4DB8AC9A829AB64B27
PC není žádný rychlík, ale přesto je to o hodně horší než před tím.
Díky za pomoc
Win XP profesional - SP3
Celeron 3.06GHz
1,99 B RAM
log hjt
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:50:13, on 12.11.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\PixArt\PAC7302\Monitor.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NetSoftware\NetSoftware.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\totalcmd\TOTALCMD.EXE
c:\Documents and Settings\Johny\Dokumenty\Stažené soubory\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\NetSoftware\IEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NetSoftware] "C:\Program Files\NetSoftware\Starter.exe" /path="C:\Program Files\NetSoftware"
O4 - HKLM\..\Run: [PAC7302_Monitor] C:\WINDOWS\PixArt\PAC7302\Monitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... ader55.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1216971A-9E0E-4A5D-B6C6-443B8BCB1E9F}: NameServer = 10.12.0.1,10.6.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{936A79EE-05A3-4865-BDFD-B6D28A7C4DAC}: NameServer = 10.12.0.1,10.6.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{1216971A-9E0E-4A5D-B6C6-443B8BCB1E9F}: NameServer = 10.12.0.1,10.6.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{1216971A-9E0E-4A5D-B6C6-443B8BCB1E9F}: NameServer = 10.12.0.1,10.6.0.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{1216971A-9E0E-4A5D-B6C6-443B8BCB1E9F}: NameServer = 10.12.0.1,10.6.0.1
O17 - HKLM\System\CS4\Services\Tcpip\..\{1216971A-9E0E-4A5D-B6C6-443B8BCB1E9F}: NameServer = 10.12.0.1,10.6.0.1
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2010.SP1d\RpcAgentSrv.exe
O23 - Service: WD SmartWare Drive Manager (WDDMService) - WDC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
O23 - Service: WD SmartWare Background Service (WDSmartWareBackgroundService) - Memeo - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
--
End of file - 8828 bytes
log Combofix
ComboFix 10-11-12.01 - Johny 12.11.2010 19:55:46.1.1 - x86
SystÚm Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2039.1442 [GMT 1:00]
SpuÜtýnř z: c:\documents and settings\Johny\Plocha\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
ADS - WINDOWS: deleted 48 bytes in 1 streams.
((((((((((((((((((((((((((((((((((((((( OstatnÝ vřmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Johny\Dokumenty\cc_20101106_120510.reg
C:\Thumbs.db
.
((((((((((((((((((((((((( Soubory vytvo°enÚ od 2010-10-12 do 2010-11-12 )))))))))))))))))))))))))))))))
.
2010-11-12 18:03 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-12 18:03 . 2010-11-12 18:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-11-12 18:03 . 2010-11-12 18:03 -------- d-----w- c:\documents and settings\All Users\Data aplikacÝ\Malwarebytes
2010-11-12 18:03 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-11-12 18:03 . 2010-11-12 18:36 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-11-12 18:03 . 2010-11-12 18:26 -------- d-----w- c:\documents and settings\All Users\Data aplikacÝ\Spybot - Search & Destroy
2010-11-12 16:40 . 2010-11-12 16:42 -------- d-----w- C:\foto taŁka mobil
2010-11-12 16:34 . 2010-11-12 16:34 -------- d-----w- c:\program files\SEMC
2010-11-06 18:39 . 2010-11-06 18:39 45056 ----a-w- c:\windows\NCUNINST.EXE
2010-11-06 18:33 . 2010-11-06 18:33 -------- d-----w- c:\program files\Common Files\SWF Studio
2010-11-06 18:29 . 2010-11-07 07:31 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-11-06 17:09 . 2010-09-18 06:53 974848 -c----w- c:\windows\system32\dllcache\mfc42.dll
2010-11-06 17:09 . 2010-09-18 06:53 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
2010-11-06 17:09 . 2010-08-23 16:12 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll
2010-11-05 20:37 . 2010-11-11 19:14 81920 ----a-w- c:\windows\ALCFDRTM.VER
2010-11-05 20:37 . 2010-11-05 20:37 81920 ----a-w- c:\windows\ALCFDRTM.EXE
2010-11-05 20:24 . 2010-09-10 05:52 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-11-05 20:24 . 2010-09-10 05:52 602112 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-11-05 20:24 . 2010-09-10 05:52 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-11-05 20:24 . 2010-09-10 05:52 1986560 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-11-05 20:24 . 2010-09-10 05:52 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-11-05 20:24 . 2010-09-10 05:52 11080192 -c----w- c:\windows\system32\dllcache\ieframe.dll
2010-11-05 20:24 . 2010-09-10 05:52 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-11-05 19:54 . 2004-08-03 21:29 1897408 ------w- c:\windows\system32\drivers\nv4_mini.sys
2010-11-05 19:54 . 2008-04-14 02:30 80896 -c----w- c:\windows\system32\dllcache\msxml6r.dll
2010-11-05 19:54 . 2008-04-14 03:21 81920 ------w- c:\windows\system32\ieencode.dll
2010-11-05 19:54 . 2008-04-14 03:22 294912 -c----w- c:\windows\system32\dllcache\dlimport.exe
2010-11-05 19:39 . 2010-11-05 19:39 -------- d-----w- c:\windows\system32\Lang
2010-11-05 19:36 . 2006-08-01 14:02 49152 ----a-w- c:\windows\system32\ChCfg.exe
2010-11-05 19:36 . 2010-11-05 19:36 -------- d-----w- c:\windows\system32\RTCOM
2010-11-05 19:31 . 2008-06-14 17:35 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-11-05 19:30 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
2010-11-05 19:28 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2010-11-05 19:26 . 2008-10-15 16:38 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll
2010-11-05 19:26 . 2010-08-26 13:39 357248 -c----w- c:\windows\system32\dllcache\srv.sys
2010-11-05 19:26 . 2010-02-24 13:11 455680 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-11-05 19:20 . 2010-07-16 11:58 219136 -c----w- c:\windows\system32\dllcache\wordpad.exe
2010-11-05 18:58 . 2006-02-07 07:40 143360 ----a-w- c:\windows\system32\igfxres.dll
2010-11-05 18:55 . 2010-11-05 18:55 -------- d-----w- c:\program files\Common Files\NewTech Infosystems
2010-11-05 18:55 . 2010-11-11 19:16 -------- d-----w- c:\program files\NewTech Infosystems
2010-11-05 18:55 . 2010-11-05 18:55 1024 ---h--r- c:\windows\system32\NTIBUN4.dll
2010-11-05 18:55 . 2010-11-05 18:55 6144 ----a-w- c:\windows\system32\drivers\NTIDrvr.sys
2010-11-05 18:54 . 2010-11-05 18:54 -------- d-----w- c:\program files\Executive Software
2010-11-05 18:54 . 2010-11-05 18:54 -------- d-----w- c:\windows\Downloaded Installations
2010-11-05 18:54 . 2010-11-05 18:54 -------- d-----w- c:\documents and settings\Johny\Data aplikacÝ\Intel
2010-11-05 18:54 . 2010-11-05 18:54 -------- d-----w- c:\documents and settings\Johny\Data aplikacÝ\Avocent AdminWorks
2010-11-05 18:54 . 2010-11-05 18:54 -------- d-----w- c:\documents and settings\All Users\Data aplikacÝ\Avocent AdminWorks
2010-11-05 18:52 . 2010-11-05 18:52 -------- d-----w- c:\windows\Drivers
2010-11-05 18:52 . 2005-03-15 15:04 21248 ----a-w- c:\windows\system32\drivers\intelsmb.sys
2010-11-05 18:52 . 2010-11-05 18:52 7424 ----a-w- c:\windows\system32\drivers\SIODRV.SYS
2010-11-05 18:52 . 2003-11-03 15:39 36484 ----a-w- c:\windows\system32\drivers\SMBios.sys
2010-11-05 17:59 . 2007-07-26 15:15 53248 ----a-w- c:\windows\system32\CSVer.dll
2010-11-05 17:59 . 2010-11-11 19:16 -------- d-----w- c:\program files\Intel
2010-11-05 17:58 . 2010-11-05 18:51 -------- d-----w- C:\Intel
2010-11-05 17:43 . 2001-10-24 11:25 23040 -c--a-w- c:\windows\system32\dllcache\EXCH_regtrace.exe
2010-11-05 17:42 . 2004-08-18 12:00 10129408 -c--a-w- c:\windows\system32\dllcache\hwxkor.dll
2010-11-05 17:41 . 2004-08-18 12:00 29184 -c--a-w- c:\windows\system32\dllcache\asptxn.dll
2010-11-05 17:38 . 2004-08-18 12:00 16384 -c--a-w- c:\windows\system32\dllcache\isignup.exe
2010-11-05 17:38 . 2004-08-18 12:00 16384 ----a-w- c:\program files\Internet Explorer\Connection Wizard\isignup.exe
2010-11-05 17:31 . 2008-04-14 02:25 5504 ----a-w- c:\windows\system32\drivers\intelide.sys
2010-11-05 17:28 . 2004-08-18 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll
2010-11-05 17:28 . 2004-08-18 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll
2010-11-05 17:28 . 2004-08-18 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll
2010-11-05 17:28 . 2004-08-18 12:00 13312 ----a-w- c:\windows\system32\irclass.dll
2010-11-05 17:27 . 2004-08-18 12:00 14043 ----a-r- c:\windows\SETF5.tmp
2010-11-05 17:27 . 2004-08-18 12:00 1086058 ----a-r- c:\windows\SETE9.tmp
2010-11-05 17:27 . 2004-08-18 12:00 1014483 ----a-r- c:\windows\SETE6.tmp
2010-11-02 14:23 . 2010-11-02 14:25 -------- d-----w- C:\ChytrÚ dÝtý-Slabikß°
2010-10-15 13:29 . 2010-09-07 14:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-10-15 13:29 . 2010-09-07 14:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-10-15 13:29 . 2010-09-07 14:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-10-15 13:29 . 2010-09-07 14:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-10-15 13:29 . 2010-09-07 14:47 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-10-15 13:29 . 2010-09-07 14:47 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-10-15 13:29 . 2010-09-07 14:46 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-10-15 13:26 . 2010-09-07 15:12 38848 ----a-w- c:\windows\avastSS.scr
2010-10-15 13:26 . 2010-09-07 15:11 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-10-15 13:26 . 2010-10-15 13:26 -------- d-----w- c:\program files\Alwil Software
2010-10-15 13:26 . 2010-10-15 13:26 -------- d-----w- c:\documents and settings\All Users\Data aplikacÝ\Alwil Software
2010-10-15 11:49 . 2007-04-12 12:19 129024 ----a-w- c:\windows\system32\AVERM.dll
2010-10-15 11:49 . 2006-09-26 11:57 28672 ----a-w- c:\windows\system32\AVEQT.dll
2010-10-15 11:49 . 2010-10-15 11:50 -------- d-----w- c:\program files\Ultra MKV Converter
.
(((((((((((((((((((((((((((((((((((((((( Find3M vřpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-06 14:57 . 2009-06-20 14:43 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-09-18 11:23 . 2004-08-18 12:00 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-18 12:00 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-18 12:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-18 12:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-15 03:50 . 2010-06-22 14:59 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-15 01:29 . 2009-06-27 16:38 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-09-10 05:52 . 2004-08-18 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:52 . 2004-08-18 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:52 . 2004-08-18 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:52 . 2004-08-18 12:00 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-09-01 07:57 . 2004-08-18 12:00 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:03 . 2004-08-18 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:54 . 2004-08-18 12:00 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-27 01:43 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-08-26 13:39 . 2004-08-18 12:00 357248 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-23 16:12 . 2004-08-18 12:00 617472 ----a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2004-08-18 12:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45 . 2004-08-18 12:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2008-08-16 15:42 . 2008-08-16 15:42 13112 ----a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
2008-08-16 15:42 . 2008-08-16 15:42 70456 ----a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
2008-08-16 15:42 . 2008-08-16 15:42 91448 ----a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
2008-08-16 15:42 . 2008-08-16 15:42 20800 ----a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
2008-08-16 15:43 . 2008-08-16 15:43 206136 ----a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
2008-08-16 15:42 . 2008-08-16 15:42 31032 ----a-w- c:\program files\mozilla firefox\plugins\icafile.dll
2008-08-16 15:42 . 2008-08-16 15:42 40248 ----a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
2008-05-21 06:41 . 2008-05-21 06:41 479232 ----a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
2008-05-21 06:41 . 2008-05-21 06:41 548864 ----a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
2008-05-21 06:41 . 2008-05-21 06:41 626688 ----a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
2008-06-05 11:58 . 2008-06-05 11:58 648504 ----a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
2008-08-16 15:42 . 2008-08-16 15:42 23864 ----a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
.
(((((((((((((((((((((((((((((((((( SpouÜtýcÝ body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznßmka* prßzdnÚ zßznamy a legitimnÝ vřchozÝ ˙daje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"NetSoftware"="c:\program files\NetSoftware\Starter.exe" [2010-03-12 139264]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-02-07 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-02-07 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-02-07 118784]
"DiskeeperSystray"="c:\program files\Executive Software\Diskeeper\DkIcon.exe" [2005-04-30 196696]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"SoundMan"="SOUNDMAN.EXE" [2006-07-21 86016]
"AlcWzrd"="ALCWZRD.EXE" [2006-05-04 2808832]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\All Users\Nabídka Start\Programy\Po spuštění\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
VPN Client.lnk - c:\windows\Installer\{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}\Icon3E5562ED7.ico [2009-7-27 6144]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^NabÝdka Start^Programy^Po spuÜtýnÝ^Adobe Gamma Loader.exe.lnk]
path=c:\documents and settings\All Users\NabÝdka Start\Programy\Po spuÜtýnÝ\Adobe Gamma Loader.exe.lnk
backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^NabÝdka Start^Programy^Po spuÜtýnÝ^Citrix XenApp.lnk]
path=c:\documents and settings\All Users\NabÝdka Start\Programy\Po spuÜtýnÝ\Citrix XenApp.lnk
backup=c:\windows\pss\Citrix XenApp.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^NabÝdka Start^Programy^Po spuÜtýnÝ^WDDMStatus.lnk]
path=c:\documents and settings\All Users\NabÝdka Start\Programy\Po spuÜtýnÝ\WDDMStatus.lnk
backup=c:\windows\pss\WDDMStatus.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^NabÝdka Start^Programy^Po spuÜtýnÝ^WDSmartWare.lnk]
path=c:\documents and settings\All Users\NabÝdka Start\Programy\Po spuÜtýnÝ\WDSmartWare.lnk
backup=c:\windows\pss\WDSmartWare.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^NabÝdka Start^Programy^Po spuÜtýnÝ^Windows Search.lnk]
path=c:\documents and settings\All Users\NabÝdka Start\Programy\Po spuÜtýnÝ\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 02:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2005-12-16 10:57 94208 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\MOette\\Wake On Lan Tool\\wol.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\dxdiag.exe"=
"c:\\Documents and Settings\\Johny\\Data aplikacÝ\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\Macmillan\\Inside Out\\Pre-intermediate\\data\\fscommand\\flashex.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2010.SP1d\\RpcAgentSrv.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2010.SP1d\\WNt500x86\\RpcSandraSrv.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [20.6.2009 15:43 721904]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [15.10.2010 14:29 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [15.10.2010 14:29 17744]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [18.8.2004 13:00 3584]
S2 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [21.1.2010 15:24 110592]
S2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [16.6.2009 7:58 20480]
S3 s916bus;Sony Ericsson Device 916 driver (WDM);c:\windows\system32\drivers\s916bus.sys [2.11.2007 10:47 83496]
S3 s916mdfl;Sony Ericsson Device 916 USB WMC Modem Filter;c:\windows\system32\drivers\s916mdfl.sys [2.11.2007 10:47 15016]
S3 s916mdm;Sony Ericsson Device 916 USB WMC Modem Driver;c:\windows\system32\drivers\s916mdm.sys [2.11.2007 10:47 109992]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2010.SP1d\RpcAgentSrv.exe [28.5.2010 11:21 93336]
S3 vaxscsi;vaxscsi;c:\windows\system32\drivers\vaxscsi.sys [20.6.2009 15:45 223128]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [27.9.2010 17:11 11520]
.
Obsah adresß°e 'NaplßnovanÚ ˙lohy'
2010-11-12 c:\windows\Tasks\Registry Reviver-Johny-Startup.job
- c:\program files\ReviverSoft\Registry Reviver\RegistryReviver.exe [2010-05-27 10:33]
.
.
------- Dopl˛kovř sken -------
.
uStart Page = hxxp://www.google.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: {1216971A-9E0E-4A5D-B6C6-443B8BCB1E9F} = 10.12.0.1,10.6.0.1
TCP: {936A79EE-05A3-4865-BDFD-B6D28A7C4DAC} = 10.12.0.1,10.6.0.1
FF - ProfilePath - c:\documents and settings\Johny\Data aplikacÝ\Mozilla\Firefox\Profiles\2p40lc4s.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL -
FF - component: c:\program files\NetSoftware\gemgecko\components\gemgecko.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npicaN.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- NASTAVEN═ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATN╔ POLOÄKY ODSTRAN╠N╔ Z REGISTRU - - - -
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
Notify-AtiExtEvent - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-12 20:06
Windows 5.1.2600 Service Pack 3 NTFS
skenovßnÝ skrytřch proces¨ ...
skenovßnÝ skrytřch polo×ek 'Po spuÜtýnÝ' ...
skenovßnÝ skrytřch soubor¨ ...
sken byl ˙speÜný dokonŔen
skrytÚ soubory: 0
**************************************************************************
.
--------------------- ZAMKNUT╔ KL═╚E V REGISTRU ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="36BB7E96625BCEA9C55DCC957C30940260B214CB23A5B947A87831D84E3B816994FC2382DAD54F14AF60419B506D96C5E72A7B3AB18C6E296DB02D456C16274C1E477EC74BEAF69B09CAD91CFA4DB234766CE96321229A088CDF32D005FEB247FAC92ABDC6032E27B887F6152103EAEDD3BF2A8AC48BF8D64F4A9125BC25384293E52113E27982B2E9365E5AEAB963210B9F67C777DCE59B43E8033D3CABED3817AE424ABA2022CF0CA7B792040D65946FBC340693A0FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808FEBC9E127BECC74CA9C6AECB7A5D1407BA7FD869164D6794C2D8EADA5D5A99271850BA66046C444D77874C735C8BDE206039B7EE0E118FACBFEBF7A5E1F1732268093CE00D76F8CF1E35C4C17F48C6F02C0AD07EC5C42DCB150D1E5DFDA9B118CB08F511590A25C3FBA3D05CAD1AC47965DD7D8198487AFC49C4E20B339F1A5D618A50DFD188B96AE9E3DAA6D94B9F86BFBBC7F921692FBE092F936EE34971BBED6276E7432CB37AE61C8D3859F6215C91BEFD1D604904FEA37C3DFAD9EA07EDDB73D978DFFE0C1D14085BDFE88D1531D61532D337DFB7A30DF035D442A1A6A7B7382D943C62C470B7747A9C25564E31AC043BBC6F740F025D659058AB5A270E313F69755208E286BBC3E1A21168237A586132A8B2264EE851C5AB140C585E371FA74B857FF96F66ADEB51DA13306B20BD99F59C1265C118C69226C8B9B1A7B2F727D165059175884179C76276EE872A6A2B28D3FEF9B74243DE62EEF3536402DA07C0E6880107DB49088A8967B955920B2A2F3A53FB8110EE5487B05979779707A5A1921349B7C2414B245579F73E48F43CB571485A779C93AE806BEE38C75E63F2C02312C5A1924889617CA3692A2E9D9D294F7E56F3F9A3BEFCB29BF642B27774AC0AD71F5F159D9CD1EC409B061D201E3B5EF806D4AA31E870CC2E6FD466EF443B6898569389A973CCC70CF4C45F3BA0E2DB9E537D2675A411355530F43E9E8F04176EBFE221758EE9DF2CAE5C32529CDAB7BB7AD3D9CBFDD998269D19F17716E2225603F381AE0687BE24D4C4CA6B9C2098FE0F43A533160B5A196CBDB093AEF6C7321B74C526834522E0487DCE32BFF5D77C763ADC51A0A7118B296298B04326FB475716FA53C58977AF3D865975BAE003AAE92BC8ECE6F5873B310AC1AE4E9867BDDD8C23509E7DE5C1BC667AA754AC5CE5F78D24724302BB4EB73D3413E339E3252491B45A738DC4AFA4A7B4DF6767D7ED01DA1FF0A89A60CDC4076C8728B981ED75DE1AD241EAA1F2A456FEDA62E121643C92DD9D98D2DC2431F65BD6540C83EC74B831C0138CBB694204C3F34BB213D234B6F8CF2D824AA22DA0E5F3356AE25C9361CBCD0D288856D448E2B1B6"
.
Celkovř Ŕas: 2010-11-12 20:18:42
ComboFix-quarantined-files.txt 2010-11-12 19:18
P°ed spuÜtýnÝm: 8á207á454á208
Po spuÜtýnÝ: 8á595á185á664
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - D4A7A79CFD9C9D4DB8AC9A829AB64B27