Prohlížeče ve stavu "Neodpovídá".

[Yutaka]

Dobrý večer, řeším problém kdy se mě prohlížeč neustále zasekavá. Dělá to jak u IE tak mozily. NOD nic nenašel. Děkuji za radu


Logfile of random's system information tool 1.08 (written by random/random)
Run by tom at 2010-11-23 21:38:31
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 7 GB (29%) free of 25 GB
Total RAM: 3327 MB (79% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:38:36, on 23.11.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
C:\Program Files\TeamViewer\Version5\TeamViewer.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\ASUS\Six Engine\SixEngine.exe
C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\UnHackMe\hackmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\tom\Dokumenty\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\tom.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - (no file)
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - (no file)
O4 - HKLM\..\Run: [Six Engine] "C:\Program Files\ASUS\Six Engine\SixEngine.exe" -r
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [QFan Help] "C:\Program Files\ASUS\AI Suite\QFan3\QFanHelp.exe"
O4 - HKLM\..\Run: [Cpu Level Up help] C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [UnHackMe Monitor] C:\Program Files\UnHackMe\hackmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - D:\QIP\qip.exe (file missing) (HKCU)
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = zak,st.kvados.cz
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = zak,st.kvados.cz
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = zak,st.kvados.cz
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - (no file)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Program Files\OpenVPN\bin\openvpnserv.exe
O23 - Service: TeamViewer 5 (TeamViewer5) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe

--
End of file - 7262 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\FileCure Startup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-08-26 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-08-26 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{4B3803EA-5230-4DC3-A7FC-33638F3D3542}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Six Engine"=C:\Program Files\ASUS\Six Engine\SixEngine.exe [2008-06-03 5964800]
"Ai Nap"=C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe [2008-05-21 1423360]
"QFan Help"=C:\Program Files\ASUS\AI Suite\QFan3\QFanHelp.exe [2008-05-06 594432]
"Cpu Level Up help"=C:\Program Files\ASUS\AI Suite\CpuLevelUpHelp.exe [2007-11-30 881152]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-05-16 16862720]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2010-08-26 149280]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-03-09 2769336]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2010-04-03 13670504]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2010-04-03 110696]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2010-08-12 2215064]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-06-27 152872]
"UnHackMe Monitor"=C:\Program Files\UnHackMe\hackmon.exe [2010-11-11 594200]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-21 932288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
C:\Program Files\CCleaner\ccleaner.exe [2010-05-25 1694520]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GAINWARD]
C:\Program Files\EXPERTool\TBPanel.exe [2008-10-21 2177576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\QIP\qip.exe"="D:\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\mIRC\mirc.exe"="C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC"
"C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Ventrilo\Ventrilo.exe"="C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe"
"C:\Program Files\Garena\Garena.exe"="C:\Program Files\Garena\Garena.exe:*:Enabled:Garena"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Documents and Settings\tom\Plocha\igluna\L2WBypass.exe"="C:\Documents and Settings\tom\Plocha\igluna\L2WBypass.exe:*:Enabled:L2WBypass"
"D:\Warcraft III\Warcraft III.exe"="D:\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"D:\HOn\hon.exe"="D:\HOn\hon.exe:*:Enabled:Heroes of Newerth"
"C:\Riot Games\League of Legends\air\LolClient.exe"="C:\Riot Games\League of Legends\air\LolClient.exe:*:Enabled:League of Legends Lobby"
"C:\Riot Games\League of Legends\game\League of Legends.exe"="C:\Riot Games\League of Legends\game\League of Legends.exe:*:Enabled:League of Legends Game Client"
"C:\Documents and Settings\tom\Dokumenty\Stažené soubory\StarCraft_2_Beta_enGB.exe"="C:\Documents and Settings\tom\Dokumenty\Stažené soubory\StarCraft_2_Beta_enGB.exe:*:Enabled:Blizzard Downloader"
"D:\StarCraft II Beta\StarCraft II.exe"="D:\StarCraft II Beta\StarCraft II.exe:*:Enabled:Blizzard Launcher"
"D:\StarCraft II Beta\Support\BlizzardDownloader.exe"="D:\StarCraft II Beta\Support\BlizzardDownloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\Spotify\spotify.exe"="C:\Program Files\Spotify\spotify.exe:*:Enabled:Spotify"
"D:\StarCraft II\StarCraft II.exe"="D:\StarCraft II\StarCraft II.exe:*:Enabled:Blizzard Launcher"
"D:\StarCraft II\Versions\Base15405\SC2.exe"="D:\StarCraft II\Versions\Base15405\SC2.exe:*:Enabled:StarCraft II"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Miranda IM\miranda32.exe"="C:\Program Files\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"C:\Program Files\Java\jre6\bin\java.exe"="C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\TeamViewer\Version5\TeamViewer.exe"="C:\Program Files\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application"
"C:\Documents and Settings\tom\Dokumenty\eL2Walker\L2W_All.EXE"="C:\Documents and Settings\tom\Dokumenty\eL2Walker\L2W_All.EXE:*:Enabled:L2W_All"
"D:\StarCraft II\Versions\Base16605\SC2.exe"="D:\StarCraft II\Versions\Base16605\SC2.exe:*:Enabled:StarCraft II"
"D:\CS\hl.exe"="D:\CS\hl.exe:*:Enabled:Half-Life Launcher"
"D:\StarCraft II\Versions\Base16755\SC2.exe"="D:\StarCraft II\Versions\Base16755\SC2.exe:*:Enabled:StarCraft II"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"D:\World of Warcraft\Launcher.exe"="D:\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher"
"D:\World of Warcraft\Launcher.patch.exe"="D:\World of Warcraft\Launcher.patch.exe:*:Enabled:Blizzard Launcher"
"D:\World of Warcraft\World of Warcraft\Launcher.exe"="D:\World of Warcraft\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher"
"D:\World of Warcraft\World of Warcraft\Launcher.patch.exe"="D:\World of Warcraft\World of Warcraft\Launcher.patch.exe:*:Enabled:Blizzard Launcher"
"D:\World of Warcraft\World of Warcraft\Blizzard Downloader.exe"="D:\World of Warcraft\World of Warcraft\Blizzard Downloader.exe:*:Enabled:Blizzard Downloader"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2010-11-04 18:03:22 ----D---- C:\Program Files\MSBuild
2010-11-04 18:03:18 ----D---- C:\WINDOWS\system32\en-us
2010-11-04 17:51:52 ----D---- C:\WINDOWS\SxsCaPendDel
2010-11-04 17:47:46 ----N---- C:\WINDOWS\system32\spmsg2.dll
2010-11-04 17:47:42 ----HDC---- C:\WINDOWS\$NtUninstallXPSEPSCLP$

======List of files/folders modified in the last 1 months======

2010-11-23 21:38:34 ----D---- C:\WINDOWS\Temp
2010-11-23 21:38:34 ----D---- C:\Program Files\trend micro
2010-11-23 21:21:25 ----D---- C:\WINDOWS\system32\CatRoot2
2010-11-23 21:21:04 ----A---- C:\WINDOWS\system32\PARTIZAN.TXT
2010-11-23 21:19:52 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-11-23 21:14:05 ----D---- C:\Documents and Settings\tom\Data aplikací\vlc
2010-11-23 17:16:17 ----D---- C:\Documents and Settings\tom\Data aplikací\uTorrent
2010-11-23 17:15:53 ----A---- C:\WINDOWS\NeroDigital.ini
2010-11-23 11:32:16 ----D---- C:\WINDOWS\Prefetch
2010-11-22 23:59:36 ----D---- C:\Program Files\UnHackMe
2010-11-22 07:20:31 ----D---- C:\WINDOWS\system32
2010-11-22 07:14:32 ----D---- C:\WINDOWS
2010-11-21 15:52:41 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-11-21 15:52:41 ----HD---- C:\WINDOWS\inf
2010-11-19 12:51:56 ----D---- C:\Program Files\uTorrent
2010-11-18 22:28:49 ----D---- C:\Program Files\JDownloader
2010-11-18 20:27:28 ----D---- C:\Documents and Settings\tom\Data aplikací\dvdcss
2010-11-17 20:20:55 ----D---- C:\Documents and Settings\tom\Data aplikací\Adobe
2010-11-17 20:03:02 ----D---- C:\Program Files\Common Files
2010-11-17 07:26:22 ----A---- C:\WINDOWS\PhotoSnapViewer.INI
2010-11-15 22:33:03 ----D---- C:\WINDOWS\Debug
2010-11-13 16:31:01 ----A---- C:\WINDOWS\system.ini
2010-11-12 06:58:21 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-11-10 23:00:25 ----A---- C:\WINDOWS\system32\MRT.exe
2010-11-08 10:09:07 ----D---- C:\Documents and Settings\tom\Data aplikací\TeamViewer
2010-11-06 16:41:01 ----D---- C:\WINDOWS\Microsoft.NET
2010-11-06 16:40:59 ----RSD---- C:\WINDOWS\assembly
2010-11-06 08:58:09 ----D---- C:\Config.Msi
2010-11-05 22:23:43 ----SHD---- C:\WINDOWS\Installer
2010-11-05 22:22:59 ----D---- C:\WINDOWS\WinSxS
2010-11-05 03:03:05 ----D---- C:\WINDOWS\system32\XPSViewer
2010-11-05 03:02:59 ----RSD---- C:\WINDOWS\Fonts
2010-11-04 23:41:31 ----D---- C:\Documents and Settings\tom\Data aplikací\Miranda
2010-11-04 18:05:33 ----D---- C:\WINDOWS\system32\CatRoot
2010-11-04 18:03:22 ----RD---- C:\Program Files
2010-11-04 18:02:29 ----D---- C:\WINDOWS\system32\mui
2010-11-04 18:02:27 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-11-04 18:02:26 ----D---- C:\WINDOWS\pchealth
2010-11-04 17:47:31 ----D---- C:\WINDOWS\system32\cs-cz
2010-10-29 10:34:17 ----D---- C:\Program Files\Mozilla Firefox
2010-10-25 17:03:16 ----D---- C:\WINDOWS\system32\drivers
2010-10-24 01:10:10 ----D---- C:\WINDOWS\security
2010-10-24 00:36:21 ----D---- C:\Program Files\TeamSpeak 3 Client

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 mv61xx;mv61xx; C:\WINDOWS\system32\DRIVERS\mv61xx.sys [2008-06-23 150568]
R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-02-23 691696]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-03-09 28880]
R1 AsIO;AsIO; C:\WINDOWS\system32\drivers\AsIO.sys [2007-12-17 12400]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-03-09 162640]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-03-09 46672]
R1 BANTExt;Belarc SMBios Access; C:\WINDOWS\System32\Drivers\BANTExt.sys [2008-02-27 3840]
R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2010-07-29 115008]
R1 epfwtdi;epfwtdi; C:\WINDOWS\system32\DRIVERS\epfwtdi.sys [2010-08-03 55256]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-03-09 19024]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-03-09 100432]
R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2010-08-04 140752]
R2 epfw;epfw; C:\WINDOWS\system32\DRIVERS\epfw.sys [2010-07-29 134512]
R2 TBPanel;TBPanel; C:\WINDOWS\system32\drivers\TBPanel.sys [2007-03-16 12256]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 Epfwndis;Eset Personal Firewall; C:\WINDOWS\system32\DRIVERS\Epfwndis.sys [2010-07-29 32608]
R3 HDAudBus;Ovladač Microsoft UAA pro sběrnici High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-05-20 4800000]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\WINDOWS\system32\DRIVERS\l1e51x86.sys [2008-06-25 36864]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2010-04-03 10232128]
R3 tap0901;TAP-Win32 Adapter V9; C:\WINDOWS\system32\DRIVERS\tap0901.sys [2009-12-12 25984]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S0 Partizan;Partizan; C:\WINDOWS\system32\drivers\Partizan.sys [2010-09-24 35816]
S3 a877fp0x;a877fp0x; C:\WINDOWS\system32\drivers\a877fp0x.sys []
S3 ASNDIS5;ASNDIS5 Protocol Driver; \??\C:\WINDOWS\system32\ASNDIS5.SYS []
S3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-03-09 23376]
S3 Cardex;Cardex; \??\C:\WINDOWS\system32\drivers\TBPANEL.SYS []
S3 npkcrypt;npkcrypt; \??\D:\Lineage2 Interlude\system\npkcrypt.sys []
S3 npkcusb;npkcusb; \??\D:\Lineage2 Interlude\system\npkcusb.sys []
S3 NPPTNT2;NPPTNT2; \??\C:\WINDOWS\system32\npptNT2.sys []
S3 RegGuard;RegGuard; \??\C:\WINDOWS\system32\Drivers\regguard.sys []
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-03-09 40384]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2010-08-12 810144]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-08-26 153376]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2010-04-03 154216]
R2 TeamViewer5;TeamViewer 5; C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe [2010-06-21 173352]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-03-09 40384]
S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-03-09 40384]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2010-08-12 33584]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-11-28 800040]
S3 npggsvc;nProtect GameGuard Service; C:\WINDOWS\system32\GameMon.des [2010-08-02 3732680]
S3 OpenVPNService;OpenVPN Service; C:\Program Files\OpenVPN\bin\openvpnserv.exe [2009-12-12 36352]
S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[Roli]

Zdravím, tohel fixni v HJT :

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.qip.ru
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Root: HKCU; Subkey: Software\Microsoft\Internet Explorer\SearchUrl; ValueType: string; ValueName: '; ValueData: '; Flags: createvalueifdoesntexist noerror; Tasks: AddSearchQip
R3 - URLSearchHook: (no name) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - (no file)
R3 - URLSearchHook: (no name) - - (no file)
O3 - Toolbar: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

HJT najdeš zde :

C:\Program Files\trend micro\tom.exe

Fix znamená že spustíš HJT

v okně které se ti otevře klikneš na Do a system scan only

v dalším okně najdeš řádky které jsem ti vypsal,

vedle nich je čtvereček do kterého uděláš zatržítko,

pak klikneš na Fix checked které je vlevo dole,

program se ti zeptá zda opravdu ANO s tím samozřejmě souhlasíš a je hotovo.


Přes Start >> Spustit >> napiš - services.msc >> OK. Najdi službu :

NBService - Nero

NMIndexingService

klikni na ni pravým myšítkem, zvol vlastnosti, na další kartě nejprve službu zastav tlačítkem Zastavit a u položky Typ spouštění zvol Zakázáno.


Dále použij Mbam z mého podpisu a dej mi sem z něj log dříve než něco smažeš.

[Yutaka]

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 5177

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

23.11.2010 22:13:24
mbam-log-2010-11-23 (22-13-24).txt

Typ skenu: Rychlý sken
Skenované objekty: 146852
Uplynulý čas: 3 minuta(y), 6 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)
Omlovám se než jste napsal odpověd tak jsem iniciativně stáhl mbam a spustil ho. Našel 2x trojana a dal jsem smazat a až poté jsem přečetl váši reakci. Aktuální log z mbamu. Problém s prohlížečem přetrvává.



Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

[Yutaka]

Zdravím, problém přetrvává í když mbam nic nenašel Nějáká rada?

[Roli]

Stáhni a ulož na plochu ComboFix,

spusť aplikaci jako Administrátor a povol instalaci Konzole pro zotavení - Recovery Console.

Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,

pak ještě jednou klik na ANO a už to jede.

Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.

Při skenovaní může být PC i restartováno nelekat se.

Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,

protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.

Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na C:/Combofix.txt

(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.

[Yutaka]

Problém Combo fix ukoncil NODa a ja nemel moznost vypnout rezidentni stit. Avast jsem smazal cca 3 mesice zpet a pokazde jak zapnu pc se zobrazuje "cannot load language" z umistení kde je nainstalovan zmizlo avast remover a pres ovladaci panely taky nejsem schopny ho smazat.

ComboFix 10-11-24.01 - tom 24.11.2010 21:42:50.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3327.2277 [GMT 1:00]
Spuštěný z: c:\documents and settings\tom\Dokumenty\Stažené soubory\ComboFix.exe
AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: ESET Smart Security 4.2 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((( Soubory vytvořené od 2010-10-24 do 2010-11-24 )))))))))))))))))))))))))))))))
.

2010-11-04 17:03 . 2010-11-04 17:03 -------- d-----w- c:\program files\MSBuild
2010-11-04 16:51 . 2010-11-05 02:22 -------- d-----w- c:\windows\SxsCaPendDel
2010-11-04 16:47 . 2006-06-29 12:07 14048 ------w- c:\windows\system32\spmsg2.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-10 07:59 . 2010-09-24 18:09 2 --shatr- c:\windows\winstart.bat
2010-10-01 15:55 . 2010-10-01 18:14 722432 ----a-w- c:\windows\system32\SUXEBE.DLL.del
2010-09-18 10:23 . 2007-04-03 06:44 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2008-04-14 06:51 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2008-04-14 06:51 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-18 06:53 . 2001-10-25 12:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-09 14:23 . 2008-04-14 06:52 668160 ----a-w- c:\windows\system32\wininet.dll
2010-09-09 14:23 . 2008-04-14 06:50 61952 ----a-w- c:\windows\system32\tdc.ocx
2010-09-09 14:23 . 2008-04-14 06:51 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-09-09 14:16 . 2008-04-14 05:50 370176 ----a-w- c:\windows\system32\html.iec
2010-09-01 11:52 . 2008-04-14 06:37 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-09-01 07:57 . 2008-04-14 05:45 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:03 . 2008-04-14 06:52 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:54 . 2008-04-14 06:52 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-27 01:43 . 2008-05-05 06:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Six Engine"="c:\program files\ASUS\Six Engine\SixEngine.exe" [2008-06-03 5964800]
"Ai Nap"="c:\program files\ASUS\AI Suite\AiNap\AiNap.exe" [2008-05-21 1423360]
"QFan Help"="c:\program files\ASUS\AI Suite\QFan3\QFanHelp.exe" [2008-05-06 594432]
"Cpu Level Up help"="c:\program files\ASUS\AI Suite\CpuLevelUpHelp.exe" [2007-11-30 881152]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 16862720]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-03-09 2769336]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-03 13670504]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-03 110696]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-08-12 2215064]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 18:37 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
2010-05-25 16:08 1694520 ----a-w- c:\program files\CCleaner\CCleaner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-10-30 11:57 369200 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GAINWARD]
2008-10-21 15:12 2177576 ----a-w- c:\program files\EXPERTool\TBPANEL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 07:52 1695232 ------w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 12:57 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"RegistryBooster"="c:\program files\Uniblue\RegistryBooster\launcher.exe" delay 20000

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Riot Games\\League of Legends\\air\\LolClient.exe"=
"c:\\Riot Games\\League of Legends\\game\\League of Legends.exe"=
"d:\\StarCraft II\\StarCraft II.exe"=
"d:\\StarCraft II\\Versions\\Base15405\\SC2.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"d:\\StarCraft II\\Versions\\Base16605\\SC2.exe"=
"d:\\CS\\hl.exe"=
"d:\\StarCraft II\\Versions\\Base16755\\SC2.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"d:\\World of Warcraft\\World of Warcraft\\Launcher.exe"=
"d:\\World of Warcraft\\World of Warcraft\\Blizzard Downloader.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57840:TCP"= 57840:TCP:Pando Media Booster
"57840:UDP"= 57840:UDP:Pando Media Booster
"8377:TCP"= 8377:TCP:League of Legends Launcher
"8377:UDP"= 8377:UDP:League of Legends Launcher
"8378:TCP"= 8378:TCP:League of Legends Launcher
"8378:UDP"= 8378:UDP:League of Legends Launcher
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"5002:UDP"= 5002:UDP:*:Disabled:5002
"6917:TCP"= 6917:TCP:League of Legends Launcher
"6917:UDP"= 6917:UDP:League of Legends Launcher
"8379:TCP"= 8379:TCP:League of Legends Launcher
"8379:UDP"= 8379:UDP:League of Legends Launcher
"6975:TCP"= 6975:TCP:League of Legends Launcher
"6975:UDP"= 6975:UDP:League of Legends Launcher
"8380:TCP"= 8380:TCP:League of Legends Launcher
"8380:UDP"= 8380:UDP:League of Legends Launcher
"6920:TCP"= 6920:TCP:League of Legends Launcher
"6920:UDP"= 6920:UDP:League of Legends Launcher
"6918:TCP"= 6918:TCP:League of Legends Launcher
"6918:UDP"= 6918:UDP:League of Legends Launcher
"6982:TCP"= 6982:TCP:League of Legends Launcher
"6982:UDP"= 6982:UDP:League of Legends Launcher
"6888:TCP"= 6888:TCP:League of Legends Launcher
"6888:UDP"= 6888:UDP:League of Legends Launcher
"3389:TCP"= 3389:TCP:Remote Desktop
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"8054:TCP"= 8054:TCP:Services
"4778:TCP"= 4778:TCP:Services
"8381:TCP"= 8381:TCP:League of Legends Launcher
"8381:UDP"= 8381:UDP:League of Legends Launcher
"4039:TCP"= 4039:TCP:Services
"6578:TCP"= 6578:TCP:Services

R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [23.6.2008 23:21 150568]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [23.2.2010 21:16 691696]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [20.3.2010 18:20 162640]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [29.7.2010 12:31 115008]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [20.3.2010 18:20 19024]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [12.8.2010 13:16 810144]
R2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [21.6.2010 9:23 173352]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
.
Obsah adresáře 'Naplánované úlohy'
.
.
------- Doplňkový sken -------
.
IE: Crawler Search - tbr:iemenu
FF - ProfilePath - c:\documents and settings\tom\Data aplikací\Mozilla\Firefox\Profiles\banchiax.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKU-Default-Run-cleansweep.exe - c:\cleansweep.exe\cleansweep.exe
AddRemove-HD Tune_is1 - c:\program files\HD Tune\unins000.exe
AddRemove-BitTorrent DNA - c:\program files\DNA\btdna.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-24 21:44
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
Celkový čas: 2010-11-24 21:45:45
ComboFix-quarantined-files.txt 2010-11-24 20:45

Před spuštěním: 8 027 836 416
Po spuštění: 9 121 505 280

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 41C96685A394F47A5DAA8CD35E0D0D4C

[Yutaka]

rezidentni stit na NODovi jsem vypl a FW taky. Ale co se tce Avastu nevim si rady. Pokousel jsem se zastavit sluzbu + zakazat spusteni pri startu win a ani jedno nejde. Porad hlasi ze toto musim provest jako spravce ale ja jsem prihlaseny pod admin uctem. Nejaka rada?

[Yutaka]

Log z Avastem



ComboFix 10-11-24.01 - tom 24.11.2010 22:12:56.2.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3327.2812 [GMT 1:00]
Spuštěný z: c:\documents and settings\tom\Dokumenty\Stažené soubory\ComboFix.exe
AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: ESET Smart Security 4.2 *On-access scanning disabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.

((((((((((((((((((((((((( Soubory vytvořené od 2010-10-24 do 2010-11-24 )))))))))))))))))))))))))))))))
.

2010-11-24 19:19 . 2010-10-27 06:12 554736 ----a-w- c:\program files\Mozilla Firefox\uninstall\helper.exe
2010-11-04 17:03 . 2010-11-04 17:03 -------- d-----w- c:\program files\MSBuild
2010-11-04 16:51 . 2010-11-05 02:22 -------- d-----w- c:\windows\SxsCaPendDel
2010-11-04 16:47 . 2006-06-29 12:07 14048 ------w- c:\windows\system32\spmsg2.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-10 07:59 . 2010-09-24 18:09 2 --shatr- c:\windows\winstart.bat
2010-10-01 15:55 . 2010-10-01 18:14 722432 ----a-w- c:\windows\system32\SUXEBE.DLL.del
2010-09-18 10:23 . 2007-04-03 06:44 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2008-04-14 06:51 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2008-04-14 06:51 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-18 06:53 . 2001-10-25 12:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-09 14:23 . 2008-04-14 06:52 668160 ----a-w- c:\windows\system32\wininet.dll
2010-09-09 14:23 . 2008-04-14 06:50 61952 ----a-w- c:\windows\system32\tdc.ocx
2010-09-09 14:23 . 2008-04-14 06:51 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-09-09 14:16 . 2008-04-14 05:50 370176 ----a-w- c:\windows\system32\html.iec
2010-09-01 11:52 . 2008-04-14 06:37 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-09-01 07:57 . 2008-04-14 05:45 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:03 . 2008-04-14 06:52 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:54 . 2008-04-14 06:52 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-27 01:43 . 2008-05-05 06:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-11-24_20.44.49 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-11-22 06:14 . 2010-11-24 20:58 32768 c:\windows\Temp\Temporary Internet Files\Content.IE5\index.dat
- 2010-11-22 06:14 . 2010-11-24 13:58 32768 c:\windows\Temp\Temporary Internet Files\Content.IE5\index.dat
+ 2010-11-24 20:58 . 2010-11-24 20:58 16384 c:\windows\Temp\Perflib_Perfdata_6e8.dat
+ 2010-11-22 06:14 . 2010-11-24 20:58 16384 c:\windows\Temp\History\History.IE5\index.dat
- 2010-11-22 06:14 . 2010-11-24 13:58 16384 c:\windows\Temp\History\History.IE5\index.dat
+ 2010-11-22 06:14 . 2010-11-24 20:58 16384 c:\windows\Temp\Cookies\index.dat
- 2010-11-22 06:14 . 2010-11-24 13:58 16384 c:\windows\Temp\Cookies\index.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Six Engine"="c:\program files\ASUS\Six Engine\SixEngine.exe" [2008-06-03 5964800]
"Ai Nap"="c:\program files\ASUS\AI Suite\AiNap\AiNap.exe" [2008-05-21 1423360]
"QFan Help"="c:\program files\ASUS\AI Suite\QFan3\QFanHelp.exe" [2008-05-06 594432]
"Cpu Level Up help"="c:\program files\ASUS\AI Suite\CpuLevelUpHelp.exe" [2007-11-30 881152]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 16862720]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-03-09 2769336]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-03 13670504]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-03 110696]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-08-12 2215064]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 18:37 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
2010-05-25 16:08 1694520 ----a-w- c:\program files\CCleaner\CCleaner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-10-30 11:57 369200 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GAINWARD]
2008-10-21 15:12 2177576 ----a-w- c:\program files\EXPERTool\TBPANEL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 07:52 1695232 ------w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 12:57 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"avast! Web Scanner"=3 (0x3)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"RegistryBooster"="c:\program files\Uniblue\RegistryBooster\launcher.exe" delay 20000

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Riot Games\\League of Legends\\air\\LolClient.exe"=
"c:\\Riot Games\\League of Legends\\game\\League of Legends.exe"=
"d:\\StarCraft II\\StarCraft II.exe"=
"d:\\StarCraft II\\Versions\\Base15405\\SC2.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"d:\\StarCraft II\\Versions\\Base16605\\SC2.exe"=
"d:\\CS\\hl.exe"=
"d:\\StarCraft II\\Versions\\Base16755\\SC2.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"d:\\World of Warcraft\\World of Warcraft\\Launcher.exe"=
"d:\\World of Warcraft\\World of Warcraft\\Blizzard Downloader.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57840:TCP"= 57840:TCP:Pando Media Booster
"57840:UDP"= 57840:UDP:Pando Media Booster
"8377:TCP"= 8377:TCP:League of Legends Launcher
"8377:UDP"= 8377:UDP:League of Legends Launcher
"8378:TCP"= 8378:TCP:League of Legends Launcher
"8378:UDP"= 8378:UDP:League of Legends Launcher
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"5002:UDP"= 5002:UDP:*:Disabled:5002
"6917:TCP"= 6917:TCP:League of Legends Launcher
"6917:UDP"= 6917:UDP:League of Legends Launcher
"8379:TCP"= 8379:TCP:League of Legends Launcher
"8379:UDP"= 8379:UDP:League of Legends Launcher
"6975:TCP"= 6975:TCP:League of Legends Launcher
"6975:UDP"= 6975:UDP:League of Legends Launcher
"8380:TCP"= 8380:TCP:League of Legends Launcher
"8380:UDP"= 8380:UDP:League of Legends Launcher
"6920:TCP"= 6920:TCP:League of Legends Launcher
"6920:UDP"= 6920:UDP:League of Legends Launcher
"6918:TCP"= 6918:TCP:League of Legends Launcher
"6918:UDP"= 6918:UDP:League of Legends Launcher
"6982:TCP"= 6982:TCP:League of Legends Launcher
"6982:UDP"= 6982:UDP:League of Legends Launcher
"6888:TCP"= 6888:TCP:League of Legends Launcher
"6888:UDP"= 6888:UDP:League of Legends Launcher
"3389:TCP"= 3389:TCP:Remote Desktop
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"8054:TCP"= 8054:TCP:Services
"4778:TCP"= 4778:TCP:Services
"8381:TCP"= 8381:TCP:League of Legends Launcher
"8381:UDP"= 8381:UDP:League of Legends Launcher
"4039:TCP"= 4039:TCP:Services
"6578:TCP"= 6578:TCP:Services
"7430:TCP"= 7430:TCP:Services
"7431:TCP"= 7431:TCP:Services

R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [23.6.2008 23:21 150568]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [23.2.2010 21:16 691696]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [20.3.2010 18:20 162640]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [29.7.2010 12:31 115008]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [20.3.2010 18:20 19024]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [12.8.2010 13:16 810144]
R2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [21.6.2010 9:23 173352]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

--- Ostatní služby/ovladače v paměti ---

*NewlyCreated* - SYSMONLOG
.
.
------- Doplňkový sken -------
.
IE: Crawler Search - tbr:iemenu
FF - ProfilePath - c:\documents and settings\tom\Data aplikací\Mozilla\Firefox\Profiles\banchiax.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

AddRemove-Belarc Advisor - c:\progra~1\Belarc\Advisor\Uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-24 22:15
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(2684)
c:\program files\Common Files\Ahead\Lib\NeroDigitalExt.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
.
Celkový čas: 2010-11-24 22:16:27
ComboFix-quarantined-files.txt 2010-11-24 21:16
ComboFix2.txt 2010-11-24 20:45

Před spuštěním: 9 129 627 648
Po spuštění: 9 116 426 240

- - End Of File - - 9A90213891969B728FD1F60EAAB2769D

[Roli]

No než použiješ ComboFix je dobré číst návod, nepíši ho pro nic za nic, tak se pak nesmíš divit že ti vypnul antivir.

Také má být ComboFix uložen na Ploše a ne někde zašitý.

Programy z PC se namažou ale odinstalují.

Pokud jsi tak ještě neučinil, přesuň Combofix na plochu

otevři si Poznámkový blok

do něj zkopíruj skript z následujícího okna:

Kód: Vybrat vše

File::  
c:\windows\system32\drivers\aswSP.sys
c:\windows\system32\drivers\aswFsBlk.sys
c:\windows\system32\drivers\Aavmker4.sys
c:\windows\system32\drivers\aswTdi.sys
c:\windows\\system32\drivers\aswMon2.sys

Folder::
C:\Program Files\Alwil Software

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"=-
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"avast! Web Scanner"=-
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"avast! Mail Scanner"=-
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"avast! Antivirus"=-

Driver::
aswSP
aswFsBlk
Aavmker4
aswTdi
aswMon2

ulož Tebou vytvořený TXT soubor jako CFScript.txt na plochu,

po uložení uchop vytvořený skript levým myšítkem a přesuň ho nad ikonu Combofixu, kde ho upustíš:



Po aplikaci na Tebe vypadne další log, zkopíruj ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou,

v tom případě znovu restartuj a přitom mačkej F8 poté zvol Poslední známou funkční konfiguraci

[Yutaka]

ComboFix 10-11-24.01 - tom 24.11.2010 23:07:51.3.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.3327.2739 [GMT 1:00]
Spuštěný z: c:\documents and settings\tom\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\tom\Plocha\CFScript.txt
AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: ESET Smart Security 4.2 *On-access scanning disabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

FILE ::
"c:\windows\\system32\drivers\aswMon2.sys"
"c:\windows\system32\drivers\Aavmker4.sys"
"c:\windows\system32\drivers\aswFsBlk.sys"
"c:\windows\system32\drivers\aswSP.sys"
"c:\windows\system32\drivers\aswTdi.sys"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Alwil Software
c:\program files\Alwil Software\Avast5\1029\aswClnTg.htm
c:\program files\Alwil Software\Avast5\1029\aswClnTg.txt
c:\program files\Alwil Software\Avast5\1029\aswInfTg.htm
c:\program files\Alwil Software\Avast5\1029\aswInfTg.txt
c:\program files\Alwil Software\Avast5\1029\Avast5_1029.chm
c:\program files\Alwil Software\Avast5\1029\Base.dll
c:\program files\Alwil Software\Avast5\1029\Boot.dll
c:\program files\Alwil Software\Avast5\1029\uiLangRes.dll
c:\program files\Alwil Software\Avast5\Aavm4h.dll
c:\program files\Alwil Software\Avast5\AavmRpch.dll
c:\program files\Alwil Software\Avast5\AhResBhv.dll
c:\program files\Alwil Software\Avast5\AhResMai.dll
c:\program files\Alwil Software\Avast5\ahResMes.dll
c:\program files\Alwil Software\Avast5\AhResNS.dll
c:\program files\Alwil Software\Avast5\ahResP2P.dll
c:\program files\Alwil Software\Avast5\AhResStd.dll
c:\program files\Alwil Software\Avast5\AhResWS.dll
c:\program files\Alwil Software\Avast5\ashBase.dll
c:\program files\Alwil Software\Avast5\ashMaiSv.dll
c:\program files\Alwil Software\Avast5\ashOutXt.dll
c:\program files\Alwil Software\Avast5\ashQuick.exe
c:\program files\Alwil Software\Avast5\ashServ.dll
c:\program files\Alwil Software\Avast5\ashShell.dll
c:\program files\Alwil Software\Avast5\ashTask.dll
c:\program files\Alwil Software\Avast5\ashTaskEx.dll
c:\program files\Alwil Software\Avast5\ashUpd.exe
c:\program files\Alwil Software\Avast5\ashWebSv.dll
c:\program files\Alwil Software\Avast5\ashWsFtr.dll
c:\program files\Alwil Software\Avast5\aswAux.dll
c:\program files\Alwil Software\Avast5\aswCmnBS.dll
c:\program files\Alwil Software\Avast5\aswCmnIS.dll
c:\program files\Alwil Software\Avast5\aswCmnOS.dll
c:\program files\Alwil Software\Avast5\aswData.dll
c:\program files\Alwil Software\Avast5\aswDld.dll
c:\program files\Alwil Software\Avast5\aswEngLdr.dll
c:\program files\Alwil Software\Avast5\aswIdle.dll
c:\program files\Alwil Software\Avast5\aswLog.dll
c:\program files\Alwil Software\Avast5\aswMonDS.sys
c:\program files\Alwil Software\Avast5\aswMonVD.dll
c:\program files\Alwil Software\Avast5\aswProperty.dll
c:\program files\Alwil Software\Avast5\aswRegSvr.exe
c:\program files\Alwil Software\Avast5\aswRegSvr64.exe
c:\program files\Alwil Software\Avast5\aswRunDll.exe
c:\program files\Alwil Software\Avast5\aswSqLt.dll
c:\program files\Alwil Software\Avast5\aswUtil.dll
c:\program files\Alwil Software\Avast5\avastSS.dll
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Alwil Software\Avast5\AvastUI.exe
c:\program files\Alwil Software\Avast5\AvSSHook.dll
c:\program files\Alwil Software\Avast5\CommonRes.dll
c:\program files\Alwil Software\Avast5\DATA\aswResp.dat
c:\program files\Alwil Software\Avast5\DATA\Avast5.ini
c:\program files\Alwil Software\Avast5\DATA\chest\index.xml
c:\program files\Alwil Software\Avast5\DATA\Log.db
c:\program files\Alwil Software\Avast5\DATA\log\Chest.log
c:\program files\Alwil Software\Avast5\DATA\log\nshield.log
c:\program files\Alwil Software\Avast5\DATA\log\selfdef.log
c:\program files\Alwil Software\Avast5\defs\10041900\acshort.map
c:\program files\Alwil Software\Avast5\defs\10041900\algo.dll
c:\program files\Alwil Software\Avast5\defs\10041900\ArPot.dll
c:\program files\Alwil Software\Avast5\defs\10041900\aswAR.dll
c:\program files\Alwil Software\Avast5\defs\10041900\aswBoot.dll
c:\program files\Alwil Software\Avast5\defs\10041900\aswCleanerDLL.dll
c:\program files\Alwil Software\Avast5\defs\10041900\aswCmnBS.dll
c:\program files\Alwil Software\Avast5\defs\10041900\aswCmnIS.dll
c:\program files\Alwil Software\Avast5\defs\10041900\aswCmnOS.dll
c:\program files\Alwil Software\Avast5\defs\10041900\aswEngin.dll
c:\program files\Alwil Software\Avast5\defs\10041900\aswRawFS.dll
c:\program files\Alwil Software\Avast5\defs\10041900\aswScan.dll
c:\program files\Alwil Software\Avast5\defs\10041900\certs.map
c:\program files\Alwil Software\Avast5\defs\10041900\db_el.dat
c:\program files\Alwil Software\Avast5\defs\10041900\db_js.dat
c:\program files\Alwil Software\Avast5\defs\10041900\db_js.map
c:\program files\Alwil Software\Avast5\defs\10041900\db_mx4.dat
c:\program files\Alwil Software\Avast5\defs\10041900\db_mx4.map
c:\program files\Alwil Software\Avast5\defs\10041900\db_mx95.dat
c:\program files\Alwil Software\Avast5\defs\10041900\db_mx95.map
c:\program files\Alwil Software\Avast5\defs\10041900\db_o7.dat
c:\program files\Alwil Software\Avast5\defs\10041900\db_o7.map
c:\program files\Alwil Software\Avast5\defs\10041900\db_ob.dat
c:\program files\Alwil Software\Avast5\defs\10041900\db_pe2.dat
c:\program files\Alwil Software\Avast5\defs\10041900\db_swf.dat
c:\program files\Alwil Software\Avast5\defs\10041900\db_swf.map
c:\program files\Alwil Software\Avast5\defs\10041900\db_tx.dat
c:\program files\Alwil Software\Avast5\defs\10041900\db_u.dat
c:\program files\Alwil Software\Avast5\defs\10041900\db_w6.dat
c:\program files\Alwil Software\Avast5\defs\10041900\db_w6.map
c:\program files\Alwil Software\Avast5\defs\10041900\db_wh.dat
c:\program files\Alwil Software\Avast5\defs\10041900\db_xtn.map
c:\program files\Alwil Software\Avast5\defs\10041900\def.ini
c:\program files\Alwil Software\Avast5\defs\10041900\dllcc.dat
c:\program files\Alwil Software\Avast5\defs\10041900\exts.dll
c:\program files\Alwil Software\Avast5\defs\10041900\fwAux.dll
c:\program files\Alwil Software\Avast5\defs\10041900\l_idx.map
c:\program files\Alwil Software\Avast5\defs\10041900\l_nmp.map
c:\program files\Alwil Software\Avast5\defs\10041900\list_d.txt
c:\program files\Alwil Software\Avast5\defs\10041900\list_i.txt
c:\program files\Alwil Software\Avast5\defs\10041900\lshe3.map
c:\program files\Alwil Software\Avast5\defs\10041900\s_idx.map
c:\program files\Alwil Software\Avast5\defs\10041900\s_nmp.map
c:\program files\Alwil Software\Avast5\defs\10041900\Sf.bin
c:\program files\Alwil Software\Avast5\defs\10041900\sl_idx.map
c:\program files\Alwil Software\Avast5\defs\10041900\sl_nmp.map
c:\program files\Alwil Software\Avast5\defs\10041900\whitelist.db
c:\program files\Alwil Software\Avast5\defs\aswdefs.ini
c:\program files\Alwil Software\Avast5\flash\amcharts_key.txt
c:\program files\Alwil Software\Avast5\flash\amline.swf
c:\program files\Alwil Software\Avast5\flash\ammap\ammap.swf
c:\program files\Alwil Software\Avast5\flash\ammap\ammap_key.txt
c:\program files\Alwil Software\Avast5\flash\ammap\ammap_settings_summary.xml
c:\program files\Alwil Software\Avast5\flash\ammap\ammap_settings_tracert.xml
c:\program files\Alwil Software\Avast5\flash\ammap\empty_map.xml
c:\program files\Alwil Software\Avast5\flash\ammap\icons\arrow.swf
c:\program files\Alwil Software\Avast5\flash\ammap\icons\bubble.swf
c:\program files\Alwil Software\Avast5\flash\ammap\icons\cross.swf
c:\program files\Alwil Software\Avast5\flash\ammap\icons\flag.swf
c:\program files\Alwil Software\Avast5\flash\ammap\icons\pin.swf
c:\program files\Alwil Software\Avast5\flash\ammap\icons\zoom_out.swf
c:\program files\Alwil Software\Avast5\flash\ammap\maps\world.swf
c:\program files\Alwil Software\Avast5\Setup\ais_core-180.vpx
c:\program files\Alwil Software\Avast5\Setup\ais_dll_cze-12a.vpx
c:\program files\Alwil Software\Avast5\Setup\ais_res-107.vpx
c:\program files\Alwil Software\Avast5\Setup\avast.setup
c:\program files\Alwil Software\Avast5\Setup\Components.ini
c:\program files\Alwil Software\Avast5\Setup\INF\Aavmker4.sys
c:\program files\Alwil Software\Avast5\Setup\INF\aswFsBlk.sys
c:\program files\Alwil Software\Avast5\Setup\INF\aswMon.sys
c:\program files\Alwil Software\Avast5\Setup\INF\aswMon2.sys
c:\program files\Alwil Software\Avast5\Setup\INF\aswMonFlt.sys
c:\program files\Alwil Software\Avast5\Setup\INF\AswRdr.sys
c:\program files\Alwil Software\Avast5\Setup\INF\aswSP.sys
c:\program files\Alwil Software\Avast5\Setup\INF\AswTdi.sys
c:\program files\Alwil Software\Avast5\Setup\jrog-a7.vpx
c:\program files\Alwil Software\Avast5\Setup\part-jrog-a7.vpx
c:\program files\Alwil Software\Avast5\Setup\part-prg_ais-1ce.vpx
c:\program files\Alwil Software\Avast5\Setup\part-setup_ais-1ce.vpx
c:\program files\Alwil Software\Avast5\Setup\part-vps_win32-10112402.vpx
c:\program files\Alwil Software\Avast5\Setup\prod-ais.vpx
c:\program files\Alwil Software\Avast5\Setup\servers.def
c:\program files\Alwil Software\Avast5\Setup\servers.def.lkg
c:\program files\Alwil Software\Avast5\Setup\servers.def.vpx
c:\program files\Alwil Software\Avast5\Setup\setif_ais-1ce.vpx
c:\program files\Alwil Software\Avast5\Setup\setiface.dll
c:\program files\Alwil Software\Avast5\Setup\setiface.ovr
c:\program files\Alwil Software\Avast5\Setup\setup.ini
c:\program files\Alwil Software\Avast5\Setup\setup.log
c:\program files\Alwil Software\Avast5\Setup\setup.ovr
c:\program files\Alwil Software\Avast5\Setup\setup_ais-1ce.vpx
c:\program files\Alwil Software\Avast5\Setup\summary.txt
c:\program files\Alwil Software\Avast5\Setup\vps_32-18f.vpx
c:\program files\Alwil Software\Avast5\Setup\vps_win32-1a4.vpx
c:\program files\Alwil Software\Avast5\Setup\winsys-3.vpx
c:\program files\Alwil Software\Avast5\sched.exe
c:\program files\Alwil Software\Avast5\VisthAux.exe
c:\windows\\system32\drivers\aswMon2.sys
c:\windows\system32\drivers\Aavmker4.sys
c:\windows\system32\drivers\aswFsBlk.sys
c:\windows\system32\drivers\aswSP.sys
c:\windows\system32\drivers\aswTdi.sys

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AAVMKER4
-------\Legacy_ASWFSBLK
-------\Legacy_ASWMON2
-------\Legacy_ASWSP
-------\Legacy_ASWTDI
-------\Service_Aavmker4
-------\Service_aswFsBlk
-------\Service_aswMon2
-------\Service_aswSP
-------\Service_aswTdi


((((((((((((((((((((((((( Soubory vytvořené od 2010-10-24 do 2010-11-24 )))))))))))))))))))))))))))))))
.

2010-11-24 21:24 . 2010-11-24 21:24 -------- d-----w- c:\documents and settings\All Users\Data aplikaci\Alwil Software
2010-11-04 17:03 . 2010-11-04 17:03 -------- d-----w- c:\program files\MSBuild
2010-11-04 16:51 . 2010-11-05 02:22 -------- d-----w- c:\windows\SxsCaPendDel
2010-11-04 16:47 . 2006-06-29 12:07 14048 ------w- c:\windows\system32\spmsg2.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-10 07:59 . 2010-09-24 18:09 2 --shatr- c:\windows\winstart.bat
2010-10-01 15:55 . 2010-10-01 18:14 722432 ----a-w- c:\windows\system32\SUXEBE.DLL.del
2010-09-18 10:23 . 2007-04-03 06:44 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2008-04-14 06:51 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2008-04-14 06:51 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-18 06:53 . 2001-10-25 12:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-09 14:23 . 2008-04-14 06:52 668160 ----a-w- c:\windows\system32\wininet.dll
2010-09-09 14:23 . 2008-04-14 06:50 61952 ----a-w- c:\windows\system32\tdc.ocx
2010-09-09 14:23 . 2008-04-14 06:51 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-09-09 14:16 . 2008-04-14 05:50 370176 ----a-w- c:\windows\system32\html.iec
2010-09-01 11:52 . 2008-04-14 06:37 285824 ----a-w- c:\windows\system32\atmfd.dll
2010-09-01 07:57 . 2008-04-14 05:45 1852800 ----a-w- c:\windows\system32\win32k.sys
2010-08-27 08:03 . 2008-04-14 06:52 119808 ----a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:54 . 2008-04-14 06:52 99840 ----a-w- c:\windows\system32\srvsvc.dll
2010-08-27 01:43 . 2008-05-05 06:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-11-24_20.44.49 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-11-22 06:14 . 2010-11-24 22:13 32768 c:\windows\Temp\Temporary Internet Files\Content.IE5\index.dat
- 2010-11-22 06:14 . 2010-11-24 13:58 32768 c:\windows\Temp\Temporary Internet Files\Content.IE5\index.dat
+ 2010-11-24 22:13 . 2010-11-24 22:13 16384 c:\windows\Temp\Perflib_Perfdata_828.dat
+ 2010-11-24 22:13 . 2010-11-24 22:13 16384 c:\windows\Temp\Perflib_Perfdata_23c.dat
+ 2010-11-22 06:14 . 2010-11-24 22:13 16384 c:\windows\Temp\History\History.IE5\index.dat
- 2010-11-22 06:14 . 2010-11-24 13:58 16384 c:\windows\Temp\History\History.IE5\index.dat
+ 2010-11-22 06:14 . 2010-11-24 22:13 16384 c:\windows\Temp\Cookies\index.dat
- 2010-11-22 06:14 . 2010-11-24 13:58 16384 c:\windows\Temp\Cookies\index.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Six Engine"="c:\program files\ASUS\Six Engine\SixEngine.exe" [2008-06-03 5964800]
"Ai Nap"="c:\program files\ASUS\AI Suite\AiNap\AiNap.exe" [2008-05-21 1423360]
"QFan Help"="c:\program files\ASUS\AI Suite\QFan3\QFanHelp.exe" [2008-05-06 594432]
"Cpu Level Up help"="c:\program files\ASUS\AI Suite\CpuLevelUpHelp.exe" [2007-11-30 881152]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 16862720]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-03 13670504]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-03 110696]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2010-08-12 2215064]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 18:37 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]
2010-05-25 16:08 1694520 ----a-w- c:\program files\CCleaner\CCleaner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-10-30 11:57 369200 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GAINWARD]
2008-10-21 15:12 2177576 ----a-w- c:\program files\EXPERTool\TBPANEL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 07:52 1695232 ------w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 12:57 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"RegistryBooster"="c:\program files\Uniblue\RegistryBooster\launcher.exe" delay 20000

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Riot Games\\League of Legends\\air\\LolClient.exe"=
"c:\\Riot Games\\League of Legends\\game\\League of Legends.exe"=
"d:\\StarCraft II\\StarCraft II.exe"=
"d:\\StarCraft II\\Versions\\Base15405\\SC2.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=
"d:\\StarCraft II\\Versions\\Base16605\\SC2.exe"=
"d:\\CS\\hl.exe"=
"d:\\StarCraft II\\Versions\\Base16755\\SC2.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"d:\\World of Warcraft\\World of Warcraft\\Launcher.exe"=
"d:\\World of Warcraft\\World of Warcraft\\Blizzard Downloader.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57840:TCP"= 57840:TCP:Pando Media Booster
"57840:UDP"= 57840:UDP:Pando Media Booster
"8377:TCP"= 8377:TCP:League of Legends Launcher
"8377:UDP"= 8377:UDP:League of Legends Launcher
"8378:TCP"= 8378:TCP:League of Legends Launcher
"8378:UDP"= 8378:UDP:League of Legends Launcher
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"5002:UDP"= 5002:UDP:*:Disabled:5002
"6917:TCP"= 6917:TCP:League of Legends Launcher
"6917:UDP"= 6917:UDP:League of Legends Launcher
"8379:TCP"= 8379:TCP:League of Legends Launcher
"8379:UDP"= 8379:UDP:League of Legends Launcher
"6975:TCP"= 6975:TCP:League of Legends Launcher
"6975:UDP"= 6975:UDP:League of Legends Launcher
"8380:TCP"= 8380:TCP:League of Legends Launcher
"8380:UDP"= 8380:UDP:League of Legends Launcher
"6920:TCP"= 6920:TCP:League of Legends Launcher
"6920:UDP"= 6920:UDP:League of Legends Launcher
"6918:TCP"= 6918:TCP:League of Legends Launcher
"6918:UDP"= 6918:UDP:League of Legends Launcher
"6982:TCP"= 6982:TCP:League of Legends Launcher
"6982:UDP"= 6982:UDP:League of Legends Launcher
"6888:TCP"= 6888:TCP:League of Legends Launcher
"6888:UDP"= 6888:UDP:League of Legends Launcher
"3389:TCP"= 3389:TCP:Remote Desktop
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"8054:TCP"= 8054:TCP:Services
"4778:TCP"= 4778:TCP:Services
"8381:TCP"= 8381:TCP:League of Legends Launcher
"8381:UDP"= 8381:UDP:League of Legends Launcher
"4039:TCP"= 4039:TCP:Services
"6578:TCP"= 6578:TCP:Services
"7430:TCP"= 7430:TCP:Services
"7431:TCP"= 7431:TCP:Services
"6484:TCP"= 6484:TCP:Services
"3992:TCP"= 3992:TCP:Services

R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [23.6.2008 23:21 150568]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [23.2.2010 21:16 691696]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [29.7.2010 12:31 115008]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [12.8.2010 13:16 810144]
R2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [21.6.2010 9:23 173352]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
.
.
------- Doplňkový sken -------
.
IE: Crawler Search - tbr:iemenu
FF - ProfilePath - c:\documents and settings\tom\Data aplikací\Mozilla\Firefox\Profiles\banchiax.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-24 23:13
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wdfmgr.exe
c:\program files\TeamViewer\Version5\TeamViewer.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Celkový čas: 2010-11-24 23:14:46 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-11-24 22:14
ComboFix2.txt 2010-11-24 21:16
ComboFix3.txt 2010-11-24 20:45

Před spuštěním: 9 111 199 744
Po spuštění: 8 880 308 224

- - End Of File - - 4651ABCEB76BDBCDA95314DB3EEA37C1

[Roli]

Přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Stáhni AvastCleaner na Plochu,

restartuj do Nouzového režimu,

spusť aswClear5 a klikni na SMAZAT,

restartuj do Normálního režimu.


Použij T-Cleaner, který smaže případné zbytky po aplikacích které jsme použili.

Jen před jeho stažením a při použití stopni antivir, protože ho muže detekovat jako vir ale není tomu tak.


Pak dej vědět jaký je stav PC.

[Yutaka]

PC funguje v pořádku. Avast byl úspešně odstraněn + internet taky funguje jak má. Děkuju mnohokrát za pomoc

[Roli]

Není zač.

[Yutaka]

Tak problem není vyřešen. Když vlezu někde na web dojde k přesměrování na nějákou stranku kde dole běží nějáká antivirová kontrola a vypisuje viry.

[Yutaka]

MBAM našel vira.


Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Verze databáze: 5177

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

25.11.2010 21:52:20
mbam-log-2010-11-25 (21-52-20).txt

Typ skenu: Rychlý sken
Skenované objekty: 146482
Uplynulý čas: 4 minuta(y), 3 sekunda(y)

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče registru: 0
Infikované hodnoty registru: 0
Infikované datové položky registru: 0
Infikované složky: 0
Infikované soubory: 1

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
C:\RECYCLER\S-1-5-21-1409082233-926492609-682003330-1003\Dc9.exe (Backdoor.Bot) -> No action taken.