RSIT stále nespustitelné...
ComboFix 10-11-30.09 - Pavel 01.12.2010 21:06:06.2.1 - x86
Spuštěný z: c:\documents and settings\Pavel\Plocha\ComboFix.exe
* Vytvořen nový Bod Obnovení
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\Drivers\uipmfsla.sys
F:\autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_uipmfsla
-------\Service_uipmfsla
((((((((((((((((((((((((( Soubory vytvořené od 2010-11-01 do 2010-12-01 )))))))))))))))))))))))))))))))
.
2010-12-01 18:25 . 2010-12-01 18:25 -------- d-----w- c:\documents and settings\Pavel\Data aplikací\Malwarebytes
2010-12-01 18:24 . 2010-11-29 16:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-01 18:24 . 2010-12-01 18:24 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2010-12-01 18:24 . 2010-11-29 16:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-01 18:24 . 2010-12-01 18:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-01 16:52 . 2010-12-01 16:52 315392 ----a-w- c:\windows\system32\joohoucun.exe
2010-11-30 17:35 . 2010-11-10 04:33 6273872 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Windows Defender\Definition Updates\{4FC541B6-6362-49A9-A009-9B8873092990}\mpengine.dll
2010-11-30 16:35 . 2010-12-01 16:52 315392 ----a-w- c:\windows\system32\desesadoj.exe
2010-11-25 14:12 . 2010-12-01 16:52 315392 ----a-w- c:\windows\system32\tuquofevyd.exe
2010-11-21 18:09 . 2010-11-21 18:09 214 ----a-w- C:\wifi32.exe
2010-11-21 11:06 . 2010-11-21 11:21 -------- d-----w- c:\documents and settings\Pavel\Local Settings\Data aplikací\AskToolbar
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-01 20:13 . 2009-08-13 13:07 0 ----a-w- c:\documents and settings\Pavel\ntuser.tmp
2010-11-10 04:33 . 2007-09-27 15:44 6273872 ----a-w- c:\documents and settings\All Users\Data aplikací\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2010-10-19 09:41 . 2009-10-03 07:29 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-09-18 10:23 . 2004-08-18 12:00 974848 ----a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2004-08-18 12:00 974848 ----a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2004-08-18 12:00 954368 ----a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2004-08-18 12:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:52 . 2004-08-18 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-09-10 05:52 . 2004-08-18 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:52 . 2004-08-18 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-09-07 15:12 . 2010-09-20 17:06 38848 ----a-w- c:\windows\avastSS.scr
2010-09-07 15:11 . 2010-09-20 09:48 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-07 14:52 . 2010-09-20 09:49 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-07 14:52 . 2010-09-20 09:49 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-07 14:47 . 2010-09-20 09:49 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-07 14:47 . 2010-09-20 09:49 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-07 14:47 . 2010-09-20 09:49 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-07 14:47 . 2010-09-20 09:49 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-07 14:46 . 2010-09-20 09:49 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-29 16132608]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-12 53248]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-17 761945]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-04-21 142104]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-04-21 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-04-21 138008]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-03-30 342528]
"Boot"="c:\acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 579584]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2007-06-14 850704]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2007-05-24 475136]
"TomTomHOME.exe"="c:\program files\TomTom HOME\TomTomHOME.exe" [2007-05-15 3975848]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-09-07 2838912]
"rimmam"="c:\windows\system32\tuquofevyd.exe" [2010-12-01 315392]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2006-10-26 434528]
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe"
"ePower_DMC"=c:\acer\Empowering Technology\ePower\ePower_DMC.exe
"Acer ePresentation HPD"=c:\acer\Empowering Technology\ePresentation\ePresentation.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\RadLight Company\\RadLight 4.0\\rlkernel.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\frd.exe"=
R2 bohqzlid;bohqzlid; [x]
R2 caosaitl;caosaitl; [x]
R2 corivubf;corivubf; [x]
R2 czduluyn;czduluyn; [x]
R2 dccpizah;dccpizah; [x]
R2 dnyzcohj;dnyzcohj; [x]
R2 dukfjqte;dukfjqte; [x]
R2 dvnwtixc;dvnwtixc; [x]
R2 eitmvcie;eitmvcie; [x]
R2 fqxkzxox;fqxkzxox; [x]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-07 135664]
R2 hlbilcac;hlbilcac; [x]
R2 hnfdtzwq;hnfdtzwq; [x]
R2 hpolcvay;hpolcvay; [x]
R2 huhazogx;huhazogx; [x]
R2 ipfjbuat;ipfjbuat; [x]
R2 jcbgvjjt;jcbgvjjt; [x]
R2 jrhkdwxm;jrhkdwxm; [x]
R2 kaltwjfv;kaltwjfv; [x]
R2 khhmgupu;khhmgupu; [x]
R2 kqivccle;kqivccle; [x]
R2 lgyvqxtq;lgyvqxtq; [x]
R2 lswsundi;lswsundi; [x]
R2 ltcswlvy;ltcswlvy; [x]
R2 lwetizmt;lwetizmt; [x]
R2 mfxsbrnd;mfxsbrnd; [x]
R2 mzetiimj;mzetiimj; [x]
R2 nbelpzbe;nbelpzbe; [x]
R2 nhfvspoq;nhfvspoq; [x]
R2 nmxeoufy;nmxeoufy; [x]
R2 npeamrqh;npeamrqh; [x]
R2 npmqkahp;npmqkahp; [x]
R2 nqeuwjtx;nqeuwjtx; [x]
R2 nslzscku;nslzscku; [x]
R2 nuxrasuy;nuxrasuy; [x]
R2 orncnbtq;orncnbtq; [x]
R2 osfcifrl;osfcifrl; [x]
R2 oufljycr;oufljycr; [x]
R2 pcfjeggv;pcfjeggv; [x]
R2 pczaebgp;pczaebgp; [x]
R2 pfwwmreq;pfwwmreq; [x]
R2 punagqnm;punagqnm; [x]
R2 qaegvkrt;qaegvkrt; [x]
R2 qljyblun;qljyblun; [x]
R2 qpgeauzd;qpgeauzd; [x]
R2 qyxknpnf;qyxknpnf; [x]
R2 rntzxtcj;rntzxtcj; [x]
R2 rxjycatd;rxjycatd; [x]
R2 rxyqfdux;rxyqfdux; [x]
R2 satttlho;satttlho; [x]
R2 sckujrno;sckujrno; [x]
R2 scuirxot;scuirxot; [x]
R2 srnzgvdp;srnzgvdp; [x]
R2 tmdjjeup;tmdjjeup; [x]
R2 txtdlspl;txtdlspl; [x]
R2 uadttnng;uadttnng; [x]
R2 uicilsfx;uicilsfx; [x]
R2 uqkcdbas;uqkcdbas; [x]
R2 uynterdr;uynterdr; [x]
R2 vbsbdjrq;vbsbdjrq; [x]
R2 vrjroumz;vrjroumz; [x]
R2 vvtcnzbz;vvtcnzbz; [x]
R2 vzuhcrny;vzuhcrny; [x]
R2 wqorixtf;wqorixtf; [x]
R2 xaifsdci;xaifsdci; [x]
R2 xbovsbtu;xbovsbtu; [x]
R2 xdwmnopx;xdwmnopx; [x]
R2 xgsqkyoa;xgsqkyoa; [x]
R2 xrufjmka;xrufjmka; [x]
R2 xtnewzda;xtnewzda; [x]
R2 ylolemld;ylolemld; [x]
R2 yuoaishw;yuoaishw; [x]
R2 zcasbfvo;zcasbfvo; [x]
R2 zewbojie;zewbojie; [x]
R2 zhhqmjbr;zhhqmjbr; [x]
R2 zmornlve;zmornlve; [x]
R3 pvurpwsn;pvurpwsn;c:\windows\System32\Drivers\pvurpwsn.sys [x]
R3 xaeeegel;xaeeegel;c:\windows\System32\Drivers\xaeeegel.sys [x]
S1 aswSP;aswSP; [x]
S2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\Broadcom\ASFIPMon\AsfIpMon.exe [2006-12-19 79432]
S2 aswFsBlk;aswFsBlk; [x]
S2 iayeiaeuy;BsHelpCS;c:\windows\system32\desesadoj.exe [2010-12-01 315392]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2008-06-10 222456]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Obsah adresáře 'Naplánované úlohy'
2010-11-26 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-08-02 18:35]
2010-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-07 16:22]
2010-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-07 16:22]
2010-12-01 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
2010-12-01 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-09-28 20:44]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://googleure.com
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Pavel\Data aplikací\Mozilla\Firefox\Profiles\p76bgmi8.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://
www.seznam.cz/
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=PTV2&o=15851&locale=en_EU&apn_uid=17364013-532D-4A4D-BED4-9DB3FA6E86B9&apn_ptnrs=H3&apn_sauid=D6255A88-D870-43D9-B989-7574C8707E43&apn_dtid=YYYYYYYYCZ&q=
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Extension: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Extension: ÄŚeskĂ© slovnĂky pro kontrolu pravopisu:
cs@dictionaries.addons.mozilla.org - c:\documents and settings\Pavel\Data aplikací\Mozilla\Firefox\Profiles\p76bgmi8.default\extensions\
cs@dictionaries.addons.mozilla.org
FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\documents and settings\Pavel\Data aplikací\Mozilla\Firefox\Profiles\p76bgmi8.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Extension: PandoraTV Toolbar:
toolbar@ask.com - c:\documents and settings\Pavel\Data aplikací\Mozilla\Firefox\Profiles\p76bgmi8.default\extensions\
toolbar@ask.com
FF - Extension: Java Quick Starter:
jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} - (no file)
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
SafeBoot-uipmfsla.sys
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2010-12-01 21:16
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'explorer.exe'(1300)
c:\windows\system32\MSNCHATHOOK.DLL
c:\windows\system32\sysenv.dll
c:\windows\system32\CryptoAPI.dll
c:\windows\system32\ShowErrMsg.dll
c:\windows\system32\MFC71U.DLL
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\igfxext.exe
c:\docume~1\Pavel\LOCALS~1\Temp\RtkBtMnt.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Celkový čas: 2010-12-01 21:23:50 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-12-01 20:23
ComboFix2.txt 2010-08-15 15:13
Před spuštěním: 1 147 502 592
Po spuštění: 1 112 326 144
- - End Of File - - 95A74BBA5231D1E13580FA49ADDD2EA3
chtěl jsem se zeptat, jakou pravidelnou údržbu byste doporučil? A co mám dělat příště, když budu chtít např. preventivní kontrolu logů, když nefunguje RSIT?
Přispějete na provoz fóra?