Preventívna kontrola

[lmp]

Nepostrehol som nejaké problémy s pc, ale mám tu nejaké divné zložky s názvom typu "35884c9d767186df48fa9eef42c4" sú asi 4 na disku "D" a myslím že sa vytvorili po inštalácii net.Frameworku a nejdú odstrániť ....ďalej robí problémy qip ak ho zapnem funguje normálne ale ak ho potom vypnem a po čase ho chcem znova zapnúť tak píše že sa pripája ale nepripojí sa a nijak nereaguje a ide vypnúť iba cez správce úloh. Po reštarte pc qip opať funguje ako má .
Sem tam robí problémy aj mozilla. Spustím ju a je celá šedá iba v ľavom rohu je vidno časť hlavného menu. Ak ju vypnem a spustím znova tak sem tam je opať šedé celé okno až po pár spustení ide normálne . ... nie sú to nejak závažné problémy ale dosť ma iritujú

prikladám log, a za pomoc vopred Ďakujem.


Logfile of random's system information tool 1.08 (written by random/random)
Run by Mato at 2011-05-08 12:28:49
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 4 GB (25%) free of 15 GB
Total RAM: 1024 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:28:57, on 8.5.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\htpatch.exe
C:\WINDOWS\Anvshell.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Documents and Settings\Mato\Plocha\Girder\Girder.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\QIP Infium\infium.exe
D:\Hry\Steam\Steam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Mato\Plocha\RSIT.exe
C:\Program Files\trend micro\Mato.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: QIPBHO Class - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Mato\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: QipLI - {6B5863A0-C43F-4C0A-982B-CC0E9125783F} - C:\Documents and Settings\Mato\Data aplikací\Microsoft\Internet Explorer\qstatsrv.dll
O2 - BHO: QIPBHO - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Mato\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [Anvshell] C:\WINDOWS\Anvshell.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Girder3.lnk = C:\Documents and Settings\Mato\Plocha\Girder\Girder.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP Infium - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP Infium\infium.exe (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{FDF9A304-1F85-41B6-ACE5-CFBAE8B93868}: NameServer = 195.146.132.58 195.146.128.62
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 5287 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 37808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6B5863A0-C43F-4C0A-982B-CC0E9125783F}]
QipLI Class - C:\Documents and Settings\Mato\Data aplikací\Microsoft\Internet Explorer\qstatsrv.dll [2010-09-01 48080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95289393-33EA-4F8D-B952-483415B9C955}]
QIPBHO Class - C:\Documents and Settings\Mato\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll [2010-09-01 140752]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"HTpatch"=C:\WINDOWS\htpatch.exe [2002-10-30 28672]
"Anvshell"=C:\WINDOWS\Anvshell.exe [2002-10-22 331776]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"avast5"=C:\Program Files\Alwil Software\Avast5\avastUI.exe [2010-09-07 2838912]
"Smapp"=C:\Program Files\Analog Devices\SoundMAX\SMTray.exe [2002-10-11 98304]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-10-22 7700480]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=NvMCTray.dll,NvTaskbarInit []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-18 15360]
"MSMSGS"=C:\Program Files\Messenger\MSMSGS.EXE [2004-08-18 1667584]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]

C:\Documents and Settings\All Users\Nabídka Start\Programy\Po spuštění
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

C:\Documents and Settings\Mato\Nabídka Start\Programy\Po spuštění
Girder3.lnk - C:\Documents and Settings\Mato\Plocha\Girder\Girder.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=0
"NoDriveAutoRun"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=1
"NoDriveAutoRun"=0
"NoDriveTypeAutoRun"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\QIP Infium\infium.exe"="C:\Program Files\QIP Infium\infium.exe:*:Enabled:QIP Infium"
"C:\Program Files\Valve\hl.exe"="C:\Program Files\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"D:\Hry\CS 1.6\hl.exe"="D:\Hry\CS 1.6\hl.exe:*:Enabled:Half-Life Launcher"
"D:\Hry\cs\hl.exe"="D:\Hry\cs\hl.exe:*:Enabled:Half-Life Launcher"
"D:\Hry\Warcraft III\Warcraft III.exe"="D:\Hry\Warcraft III\Warcraft III.exe:*:Disabled:Warcraft III"
"D:\Hry\Warcraft III\War3.exe"="D:\Hry\Warcraft III\War3.exe:*:Enabled:Warcraft III"
"D:\Hry\steam\Steam.exe"="D:\Hry\steam\Steam.exe:*:Enabled:Steam"
"D:\Sony\Vegas Pro 9.0\VegSrv90.exe"="D:\Sony\Vegas Pro 9.0\VegSrv90.exe:*:Disabled:Sony Vegas Network Render Service Control"
"D:\Hamachi\hamachi.exe"="D:\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"C:\Documents and Settings\Mato\Plocha\Bulanci.exe"="C:\Documents and Settings\Mato\Plocha\Bulanci.exe:*:Enabled:Bulanci"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"D:\Hry\Steam\SteamApps\lmpsko\counter-strike\hl.exe"="D:\Hry\Steam\SteamApps\lmpsko\counter-strike\hl.exe:*:Enabled:Counter-Strike"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.scr - open - "%1" /S "%3"

======List of files/folders created in the last 1 months======

2011-05-08 12:28:49 ----D---- C:\rsit
2011-04-22 13:49:53 ----A---- C:\WINDOWS\WININIT.INI
2011-04-19 14:58:10 ----D---- C:\Documents and Settings\Mato\Data aplikací\Hamachi
2011-04-18 19:49:12 ----A---- C:\WINDOWS\system32\nvudisp.exe
2011-04-18 19:48:51 ----A---- C:\WINDOWS\system32\NVUNINST.EXE
2011-04-18 16:29:03 ----D---- C:\Documents and Settings\Mato\Data aplikací\ATI
2011-04-18 15:50:54 ----D---- C:\WINDOWS\system32\NtmsData
2011-04-17 17:17:15 ----D---- C:\Documents and Settings\Mato\Data aplikací\GHISLER
2011-04-17 17:17:15 ----A---- C:\WINDOWS\UC.PIF
2011-04-17 17:17:15 ----A---- C:\WINDOWS\RAR.PIF
2011-04-17 17:17:15 ----A---- C:\WINDOWS\PKZIP.PIF
2011-04-17 17:17:15 ----A---- C:\WINDOWS\PKUNZIP.PIF
2011-04-17 17:17:15 ----A---- C:\WINDOWS\NOCLOSE.PIF
2011-04-17 17:17:15 ----A---- C:\WINDOWS\LHA.PIF
2011-04-17 17:17:15 ----A---- C:\WINDOWS\ARJ.PIF
2011-04-17 17:17:14 ----D---- C:\totalcmd
2011-04-15 15:24:31 ----D---- C:\Documents and Settings\Mato\Data aplikací\TS3Client
2011-04-10 20:19:09 ----HDC---- C:\WINDOWS\$NtUninstallKB941569$
2011-04-10 20:18:46 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2011-04-09 14:58:23 ----D---- C:\Documents and Settings\Mato\Data aplikací\Publish Providers
2011-04-09 14:34:09 ----D---- C:\Documents and Settings\Mato\Data aplikací\Sony
2011-04-09 14:30:28 ----D---- C:\Documents and Settings\All Users\Data aplikací\Sony
2011-04-09 14:27:09 ----N---- C:\WINDOWS\system32\spmsg.dll
2011-04-09 14:27:04 ----HDC---- C:\WINDOWS\$NtUninstallKB926239$
2011-04-09 14:26:10 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2011-04-09 14:25:20 ----D---- C:\WINDOWS\system32\drivers\UMDF
2011-04-09 14:25:19 ----D---- C:\WINDOWS\system32\LogFiles
2011-04-09 14:25:09 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2011-04-09 13:25:46 ----D---- C:\Documents and Settings\All Users\Data aplikací\VideoMach

======List of files/folders modified in the last 1 months======

2011-05-08 12:28:54 ----D---- C:\Program Files\trend micro
2011-05-08 11:59:59 ----D---- C:\Program Files\Mozilla Firefox
2011-05-08 11:51:54 ----D---- C:\WINDOWS\system32\CatRoot2
2011-05-08 11:50:45 ----D---- C:\WINDOWS\Temp
2011-05-08 11:47:54 ----A---- C:\WINDOWS\SchedLgU.Txt
2011-05-07 17:53:15 ----D---- C:\WINDOWS\Prefetch
2011-05-07 16:02:05 ----D---- C:\WINDOWS
2011-04-27 21:16:02 ----D---- C:\WINDOWS\Debug
2011-04-25 18:11:05 ----SHD---- C:\WINDOWS\Installer
2011-04-25 18:11:05 ----SHD---- C:\Config.Msi
2011-04-23 07:56:20 ----D---- C:\WINDOWS\system32
2011-04-22 13:52:54 ----RD---- C:\Program Files
2011-04-22 13:51:40 ----RSHDC---- C:\WINDOWS\system32\dllcache
2011-04-22 13:51:24 ----HD---- C:\WINDOWS\inf
2011-04-22 13:50:04 ----D---- C:\WINDOWS\system32\drivers
2011-04-20 19:32:00 ----A---- C:\WINDOWS\NeroDigital.ini
2011-04-18 19:50:55 ----D---- C:\WINDOWS\nview
2011-04-18 19:49:13 ----D---- C:\WINDOWS\Help
2011-04-18 19:49:01 ----D---- C:\WINDOWS\system32\CatRoot
2011-04-18 19:21:57 ----D---- C:\WINDOWS\VirtualEar
2011-04-18 19:21:57 ----D---- C:\WINDOWS\system
2011-04-18 19:21:51 ----A---- C:\WINDOWS\system32\msssc.dll
2011-04-18 19:21:39 ----A---- C:\WINDOWS\Ascd_tmp.ini
2011-04-18 16:29:09 ----D---- C:\WINDOWS\system32\config
2011-04-18 15:46:44 ----A---- C:\WINDOWS\system32\MRT.exe
2011-04-16 10:59:46 ----D---- C:\Program Files\VDownloader
2011-04-10 06:54:24 ----D---- C:\WINDOWS\AppPatch
2011-04-09 14:32:13 ----RSD---- C:\WINDOWS\assembly
2011-04-09 14:26:21 ----D---- C:\Program Files\Windows Media Player
2011-04-09 14:24:18 ----D---- C:\WINDOWS\WinSxS

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 sisagp;SiS AGP Filter; C:\WINDOWS\System32\DRIVERS\SISAGPX.sys [2003-01-13 30720]
R0 SiSide;SiSide; C:\WINDOWS\System32\DRIVERS\siside.sys [2002-10-21 6016]
R0 sisidex;sisidex; C:\WINDOWS\system32\drivers\sisidex.sys [2002-10-17 49024]
R0 sisperf;Add Performance Filter Driver; C:\WINDOWS\system32\drivers\sisperf.sys [2002-08-20 9472]
R0 sptd;sptd; C:\WINDOWS\System32\Drivers\sptd.sys [2010-10-19 436792]
R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-09-07 28880]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-09-07 165584]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-09-07 46672]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-18 39936]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-09-07 17744]
R2 aswMon2;aswMon2; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-09-07 100176]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-09-07 23376]
R3 EIO;EIO; \??\C:\WINDOWS\system32\drivers\EIO.sys []
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2003-04-16 9600]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2003-04-16 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-10-22 3994624]
R3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\System32\DRIVERS\sisnic.sys [2002-07-10 32256]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2002-12-05 534976]
S3 ab036h9w;ab036h9w; C:\WINDOWS\system32\drivers\ab036h9w.sys []
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2011-04-19 25280]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2004-08-04 15104]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S3 VIAudio;Vinyl AC'97 Audio Controller (WDM); C:\WINDOWS\system32\drivers\vinyl97.sys []
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2001-02-23 270336]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-10-22 159810]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-09-07 40384]
S3 aspnet_state;Stavová služba ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Služba Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-18 14336]
S4 NetTcpPortSharing;Služba sdílení portů Net.Tcp; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

[Roli]

Zdravím, ty divné soubory jsou opravdu od různých instalací a měly by jít normálně smáznout, pokud se jim nechce

použij Unlocker podle TOHOTO návodu.


Tohle fixni v HJT :

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R3 - URLSearchHook: QIPBHO Class - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Mato\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: QIPBHO - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Documents and Settings\Mato\Data aplikací\Microsoft\Internet Explorer\qipsearchbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

HJT najdeš zde :

C:\Program Files\trend micro\Mato.exe

Fix znamená že spustíš HJT

v okně které se ti otevře klikneš na Do a system scan only

v dalším okně najdeš řádky které jsem ti vypsal,

vedle nich je čtvereček do kterého uděláš zatržítko,

pak klikneš na Fix checked které je vlevo dole,

program se ti zeptá zda opravdu ANO s tím samozřejmě souhlasíš a je hotovo.


Pak použij Mbam z mého podpisu a dej mi sem z něj log, předem nic nemazat !!!

[lmp]

divné súbory zmazané , položky v HJT fixnuté ...
log:

Malwarebytes' Anti-Malware 1.50.1.1100
http://www.malwarebytes.org

Verze databáze: 6537

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

9.5.2011 14:17:48
mbam-log-2011-05-09 (14-17-48).txt

Typ kontroly: Rychlý test
Testované objekty: 146934
Uplynulý čas: 3 minut, 48 sekund

Infikované procesy v paměti: 0
Infikované moduly v paměti: 0
Infikované klíče v registru: 0
Infikované hodnoty v registru: 0
Infikované datové položky v registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované moduly v paměti:
(Žádné škodlivé položky nebyly zjištěny)

Infikované klíče v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované hodnoty v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované datové položky v registru:
(Žádné škodlivé položky nebyly zjištěny)

Infikované složky:
(Žádné škodlivé položky nebyly zjištěny)

Infikované soubory:
(Žádné škodlivé položky nebyly zjištěny)

Edit: otestoval som QIP po prvom vypnutí a následnom zapnutí sa qip prihlásil, po druhom vypnutí a následnom zapnutí robí to isté čo predtým tj. píše že sa prihlasuje ale neprihlási a nereaguje ide iba vypnúť cez správcu úloh

[Roli]

Stáhni a ulož na plochu ComboFix,

spusť aplikaci jako Administrátor a povol instalaci Konzole pro zotavení - Recovery Console.

Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,

pak ještě jednou klik na ANO a už to jede.

Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.

Při skenovaní může být PC i restartováno nelekat se.

Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,

protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.

Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na C:/Combofix.txt

(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.


V případě nejasností je ZDE obrázkový návod.

[lmp]

ComboFix 11-05-08.04 - Mato 09.05.2011 21:14:52.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.421.1029.18.1024.692 [GMT 2:00]
Running from: c:\documents and settings\Mato\Plocha\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Mato\WINDOWS
c:\windows\system32\msssc.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
.
.
((((((((((((((((((((((((( Files Created from 2011-04-09 to 2011-05-09 )))))))))))))))))))))))))))))))
.
.
2011-05-09 12:11 . 2011-05-09 12:11 -------- d-----w- c:\documents and settings\Mato\Data aplikací\Malwarebytes
2011-05-09 12:10 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-09 12:10 . 2011-05-09 12:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-05-09 12:10 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-09 11:56 . 2011-05-09 11:56 -------- d-----w- c:\documents and settings\Mato\Data aplikací\QuickStoresToolbar
2011-05-09 11:56 . 2011-05-09 11:56 -------- d-----w- c:\program files\Unlocker
2011-05-08 10:28 . 2011-05-08 10:29 -------- d-----w- C:\rsit
2011-04-19 12:58 . 2011-04-19 13:34 -------- d-----w- c:\documents and settings\Mato\Data aplikací\Hamachi
2011-04-18 17:49 . 2006-10-22 10:22 208896 ----a-w- c:\windows\system32\nvudisp.exe
2011-04-18 17:48 . 2006-10-22 13:06 208896 ----a-w- c:\windows\system32\NVUNINST.EXE
2011-04-18 14:29 . 2011-04-22 11:50 -------- d-----w- c:\documents and settings\Mato\Local Settings\Data aplikací\ATI
2011-04-18 14:29 . 2011-04-22 11:50 -------- d-----w- c:\documents and settings\Mato\Data aplikací\ATI
2011-04-18 14:25 . 2006-11-22 08:52 212992 ----a-w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\ILog.dll
2011-04-18 13:50 . 2011-04-18 13:51 -------- d-----w- c:\windows\system32\NtmsData
2011-04-17 17:24 . 2011-04-17 17:24 -------- d-----w- c:\documents and settings\Mato\Local Settings\Data aplikací\WMTools Downloaded Files
2011-04-17 15:31 . 2011-04-17 15:33 -------- d-----w- c:\documents and settings\Mato\Local Settings\Data aplikací\compLexity Demo Player
2011-04-17 15:18 . 2011-04-17 15:18 -------- d-----w- c:\documents and settings\Mato\Local Settings\Data aplikací\GHISLER
2011-04-17 15:17 . 2011-04-17 15:17 -------- d-----w- c:\documents and settings\Mato\Data aplikací\GHISLER
2011-04-17 15:17 . 2010-12-17 05:56 545 ----a-w- c:\windows\UC.PIF
2011-04-17 15:17 . 2010-12-17 05:56 545 ----a-w- c:\windows\RAR.PIF
2011-04-17 15:17 . 2010-12-17 05:56 545 ----a-w- c:\windows\PKZIP.PIF
2011-04-17 15:17 . 2010-12-17 05:56 545 ----a-w- c:\windows\PKUNZIP.PIF
2011-04-17 15:17 . 2010-12-17 05:56 545 ----a-w- c:\windows\NOCLOSE.PIF
2011-04-17 15:17 . 2010-12-17 05:56 545 ----a-w- c:\windows\LHA.PIF
2011-04-17 15:17 . 2010-12-17 05:56 545 ----a-w- c:\windows\ARJ.PIF
2011-04-17 15:17 . 2011-04-17 15:17 -------- d-----w- C:\totalcmd
2011-04-15 13:24 . 2011-04-21 10:34 -------- d-----w- c:\documents and settings\Mato\Data aplikací\TS3Client
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-19 12:57 . 2009-03-18 15:35 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2011-03-29 18:21 . 2011-03-29 18:21 15872 ----a-r- c:\documents and settings\Mato\Data aplikací\Microsoft\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C9.exe
2010-01-26 22:11 . 2011-02-13 13:55 444283 ----a-w- c:\program files\Common Files\WinPcapNmap.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HTpatch"="c:\windows\htpatch.exe" [2002-10-30 28672]
"Anvshell"="c:\windows\Anvshell.exe" [2002-10-22 331776]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
"Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2002-10-11 98304]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 1622016]
"NvMediaCenter"="NvMCTray.dll" [2006-10-22 86016]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408]
.
c:\documents and settings\Mato\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Girder3.lnk - c:\documents and settings\Mato\Plocha\Girder\Girder.exe [2010-10-11 751616]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\QIP Infium\\infium.exe"=
"d:\\Hry\\Warcraft III\\Warcraft III.exe"=
"d:\\Hry\\Warcraft III\\War3.exe"=
"d:\\Hry\\steam\\Steam.exe"=
"d:\\Sony\\Vegas Pro 9.0\\VegSrv90.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"d:\\Hry\\Steam\\SteamApps\\lmpsko\\counter-strike\\hl.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [19.10.2010 16:27 436792]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [18.12.2010 10:50 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [18.12.2010 10:50 17744]
.
.
------- Supplementary Scan -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Mato\Data aplikací\Mozilla\Firefox\Profiles\o73r4gug.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - google.com
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=
FF - prefs.js: network.proxy.ftp - 203.178.133.03
FF - prefs.js: network.proxy.ftp_port - 3127
FF - prefs.js: network.proxy.gopher - 203.178.133.03
FF - prefs.js: network.proxy.gopher_port - 3127
FF - prefs.js: network.proxy.http - 203.178.133.03
FF - prefs.js: network.proxy.http_port - 3127
FF - prefs.js: network.proxy.socks - 203.178.133.03
FF - prefs.js: network.proxy.socks_port - 3127
FF - prefs.js: network.proxy.ssl - 203.178.133.03
FF - prefs.js: network.proxy.ssl_port - 3127
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: QuickStores-Toolbar: quickstores@quickstores.de - c:\program files\Mozilla Firefox\extensions\quickstores@quickstores.de
FF - Ext: FetchMP3 Video to Audio Converter: {1d8e98fb-53c3-47a8-9fb9-1b51bbf3890d} - %profile%\extensions\{1d8e98fb-53c3-47a8-9fb9-1b51bbf3890d}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - ORPHANS REMOVED - - - -
.
Notify-AtiExtEvent - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-09 21:22
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HTpatch = c:\windows\htpatch.exe?ows\CurrentVersion\Run???\?????%[????`?'[??'[`?'[??????????????%[??%[??'[??'[$?????%[??????????????%[??????????%[???w????(????3?w???w?????3?w ??w??%[:???????d???r?%[1?%[??'[d?????%[?-%[????z??w8h%[\2%[?1%[htinst.INI?[?u%[????d????????F?
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1645522239-1214440339-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1284)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\RunDLL32.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2011-05-09 21:25:22 - machine was rebooted
ComboFix-quarantined-files.txt 2011-05-09 19:25
.
Pre-Run: 3 740 360 704
Post-Run: 3 822 305 280
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 414B106183C166B8CF640D1AEC66F821

[Roli]

Pokud jsi tak ještě neučinil, přesuň Combofix na plochu

otevři si Poznámkový blok

do něj zkopíruj skript z následujícího okna:

Kód: Vybrat vše

FireFox::
FF - ProfilePath - c:\documents and settings\Mato\Data aplikací\Mozilla\Firefox\Profiles\o73r4gug.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: keyword.URL - hxxp://search.qip.ru/search?from=FF&query=

ulož Tebou vytvořený TXT soubor jako CFScript.txt na plochu,

po uložení uchop vytvořený skript levým myšítkem a přesuň ho nad ikonu Combofixu, kde ho upustíš:



Po aplikaci na Tebe vypadne další log, zkopíruj ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou,

v tom případě znovu restartuj a přitom mačkej F8 poté zvol Poslední známou funkční konfiguraci

[lmp]

ComboFix 11-05-09.02 - Mato 10.05.2011 14:23:26.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.421.1029.18.1024.678 [GMT 2:00]
Running from: c:\documents and settings\Mato\Plocha\ComboFix.exe
Command switches used :: c:\documents and settings\Mato\Plocha\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((( Files Created from 2011-04-10 to 2011-05-10 )))))))))))))))))))))))))))))))
.
.
2011-05-09 12:11 . 2011-05-09 12:11 -------- d-----w- c:\documents and settings\Mato\Data aplikací\Malwarebytes
2011-05-09 12:10 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-09 12:10 . 2011-05-09 12:10 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Malwarebytes
2011-05-09 12:10 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-09 11:56 . 2011-05-09 11:56 -------- d-----w- c:\documents and settings\Mato\Data aplikací\QuickStoresToolbar
2011-05-09 11:56 . 2011-05-09 11:56 -------- d-----w- c:\program files\Unlocker
2011-05-08 10:28 . 2011-05-08 10:29 -------- d-----w- C:\rsit
2011-04-19 12:58 . 2011-04-19 13:34 -------- d-----w- c:\documents and settings\Mato\Data aplikací\Hamachi
2011-04-18 17:49 . 2006-10-22 10:22 208896 ----a-w- c:\windows\system32\nvudisp.exe
2011-04-18 17:48 . 2006-10-22 13:06 208896 ----a-w- c:\windows\system32\NVUNINST.EXE
2011-04-18 14:29 . 2011-04-22 11:50 -------- d-----w- c:\documents and settings\Mato\Local Settings\Data aplikací\ATI
2011-04-18 14:29 . 2011-04-22 11:50 -------- d-----w- c:\documents and settings\Mato\Data aplikací\ATI
2011-04-18 14:25 . 2006-11-22 08:52 212992 ----a-w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\ILog.dll
2011-04-18 13:50 . 2011-04-18 13:51 -------- d-----w- c:\windows\system32\NtmsData
2011-04-17 17:24 . 2011-04-17 17:24 -------- d-----w- c:\documents and settings\Mato\Local Settings\Data aplikací\WMTools Downloaded Files
2011-04-17 15:31 . 2011-04-17 15:33 -------- d-----w- c:\documents and settings\Mato\Local Settings\Data aplikací\compLexity Demo Player
2011-04-17 15:18 . 2011-04-17 15:18 -------- d-----w- c:\documents and settings\Mato\Local Settings\Data aplikací\GHISLER
2011-04-17 15:17 . 2011-04-17 15:17 -------- d-----w- c:\documents and settings\Mato\Data aplikací\GHISLER
2011-04-17 15:17 . 2010-12-17 05:56 545 ----a-w- c:\windows\UC.PIF
2011-04-17 15:17 . 2010-12-17 05:56 545 ----a-w- c:\windows\RAR.PIF
2011-04-17 15:17 . 2010-12-17 05:56 545 ----a-w- c:\windows\PKZIP.PIF
2011-04-17 15:17 . 2010-12-17 05:56 545 ----a-w- c:\windows\PKUNZIP.PIF
2011-04-17 15:17 . 2010-12-17 05:56 545 ----a-w- c:\windows\NOCLOSE.PIF
2011-04-17 15:17 . 2010-12-17 05:56 545 ----a-w- c:\windows\LHA.PIF
2011-04-17 15:17 . 2010-12-17 05:56 545 ----a-w- c:\windows\ARJ.PIF
2011-04-17 15:17 . 2011-04-17 15:17 -------- d-----w- C:\totalcmd
2011-04-15 13:24 . 2011-04-21 10:34 -------- d-----w- c:\documents and settings\Mato\Data aplikací\TS3Client
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-19 12:57 . 2009-03-18 15:35 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2011-03-29 18:21 . 2011-03-29 18:21 15872 ----a-r- c:\documents and settings\Mato\Data aplikací\Microsoft\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C9.exe
2010-01-26 22:11 . 2011-02-13 13:55 444283 ----a-w- c:\program files\Common Files\WinPcapNmap.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HTpatch"="c:\windows\htpatch.exe" [2002-10-30 28672]
"Anvshell"="c:\windows\Anvshell.exe" [2002-10-22 331776]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
"Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2002-10-11 98304]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 1622016]
"NvMediaCenter"="NvMCTray.dll" [2006-10-22 86016]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408]
.
c:\documents and settings\Mato\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Girder3.lnk - c:\documents and settings\Mato\Plocha\Girder\Girder.exe [2010-10-11 751616]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\QIP Infium\\infium.exe"=
"d:\\Hry\\Warcraft III\\Warcraft III.exe"=
"d:\\Hry\\Warcraft III\\War3.exe"=
"d:\\Hry\\steam\\Steam.exe"=
"d:\\Sony\\Vegas Pro 9.0\\VegSrv90.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"d:\\Hry\\Steam\\SteamApps\\lmpsko\\counter-strike\\hl.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [19.10.2010 16:27 436792]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [18.12.2010 10:50 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [18.12.2010 10:50 17744]
.
.
------- Supplementary Scan -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: {FDF9A304-1F85-41B6-ACE5-CFBAE8B93868} = 195.146.132.58 195.146.128.62
FF - ProfilePath - c:\documents and settings\Mato\Data aplikací\Mozilla\Firefox\Profiles\o73r4gug.default\
FF - prefs.js: browser.startup.homepage - google.com
FF - prefs.js: network.proxy.ftp - 203.178.133.03
FF - prefs.js: network.proxy.ftp_port - 3127
FF - prefs.js: network.proxy.gopher - 203.178.133.03
FF - prefs.js: network.proxy.gopher_port - 3127
FF - prefs.js: network.proxy.http - 203.178.133.03
FF - prefs.js: network.proxy.http_port - 3127
FF - prefs.js: network.proxy.socks - 203.178.133.03
FF - prefs.js: network.proxy.socks_port - 3127
FF - prefs.js: network.proxy.ssl - 203.178.133.03
FF - prefs.js: network.proxy.ssl_port - 3127
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: QuickStores-Toolbar: quickstores@quickstores.de - c:\program files\Mozilla Firefox\extensions\quickstores@quickstores.de
FF - Ext: FetchMP3 Video to Audio Converter: {1d8e98fb-53c3-47a8-9fb9-1b51bbf3890d} - %profile%\extensions\{1d8e98fb-53c3-47a8-9fb9-1b51bbf3890d}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-10 14:29
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HTpatch = c:\windows\htpatch.exe?ows\CurrentVersion\Run???\?????%[????`?'[??'[`?'[??????????????%[??%[??'[??'[$?????%[??????????????%[??????????%[???w????(????3?w???w?????3?w ??w??%[:???????d???r?%[1?%[??'[d?????%[?-%[????z??w8h%[\2%[?1%[htinst.INI?[?u%[????d????????F?
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1645522239-1214440339-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3512)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-05-10 14:32:39
ComboFix-quarantined-files.txt 2011-05-10 12:32
ComboFix2.txt 2011-05-09 19:25
.
Pre-Run: 3 702 317 056
Post-Run: 3 691 118 592
.
- - End Of File - - 047AE6079843CB93245C6B31D9B8FE36

[Roli]

Přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Použij T-Cleaner, který smaže případné zbytky po aplikacích které jsme použili.

Jen před jeho stažením a při použití stopni antivir, protože ho muže detekovat jako vir ale není tomu tak.


Pak dej vědět jaký je stav PC.

[lmp]

hotovo ... problémy s mozillou som nepostrehol ...ale qip sa chová ako na začiatku vidím to na chybu toho programu nejako to prežijem

tak ďakujem za Tvoj čas a ochotu

[Roli]

Zkus QIPa reinstalovat, případně se podívat zda není novější verze.

Jinak není zač.

[lmp]

stiahol som novú verziu QIP a funguje tak ako má ..ešte raz ďakujem

[Roli]

Není vůbec zač

[lmp]

Dovolím si znova "otvoriť" túto tému nebudem zbytočne zakladať novú

Teraz pred malou chvílou sa mi druhý krát sám z ničoho nič reštartoval pc .
Akoby na okamih vypadla elektrina a znova naskočila, a pc sa zapne. Nechápem :O
Stalo sa to vo wine pri "surfovaní" na nete.
Nejaký nápad čo s tým ?

[Roli]

Tohle může být čímkoliv, od výkyvů v síti, problém se zdrojem nebo základní deskou atd.

Pozoruj zda se to bude a při jaké činnosti opakovat a pak dej vědět i když si myslím že takhle nadálku to nedáme.

[lmp]

okej budem to sledovať keby niečo sa ozvem
pc už pravdepodobne dožíva má čo to za sebou