VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Preventivka

https://forum.viry.cz:443/viewtopic.php?t=112102

Stránka 1 z 1

Preventivka

Napsal: 31 kvě 2011 14:27
od darius22
Internet neposlucha s pocitacom sa vsak nic zvlastne nedeje. Mozno neaky skryty parazit.
prosim teda o kontrolu logu.

Logfile of random's system information tool 1.08 (written by random/random)
Run by sklb at 2011-05-31 15:26:45
Microsoft Windows 7 Ultimate
System drive C: has 210 GB (29%) free of 715 GB
Total RAM: 4094 MB (68% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:26:50, on 5/31/2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16766)
Boot mode: Normal

Running processes:
C:\Windows\PixArt\Pac207\Monitor.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\uTorrent\uTorrent.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Windows\SysWOW64\regsvr32.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program Files (x86)\QIP\qip.exe
C:\Program Files (x86)\mIRC\mirc.exe
X:\UOAM\uoam.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files\trend micro\sklb.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: brincome browser plug-in - {806EDB6A-5ACB-95F5-52FC-E19334C3F4C1} - C:\Windows\SysWow64\hxgwiuchehyfkqnnk.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [messenger.exe] C:\Program Files (x86)\Common Files\Microsoft Shared\Web Components\messenger.exe
O4 - HKLM\..\Run: [jigopixxnjptoh] C:\Windows\System32\regsvr32.exe /s "C:\Windows\system32\hxgwiuchehyfkqnnk.dll"
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - C:\Program Files (x86)\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 6306 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
taskeng.exe {F88B3F1E-DBE3-4B10-9010-767AC18B67A6}
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\rundll32.exe "C:\Windows\SysWOW64\d3dx9_31C.dll",Nsso
C:\Windows\system32\rundll32.exe "C:\Windows\SysWOW64\d3dx9_31C.dll",Nsso
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Windows\PixArt\Pac207\Monitor.exe"
"C:\Windows\SysWOW64\rundll32.exe" C:\Windows\Syswow64\CMICNFG3.dll,CMICtrlWnd
"C:\Program Files (x86)\uTorrent\uTorrent.exe"
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\hxgwiuchehyfkqnnk.dll"
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -Embedding
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2880 CREDAT:79873
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Microsoft Office\OFFICE11\WINWORD.EXE" /n /dde
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe" -s
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" -c "C:\Users\sklb\AppData\Local\LogMeIn Hamachi"
C:\Windows\splwow64.exe 2
"C:\Windows\system32\wuauclt.exe"
"C:\Program Files (x86)\QIP\qip.exe"
"C:\Program Files (x86)\mIRC\mirc.exe"
"C:\Windows\system32\calc.exe"
"X:\UOAM\uoam.exe"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=1792.129b8240.1047229995 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll" "Mozilla.Firefox.4.0.1" -omnijar C:\Program Files (x86)\Mozilla Firefox\omni.jar 1792 \\.\pipe\gecko-crash-server-pipe.1792 plugin
"C:\Windows\system32\cmd.exe"
\??\C:\Windows\system32\conhost.exe
ping 10.10.15.1 -t
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 516 520 528 65536 524
"C:\Users\sklb\Downloads\RSITx64(3).exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\KDVI.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{806EDB6A-5ACB-95F5-52FC-E19334C3F4C1}]
brincome browser plug-in - C:\Windows\SysWow64\hxgwiuchehyfkqnnk.dll [2011-05-20 288256]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-10-01 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Monitor"=C:\Windows\PixArt\PAC207\Monitor.exe [2007-12-10 323584]
"PAC207_Monitor"=C:\Windows\PixArt\PAC207\Monitor.exe [2007-12-10 323584]
"CmPCIaudio"=C:\Windows\syswow64\RunDll32.exe [2009-07-14 44544]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"=C:\Program Files (x86)\uTorrent\uTorrent.exe [2011-05-21 399736]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1475072]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"messenger.exe"=C:\Program Files (x86)\Common Files\Microsoft Shared\Web Components\messenger.exe []
"jigopixxnjptoh"=C:\Windows\System32\regsvr32.exe [2009-07-14 19456]
"LogMeIn Hamachi Ui"=C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2011-05-25 1951112]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2011-05-31 08:39:56 ----AH---- C:\Windows\system32\hamachi.sys
2011-05-31 08:39:54 ----D---- C:\Program Files (x86)\LogMeIn Hamachi
2011-05-26 18:21:17 ----D---- C:\Program Files (x86)\ESET
2011-05-25 08:20:25 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2011-05-24 12:12:17 ----A---- C:\Windows\SYSWOW64\poqexec.exe
2011-05-24 12:12:17 ----A---- C:\Windows\system32\poqexec.exe
2011-05-21 20:43:45 ----D---- C:\Users\sklb\AppData\Roaming\.minecraft
2011-05-17 12:25:10 ----A---- C:\Windows\SYSWOW64\.dll
2011-05-11 10:39:00 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-05-11 10:38:59 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2011-05-11 10:38:59 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2011-05-11 10:38:42 ----A---- C:\Windows\system32\drivers\usbuhci.sys
2011-05-11 10:38:42 ----A---- C:\Windows\system32\drivers\usbport.sys
2011-05-11 10:38:42 ----A---- C:\Windows\system32\drivers\usbohci.sys
2011-05-11 10:38:42 ----A---- C:\Windows\system32\drivers\usbhub.sys
2011-05-11 10:38:42 ----A---- C:\Windows\system32\drivers\usbehci.sys
2011-05-11 10:38:42 ----A---- C:\Windows\system32\drivers\usbd.sys
2011-05-11 10:38:42 ----A---- C:\Windows\system32\drivers\usbccgp.sys

======List of files/folders modified in the last 1 months======

2011-05-31 15:26:50 ----D---- C:\Windows\Prefetch
2011-05-31 15:26:49 ----D---- C:\Program Files\trend micro
2011-05-31 15:23:25 ----D---- C:\Users\sklb\AppData\Roaming\mIRC
2011-05-31 15:19:31 ----D---- C:\Users\sklb\AppData\Roaming\uTorrent
2011-05-31 10:16:09 ----D---- C:\Program Files (x86)\mIRC
2011-05-31 09:54:45 ----D---- C:\Phoenix06bin
2011-05-31 08:42:57 ----D---- C:\Windows\System32
2011-05-31 08:42:57 ----D---- C:\Windows\inf
2011-05-31 08:42:57 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-05-31 08:41:56 ----D---- C:\Windows\system32\config
2011-05-31 08:40:46 ----D---- C:\Windows\Temp
2011-05-31 08:40:01 ----SHD---- C:\Windows\Installer
2011-05-31 08:40:01 ----D---- C:\Config.Msi
2011-05-31 08:39:54 ----RD---- C:\Program Files (x86)
2011-05-30 22:05:10 ----D---- C:\Program Files (x86)\Google
2011-05-27 11:29:04 ----D---- C:\Windows\Minidump
2011-05-27 11:28:58 ----D---- C:\Windows
2011-05-26 00:15:33 ----D---- C:\Windows\system32\drivers
2011-05-26 00:15:30 ----D---- C:\Windows\winsxs
2011-05-26 00:15:10 ----D---- C:\Windows\system32\catroot2
2011-05-26 00:15:10 ----D---- C:\Windows\system32\catroot
2011-05-24 23:41:44 ----D---- C:\Windows\SysWOW64
2011-05-24 15:58:47 ----D---- C:\Windows\system32\DriverStore
2011-05-24 12:19:45 ----A---- C:\Windows\SYSWOW64\txjtybrtfztmq.exe
2011-05-24 12:19:43 ----A---- C:\Program Files (x86)\Drivers_pack_v4.55.63_fix.exe
2011-05-24 12:06:43 ----D---- C:\Windows\system32\NDF
2011-05-24 08:10:40 ----D---- C:\SKOLA
2011-05-23 10:19:43 ----D---- C:\yoko
2011-05-21 20:56:48 ----D---- C:\Program Files (x86)\uTorrent
2011-05-20 16:47:44 ----A---- C:\Windows\SYSWOW64\hxgwiuchehyfkqnnk.dll
2011-05-19 22:09:17 ----A---- C:\Windows\Cmicnfg3.ini.imi
2011-05-12 17:41:07 ----D---- C:\Users\sklb\AppData\Roaming\TS3Client
2011-05-12 03:00:32 ----A---- C:\Windows\system32\MRT.exe
2011-05-09 08:25:33 ----D---- C:\BraCa Soft
2011-05-04 17:17:17 ----D---- C:\Windows\rescache
2011-05-04 15:49:47 ----D---- C:\Windows\AppPatch
2011-05-04 15:49:46 ----D---- C:\Windows\SYSWOW64\en-US
2011-05-04 15:49:46 ----D---- C:\Windows\system32\en-US
2011-05-01 19:08:07 ----D---- C:\Program Files (x86)\Mozilla Firefox

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-04-07 834544]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys [2010-06-01 314016]
R2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys [2010-06-01 43680]
R3 cmuda3;C-Media PCI Audio Interface; C:\Windows\system32\drivers\cmudax3.sys [2009-12-01 1155072]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 33856]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2005-03-29 8192]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x64.sys [2009-06-10 408960]
S1 roveqiha;roveqiha; \??\C:\Windows\system32\drivers\roveqiha.sys []
S3 aj90ur4t;aj90ur4t; C:\Windows\system32\drivers\aj90ur4t.sys []
S3 nmwcd;Nokia USB Phone Parent Driver; C:\Windows\system32\drivers\ccdcmbx64.sys [2010-12-02 19968]
S3 nmwcdc;Nokia USB Communication Driver; C:\Windows\system32\drivers\ccdcmbox64.sys [2010-12-02 27136]
S3 PAC207;PC Camer@; C:\Windows\system32\DRIVERS\PFC027.SYS [2008-02-13 686592]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 usbser;Nokia USB Serial Port Driver ; C:\Windows\system32\drivers\usbser.sys [2009-07-14 32768]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys [2010-12-02 9216]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 40448]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-05-25 2275720]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2010-07-09 159336]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2010-11-29 75136]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Google Update Service (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-07-06 136176]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe []
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater; C:\Program Files (x86)\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-07-26 25832]
S3 gupdatem;Google Update Service (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-07-06 136176]
S3 NMIndexingService;NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-05-26 1255736]
S4 NBService;NBService; C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040]

-----------------EOF-----------------

Re: Preventivka

Napsal: 31 kvě 2011 14:46
od Roli
Zdravím, tohle fixni v HJT :

O2 - BHO: brincome browser plug-in - {806EDB6A-5ACB-95F5-52FC-E19334C3F4C1} - C:\Windows\SysWow64\hxgwiuchehyfkqnnk.dll
O4 - HKLM\..\Run: [jigopixxnjptoh] C:\Windows\System32\regsvr32.exe /s "C:\Windows\system32\hxgwiuchehyfkqnnk.dll"

HJT najdeš zde :

C:\Program Files\trend micro\sklb.exe

Fix znamená že spustíš HJT Obrázek jako admin

v okně které se ti otevře klikneš na Do a system scan only

v dalším okně najdeš řádky které jsem ti vypsal,

vedle nich je čtvereček do kterého uděláš zatržítko,

pak klikneš na Fix checked které je vlevo dole,

program se ti zeptá zda opravdu ANO s tím samozřejmě souhlasíš a je hotovo.


Přes Start >> Všechny programy >> Příslušenství >> Spustit >> napiš - services.msc >> Enter. Najdi službu :

Google Update Service (gupdate)

Google Update Service (gupdatem)

NMIndexingService

klikni na ni pravým myšítkem, zvol vlastnosti, na další kartě nejprve službu zastav tlačítkem Zastavit a u položky Typ spouštění zvol Zakázáno.


Smaž nepotřebné soubory

pomocí CCleaneru

návod :

Čistič - tady vyčistíš PC od nepotřebných souborů a vysypeš Koš

Registry - tady vyčistíš registry (před použitím doporučuji udělat jejich zálohu kterou CCleaner nabízí)

čištění registru je třeba několikrát zopakovat !

Nástroje - tady lze odinstalovat programy, upravit co se spustí po Startu systému a obnovit systém


Pak spusť skener Cure It podle TOHOTO návodu

po skončení skenu chci sem výsledky.

(Upozornění je úchylně pomalý a je zapotřebí ho sledovat občas se na něco ptá)

Re: Preventivka

Napsal: 02 čer 2011 12:24
od darius22
zdravim.
tak ten scan mi trval 2 dni :D . Vsetko som to pomazal snad som s tym nieco nepokazil
.dll;C:\Windows\SysWOW64;Adware.Siggen.14481;Deleted.;
cacaoweb(2).exe;C:\Documents and Settings\sklb\Downloads;Trojan.DownLoader1.33578;Incurable.Moved.;
cacaoweb.exe;C:\Documents and Settings\sklb\Downloads;Trojan.DownLoader1.33578;Incurable.Moved.;
detektiv.swf;C:\Windows.old\Program Files\QIP\Users\218175717\RcvdFiles\414173926_mrs;Joke.Scream;Deleted.;
GameExplorerUtilities.dll;C:\Windows.old.000\Documents and Settings\Peter Gajdosik\AppData\Local\Application Data\Temp\280186.tmp;Trojan.MulDrop1.59377;Deleted.;
Riodude's Kaspersky Patcher.exe;C:\Windows.old.000\Documents and Settings\Peter Gajdosik\Downloads\Kaspersky Anti-Virus & Internet Security 2010 9.0.0.679\Patc;Trojan.Siggen.6417;Incurable.Moved.;
hk.dll;C:\Windows.old.000\Program Files (x86)\ASPMonitor;Program.ActualSpy.2;Deleted.;
hk2.dll;C:\Windows.old.000\Program Files (x86)\ASPMonitor;Program.ActualSpy.2;Deleted.;
hprog.dll;C:\Windows.old.000\Program Files (x86)\ASPMonitor;Trojan.ActualSpy.426;Incurable.Moved.;
settings.exe;C:\Windows.old.000\Program Files (x86)\ASPMonitor;Trojan.ActualSpy.472;Incurable.Moved.;
KeyLogger.Dll;C:\Windows.old.000\Program Files (x86)\HomeKeylogger;Program.HomeKeylog.4;Deleted.;
KeyLogger.exe;C:\Windows.old.000\Program Files (x86)\HomeKeylogger;Trojan.HKL.11;Deleted.;
hk.dll;X:\Windows.old.000\Program Files (x86)\ASPMonitor;Program.ActualSpy.2;Deleted.;
hk2.dll;X:\Windows.old.000\Program Files (x86)\ASPMonitor;Program.ActualSpy.2;Deleted.;
hprog.dll;X:\Windows.old.000\Program Files (x86)\ASPMonitor;Trojan.ActualSpy.426;Incurable.Moved.;
settings.exe;X:\Windows.old.000\Program Files (x86)\ASPMonitor;Trojan.ActualSpy.472;Incurable.Moved.;
KeyLogger.Dll;X:\Windows.old.000\Program Files (x86)\HomeKeylogger;Program.HomeKeylog.4;Deleted.;
KeyLogger.exe;X:\Windows.old.000\Program Files (x86)\HomeKeylogger;Trojan.HKL.11;Deleted.;
GameExplorerUtilities.dll;X:\Windows.old.000\Users\Peter Gajdosik\AppData\Local\Temp\280186.tmp;Trojan.MulDrop1.59377;Deleted.;
Riodude's Kaspersky Patcher.exe;X:\Windows.old.000\Users\Peter Gajdosik\Downloads\Kaspersky Anti-Virus & Internet Security 2010 9.0.0.679\Patcher;Trojan.Siggen.6417;Incurable.Moved.;
winsys.exe;X:\Windows.old.000\Windows\SysWOW64;Trojan.Packed.12453;Deleted.;

Logfile of random's system information tool 1.08 (written by random/random)
Run by sklb at 2011-06-02 13:23:50
Microsoft Windows 7 Ultimate
System drive C: has 212 GB (30%) free of 715 GB
Total RAM: 4094 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:23:52, on 6/2/2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16766)
Boot mode: Normal

Running processes:
C:\Windows\PixArt\Pac207\Monitor.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program Files (x86)\QIP\qip.exe
C:\Program Files (x86)\mIRC\mirc.exe
C:\Program Files (x86)\CCleaner\ccleaner.exe
C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 12\firefox.exe
C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 12\plugin-container.exe
C:\Windows\SysWOW64\ctfmon.exe
C:\Windows\SysWOW64\ctfmon.exe
C:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\trend micro\sklb.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - C:\Program Files (x86)\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 5761 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
taskeng.exe {7287229D-0445-41E7-B6F7-86FC731A546F}
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\rundll32.exe "C:\Windows\SysWOW64\d3dx9_31C.dll",Nsso
C:\Windows\system32\rundll32.exe "C:\Windows\SysWOW64\d3dx9_31C.dll",Nsso
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe" -s
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Windows\PixArt\Pac207\Monitor.exe"
"C:\Windows\SysWOW64\rundll32.exe" C:\Windows\Syswow64\CMICNFG3.dll,CMICtrlWnd
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\QIP\qip.exe"
"C:\Program Files (x86)\mIRC\mirc.exe"
"C:\Program Files (x86)\CCleaner\ccleaner.exe"
"C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 12\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 12\plugin-container.exe" --channel=3588.d92c8a0.960096729 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll" "Mozilla.Firefox.4.0.1" -omnijar C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 12\omni.jar 3588 \\.\pipe\gecko-crash-server-pipe.3588 plugin
ctfmon.exe
ctfmon.exe
"taskhost.exe"
"C:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.EXE" /e
"C:\Users\sklb\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\KDVI.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-10-01 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Monitor"=C:\Windows\PixArt\PAC207\Monitor.exe [2007-12-10 323584]
"PAC207_Monitor"=C:\Windows\PixArt\PAC207\Monitor.exe [2007-12-10 323584]
"CmPCIaudio"=C:\Windows\syswow64\RunDll32.exe [2009-07-14 44544]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"=C:\Program Files (x86)\uTorrent\uTorrent.exe [2011-05-21 399736]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-07-14 1475072]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"LogMeIn Hamachi Ui"=C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2011-05-25 1951112]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2011-05-31 08:39:56 ----AH---- C:\Windows\system32\hamachi.sys
2011-05-31 08:39:54 ----D---- C:\Program Files (x86)\LogMeIn Hamachi
2011-05-26 18:21:17 ----D---- C:\Program Files (x86)\ESET
2011-05-25 08:20:25 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2011-05-24 12:12:17 ----A---- C:\Windows\SYSWOW64\poqexec.exe
2011-05-24 12:12:17 ----A---- C:\Windows\system32\poqexec.exe
2011-05-21 20:43:45 ----D---- C:\Users\sklb\AppData\Roaming\.minecraft
2011-05-11 10:39:00 ----A---- C:\Windows\system32\ntoskrnl.exe
2011-05-11 10:38:59 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2011-05-11 10:38:59 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2011-05-11 10:38:42 ----A---- C:\Windows\system32\drivers\usbuhci.sys
2011-05-11 10:38:42 ----A---- C:\Windows\system32\drivers\usbport.sys
2011-05-11 10:38:42 ----A---- C:\Windows\system32\drivers\usbohci.sys
2011-05-11 10:38:42 ----A---- C:\Windows\system32\drivers\usbhub.sys
2011-05-11 10:38:42 ----A---- C:\Windows\system32\drivers\usbehci.sys
2011-05-11 10:38:42 ----A---- C:\Windows\system32\drivers\usbd.sys
2011-05-11 10:38:42 ----A---- C:\Windows\system32\drivers\usbccgp.sys

======List of files/folders modified in the last 1 months======

2011-06-02 13:23:51 ----D---- C:\Program Files\trend micro
2011-06-02 13:18:23 ----D---- C:\Windows\Temp
2011-06-02 12:30:31 ----D---- C:\Windows\Prefetch
2011-06-02 10:03:01 ----SHD---- C:\Windows\Installer
2011-06-02 10:03:01 ----D---- C:\Config.Msi
2011-06-02 02:58:16 ----D---- C:\Windows\system32\config
2011-06-01 19:08:05 ----D---- C:\Windows\SysWOW64
2011-06-01 17:10:44 ----D---- C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 12
2011-06-01 16:55:38 ----D---- C:\Windows\system32\drivers
2011-06-01 16:38:28 ----D---- C:\Windows
2011-06-01 15:27:59 ----D---- C:\Users\sklb\AppData\Roaming\uTorrent
2011-06-01 14:53:36 ----D---- C:\Users\sklb\AppData\Roaming\mIRC
2011-06-01 12:52:42 ----D---- C:\Program Files (x86)\mIRC
2011-06-01 08:07:30 ----D---- C:\Windows\System32
2011-06-01 08:07:30 ----D---- C:\Windows\inf
2011-06-01 08:07:30 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-05-31 21:18:17 ----D---- C:\Windows\Minidump
2011-05-31 21:18:17 ----D---- C:\Windows\debug
2011-05-31 15:29:44 ----D---- C:\Phoenix06bin
2011-05-31 08:39:54 ----RD---- C:\Program Files (x86)
2011-05-30 22:05:10 ----D---- C:\Program Files (x86)\Google
2011-05-26 00:15:30 ----D---- C:\Windows\winsxs
2011-05-26 00:15:10 ----D---- C:\Windows\system32\catroot2
2011-05-26 00:15:10 ----D---- C:\Windows\system32\catroot
2011-05-24 15:58:47 ----D---- C:\Windows\system32\DriverStore
2011-05-24 12:19:45 ----A---- C:\Windows\SYSWOW64\txjtybrtfztmq.exe
2011-05-24 12:19:43 ----A---- C:\Program Files (x86)\Drivers_pack_v4.55.63_fix.exe
2011-05-24 12:06:43 ----D---- C:\Windows\system32\NDF
2011-05-24 08:10:40 ----D---- C:\SKOLA
2011-05-23 10:19:43 ----D---- C:\yoko
2011-05-21 20:56:48 ----D---- C:\Program Files (x86)\uTorrent
2011-05-20 16:47:44 ----A---- C:\Windows\SYSWOW64\hxgwiuchehyfkqnnk.dll
2011-05-19 22:09:17 ----A---- C:\Windows\Cmicnfg3.ini.imi
2011-05-12 17:41:07 ----D---- C:\Users\sklb\AppData\Roaming\TS3Client
2011-05-12 03:00:32 ----A---- C:\Windows\system32\MRT.exe
2011-05-09 08:25:33 ----D---- C:\BraCa Soft
2011-05-04 17:17:17 ----D---- C:\Windows\rescache
2011-05-04 15:49:47 ----D---- C:\Windows\AppPatch
2011-05-04 15:49:46 ----D---- C:\Windows\SYSWOW64\en-US
2011-05-04 15:49:46 ----D---- C:\Windows\system32\en-US

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-04-07 834544]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys [2010-06-01 314016]
R2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys [2010-06-01 43680]
R3 cmuda3;C-Media PCI Audio Interface; C:\Windows\system32\drivers\cmudax3.sys [2009-12-01 1155072]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 33856]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2005-03-29 8192]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x64.sys [2009-06-10 408960]
S1 roveqiha;roveqiha; \??\C:\Windows\system32\drivers\roveqiha.sys []
S3 ay5nfykl;ay5nfykl; C:\Windows\system32\drivers\ay5nfykl.sys []
S3 nmwcd;Nokia USB Phone Parent Driver; C:\Windows\system32\drivers\ccdcmbx64.sys [2010-12-02 19968]
S3 nmwcdc;Nokia USB Communication Driver; C:\Windows\system32\drivers\ccdcmbox64.sys [2010-12-02 27136]
S3 PAC207;PC Camer@; C:\Windows\system32\DRIVERS\PFC027.SYS [2008-02-13 686592]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 usbser;Nokia USB Serial Port Driver ; C:\Windows\system32\drivers\usbser.sys [2009-07-14 32768]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys [2010-12-02 9216]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-14 40448]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2011-05-25 2275720]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2010-07-09 159336]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2010-11-29 75136]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Google Update Service (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-07-06 136176]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe []
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater; C:\Program Files (x86)\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-07-26 25832]
S3 gupdatem;Google Update Service (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-07-06 136176]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-05-26 1255736]
S4 NBService;NBService; C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040]
S4 NMIndexingService;NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]

-----------------EOF-----------------

Re: Preventivka

Napsal: 02 čer 2011 14:20
od Roli
Jestliže běží PC normálně nic jsi nepokazil, nehledě na to že Cure It se neplete.

Ještě ale doladíme.

Tohle fixni v HJT :

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

jak na to jsem si již psal.


Stáhni a spusť OTMoveIt

do levého okna aplikace pod Paste Instructions for Items to be Moved zkopíruj tento text:

Kód: Vybrat vše

:processes
explorer.exe       

:files 
C:\*.tmp
C:\WINDOWS\System32\*.tmp
C:\WINDOWS\*.tmp
C:\Windows\SYSWOW64\txjtybrtfztmq.exe
C:\Program Files (x86)\Drivers_pack_v4.55.63_fix.exe
C:\Windows\SYSWOW64\hxgwiuchehyfkqnnk.dll
C:\Windows\system32\drivers\roveqiha.sys

:services
roveqiha

:commands
[purity]
[emptytemp]
[start explorer]
klikni na MoveIt! a v pravém zeleném okně aplikace se Ti objeví info o provedene akci, obsah okna zkopíruj sem,

pokud aplikace bude požadovat restart, klikni na YES

v tom případě sem chci zkopírovat obsah logu uloženého na C:\_OTMoveIt\MovedFiles\


P.S. dej pozor ať ten text zkopíruješ přesně, hlavně na začátku aby před prvním příkazem nebyla mezera.

Re: Preventivka

Napsal: 02 čer 2011 15:08
od darius22
ok spravene podla instrukcii

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File/Folder C:\*.tmp not found.
File/Folder C:\WINDOWS\System32\*.tmp not found.
C:\WINDOWS\1C4551A64743409391E41477CD655043.TMP folder moved successfully.
C:\WINDOWS\msdownld.tmp folder moved successfully.
C:\Windows\SYSWOW64\txjtybrtfztmq.exe moved successfully.
C:\Program Files (x86)\Drivers_pack_v4.55.63_fix.exe moved successfully.
C:\Windows\SYSWOW64\hxgwiuchehyfkqnnk.dll moved successfully.
File/Folder C:\Windows\system32\drivers\roveqiha.sys not found.
========== SERVICES/DRIVERS ==========
Service roveqiha stopped successfully!
Service roveqiha deleted successfully!
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: AppData

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 62762 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: sklb
->Temp folder emptied: 401 bytes
->Temporary Internet Files folder emptied: 145691 bytes
->Java cache emptied: 3957 bytes
->FireFox cache emptied: 84597863 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 642 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 43204961 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67630 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 122.00 mb


OTM by OldTimer - Version 3.1.18.0 log created on 06022011_160456

Files moved on Reboot...
C:\Users\sklb\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

Re: Preventivka

Napsal: 02 čer 2011 19:28
od Roli
Znovu spusť OTMoveIt a nahoře v aplikaci klini na CleanUP!

tímto po sobě uklidí.


Pak dej vědět jaký je stav PC.

Re: Preventivka

Napsal: 02 čer 2011 21:22
od darius22
Stav pc je OK.
No stav internetu sa myslim nezmenil.
Zrejme budem mat problem so zariadenim alebo providerom :p.
Kazdopadne dakujem za dokladne precistenie Pc ani som nevedel ze tam mam tolko toho nabaleneho :)

Re: Preventivka

Napsal: 02 čer 2011 21:34
od Roli
V některých případech když je problém s netem pomůže restart modemu - routru (na minutku ho odpoj z elektřiny)

Případně zkontroluj všechny kabely, zda jsou v pořádku a docvaknuté.

Pak je tu možnost aktualizovat ovladače k síťovce.

No a poslední možnost, problém u providera.

Jinak nemáš zač a kdybys s něčím nemohl pohnout klidně písni :wink:

Re: Preventivka

Napsal: 03 čer 2011 16:27
od darius22
No mozno to bude v kabloch, pozrem to ;)
Kazdopadne dakujem velmi pekne za pomoc a ochotu.
Majte sa pekne

Re: Preventivka

Napsal: 03 čer 2011 20:51
od Roli
Není zač a měj se :)
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz