Odstranění win32:rootkit-gen (rtk)
Napsal: 12 črc 2011 19:18
Dobrý den,
chtěl bych Vás poprosit o pomoc s odstraněním win32:rootkit-gen (rtk), který mi našel Avast. Kompletní kontrolu systému jsem udělal, protože se mi v posledních dnech celý počítač hodně zpomalil a dnes jsem zjistil, že mi nejdou ani otevírat určité stránky na internetu. Hledal jsem ve Vašem fóru příspěvky na téma tohoto rootkitu a viděl jsem, že v podstatě vždy bylo doporučeno použít Combofix, což jsem udělal ale počítač zlobí dál... Abych řekl pravdu, tak jsem poměrně silný IT analfabet a proto bych Vás rád poprosil o radu co s tím
Tady je log z Combofixu:
ComboFix 11-07-12.05 - Jirka 22.01.2011 18:34:25.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1014.467 [GMT 1:00]
Spuštěný z: c:\documents and settings\Jirka\Dokumenty\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\ICQ6.5\ICQLRun.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-12-22 do 2011-01-22 )))))))))))))))))))))))))))))))
.
.
2011-01-23 17:47 . 2011-01-22 17:07 -------- d-----w- c:\program files\Common Files\Akamai
2011-01-23 17:18 . 2011-01-23 17:18 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ZoomBrowser
2011-01-23 17:17 . 2011-01-23 17:20 -------- d-----w- c:\program files\Canon
2011-01-23 17:14 . 2011-01-23 17:14 -------- d-----w- c:\program files\MSBuild
2011-01-23 17:14 . 2011-01-23 17:14 -------- d-----w- c:\documents and settings\Jirka\Data aplikací\ZoomBrowser EX
2011-01-23 17:14 . 2011-01-22 17:06 88 --sh--r- c:\documents and settings\All Users\Data aplikací\FA60F7B2B7.sys
2011-01-23 17:14 . 2011-01-22 17:06 2828 --sha-w- c:\documents and settings\All Users\Data aplikací\KGyGaAvL.sys
2011-01-23 17:14 . 2011-01-23 17:14 -------- d-----w- c:\documents and settings\Jirka\Data aplikací\Corel
2011-01-23 17:13 . 2011-01-23 17:13 -------- d-----w- c:\documents and settings\Jirka\Local Settings\Data aplikací\yBook
2011-01-23 17:13 . 2011-01-22 17:59 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Corel
2011-01-23 17:12 . 2004-03-09 15:45 212240 ----a-w- c:\windows\system32\RICHTX32.OCX
2011-01-23 17:12 . 2004-03-09 15:45 132880 ----a-w- c:\windows\system32\MSINET.OCX
2011-01-23 17:12 . 1998-05-11 19:01 240944 ----a-w- c:\windows\system32\RICHED.DLL
2011-01-23 17:10 . 2011-01-23 17:10 -------- d-----w- c:\program files\Common Files\Corel
2011-01-23 17:08 . 2011-01-23 17:08 -------- d-----w- c:\windows\system32\XPSViewer
2011-01-23 17:07 . 2011-01-23 17:07 -------- d-----w- c:\program files\Reference Assemblies
2011-01-23 17:07 . 2006-10-14 15:43 27648 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2011-01-23 17:06 . 2006-06-29 12:07 14048 ------w- c:\windows\system32\spmsg2.dll
2011-01-23 16:59 . 2011-01-22 17:38 -------- d-----w- c:\documents and settings\Jirka\.musikproject
2011-01-23 16:59 . 2011-01-23 16:59 -------- d-----w- c:\program files\musikCube_1.0
2011-01-23 16:56 . 2011-01-23 16:56 -------- d-----w- c:\program files\Common Files\Canon
2011-01-22 18:02 . 2011-01-22 18:02 -------- d-----w- c:\documents and settings\All Users\Data aplikací\PhotoStitch
2011-01-22 17:54 . 2011-05-10 13:03 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-01-22 17:45 . 2011-01-22 17:45 -------- d-----w- c:\program files\MP3 Cutter
2011-01-22 17:45 . 1998-06-23 17:00 140096 ----a-w- c:\windows\system32\comdlg32.ocx
2011-01-22 17:28 . 2005-02-11 09:24 79488 ----a-w- c:\windows\system32\drivers\k750obex.sys
2011-01-22 17:28 . 2005-02-11 09:24 6144 ----a-w- c:\windows\system32\drivers\k750cmnt.sys
2011-01-22 17:28 . 2005-02-11 09:24 6144 ----a-w- c:\windows\system32\drivers\k750cm.sys
2011-01-22 17:28 . 2005-02-11 09:22 81728 ----a-w- c:\windows\system32\drivers\k750mgmt.sys
2011-01-22 17:28 . 2005-02-11 09:21 89872 ----a-w- c:\windows\system32\drivers\k750mdm.sys
2011-01-22 17:28 . 2005-02-11 09:21 6576 ----a-w- c:\windows\system32\drivers\k750mdfl.sys
2011-01-22 17:28 . 2005-02-11 09:19 55216 ----a-w- c:\windows\system32\drivers\k750bus.sys
2011-01-22 17:28 . 2005-02-11 09:19 5744 ----a-w- c:\windows\system32\drivers\k750whnt.sys
2011-01-22 17:28 . 2005-02-11 09:19 5744 ----a-w- c:\windows\system32\drivers\k750wh.sys
2011-01-22 17:19 . 2011-01-22 17:19 -------- d-----w- c:\documents and settings\Jirka\Data aplikací\inkscape
2011-01-22 17:12 . 2011-01-22 17:18 -------- d-----w- c:\program files\Inkscape
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-10 13:10 . 2010-11-03 16:46 40112 ----a-w- c:\windows\avastSS.scr
2011-05-10 13:10 . 2010-11-03 16:46 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-05-10 13:03 . 2010-11-03 16:47 307928 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-05-10 13:02 . 2010-11-03 16:47 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-05-10 13:02 . 2010-11-03 16:47 102616 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-05-10 13:02 . 2010-11-03 16:47 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-05-10 12:59 . 2010-11-03 16:47 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-05-10 12:59 . 2010-11-03 16:47 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-05-10 12:59 . 2010-11-03 16:47 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-11-03 17:16 . 2010-11-03 17:16 682232 ----a-w- c:\windows\system32\drivers\sptd.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-12-09 17:40 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-12-09 333192]
.
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-12-09 333192]
.
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-05-10 13:10 122512 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ICQ"="c:\program files\ICQ6.5\ICQ.exe" [2010-11-16 172856]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"SMSERIAL"="sm56hlpr.exe" [2006-01-20 544768]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 16261632]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-21 761946]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2010-4-5 494920]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2820:TCP"= 2820:TCP:rhikmc
"1046:TCP"= 1046:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3.11.2010 18:16 682232]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [22.1.2011 18:54 441176]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [3.11.2010 17:47 307928]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [17.8.2004 16:49 14336]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [3.11.2010 17:47 19544]
S2 bigabux;Image Monitor;c:\windows\system32\svchost.exe -k netsvcs [17.8.2004 16:49 14336]
S2 dbectdhn;Server System;c:\windows\system32\svchost.exe -k netsvcs [17.8.2004 16:49 14336]
S2 epohsglu;Monitor Manager;c:\windows\system32\svchost.exe -k netsvcs [17.8.2004 16:49 14336]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [3.11.2010 17:47 136176]
S2 nhusbvvk;Image Universal;c:\windows\system32\svchost.exe -k netsvcs [17.8.2004 16:49 14336]
S2 squjkc;Monitor Image;c:\windows\system32\svchost.exe -k netsvcs [17.8.2004 16:49 14336]
S2 xaszjx;Helper Network;c:\windows\system32\svchost.exe -k netsvcs [17.8.2004 16:49 14336]
S3 flash;flash;c:\windows\system32\drivers\flash.sys [22.10.2009 20:51 8064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
qjakxfnjw
xaszjx
epohsglu
bigabux
dbectdhn
nhusbvvk
squjkc
.
Obsah adresáře 'Naplánované úlohy'
.
2011-01-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-03 16:47]
.
2011-01-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-03 16:47]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13836&gct=&gc=1&q=%s
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Jirka\Data aplikací\Mozilla\Firefox\Profiles\b34mjxfb.default\
FF - prefs.js: browser.search.selectedEngine - WebHledani
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/firefox?client=firefox-a& ... s:official
FF - prefs.js: keyword.URL - hxxp://www.webhledani.cz/results.aspx?i=42&tp=ab&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Ask Toolbar for Firefox: {E9A1DEE0-C623-4439-8932-001E7D17607D} - %profile%\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-22 18:54
Windows 5.1.2600 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\bigabux]
"ServiceDll"="c:\windows\system32\sezalv.dll"
--
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dbectdhn]
"ServiceDll"="c:\windows\system32\sezalv.dll"
--
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\epohsglu]
"ServiceDll"="c:\windows\system32\sezalv.dll"
--
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nhusbvvk]
"ServiceDll"="c:\windows\system32\sezalv.dll"
--
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\squjkc]
"ServiceDll"="c:\windows\system32\sezalv.dll"
--
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\xaszjx]
"ServiceDll"="c:\windows\system32\sezalv.dll"
.
Celkový čas: 2011-01-22 19:03:22
ComboFix-quarantined-files.txt 2011-01-22 18:03
.
Před spuštěním: 1 546 862 592
Po spuštění: 2 200 301 568
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - FB40864E86A637D8D4473EA5A8FCACB3
A tady z HijackThis následně po použití CF:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:21:09, on 22.1.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jirka\Dokumenty\Stažené soubory\hijackthis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedi ... &gc=1&q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6.5\ICQ.exe" silent
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP\qip.exe (file missing) (HKCU)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
--
End of file - 5030 bytes
Předem mockrát děkuji
chtěl bych Vás poprosit o pomoc s odstraněním win32:rootkit-gen (rtk), který mi našel Avast. Kompletní kontrolu systému jsem udělal, protože se mi v posledních dnech celý počítač hodně zpomalil a dnes jsem zjistil, že mi nejdou ani otevírat určité stránky na internetu. Hledal jsem ve Vašem fóru příspěvky na téma tohoto rootkitu a viděl jsem, že v podstatě vždy bylo doporučeno použít Combofix, což jsem udělal ale počítač zlobí dál... Abych řekl pravdu, tak jsem poměrně silný IT analfabet a proto bych Vás rád poprosil o radu co s tím
Tady je log z Combofixu:ComboFix 11-07-12.05 - Jirka 22.01.2011 18:34:25.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.1014.467 [GMT 1:00]
Spuštěný z: c:\documents and settings\Jirka\Dokumenty\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\ICQ6.5\ICQLRun.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-12-22 do 2011-01-22 )))))))))))))))))))))))))))))))
.
.
2011-01-23 17:47 . 2011-01-22 17:07 -------- d-----w- c:\program files\Common Files\Akamai
2011-01-23 17:18 . 2011-01-23 17:18 -------- d-----w- c:\documents and settings\All Users\Data aplikací\ZoomBrowser
2011-01-23 17:17 . 2011-01-23 17:20 -------- d-----w- c:\program files\Canon
2011-01-23 17:14 . 2011-01-23 17:14 -------- d-----w- c:\program files\MSBuild
2011-01-23 17:14 . 2011-01-23 17:14 -------- d-----w- c:\documents and settings\Jirka\Data aplikací\ZoomBrowser EX
2011-01-23 17:14 . 2011-01-22 17:06 88 --sh--r- c:\documents and settings\All Users\Data aplikací\FA60F7B2B7.sys
2011-01-23 17:14 . 2011-01-22 17:06 2828 --sha-w- c:\documents and settings\All Users\Data aplikací\KGyGaAvL.sys
2011-01-23 17:14 . 2011-01-23 17:14 -------- d-----w- c:\documents and settings\Jirka\Data aplikací\Corel
2011-01-23 17:13 . 2011-01-23 17:13 -------- d-----w- c:\documents and settings\Jirka\Local Settings\Data aplikací\yBook
2011-01-23 17:13 . 2011-01-22 17:59 -------- d-----w- c:\documents and settings\All Users\Data aplikací\Corel
2011-01-23 17:12 . 2004-03-09 15:45 212240 ----a-w- c:\windows\system32\RICHTX32.OCX
2011-01-23 17:12 . 2004-03-09 15:45 132880 ----a-w- c:\windows\system32\MSINET.OCX
2011-01-23 17:12 . 1998-05-11 19:01 240944 ----a-w- c:\windows\system32\RICHED.DLL
2011-01-23 17:10 . 2011-01-23 17:10 -------- d-----w- c:\program files\Common Files\Corel
2011-01-23 17:08 . 2011-01-23 17:08 -------- d-----w- c:\windows\system32\XPSViewer
2011-01-23 17:07 . 2011-01-23 17:07 -------- d-----w- c:\program files\Reference Assemblies
2011-01-23 17:07 . 2006-10-14 15:43 27648 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2011-01-23 17:06 . 2006-06-29 12:07 14048 ------w- c:\windows\system32\spmsg2.dll
2011-01-23 16:59 . 2011-01-22 17:38 -------- d-----w- c:\documents and settings\Jirka\.musikproject
2011-01-23 16:59 . 2011-01-23 16:59 -------- d-----w- c:\program files\musikCube_1.0
2011-01-23 16:56 . 2011-01-23 16:56 -------- d-----w- c:\program files\Common Files\Canon
2011-01-22 18:02 . 2011-01-22 18:02 -------- d-----w- c:\documents and settings\All Users\Data aplikací\PhotoStitch
2011-01-22 17:54 . 2011-05-10 13:03 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-01-22 17:45 . 2011-01-22 17:45 -------- d-----w- c:\program files\MP3 Cutter
2011-01-22 17:45 . 1998-06-23 17:00 140096 ----a-w- c:\windows\system32\comdlg32.ocx
2011-01-22 17:28 . 2005-02-11 09:24 79488 ----a-w- c:\windows\system32\drivers\k750obex.sys
2011-01-22 17:28 . 2005-02-11 09:24 6144 ----a-w- c:\windows\system32\drivers\k750cmnt.sys
2011-01-22 17:28 . 2005-02-11 09:24 6144 ----a-w- c:\windows\system32\drivers\k750cm.sys
2011-01-22 17:28 . 2005-02-11 09:22 81728 ----a-w- c:\windows\system32\drivers\k750mgmt.sys
2011-01-22 17:28 . 2005-02-11 09:21 89872 ----a-w- c:\windows\system32\drivers\k750mdm.sys
2011-01-22 17:28 . 2005-02-11 09:21 6576 ----a-w- c:\windows\system32\drivers\k750mdfl.sys
2011-01-22 17:28 . 2005-02-11 09:19 55216 ----a-w- c:\windows\system32\drivers\k750bus.sys
2011-01-22 17:28 . 2005-02-11 09:19 5744 ----a-w- c:\windows\system32\drivers\k750whnt.sys
2011-01-22 17:28 . 2005-02-11 09:19 5744 ----a-w- c:\windows\system32\drivers\k750wh.sys
2011-01-22 17:19 . 2011-01-22 17:19 -------- d-----w- c:\documents and settings\Jirka\Data aplikací\inkscape
2011-01-22 17:12 . 2011-01-22 17:18 -------- d-----w- c:\program files\Inkscape
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-10 13:10 . 2010-11-03 16:46 40112 ----a-w- c:\windows\avastSS.scr
2011-05-10 13:10 . 2010-11-03 16:46 199304 ----a-w- c:\windows\system32\aswBoot.exe
2011-05-10 13:03 . 2010-11-03 16:47 307928 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-05-10 13:02 . 2010-11-03 16:47 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-05-10 13:02 . 2010-11-03 16:47 102616 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2011-05-10 13:02 . 2010-11-03 16:47 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys
2011-05-10 12:59 . 2010-11-03 16:47 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-05-10 12:59 . 2010-11-03 16:47 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2011-05-10 12:59 . 2010-11-03 16:47 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-11-03 17:16 . 2010-11-03 17:16 682232 ----a-w- c:\windows\system32\drivers\sptd.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-12-09 17:40 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-12-09 333192]
.
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-12-09 333192]
.
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-05-10 13:10 122512 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ICQ"="c:\program files\ICQ6.5\ICQ.exe" [2010-11-16 172856]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"SMSERIAL"="sm56hlpr.exe" [2006-01-20 544768]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 16261632]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-21 761946]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-17 15360]
.
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2010-4-5 494920]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2820:TCP"= 2820:TCP:rhikmc
"1046:TCP"= 1046:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [3.11.2010 18:16 682232]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [22.1.2011 18:54 441176]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [3.11.2010 17:47 307928]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [17.8.2004 16:49 14336]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [3.11.2010 17:47 19544]
S2 bigabux;Image Monitor;c:\windows\system32\svchost.exe -k netsvcs [17.8.2004 16:49 14336]
S2 dbectdhn;Server System;c:\windows\system32\svchost.exe -k netsvcs [17.8.2004 16:49 14336]
S2 epohsglu;Monitor Manager;c:\windows\system32\svchost.exe -k netsvcs [17.8.2004 16:49 14336]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [3.11.2010 17:47 136176]
S2 nhusbvvk;Image Universal;c:\windows\system32\svchost.exe -k netsvcs [17.8.2004 16:49 14336]
S2 squjkc;Monitor Image;c:\windows\system32\svchost.exe -k netsvcs [17.8.2004 16:49 14336]
S2 xaszjx;Helper Network;c:\windows\system32\svchost.exe -k netsvcs [17.8.2004 16:49 14336]
S3 flash;flash;c:\windows\system32\drivers\flash.sys [22.10.2009 20:51 8064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
qjakxfnjw
xaszjx
epohsglu
bigabux
dbectdhn
nhusbvvk
squjkc
.
Obsah adresáře 'Naplánované úlohy'
.
2011-01-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-03 16:47]
.
2011-01-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-03 16:47]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://start.icq.com/
uDefault_Search_URL = hxxp://search.qip.ru
uSearchAssistant = hxxp://search.qip.ru/ie
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13836&gct=&gc=1&q=%s
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\documents and settings\Jirka\Data aplikací\Mozilla\Firefox\Profiles\b34mjxfb.default\
FF - prefs.js: browser.search.selectedEngine - WebHledani
FF - prefs.js: browser.startup.homepage - hxxp://www.google.cz/firefox?client=firefox-a& ... s:official
FF - prefs.js: keyword.URL - hxxp://www.webhledani.cz/results.aspx?i=42&tp=ab&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Ask Toolbar for Firefox: {E9A1DEE0-C623-4439-8932-001E7D17607D} - %profile%\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-22 18:54
Windows 5.1.2600 Service Pack 2 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\bigabux]
"ServiceDll"="c:\windows\system32\sezalv.dll"
--
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dbectdhn]
"ServiceDll"="c:\windows\system32\sezalv.dll"
--
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\epohsglu]
"ServiceDll"="c:\windows\system32\sezalv.dll"
--
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nhusbvvk]
"ServiceDll"="c:\windows\system32\sezalv.dll"
--
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\squjkc]
"ServiceDll"="c:\windows\system32\sezalv.dll"
--
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\xaszjx]
"ServiceDll"="c:\windows\system32\sezalv.dll"
.
Celkový čas: 2011-01-22 19:03:22
ComboFix-quarantined-files.txt 2011-01-22 18:03
.
Před spuštěním: 1 546 862 592
Po spuštění: 2 200 301 568
.
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - FB40864E86A637D8D4473EA5A8FCACB3
A tady z HijackThis následně po použití CF:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:21:09, on 22.1.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jirka\Dokumenty\Stažené soubory\hijackthis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi ... t=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedi ... &gc=1&q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6.5\ICQ.exe" silent
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: QIP 2005 - {1EF681F7-A04B-4D6D-9012-A307CCA55610} - C:\Program Files\QIP\qip.exe (file missing) (HKCU)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
--
End of file - 5030 bytes
Předem mockrát děkuji
