VIRY.CZ

prosím o pomoc. Ulovil jsem nějakou havěť. PC je pomalé a mwav se ani nerozeběhne. Nefunguje ani poslední záchrana combofix.

.....
Logfile of random's system information tool 1.09 (written by random/random)
Run by lubo at 2012-01-26 19:35:54
Systém Microsoft Windows XP Professional Service Pack 3
System drive C: has 69 GB (90%) free of 76 GB
Total RAM: 246 MB (30% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:36:25, on 26.1.2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Ashampoo\Ashampoo WinOptimizer 8\DfsdkS.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\lubo\Plocha\RSIT.exe
C:\Program Files\trend micro\lubo.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [PSUNMain] "C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" /Traybar
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Defragmentation-Service (DfSdkS) - mst software GmbH, Germany - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 8\DfsdkS.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Panda Cloud Antivirus Service (NanoServiceMain) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

--
End of file - 3878 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-10-07 42272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2011-10-07 79648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"igfxhkcmd"=C:\WINDOWS\system32\hkcmd.exe [2006-02-07 77824]
"igfxpers"=C:\WINDOWS\system32\igfxpers.exe [2006-02-07 118784]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2011-06-09 254696]
"PSUNMain"=C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe [2011-04-28 439616]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2006-02-07 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2008-08-08 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.trspch"=tssoft32.acm
"vidc.cvid"=iccvid.dll
"vidc.I420"=msh263.drv
"vidc.iv31"=ir32_32.dll
"vidc.iv32"=ir32_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"msacm.msg723"=msg723.acm
"vidc.M263"=msh263.drv
"vidc.M261"=msh261.drv
"msacm.msaudio1"=msaud32.acm
"msacm.sl_anet"=sl_anet.acm
"msacm.iac2"=C:\WINDOWS\system32\iac25_32.ax
"vidc.iv50"=ir50_32.dll
"msacm.l3acm"=C:\WINDOWS\system32\l3codeca.acm
"msacm.l3fhg"=mp3fhg.acm
"VIDC.XVID"=xvidvfw.dll
"VIDC.YV12"=xvidvfw.dll
"msacm.ac3acm"=ac3acm.acm
"VIDC.FFDS"=ff_vfw.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.FMVC"=fmcodec.dll

======List of files/folders created in the last 1 month======

2012-01-26 19:36:01 ----D---- C:\Program Files\trend micro
2012-01-26 19:35:54 ----D---- C:\rsit
2012-01-26 19:30:15 ----A---- C:\WINDOWS\SchedLgU.Txt
2012-01-26 18:55:54 ----SD---- C:\tralala
2012-01-24 22:17:00 ----HDC---- C:\WINDOWS\$NtUninstallKB2585542$
2012-01-19 14:01:07 ----SHD---- C:\RECYCLER
2012-01-12 00:51:30 ----HDC---- C:\WINDOWS\$NtUninstallKB2646524$
2012-01-12 00:51:12 ----HDC---- C:\WINDOWS\$NtUninstallKB2631813$
2012-01-12 00:48:04 ----HDC---- C:\WINDOWS\$NtUninstallKB2598479$
2012-01-12 00:47:57 ----HDC---- C:\WINDOWS\$NtUninstallKB2603381$
2012-01-12 00:47:37 ----HDC---- C:\WINDOWS\$NtUninstallKB2584146$
2012-01-10 14:43:40 ----D---- C:\WINDOWS\system32\GroupPolicy
2012-01-07 19:17:58 ----A---- C:\WINDOWS\system32\temp.txt
2012-01-07 19:17:30 ----A---- C:\WINDOWS\system32\PSUNCpl.dat
2012-01-07 19:16:33 ----D---- C:\Program Files\Panda Security
2012-01-07 18:55:12 ----A---- C:\WINDOWS\sed.exe
2012-01-07 18:55:12 ----A---- C:\WINDOWS\NIRCMD.exe

======List of files/folders modified in the last 1 month======

2012-01-26 19:36:21 ----D---- C:\WINDOWS\Temp
2012-01-26 19:36:01 ----RD---- C:\Program Files
2012-01-26 19:30:31 ----D---- C:\WINDOWS\system32\CatRoot2
2012-01-26 19:30:15 ----D---- C:\WINDOWS
2012-01-26 18:55:57 ----D---- C:\WINDOWS\Prefetch
2012-01-26 18:55:49 ----D---- C:\WINDOWS\system32\drivers
2012-01-24 22:22:12 ----D---- C:\WINDOWS\system32
2012-01-24 22:17:40 ----HD---- C:\WINDOWS\inf
2012-01-24 22:17:15 ----RSHDC---- C:\WINDOWS\system32\dllcache
2012-01-24 14:14:06 ----D---- C:\WINDOWS\Network Diagnostic
2012-01-22 00:27:18 ----HD---- C:\WINDOWS\$hf_mig$
2012-01-17 17:32:22 ----A---- C:\WINDOWS\system.ini
2012-01-17 17:29:13 ----D---- C:\WINDOWS\AppPatch
2012-01-17 17:29:08 ----D---- C:\Program Files\Common Files
2012-01-13 15:17:06 ----D---- C:\Documents and Settings
2012-01-13 13:29:25 ----D---- C:\Qoobox
2012-01-12 14:09:43 ----D---- C:\WINDOWS\Debug
2012-01-12 00:48:28 ----A---- C:\WINDOWS\system32\MRT.exe
2012-01-11 13:50:49 ----D---- C:\WINDOWS\system32\CatRoot
2012-01-11 00:25:49 ----SHD---- C:\WINDOWS\Installer
2012-01-07 19:16:33 ----D---- C:\Documents and Settings\All Users\Data aplikací\Panda Security
2012-01-07 19:10:19 ----SD---- C:\WINDOWS\Tasks
2012-01-07 19:08:42 ----D---- C:\WINDOWS\system32\drivers\etc
2012-01-07 18:53:24 ----D---- C:\WINDOWS\system32\config

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 ohci1394;Hostitelský řadič IEEE 1394 dle standardu OHCI; C:\WINDOWS\system32\DRIVERS\ohci1394.sys [2008-04-13 61696]
R1 intelppm;Řadič procesoru Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40192]
R1 kbdhid;Ovladač klávesnice standardu HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 PSINKNC;PSINKNC; C:\WINDOWS\system32\DRIVERS\psinknc.sys [2011-04-28 129992]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
R2 irda;Protokol IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-14 88192]
R2 PSINAflt;PSINAflt; C:\WINDOWS\system32\DRIVERS\PSINAflt.sys [2011-08-01 143752]
R2 PSINFile;PSINFile; C:\WINDOWS\system32\DRIVERS\PSINFile.sys [2011-04-28 97096]
R2 PSINProc;PSINProc; C:\WINDOWS\system32\DRIVERS\PSINProc.sys [2011-04-28 111688]
R2 PSINProt;PSINProt; C:\WINDOWS\system32\DRIVERS\PSINProt.sys [2011-04-28 112456]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 cs429x;Cirrus Logic WDM Audio Codec Driver; C:\WINDOWS\system32\drivers\cwawdm.sys [2004-04-05 112192]
R3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2006-02-07 1399615]
R3 iANSMiniport;Intel(R) Advanced Network Services Virtual Adapter; C:\WINDOWS\System32\DRIVERS\ianswxp.sys [2002-10-09 89088]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-24 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 NSCIRDA;NSC Infrared Device Driver; C:\WINDOWS\system32\DRIVERS\nscirda.sys [2008-04-14 28672]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERS\rt2870.sys [2008-10-01 637952]
R3 usbccgp;Obecný nadřazený ovladač Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbuhci;Ovladač Microsoft univerzálního hostitelského řadiče USB od společnosti Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 iANSProtocol;Intel(R) Advanced Network Services Protocol; C:\WINDOWS\System32\DRIVERS\ianswxp.sys [2002-10-09 89088]
S3 RT73;RT73 USB Wireless LAN Card Driver; C:\WINDOWS\system32\DRIVERS\rt73.sys [2006-03-08 255232]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2008-08-08 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-08-08 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 DfSdkS;Defragmentation-Service; C:\Program Files\Ashampoo\Ashampoo WinOptimizer 8\DfsdkS.exe [2009-08-24 406016]
R2 Irmon;Sledování infračerveného přenosu; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2011-10-03 153376]
R2 NanoServiceMain;Panda Cloud Antivirus Service; C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe [2011-04-28 140608]
S3 NetSvc;Intel NCS NetService; C:\Program Files\Intel\NCS\Sync\NetSvc.exe [2003-04-29 139264]
S3 WMPNetworkSvc;Služba Windows Media Player Network Sharing; C:\Program Files\Windows Media Player\WMPNetwk.exe [2007-01-05 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

-----------------EOF-----------------

Zkuste CF spustit v nouz. režimu a dát log.

jdu na to

OK.

tak se to v nouzovém režimu povedlo, ale trvalo to tři hodiny. Myslim, že je to hodně, na to že disk je obsazen jen na 7,5 Gb.

ComboFix 12-01-26.01 - lubo 26.01.2012 20:07:46.8.1 - x86 MINIMAL
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.246.153 [GMT 1:00]
Spuštěný z: c:\documents and settings\lubo\Plocha\antivir\tralala.exe
AV: Panda Cloud Antivirus *Enabled/Updated* {5AD27692-540A-464E-B625-78275FA38393}
SP: Panda Cloud Antivirus *Disabled/Updated* {3C6467D5-0CB7-4322-B2CA-E08614E5D9B5}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\regedit.com
c:\windows\system32\taskmgr.com
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2011-12-26 do 2012-01-26 )))))))))))))))))))))))))))))))
.
.
2012-01-26 18:36 . 2012-01-26 18:36 -------- d-----w- c:\program files\trend micro
2012-01-26 18:35 . 2012-01-26 18:36 -------- d-----w- C:\rsit
2012-01-13 14:17 . 2012-01-13 14:17 -------- d-----w- c:\documents and settings\Administrator
2012-01-10 13:43 . 2012-01-10 13:43 -------- d-----w- c:\windows\system32\GroupPolicy
2012-01-07 18:16 . 2012-01-07 18:16 -------- d-----w- c:\program files\Panda Security
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-24 23:28 . 2012-01-24 23:28 3487594 ----a-w- c:\windows\REGBK00.ZIP
2011-11-25 21:57 . 2008-04-14 06:52 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-11-23 14:40 . 2008-04-14 05:45 1859584 ----a-w- c:\windows\system32\win32k.sys
2011-11-20 06:12 . 2008-04-14 06:52 60416 ----a-w- c:\windows\system32\packager.exe
2011-11-16 14:21 . 2008-04-14 06:52 354816 ----a-w- c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2008-04-14 06:51 152064 ----a-w- c:\windows\system32\schannel.dll
2011-11-04 19:13 . 2008-08-08 15:43 916992 ----a-w- c:\windows\system32\wininet.dll
2011-11-04 19:13 . 2008-08-08 15:43 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:13 . 2008-08-08 15:43 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2008-08-08 15:43 385024 ----a-w- c:\windows\system32\html.iec
2011-11-03 15:29 . 2008-04-14 06:51 1294848 ----a-w- c:\windows\system32\quartz.dll
2011-11-03 15:29 . 2008-04-14 06:51 386560 ----a-w- c:\windows\system32\qdvd.dll
2011-11-01 16:07 . 2008-04-14 06:51 1288192 ----a-w- c:\windows\system32\ole32.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-08-08 . 1E603EA2A3FDBAE9E5B88A8CB3C03124 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot@2012-01-07_18.08.51 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-14 06:51 . 2008-04-14 06:51 23040 c:\windows\system32\mciseq.dll
+ 2008-04-14 06:51 . 2011-10-14 14:47 23040 c:\windows\system32\mciseq.dll
+ 2011-04-28 12:57 . 2011-04-28 12:57 97096 c:\windows\system32\drivers\PSINFile.sys
+ 2008-04-14 06:52 . 2011-11-20 06:12 60416 c:\windows\system32\dllcache\packager.exe
- 2008-04-14 06:51 . 2008-04-14 06:51 23040 c:\windows\system32\dllcache\mciseq.dll
+ 2008-04-14 06:51 . 2011-10-14 14:47 23040 c:\windows\system32\dllcache\mciseq.dll
+ 2012-01-10 13:43 . 2012-01-10 13:43 32256 c:\windows\Installer\253413d.msp
- 2008-04-14 06:52 . 2008-04-14 06:52 174592 c:\windows\system32\winmm.dll
+ 2008-04-14 06:52 . 2011-10-14 14:47 174592 c:\windows\system32\winmm.dll
+ 2008-04-14 06:51 . 2011-11-16 14:21 152064 c:\windows\system32\schannel.dll
+ 2011-04-28 12:57 . 2011-04-28 12:57 112456 c:\windows\system32\drivers\PSINProt.sys
+ 2011-04-28 12:57 . 2011-04-28 12:57 111688 c:\windows\system32\drivers\PSINProc.sys
+ 2011-04-28 12:57 . 2011-04-28 12:57 129992 c:\windows\system32\drivers\PSINKNC.sys
+ 2011-08-01 11:23 . 2011-08-01 11:23 143752 c:\windows\system32\drivers\PSINAflt.sys
- 2008-04-14 06:52 . 2011-06-20 17:44 293376 c:\windows\system32\dllcache\winsrv.dll
+ 2008-04-14 06:52 . 2011-11-25 21:57 293376 c:\windows\system32\dllcache\winsrv.dll
+ 2008-04-14 06:52 . 2011-10-14 14:47 174592 c:\windows\system32\dllcache\winmm.dll
- 2008-04-14 06:52 . 2008-04-14 06:52 174592 c:\windows\system32\dllcache\winmm.dll
+ 2008-04-14 06:52 . 2011-11-16 14:21 354816 c:\windows\system32\dllcache\winhttp.dll
- 2008-04-14 06:52 . 2009-08-25 09:19 354816 c:\windows\system32\dllcache\winhttp.dll
+ 2008-04-14 06:51 . 2011-11-16 14:21 152064 c:\windows\system32\dllcache\schannel.dll
- 2008-04-14 06:51 . 2008-04-14 06:51 386560 c:\windows\system32\dllcache\qdvd.dll
+ 2008-04-14 06:51 . 2011-11-03 15:29 386560 c:\windows\system32\dllcache\qdvd.dll
+ 2012-01-10 23:25 . 2012-01-10 23:25 339968 c:\windows\Installer\{FEB2D0CA-9912-4AA1-8FBE-CFD852F9F1FC}\Shortcuts_ProductN_A17DF807A25C4F9396D48EA53C96348F.exe
+ 2008-04-14 06:51 . 2011-11-03 15:29 1294848 c:\windows\system32\dllcache\quartz.dll
+ 2012-01-07 18:17 . 2012-01-07 18:17 6115328 c:\windows\Installer\155a5a.msi
+ 2011-10-06 15:29 . 2012-01-11 23:48 52128560 c:\windows\system32\MRT.exe
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-02-07 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-02-07 118784]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"PSUNMain"="c:\program files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" [2011-04-28 439616]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
.
S1 PSINKNC;PSINKNC;c:\windows\system32\drivers\PSINKNC.sys [28.4.2011 13:57 129992]
S2 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 8\DfSdkS.exe [6.10.2011 2:44 406016]
S2 NanoServiceMain;Panda Cloud Antivirus Service;c:\program files\Panda Security\Panda Cloud Antivirus\PSANHost.exe [28.4.2011 13:58 140608]
S2 PSINAflt;PSINAflt;c:\windows\system32\drivers\PSINAflt.sys [1.8.2011 12:23 143752]
S2 PSINFile;PSINFile;c:\windows\system32\drivers\PSINFile.sys [28.4.2011 13:57 97096]
S2 PSINProc;PSINProc;c:\windows\system32\drivers\PSINProc.sys [28.4.2011 13:57 111688]
S2 PSINProt;PSINProt;c:\windows\system32\drivers\PSINProt.sys [28.4.2011 13:57 112456]
S3 iANSMiniport;Intel(R) Advanced Network Services Virtual Adapter;c:\windows\system32\drivers\ianswxp.sys [6.10.2011 3:04 89088]
S3 iANSProtocol;Intel(R) Advanced Network Services Protocol;c:\windows\system32\drivers\ianswxp.sys [6.10.2011 3:04 89088]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
TCP: DhcpNameServer = 10.0.0.138
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-26 20:52
Windows 5.1.2600 Service Pack 3 NTFS
.
skenování skrytých procesů ...
.
skenování skrytých položek 'Po spuštění' ...
.
skenování skrytých souborů ...
.
sken byl úspešně dokončen
skryté soubory: 0
.
**************************************************************************
.
Celkový čas: 2012-01-26 20:54:18
ComboFix-quarantined-files.txt 2012-01-26 19:54
ComboFix2.txt 2012-01-07 18:10
ComboFix3.txt 2011-11-07 18:21
ComboFix4.txt 2011-10-31 02:17
.
Před spuštěním: Volných bajtů: 72 377 225 216
Po spuštění: Volných bajtů: 72 553 402 368
.
- - End Of File - - 1A5C0810C05E334619A935A66F77F356

Ještě jdu zkusit mbam

Něco CF smazal, zbytek logu vypadá OK. Nastala nějaká změna?

Tak mwav už funguje. Našel ještě dva viry. Prosím nevíte náhodou co je to ten backdor? MWAV ho smaže a druhý den je tam znova.

Nalezl pouze neškodné zbytky po dříve vyléčené infekci a jeden prázdný klíč. Nic nebezpečného.

Tak děkuji moc. S tím backdorem si tedy lámat hlavu nemusím, neva že se vrací?

On se nevrací. V PC jsou neškodné zbytky po něm, když byl vyléčen jiným antivirem. Zbytky jsou těžko dohledatelné dokonce i editací registry, lze je odstranit prkaicky jen plnou verzí MWAV.