Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Desktop Security 2010

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
pavel.stbk
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 12 úno 2010 11:51

Desktop Security 2010

#1 Příspěvek od pavel.stbk »

prosim o pomoc - otravnejsi havet sem snad jeste nezazil :?:

vypis z RSIT:

Logfile of random's system information tool 1.07 (written by random/random)
Run by selm1 at 2010-05-13 11:13:24
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 249 GB (82%) free of 305 GB
Total RAM: 3582 MB (86% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:13:32, on 13.5.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\bgsmsnd.exe
C:\DOCUME~1\selm1\LOCALS~1\Temp\Dočasný adresář 1 pro setup.zip\setup.exe
C:\program files\eleco\arcon\obrazky\dřevojas 3d (d)\3ds max\sara\zrcadlosara.exe
C:\program files\virtualdecor\webvd\objects\aparici\kitchenware & cabinets\kitchen furniture\suggested collections\coleccionesugerida.exe
C:\program files\eleco\arcon\program\standard\makros\famada\fromo2cplayer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\selm1\Local Settings\Temp\m.287.tmp.exe
C:\Documents and Settings\selm1\Data aplikací\Desktop Security 2010\securitycenter.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
c:\program files\common files\microsoft shared\dw\networkapplication.exe
C:\Documents and Settings\selm1\Data aplikací\Desktop Security 2010\Desktop Security 2010.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Documents and Settings\selm1\Plocha\RSIT.exe
C:\Program Files\trend micro\selm1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: pdfMachine - {56CF4856-ECB4-4e46-A897-A378821F97B9} - C:\WINDOWS\system32\bgstb.dll
O3 - Toolbar: pdfMachine - {56CF4856-ECB4-4e46-A897-A378821F97B9} - C:\WINDOWS\system32\bgstb.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ScreenManager Pro for LCD] C:\Program Files\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [bgsmsnd.exe] C:\WINDOWS\system32\bgsmsnd.exe
O4 - HKLM\..\Run: [setup] C:\DOCUME~1\selm1\LOCALS~1\Temp\Dočasný adresář 1 pro setup.zip\setup.exe
O4 - HKLM\..\Run: [SARAzrcadlo] C:\program files\eleco\arcon\obrazky\dřevojas 3d (d)\3ds max\sara\zrcadlosara.exe
O4 - HKLM\..\Run: [MapleSugerida] c:\program files\virtualdecor\webvd\objects\aparici\kitchenware & cabinets\kitchen furniture\suggested collections\coleccionesugerida.exe
O4 - HKLM\..\Run: [zrcadloPLUS] c:\program files\eleco\arcon\obrazky\dřevojas 3d (d)\dwg\dreja plus\pluszrcadlo.exe
O4 - HKLM\..\Run: [typeO2CPlayer] c:\program files\eleco\arcon\program\standard\makros\famada\fromo2cplayer.exe
O4 - HKLM\..\RunServices: [setup] C:\DOCUME~1\selm1\LOCALS~1\Temp\Dočasný adresář 1 pro setup.zip\setup.exe
O4 - HKLM\..\RunServices: [ColeccioneMaple] c:\program files\virtualdecor\webvd\objects\vives\kitchenware & cabinets\kitchen furniture\suggested collections\sugeridacoleccione.exe
O4 - HKLM\..\RunServices: [WatsonReporting11.0.8160] c:\program files\common files\microsoft shared\dw\networkapplication.exe
O4 - HKLM\..\RunServices: [SARAzrcadlo] C:\program files\eleco\arcon\obrazky\dřevojas 3d (d)\3ds max\sara\zrcadlosara.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [glvpp7usfo8r] C:\Documents and Settings\selm1\Local Settings\Temp\m.287.tmp.exe
O4 - HKCU\..\Run: [Desktop Security 2010] "C:\Documents and Settings\selm1\Data aplikací\Desktop Security 2010\Desktop Security 2010.exe" /STARTUP
O4 - HKCU\..\Run: [SecurityCenter] C:\Documents and Settings\selm1\Data aplikací\Desktop Security 2010\securitycenter.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5CF549B1-E178-4D8C-ADEF-73F226644F12} (Room328 Designer Setup) - http://deploy.webvdecor.com/app/WebVDSetUp.cab
O18 - Filter: video/x-flv - {08C72DD4-19AD-49f1-83DA-8542B4D302C5} - C:\DOCUME~1\selm1\LOCALS~1\Temp\5E.tmp
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Proces mezipaměti kategorií součástí - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6460 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\WGASetup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{56CF4856-ECB4-4e46-A897-A378821F97B9}]
pdfMachine - C:\WINDOWS\system32\bgstb.dll [2007-03-09 272088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{56CF4856-ECB4-4e46-A897-A378821F97B9} - pdfMachine - C:\WINDOWS\system32\bgstb.dll [2007-03-09 272088]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files\Analog Devices\Core\smax4pnp.exe [2006-12-18 868352]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2006-07-13 729088]
"JMB36X IDE Setup"=C:\WINDOWS\JM\JMInsIDE.exe [2006-10-30 36864]
"36X Raid Configurer"=C:\WINDOWS\system32\JMRaidSetup.exe [2006-11-16 1953792]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-05-11 8429568]
"nwiz"=nwiz.exe /install []
"ScreenManager Pro for LCD"=C:\Program Files\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe [2007-08-30 10937640]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2008-05-16 79224]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-05-11 81920]
"bgsmsnd.exe"=C:\WINDOWS\system32\bgsmsnd.exe [2007-03-09 161496]
"setup"=C:\DOCUME~1\selm1\LOCALS~1\Temp\Dočasný adresář 1 pro setup.zip\setup.exe [2010-05-07 152064]
"SARAzrcadlo"=C:\program files\eleco\arcon\obrazky\dřevojas 3d (d)\3ds max\sara\zrcadlosara.exe [2010-05-07 152064]
"MapleSugerida"=c:\program files\virtualdecor\webvd\objects\aparici\kitchenware & cabinets\kitchen furniture\suggested collections\coleccionesugerida.exe [2010-05-07 152064]
"zrcadloPLUS"=c:\program files\eleco\arcon\obrazky\dřevojas 3d (d)\dwg\dreja plus\pluszrcadlo.exe [2010-05-07 152064]
"typeO2CPlayer"=c:\program files\eleco\arcon\program\standard\makros\famada\fromo2cplayer.exe [2010-05-07 152064]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2007-10-29 15360]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-10-13 1694208]
"glvpp7usfo8r"=C:\Documents and Settings\selm1\Local Settings\Temp\m.287.tmp.exe [2010-05-07 2942976]
"Desktop Security 2010"=C:\Documents and Settings\selm1\Data aplikací\Desktop Security 2010\Desktop Security 2010.exe [2010-05-05 1409024]
"SecurityCenter"=C:\Documents and Settings\selm1\Data aplikací\Desktop Security 2010\securitycenter.exe [2010-05-05 134656]

C:\Documents and Settings\selm1\Nabídka Start\Programy\Po spuštění
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b2c700d1-f53d-11dc-b1ee-806d6172696f}]
shell\AutoRun\command - VB_Win.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b57e86bd-8317-11dd-adbe-001e8c60775e}]
shell\AutoRun\command - start.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c533f35c-355f-11de-aee2-001e8c60775e}]
shell\AutoRun\command - E:\n1deiect.com
shell\explore\command - E:\n1deiect.com
shell\open\command - E:\n1deiect.com


======List of files/folders created in the last 1 months======

2010-05-13 11:13:24 ----D---- C:\rsit
2010-05-13 11:13:24 ----D---- C:\Program Files\trend micro
2010-05-07 12:49:13 ----D---- C:\Documents and Settings\selm1\Data aplikací\Desktop Security 2010
2010-05-06 13:10:42 ----A---- C:\WINDOWS\system32\bgsview.exe
2010-05-06 13:10:42 ----A---- C:\WINDOWS\system32\bgstb.dll
2010-05-06 13:10:42 ----A---- C:\WINDOWS\system32\bgsresfr.dll
2010-05-06 13:10:42 ----A---- C:\WINDOWS\system32\bgsreses.dll
2010-05-06 13:10:42 ----A---- C:\WINDOWS\system32\bgsresen.dll
2010-05-06 13:10:42 ----A---- C:\WINDOWS\system32\bgsresde.dll
2010-05-06 13:10:42 ----A---- C:\WINDOWS\system32\bgspmnt.dll
2010-05-06 13:10:42 ----A---- C:\WINDOWS\system32\bgsofice.dll
2010-05-06 13:10:42 ----A---- C:\WINDOWS\system32\bgsmsnd.exe
2010-05-06 13:10:42 ----A---- C:\WINDOWS\system32\bgscapi.dll
2010-05-06 11:53:38 ----A---- C:\m23apdfj.tmp.X
2010-04-21 09:14:13 ----N---- C:\WINDOWS\system32\browserchoice.exe
2010-04-14 18:08:22 ----HDC---- C:\WINDOWS\$NtUninstallKB979683$
2010-04-14 18:08:18 ----HDC---- C:\WINDOWS\$NtUninstallKB980232$
2010-04-14 18:08:14 ----HDC---- C:\WINDOWS\$NtUninstallKB981350$
2010-04-14 18:08:11 ----HDC---- C:\WINDOWS\$NtUninstallKB978338$
2010-04-14 18:08:08 ----HDC---- C:\WINDOWS\$NtUninstallKB977816$
2010-04-14 18:08:04 ----HDC---- C:\WINDOWS\$NtUninstallKB978601$
2010-04-14 18:08:01 ----HDC---- C:\WINDOWS\$NtUninstallKB979309$
2010-04-14 18:07:53 ----HDC---- C:\WINDOWS\$NtUninstallKB979402_WM9L$

======List of files/folders modified in the last 1 months======

2010-05-13 11:13:25 ----D---- C:\WINDOWS\Prefetch
2010-05-13 11:13:24 ----RD---- C:\Program Files
2010-05-13 10:08:01 ----D---- C:\Documents and Settings\selm1\Data aplikací\OpenOffice.org2
2010-05-07 12:49:25 ----D---- C:\Program Files\Mozilla Thunderbird
2010-05-07 12:46:53 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-05-06 13:42:07 ----D---- C:\WINDOWS\system32\CatRoot2
2010-05-06 13:12:11 ----D---- C:\WINDOWS\Temp
2010-05-06 13:12:11 ----D---- C:\WINDOWS\system32
2010-05-06 13:10:53 ----D---- C:\Program Files\Syncrosoft
2010-05-06 13:10:50 ----HD---- C:\WINDOWS\inf
2010-05-06 13:10:29 ----SHD---- C:\WINDOWS\Installer
2010-05-06 13:10:29 ----SHD---- C:\Config.Msi
2010-05-04 12:29:20 ----D---- C:\DWG_2D
2010-05-03 12:52:21 ----D---- C:\DWG_3D
2010-04-22 09:59:59 ----D---- C:\WINDOWS
2010-04-14 18:08:25 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-04-14 18:08:21 ----HD---- C:\WINDOWS\$hf_mig$
2010-04-14 18:08:19 ----D---- C:\WINDOWS\system32\drivers
2010-04-14 18:08:19 ----A---- C:\WINDOWS\imsins.BAK
2010-04-14 15:54:38 ----D---- C:\Program Files\Mozilla Firefox

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2008-05-16 26944]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 78416]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2008-05-16 42912]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2008-05-16 94416]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\ADIHdAud.sys [2007-01-16 293888]
R3 AEAudio;AE Audio Service; C:\WINDOWS\system32\drivers\AEAudio.sys [2006-08-07 93952]
R3 Arp1394;Protokol 1394 ARP Client; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2007-10-29 60800]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2004-10-27 138240]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2007-10-29 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-05-11 6738432]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-09-11 57856]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-09-11 19968]
R3 SenFiltService;SenFilt Service; C:\WINDOWS\system32\drivers\Senfilt.sys [2006-03-17 392960]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2007-10-29 26624]
R3 usbhub;Ovladač standardního rozbočovače USB; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2007-10-29 57600]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2007-10-29 17024]
S3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2008-05-16 23152]
S3 HidUsb;Ovladač třídy standardu HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 SynasUSB;SynasUSB; C:\WINDOWS\system32\drivers\SynasUSB.sys [2006-11-23 18432]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2008-05-16 17272]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-05-11 163908]
S2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2008-05-16 144760]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2008-05-16 247160]
S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2008-05-16 349560]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Uživatelský avatar
JaRon
Moderátor
Moderátor
Příspěvky: 15658
Registrován: 29 bře 2005 13:39
Bydliště: BB-SK

Re: Desktop Security 2010

#2 Příspěvek od JaRon »

to bud rad, su aj horsie zvieratka :)
Presun ComboFix
na plochu (ak tam este nie je)

otvor si Poznamkovy blok - notepad

do neho zkopiruj skript z nasledujiceho okna:

Kód: Vybrat vše

File::
C:\Documents and Settings\selm1\Local Settings\Temp\m.287.tmp.exe
C:\Documents and Settings\selm1\Data aplikací\Desktop Security 2010\securitycenter.exe
C:\Documents and Settings\selm1\Data aplikací\Desktop Security 2010\Desktop Security 2010.exe


Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c533f35c-355f-11de-aee2-001e8c60775e}]




uloz vytvoreny textovy soubor ako CFScript.txt na plochu

po ulozeni uchop vytvoreny skript lavym tlacitkom mysi a presun ho nad ikonu Combofixu, nad nim skript upust:

Obrázek

po aplikacii by mal vzniknut dalsi log, ten vloz sem :)
FRST |ADWCleaner |MBAM |CCleaner |AVPTool

V prípade spokojnosti je možné podporiť fórum
https://platba.viry.cz/payment/

pavel.stbk
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 12 úno 2010 11:51

Re: Desktop Security 2010

#3 Příspěvek od pavel.stbk »

a vypis z ComboFix je tu:

ComboFix 10-05-12.03 - selm1 13.05.2010 11:41:23.1.2 - x86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.420.1029.18.3582.3039 [GMT 2:00]
Spuštěný z: c:\documents and settings\selm1\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\selm1\Plocha\CFScript.txt
AV: avast! antivirus 4.8.1201 [VPS 080606-0] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\AUTORUN.INF
c:\docume~1\selm1\LOCALS~1\Temp\Dočasný adresář 1 pro setup.zip\setup.exe
c:\documents and settings\selm1\Local Settings\Temp\Dočasný adresář 1 pro setup.zip\setup.exe
c:\program files\Common Files\Microsoft Shared\DW\NetworkApplication.exe
c:\program files\Eleco\ArCon\Obrazky\Dřevojas 3D (D)\3ds MAX\Sara\zrcadloSARA.exe
c:\program files\Eleco\ArCon\Obrazky\Dřevojas 3D (D)\DWG\Dreja plus\PLUSzrcadlo.exe
c:\program files\eleco\arcon\program\standard\makros\famada\fromo2cplayer.exe
c:\program files\virtualdecor\webvd\objects\aparici\kitchenware & cabinets\kitchen furniture\suggested collections\coleccionesugerida.exe
c:\program files\VirtualDecor\WebVD\objects\vives\Kitchenware & cabinets\Kitchen Furniture\Suggested Collections\SugeridaColeccione.exe
C:\Thumbs.db
c:\windows\system32\VB40032.DLL

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-04-13 do 2010-05-13 )))))))))))))))))))))))))))))))
.

2010-05-13 09:13 . 2010-05-13 09:13 -------- d-----w- C:\rsit
2010-05-13 09:13 . 2010-05-13 09:13 -------- d-----w- c:\program files\trend micro
2010-05-06 11:10 . 2007-03-09 11:38 67288 ----a-w- c:\windows\system32\bgsresfr.dll
2010-05-06 11:10 . 2007-03-09 11:38 67288 ----a-w- c:\windows\system32\bgsreses.dll
2010-05-06 11:10 . 2007-03-09 11:38 63192 ----a-w- c:\windows\system32\bgsresde.dll
2010-05-06 11:10 . 2007-03-09 11:38 67288 ----a-w- c:\windows\system32\bgsresen.dll
2010-05-06 11:10 . 2007-03-09 11:38 2225880 ----a-w- c:\windows\system32\bgsview.exe
2010-05-06 11:10 . 2007-03-09 11:38 272088 ----a-w- c:\windows\system32\bgstb.dll
2010-05-06 11:10 . 2007-03-09 11:38 59096 ----a-w- c:\windows\system32\bgspmnt.dll
2010-05-06 11:10 . 2007-03-09 11:38 452312 ----a-w- c:\windows\system32\bgsofice.dll
2010-05-06 11:10 . 2007-03-09 11:38 161496 ----a-w- c:\windows\system32\bgsmsnd.exe
2010-05-06 11:10 . 2007-02-03 09:00 516832 ----a-w- c:\windows\system32\bgscapi.dll
2010-04-21 07:14 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-07 10:49 . 2008-03-18 15:34 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-05-06 11:10 . 2008-09-09 12:49 -------- d-----w- c:\program files\Syncrosoft
2010-03-29 08:07 . 2007-10-29 12:00 77872 ----a-w- c:\windows\system32\perfc005.dat
2010-03-29 08:07 . 2007-10-29 12:00 428750 ----a-w- c:\windows\system32\perfh005.dat
2010-03-10 08:07 . 2007-10-29 12:00 417792 ----a-w- c:\windows\system32\vbscript.dll
2010-02-26 06:12 . 2007-10-29 12:00 663040 ----a-w- c:\windows\system32\wininet.dll
2010-02-26 06:12 . 2007-10-29 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-02-24 12:31 . 2007-10-29 12:00 454016 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-16 19:34 . 2007-10-29 12:00 2139136 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 19:34 . 2004-08-17 15:45 2018816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2008-04-02 12:48 . 2008-04-02 12:48 8192 --sha-w- c:\windows\o2cLicStore.bin
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SecurityCenter"="c:\documents and settings\selm1\Data aplikací\Desktop Security 2010\securitycenter.exe" [2010-05-05 134656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"JMB36X IDE Setup"="c:\windows\JM\JMInsIDE.exe" [2006-10-30 36864]
"36X Raid Configurer"="c:\windows\system32\JMRaidSetup.exe" [2006-11-16 1953792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-10 8429568]
"nwiz"="nwiz.exe" [2007-05-10 1626112]
"ScreenManager Pro for LCD"="c:\program files\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe" [2007-08-30 10937640]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-15 79224]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-10 81920]
"bgsmsnd.exe"="c:\windows\system32\bgsmsnd.exe" [2007-03-09 161496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2007-10-29 15360]

c:\documents and settings\selm1\Nabˇdka Start\Programy\Po spuçtŘnˇ\
OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-11-14 393216]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [7.4.2008 13:04 78416]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [7.4.2008 13:04 20560]
S3 SynasUSB;SynasUSB;c:\windows\system32\drivers\synasUSB.sys [9.9.2008 14:49 18432]
.
Obsah adresáře 'Naplánované úlohy'

2010-05-13 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-22 20:18]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
Filter: video/x-flv - {08C72DD4-19AD-49f1-83DA-8542B4D302C5} -
DPF: {5CF549B1-E178-4D8C-ADEF-73F226644F12} - hxxp://deploy.webvdecor.com/app/WebVDSetUp.cab
FF - ProfilePath - c:\documents and settings\selm1\Data aplikací\Mozilla\Firefox\Profiles\dha4ufn6.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

HKLM-Run-SARAzrcadlo - c:\program files\eleco\arcon\obrazky\dřevojas 3d (d)\3ds max\sara\zrcadlosara.exe
HKLM-Run-MapleSugerida - c:\program files\virtualdecor\webvd\objects\aparici\kitchenware & cabinets\kitchen furniture\suggested collections\coleccionesugerida.exe
HKLM-Run-zrcadloPLUS - c:\program files\eleco\arcon\obrazky\dřevojas 3d (d)\dwg\dreja plus\pluszrcadlo.exe
HKLM-Run-typeO2CPlayer - c:\program files\eleco\arcon\program\standard\makros\famada\fromo2cplayer.exe
HKLM-Run-DREJAzrcadlo - c:\program files\eleco\arcon\obrazky\dřevojas 3d (d)\dwg\dreja plus\pluszrcadlo.exe
HKLM-Run-dwtrig20DW2011.0.8160 - c:\program files\common files\microsoft shared\dw\networkapplication.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-13 11:46
Windows 5.1.2600 Service Pack 2 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3792)
c:\windows\system32\shdoclc.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\OpenOffice.org 2.3\program\soffice.exe
c:\program files\OpenOffice.org 2.3\program\soffice.BIN
.
**************************************************************************
.
Celkový čas: 2010-05-13 11:49:42 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-05-13 09:49

Před spuštěním: Volných bajtů: 262 424 653 824
Po spuštění: Volných bajtů: 264 994 492 416

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 4E1D8F95BE7BBE8B0DB7CA48AEB76A60

Uživatelský avatar
JaRon
Moderátor
Moderátor
Příspěvky: 15658
Registrován: 29 bře 2005 13:39
Bydliště: BB-SK

Re: Desktop Security 2010

#4 Příspěvek od JaRon »

no vypada to celkom dobre :)
1. prescanuj PC s CureIT - staci expresna kontrola
2. doinstaluj ServicePack3 + MSIE7
FRST |ADWCleaner |MBAM |CCleaner |AVPTool

V prípade spokojnosti je možné podporiť fórum
https://platba.viry.cz/payment/

pavel.stbk
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 12 úno 2010 11:51

Re: Desktop Security 2010

#5 Příspěvek od pavel.stbk »

Vypada to ze je vse v cajku, to uz je podruhe co si me zachranil ... si zlatko :D

Uživatelský avatar
JaRon
Moderátor
Moderátor
Příspěvky: 15658
Registrován: 29 bře 2005 13:39
Bydliště: BB-SK

Re: Desktop Security 2010

#6 Příspěvek od JaRon »

to ma tesi :D
FRST |ADWCleaner |MBAM |CCleaner |AVPTool

V prípade spokojnosti je možné podporiť fórum
https://platba.viry.cz/payment/

Odpovědět