měl jsem problém se spouštením Search Settings v1.2.3. Pomocí uvedeného návodu na tomto foru byl problém úspěšně odstraněn. ComboFix nainstaloval nějakou zotavovací lištu, která by se měla spouštět vždy po startu OS. Mělo by se objevit černé okno. Nic se ale nezobrazuje ale vyskočí vždy toto:
http://s1.imgupload.cz/img/--/261372/l9us8/Okno.jpg
Nevíte někdo, v čem je problem?
Jinak, zde je log po vyřešení problému se Search Settings:
ComboFix 10-03-28.02 - Honza 29.03.2010 10:03:10.1.1 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2046.1669 [GMT 2:00]
Spuštěný z: c:\documents and settings\Honza\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Honza\Plocha\CFScript.txt
AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Rezidentní štít AV je zapnutý
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Search Settings
c:\program files\Search Settings\FF\components\IFBHOSearch.xpt
c:\program files\Search Settings\FF\components\IFBHOSearchHelperEngine.xpt
c:\program files\Search Settings\FF\components\IFHelperPreferences.xpt
c:\program files\Search Settings\FF\components\SearchSettingsFF.dll
c:\program files\Search Settings\FF\chrome.manifest
c:\program files\Search Settings\FF\chrome\content\plugin.js
c:\program files\Search Settings\FF\chrome\content\plugin.xul
c:\program files\Search Settings\FF\chrome\content\protection.js
c:\program files\Search Settings\FF\chrome\content\utils.js
c:\program files\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.dtd
c:\program files\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.properties
c:\program files\Search Settings\FF\install.rdf
c:\windows\system32\autorun.ini
.
((((((((((((((((((((((((( Soubory vytvořené od 2010-02-28 do 2010-03-29 )))))))))))))))))))))))))))))))
.
2010-03-23 20:06 . 2010-03-23 20:06 -------- d-----w- c:\windows\system32\Futuremark
2010-03-23 20:06 . 2008-09-17 14:14 27672 ----a-r- c:\windows\system32\drivers\Entech.sys
2010-03-23 20:06 . 2010-03-23 20:06 -------- d-----w- c:\program files\Common Files\Futuremark Shared
2010-03-17 12:35 . 2010-03-17 12:35 -------- d-----w- c:\program files\Application Updater
2010-03-16 09:38 . 2010-03-16 09:38 -------- d-----w- c:\program files\Common Files\Skype
2010-03-10 21:55 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-03-10 06:48 . 2009-10-23 15:28 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-08 21:11 . 2008-02-19 08:09 72704 ----a-w- c:\windows\system32\drivers\HS3dSensor1394.sys
2010-03-03 11:14 . 2005-03-11 16:37 1986560 ----a-w- c:\windows\system32\AudFile.dll
2010-03-03 11:14 . 2005-02-24 11:11 1212416 ----a-w- c:\windows\system32\AudioInfos.dll
2010-03-03 11:14 . 2005-02-24 10:51 348160 ----a-w- c:\windows\system32\WMAFile.dll
2010-03-03 11:14 . 2003-01-26 10:41 40960 ----a-w- c:\windows\system32\SSubTmr6.dll
2010-03-03 11:14 . 1999-03-25 16:00 101888 ----a-w- c:\windows\system32\VB6STKIT.DLL
2010-03-03 11:14 . 1998-07-12 20:00 15360 ----a-w- c:\windows\system32\inetfr.DLL
2010-03-03 11:14 . 2000-10-01 16:00 119568 ----a-w- c:\windows\system32\VB6FR.DLL
2010-03-03 11:14 . 1998-07-12 20:00 141312 ----a-w- c:\windows\system32\MSCMCFR.DLL
2010-03-03 11:14 . 1998-07-12 16:00 32768 ----a-w- c:\windows\system32\CMDLGFR.DLL
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-29 08:02 . 2001-10-25 12:00 79062 ----a-w- c:\windows\system32\perfc005.dat
2010-03-29 08:02 . 2001-10-25 12:00 432004 ----a-w- c:\windows\system32\perfh005.dat
2010-03-28 16:25 . 2009-11-06 19:36 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-03-23 20:06 . 2009-11-06 18:46 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-26 17:43 . 2010-02-26 17:42 -------- d-----w- c:\program files\QuickTime
2010-02-13 22:04 . 2010-02-13 22:04 -------- d-----w- c:\program files\Microsoft Silverlight
2010-02-13 12:22 . 2010-02-13 12:22 -------- d--h--w- c:\program files\InstallJammer Registry
2010-02-13 12:18 . 2010-02-12 19:50 -------- d-----w- c:\program files\WinLemm
2010-02-09 20:09 . 2010-02-09 20:09 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2010-02-09 19:41 . 2010-02-09 19:41 -------- d-----w- c:\program files\TGTSoft
2010-02-06 19:22 . 2009-11-06 21:22 -------- d-----w- c:\program files\Common Files\Nero
2010-02-05 13:38 . 2009-11-06 21:55 -------- d-----w- c:\program files\Google
2010-01-09 13:26 . 2010-01-09 13:26 54784 ----a-w- c:\windows\system32\drivers\CDAC11BA.EXE
2010-01-09 13:26 . 2010-01-09 13:26 12464 ----a-w- c:\windows\system32\drivers\CdaC15BA.SYS
2009-12-31 16:50 . 2004-08-03 21:14 353792 ----a-w- c:\windows\system32\drivers\srv.sys
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Soltek"="c:\windows\system32\autorun.exe" [2001-10-29 61440]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-06-10 1447168]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]
"PtiuPbmd"="ulutil2.dll" [2003-11-05 110592]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-27 13918208]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programy\\InterVideo\\DVD8\\WinDVD.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\Programy\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programy\\Vuze\\Azureus.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Hry\\Counter-Strike Source\\hl2.exe"=
"c:\\Hry\\KONAMI\\Pro Evolution Soccer 2010\\pes2010.exe"=
"c:\\Programy\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Programy\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Programy\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Programy\\Pinnacle\\Studio 14\\Programs\\RM.exe"=
"c:\\Programy\\Pinnacle\\Studio 14\\Programs\\Studio.exe"=
"c:\\Programy\\Pinnacle\\Studio 14\\Programs\\umi.exe"=
"c:\\Hry\\Kyodai Mahjongg 2006\\kmj.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Programy\\Skype\\Phone\\Skype.exe"=
R0 dontgo;Promise Removable Disk Control Driver;c:\windows\system32\drivers\dontgo.sys [24.2.2010 13:59 7680]
R0 ulsata2;ulsata2;c:\windows\system32\drivers\ulsata2.sys [24.2.2010 13:59 115208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [10.6.2008 19:56 34312]
R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [16.12.2009 18:38 375296]
R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [21.12.2007 9:21 468224]
R3 PGR1394b;HS 3d Sensor IEEE 1394 Bus host controllers;c:\windows\system32\drivers\HS3dSensor1394.sys [8.3.2010 23:11 72704]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6.11.2009 22:59 691696]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [6.11.2009 23:55 135664]
.
Obsah adresáře 'Naplánované úlohy'
2010-03-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2010-03-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-06 21:55]
2010-03-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-06 21:55]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {ACDC90C1-E565-41C4-8BEF-2FF7A683BB30} = 99.92.158.230,81.92.155.1
FF - ProfilePath - c:\documents and settings\Honza\Data aplikací\Mozilla\Firefox\Profiles\hrg9zznn.default\
FF - prefs.js: browser.startup.homepage - www.seznam.cz
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npfiller.dll
FF - plugin: c:\programy\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\programy\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
AddRemove-Counter-Strike: Source Texture Pack 1.00 - c:\hry\Counter-Strike Source\Uninstall.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-29 10:06
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
Celkový čas: 2010-03-29 10:08:13
ComboFix-quarantined-files.txt 2010-03-29 08:08
Před spuštěním: Volných bajtů: 28 317 401 088
Po spuštění: Volných bajtů: 28 718 272 512
WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - 3EED08648841891DF1A3E2679368F531
Přispějete na provoz fóra?