PC-HELP.CZ

České diskuzní fórum o počítačích
http://www.pc-help.cz/

Prosim o Kontrolu

http://www.pc-help.cz/viewtopic.php?f=70&t=43251

Stránka 1 z 1

Prosim o Kontrolu

Napsal: 03 srp 2009 13:06
od Lineage2nejde
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:01:24, on 3.8.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896" onclick="window.open(this.href);return false;
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157" onclick="window.open(this.href);return false;
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157" onclick="window.open(this.href);return false;
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896" onclick="window.open(this.href);return false;
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896" onclick="window.open(this.href);return false;
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157" onclick="window.open(this.href);return false;
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 89.185.235.158 l2authd.lineage2.com
O1 - Hosts: 89.185.235.158 l2testauthd.lineage2.com
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/G ... meHost.cab" onclick="window.open(this.href);return false;
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\Windows\system32\AEADISRV.EXE
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
O23 - Service: Služba Google Update (gupdate1ca047e7384c01a) (gupdate1ca047e7384c01a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\Windows\System32\LEXBCES.EXE
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

--
End of file - 5312 bytes

Re: Prosim o Kontrolu

Napsal: 03 srp 2009 15:21
od jaro3
Odinstaluj:
AskBarDis
askBar

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod: http://www.pc-help.cz/viewtopic.php?f=70&t=5119" onclick="window.open(this.href);return false;

Kód: Vybrat vše

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O13 - Gopher Prefix:
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/G ... meHost.cab
Stáhni si ATF Cleaner
Poklepej na ATF Cleaner.exe, klikni na select all found, poté:
-Když používáš Firefox (Mozzila), klikni na Firefox nahoře a vyber: Select All, poté klikni na Empty Selected.
-Když používáš Operu, klikni nahoře na Operu a vyber: Select All, poté klikni na Empty Selected.
Po vyčištění klikni na Exit k zavření programu.

Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.

Re: Prosim o Kontrolu

Napsal: 03 srp 2009 20:55
od Lineage2nejde
Malwarebytes' Anti-Malware 1.40
Verze databáze: 2551
Windows 6.0.6001 Service Pack 1

3.8.2009 20:54:08
mbam-log-2009-08-03 (20-54-08).txt

Typ skenu: Rychlý sken
Objektu skenováno: 76312
Uplynulý cas: 5 minute(s), 27 second(s)

Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 0

Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)

Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)

Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)

Infikované složky:
(Žádné zákerné položky nebyly zjišteny)

Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)

Re: Prosim o Kontrolu

Napsal: 03 srp 2009 21:04
od jaro3
Máš nějaké problémy?

Re: Prosim o Kontrolu

Napsal: 04 srp 2009 08:24
od Lineage2nejde
Zablokovaná IP adresa.....

Re: Prosim o Kontrolu

Napsal: 04 srp 2009 09:51
od jaro3
Vypni rez. ochranu u NOD32

Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

Re: Prosim o Kontrolu

Napsal: 04 srp 2009 23:40
od Lineage2nejde
ComboFix 09-08-04.01 - Vojťass 04.08.2009 23:31.1.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1250.420.1029.18.2039.1340 [GMT 2:00]
Spuštěný z: c:\users\Vojťass\Desktop\ComboFix.exe
AV: Eset NOD32 Antivirus 2.70 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2365545147-1999384947-2466353664-500
c:\$recycle.bin\S-1-5-21-2815255612-1331869671-2029657788-1000
c:\$recycle.bin\S-1-5-21-2815255612-1331869671-2029657788-1001
c:\windows\Installer\41ab8.msi

.
((((((((((((((((((((((((( Soubory vytvořené od 2009-07-04 do 2009-08-04 )))))))))))))))))))))))))))))))
.

2009-08-04 19:49 . 2009-08-04 19:49 -------- d-----w- C:\PacSteamT
2009-08-04 19:49 . 2009-08-04 19:49 -------- d-----w- c:\program files\Common Files\Thraex Software
2009-08-03 18:48 . 2009-08-03 18:48 3942048 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-08-03 18:47 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 18:47 . 2009-08-03 18:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-03 18:47 . 2009-08-03 18:47 -------- d-----w- c:\programdata\Malwarebytes
2009-08-03 18:47 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-03 18:26 . 2009-08-03 18:26 50688 ----a-w- c:\program files\ATF-Cleaner.exe
2009-08-03 17:15 . 2006-02-04 01:50 4682 ----a-w- c:\windows\system32\npptNT2.sys
2009-08-03 16:30 . 2006-04-13 09:30 1073152 ----a-w- c:\windows\system32\libmysql_c.dll
2009-08-03 16:30 . 2009-08-03 16:30 -------- d-----w- c:\program files\PremiumSoft
2009-08-03 16:11 . 2009-08-03 16:11 -------- d-----w- c:\program files\MySQL
2009-08-03 16:11 . 2009-08-03 16:11 -------- d-----w- c:\programdata\MySQL
2009-08-03 11:01 . 2009-08-03 11:01 -------- d-----w- c:\program files\Trend Micro
2009-08-03 06:48 . 2009-08-03 06:48 147456 ----a-w- c:\programdata\TuneUp Software\TuneUp Utilities\WinStyler\LogoAnimations\Bubbles.tla.dll
2009-08-02 17:26 . 2009-08-02 18:04 -------- d-----w- c:\program files\The Simpsons - Hit & run
2009-08-02 16:59 . 2009-08-02 16:59 -------- d-----w- c:\program files\GamersFirst
2009-07-31 16:54 . 2009-08-03 17:15 -------- d-----w- c:\program files\Lineage II
2009-07-29 17:08 . 2009-07-29 17:08 -------- d-----w- c:\users\Microsoft\My Vojťas
2009-07-29 17:08 . 2009-07-29 17:08 -------- d-----w- c:\users\Microsoft
2009-07-29 10:59 . 2009-07-29 17:08 -------- d-----w- c:\users\Public\Interlude -L2
2009-07-29 10:06 . 2009-08-04 19:52 -------- d-----w- c:\users\Vojťass
2009-07-27 18:15 . 2007-12-26 15:30 679936 ----a-w- c:\windows\system32\D3DX81ab.dll
2009-07-27 18:15 . 2007-12-26 15:30 1970176 ----a-w- c:\windows\system32\d3dx9.dll
2009-07-27 18:15 . 2009-07-30 20:00 -------- d-----w- c:\program files\Cheat Engine
2009-07-27 18:02 . 2009-07-27 18:02 -------- d-----w- C:\games
2009-07-27 12:52 . 2009-07-27 12:52 -------- d-----w- c:\program files\GTA Vice City CZ
2009-07-27 12:37 . 2009-07-30 18:22 -------- d-----w- c:\program files\Rockstar Games
2009-07-25 10:45 . 2009-07-25 10:45 -------- d-----w- c:\program files\QIP
2009-07-19 14:15 . 2009-07-19 14:15 -------- d-----w- c:\program files\Sun
2009-07-19 14:14 . 2009-07-19 14:14 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-07-19 14:12 . 2009-07-19 14:14 -------- d-----w- c:\program files\Java
2009-07-19 13:57 . 2009-07-19 13:58 -------- d-----w- c:\program files\VertrigoServ
2009-07-16 20:12 . 2009-07-16 20:12 -------- d-----w- c:\program files\Common Files\INCA Shared
2009-07-15 07:56 . 2009-06-15 15:24 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-07-15 07:56 . 2009-06-15 15:20 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-15 07:56 . 2009-06-15 15:20 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-15 07:56 . 2009-06-15 12:52 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-07-14 13:14 . 2009-07-14 13:14 -------- d-----w- c:\program files\TOU
2009-07-14 12:28 . 2009-07-14 12:28 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2009-07-14 12:27 . 2009-07-14 12:28 -------- d-----w- c:\program files\DivX
2009-07-14 12:27 . 2009-07-14 12:27 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-07-11 06:26 . 2009-07-11 06:26 538 ----a-w- c:\windows\eReg.dat
2009-07-11 06:23 . 2009-07-11 06:23 -------- d-----w- c:\program files\Crave
2009-07-11 06:20 . 2009-07-11 06:20 -------- d-----w- c:\windows\Downloaded Installations

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-03 09:13 . 2009-05-14 17:05 -------- d-----w- c:\program files\Eset
2009-08-02 16:59 . 2009-05-13 08:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-30 20:00 . 2009-07-27 18:15 -------- d-----w- c:\program files\Cheat Engine
2009-07-30 17:09 . 2007-01-08 21:10 607532 ----a-w- c:\windows\system32\perfh005.dat
2009-07-30 17:09 . 2007-01-08 21:10 119966 ----a-w- c:\windows\system32\perfc005.dat
2009-07-27 12:36 . 2009-05-15 16:53 -------- d-----w- c:\program files\Common Files\InstallShield
2009-07-21 21:52 . 2009-07-29 07:58 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-29 07:58 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-29 07:58 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-29 07:58 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-15 15:31 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-07-14 12:28 . 2009-05-14 12:58 -------- d-----w- c:\program files\Google
2009-07-11 06:47 . 2009-06-25 15:55 -------- d-----w- c:\program files\Game_Maker6
2009-07-11 06:46 . 2009-05-24 18:52 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-27 06:39 . 2009-06-27 06:39 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-06-26 23:04 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Calendar
2009-06-26 23:04 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Sidebar
2009-06-26 23:04 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Photo Gallery
2009-06-26 23:04 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Collaboration
2009-06-26 23:04 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Defender
2009-06-26 23:01 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-06-26 22:46 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2009-06-26 22:45 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll
2009-06-25 16:16 . 2009-06-25 16:16 -------- d-----w- c:\program files\Game_Maker7
2009-06-08 05:35 . 2009-06-08 05:35 -------- d-----w- c:\program files\Ventrilo
2009-06-08 05:35 . 2009-06-08 05:35 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-05-29 19:33 . 2009-05-29 19:33 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-05-24 10:30 . 2009-05-24 10:30 56 ---ha-w- c:\programdata\ezsidmv.dat
2009-05-19 16:02 . 2009-05-19 16:02 360192 ----a-w- c:\windows\system32\TuneUpDefragService.exe
2009-05-19 15:10 . 2009-05-19 15:10 603904 ----a-w- c:\windows\system32\TUProgSt.exe
2009-05-18 16:47 . 2009-05-18 16:47 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-05-15 21:57 . 2009-05-15 21:57 269312 ----a-w- c:\windows\system32\es.dll
2009-05-15 05:31 . 2009-05-15 05:31 1808896 ----a-w- c:\windows\system32\NlsLexicons0046.dll
2009-05-15 05:31 . 2009-05-15 05:31 1793536 ----a-w- c:\windows\system32\NlsLexicons0045.dll
2009-05-15 05:31 . 2009-05-15 05:31 1558016 ----a-w- c:\windows\system32\NlsLexicons0049.dll
2009-05-15 05:31 . 2009-05-15 05:31 1411072 ----a-w- c:\windows\system32\NlsLexicons0047.dll
2009-05-15 05:31 . 2009-05-15 05:31 1236992 ----a-w- c:\windows\system32\NlsLexicons0020.dll
2009-05-15 05:31 . 2009-05-15 05:31 2136064 ----a-w- c:\windows\system32\NlsLexicons0021.dll
2009-05-15 05:31 . 2009-05-15 05:31 1782272 ----a-w- c:\windows\system32\NlsLexicons0039.dll
2009-05-15 05:31 . 2009-05-15 05:31 5499904 ----a-w- c:\windows\system32\NlsLexicons0022.dll
2009-05-15 05:31 . 2009-05-15 05:31 7964672 ----a-w- c:\windows\system32\NlsLexicons0024.dll
2009-05-15 05:31 . 2009-05-15 05:31 5791232 ----a-w- c:\windows\system32\NlsLexicons0026.dll
2009-05-15 05:31 . 2009-05-15 05:30 6224896 ----a-w- c:\windows\system32\NlsLexicons0027.dll
2009-05-15 01:44 . 2009-05-15 01:44 61440 ----a-w- c:\windows\system32\winipsec.dll
2009-05-15 01:44 . 2009-05-15 01:44 361984 ----a-w- c:\windows\system32\IPSECSVC.DLL
2009-05-15 01:44 . 2009-05-15 01:44 28672 ----a-w- c:\windows\system32\FwRemoteSvr.dll
2009-05-15 01:44 . 2009-05-15 01:44 272896 ----a-w- c:\windows\system32\polstore.dll
2009-05-15 01:43 . 2009-05-15 01:43 94720 ----a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2009-05-15 01:43 . 2009-05-15 01:43 241152 ----a-w- c:\windows\system32\PortableDeviceApi.dll
2009-05-15 01:43 . 2009-05-15 01:43 160768 ----a-w- c:\windows\system32\PortableDeviceTypes.dll
2009-05-15 01:37 . 2009-05-15 01:37 376832 ----a-w- c:\windows\system32\winhttp.dll
2009-05-15 01:36 . 2009-05-15 01:36 296960 ----a-w- c:\windows\system32\gdi32.dll
2009-05-15 01:34 . 2009-05-15 01:34 212480 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2009-05-15 01:33 . 2009-05-15 01:33 562176 ----a-w- c:\windows\system32\msdtcprx.dll
2009-05-15 01:33 . 2009-05-15 01:33 38912 ----a-w- c:\windows\system32\xolehlp.dll
2009-05-15 01:32 . 2009-05-15 01:32 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-05-15 01:32 . 2009-05-15 01:32 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-05-15 01:32 . 2009-05-15 01:32 1695744 ----a-w- c:\windows\system32\gameux.dll
2009-05-15 01:31 . 2009-05-15 01:31 303616 ----a-w- c:\windows\system32\wmpeffects.dll
2009-05-15 01:30 . 2009-05-15 01:30 2048 ----a-w- c:\windows\system32\msxml3r.dll
2009-05-15 01:30 . 2009-05-15 01:30 1191936 ----a-w- c:\windows\system32\msxml3.dll
2009-05-15 01:27 . 2009-05-15 01:27 2048 ----a-w- c:\windows\system32\tzres.dll
2009-05-15 01:25 . 2009-05-15 01:25 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-05-15 01:25 . 2009-05-15 01:25 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-05-15 01:25 . 2009-05-15 01:25 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-05-15 01:21 . 2009-05-15 01:21 2927104 ----a-w- c:\windows\explorer.exe
2009-05-15 01:17 . 2009-05-15 01:17 6656 ----a-w- c:\windows\system32\kbd106n.dll
2009-05-15 01:17 . 2009-05-15 01:17 988216 ----a-w- c:\windows\system32\winload.exe
2009-05-15 01:17 . 2009-05-15 01:17 927288 ----a-w- c:\windows\system32\winresume.exe
2009-05-15 01:16 . 2009-05-15 01:16 40960 ----a-w- c:\windows\system32\srclient.dll
2009-05-15 01:16 . 2009-05-15 01:16 378368 ----a-w- c:\windows\system32\srcore.dll
2009-05-15 01:16 . 2009-05-15 01:16 318464 ----a-w- c:\windows\system32\rstrui.exe
2009-05-15 01:16 . 2009-05-15 01:16 19000 ----a-w- c:\windows\system32\kd1394.dll
2009-05-15 01:16 . 2009-05-15 01:16 14848 ----a-w- c:\windows\system32\srdelayed.exe
2009-05-15 01:16 . 2009-05-15 01:16 46592 ----a-w- c:\windows\system32\setbcdlocale.dll
2009-05-15 01:16 . 2009-05-15 01:16 615992 ----a-w- c:\windows\system32\ci.dll
2009-05-15 01:13 . 2009-05-15 01:13 9728 ----a-w- c:\windows\system32\lsass.exe
2009-05-15 01:13 . 2009-05-15 01:13 72704 ----a-w- c:\windows\system32\secur32.dll
2009-05-15 01:13 . 2009-05-15 01:13 441400 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-05-15 01:13 . 2009-05-15 01:13 1255936 ----a-w- c:\windows\system32\lsasrv.dll
2009-05-15 01:13 . 2009-05-15 01:13 24064 ----a-w- c:\windows\system32\amxread.dll
2009-05-15 01:13 . 2009-05-15 01:13 13824 ----a-w- c:\windows\system32\apilogen.dll
2009-05-15 01:12 . 2009-05-15 01:12 425472 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
2009-05-15 01:12 . 2009-05-15 01:12 712704 ----a-w- c:\windows\system32\WindowsCodecs.dll
2009-05-15 01:12 . 2009-05-15 01:12 347136 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2009-05-15 01:11 . 2009-05-15 01:11 443392 ----a-w- c:\windows\system32\win32spl.dll
2009-05-15 01:11 . 2009-05-15 01:11 37888 ----a-w- c:\windows\system32\printcom.dll
2009-05-15 01:11 . 2009-05-15 01:11 14848 ----a-w- c:\windows\system32\wshrm.dll
2009-05-15 01:11 . 2009-05-15 01:11 113664 ----a-w- c:\windows\system32\drivers\rmcast.sys
2009-05-15 01:09 . 2009-05-15 01:09 288768 ----a-w- c:\windows\system32\drivers\srv.sys
2009-05-15 01:08 . 2009-05-15 01:08 268288 ----a-w- c:\windows\system32\schannel.dll
2009-05-15 01:08 . 2009-05-15 01:08 98816 ----a-w- c:\windows\system32\mfps.dll
2009-05-15 01:08 . 2009-05-15 01:08 53248 ----a-w- c:\windows\system32\rrinstaller.exe
2009-05-15 01:08 . 2009-05-15 01:08 2868736 ----a-w- c:\windows\system32\mf.dll
2009-05-15 01:08 . 2009-05-15 01:08 24576 ----a-w- c:\windows\system32\mfpmp.exe
2009-05-15 01:08 . 2009-05-15 01:08 2048 ----a-w- c:\windows\system32\mferror.dll
2009-05-15 01:08 . 2009-05-15 01:08 996352 ----a-w- c:\windows\system32\WMNetMgr.dll
2009-05-15 01:08 . 2009-05-15 01:08 94720 ----a-w- c:\windows\system32\logagent.exe
2009-05-15 01:06 . 2009-05-15 01:06 84480 ----a-w- c:\windows\system32\INETRES.dll
2009-05-15 01:06 . 2009-05-15 01:06 738304 ----a-w- c:\windows\system32\inetcomm.dll
2009-08-04 21:05 . 2009-05-14 13:20 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-15 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-05-22 166424]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-05-14 949376]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-05-22 133656]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-05-22 141848]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-02-21 1183744]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WindowsWelcomeCenter"=rundll32.exe oobefldr.dll,ShowWelcomeCenter
"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
"Sidebar"=c:\program files\Windows Sidebar\sidebar.exe /autoRun

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SoundMAXPnP"=c:\program files\Analog Devices\Core\smax4pnp.exe
"Windows Defender"=%ProgramFiles%\Windows Defender\MSASCui.exe -hide
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{109608F3-231B-4AF9-8F1D-52ED4B404D54}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{3F001EC6-AF54-4003-B78B-F49C44DB1E29}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{C403913C-85EE-4500-87D2-1726CE9F9D18}c:\\program files\\icq6.5\\icq.exe"= UDP:c:\program files\icq6.5\icq.exe:ICQ
"UDP Query User{41764B7E-EECE-4F4B-B6FF-7496C21FACBD}c:\\program files\\icq6.5\\icq.exe"= TCP:c:\program files\icq6.5\icq.exe:ICQ
"TCP Query User{C5B9EFDE-6980-497C-BBB9-9592B546C3FF}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
"UDP Query User{5EA5796C-3D30-49D5-AFC0-EADCDC5D9A2C}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent
"TCP Query User{FA7845A1-F025-44F0-A3AE-FDE66945C61F}c:\\program files\\icq6.5\\icq.exe"= UDP:c:\program files\icq6.5\icq.exe:ICQ
"UDP Query User{1BE623CC-D160-4F4A-8739-0356DE077A81}c:\\program files\\icq6.5\\icq.exe"= TCP:c:\program files\icq6.5\icq.exe:ICQ
"{CE3345F3-F152-4FAF-96CB-800BC9F53FE3}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{2B07FFAD-00F0-402A-86A9-DD9994FB2C63}c:\\program files\\vertrigoserv\\apache\\bin\\v_apache.exe"= UDP:c:\program files\vertrigoserv\apache\bin\v_apache.exe:Apache HTTP Server
"UDP Query User{33653A45-2C75-4A7D-B3F4-F99644C875DB}c:\\program files\\vertrigoserv\\apache\\bin\\v_apache.exe"= TCP:c:\program files\vertrigoserv\apache\bin\v_apache.exe:Apache HTTP Server
"TCP Query User{9311B57F-D605-43F5-9C81-D527E757124E}c:\\program files\\vertrigoserv\\mysql\\bin\\v_mysqld.exe"= UDP:c:\program files\vertrigoserv\mysql\bin\v_mysqld.exe:v_mysqld
"UDP Query User{BDAD5F09-8814-4B83-B90D-2F71F3F8E656}c:\\program files\\vertrigoserv\\mysql\\bin\\v_mysqld.exe"= TCP:c:\program files\vertrigoserv\mysql\bin\v_mysqld.exe:v_mysqld
"{28220B6F-3944-4C12-ADDA-011AFEC509DC}"= UDP:c:\program files\GamersFirst\War Rock\WRLauncher.exe:War Rock
"{52E839F0-D201-4E40-9ED8-E473EAFB8547}"= TCP:c:\program files\GamersFirst\War Rock\WRLauncher.exe:War Rock
"{7ADFDDEC-E835-4B36-98AA-248901CFE00F}"= UDP:c:\program files\Internet Explorer\iexplore.exe:Internet Explorer
"{75F7A00B-C32B-49FB-9F3D-1C4342C1D43A}"= TCP:c:\program files\Internet Explorer\iexplore.exe:Internet Explorer
"TCP Query User{E7F47C6A-6AF7-4C61-8AE9-6D9B3798A443}c:\\users\\vojťass\\desktop\\chmatakov15.exe"= UDP:c:\users\vojťass\desktop\chmatakov15.exe:chmatakov15.exe
"UDP Query User{2CB922F7-9DF2-4528-9448-38060BABB2CE}c:\\users\\vojťass\\desktop\\chmatakov15.exe"= TCP:c:\users\vojťass\desktop\chmatakov15.exe:chmatakov15.exe
"TCP Query User{A7D2C091-4014-43B4-B9AB-48188839F5DE}c:\\users\\vojťass\\desktop\\chmatakov15.exe"= UDP:c:\users\vojťass\desktop\chmatakov15.exe:chmatakov15.exe
"UDP Query User{03FF0076-95E9-42FD-99BC-EE182B460CB7}c:\\users\\vojťass\\desktop\\chmatakov15.exe"= TCP:c:\users\vojťass\desktop\chmatakov15.exe:chmatakov15.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 0 (0x0)

R1 nod32drv;nod32drv;c:\windows\System32\drivers\nod32drv.sys [14.5.2009 19:06 15424]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [19.5.2009 17:10 603904]
S2 gupdate1ca047e7384c01a;Služba Google Update (gupdate1ca047e7384c01a);c:\program files\Google\Update\GoogleUpdate.exe [14.7.2009 14:27 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Obsah adresáře 'Naplánované úlohy'

2009-08-04 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 19:36]

2009-08-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-14 12:27]

2009-08-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-14 12:27]
.
.
------- Doplňkový sken -------
.
LSP: c:\windows\system32\imon.dll
FF - ProfilePath - c:\users\Vojťass\AppData\Roaming\Mozilla\Firefox\Profiles\l0eg6363.default\
FF - prefs.js: browser.startup.homepage - http://www.google.cz" onclick="window.open(this.href);return false;
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- NASTAVENÍ FIREFOXU ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net" onclick="window.open(this.href);return false;
Rootkit scan 2009-08-04 23:38
Windows 6.0.6001 Service Pack 1 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MySQL]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 5.1\bin\mysqld\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.1\my.ini\" MySQL"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Celkový čas: 2009-08-04 23:41
ComboFix-quarantined-files.txt 2009-08-04 21:41

Před spuštěním: Volných bajtů: 53 467 705 344
Po spuštění: Volných bajtů: 53 674 393 600

279 --- E O F --- 2009-07-31 11:03

Re: Prosim o Kontrolu

Napsal: 05 srp 2009 17:21
od jaro3
Vypni si ochrany antiviru a defenderu (štít)
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE

Kód: Vybrat vše

File::
c:\windows\system32\libmysql_c.dll
c:\windows\eReg.dat
c:\programdata\ezsidmv.dat

RegNull::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Toto otestuj na Virustotal
c:\programdata\TuneUp Software\TuneUp Utilities\WinStyler\LogoAnimations\Bubbles.tla.dll
Vlož sem pak odkaz výsledku.
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz