Prosim o kontrolu logu - svchost odesila spam

Problematika virů a antivirů, zabezpečení PC - firewall, spyware, atd.
Odpovědět
romandude
Nováček
Nováček
Registrován: 01. led 2008

Prosim o kontrolu logu - svchost odesila spam

Příspěvek od romandude »

Snazil jsem se tento problem vyresit jiz vsemimoznymi zpusoby, ale porad se mi to nedari. Pocitac mi odesila mnozstvi mailu, jedna se o proces svchost.

Log z aplikace ComboFix:

Kód: Vybrat vše

ComboFix 07-12-31.4 - Administrator 2008-01-01 18:40:49.1 - NTFSx86 MINIMAL
Systém Microsoft Windows XP Professional  5.1.2600.2.1250.1.1033.18.354 [GMT 1:00]
Running from: c:\Downloads\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CnsMin.zip
C:\Program Files\akl
C:\Program Files\akl\akl.dll
C:\Program Files\akl\akl.exe
C:\Program Files\akl\curlog.htm
C:\Program Files\akl\keylog.txt
C:\Program Files\akl\readme.txt
C:\Program Files\akl\uninstall.exe
C:\Program Files\akl\unsetup.dat
C:\Program Files\akl\unsetup.exe
C:\Program Files\amsys
C:\Program Files\amsys\awmsg.dat
C:\Program Files\amsys\mfc42.dll
C:\Program Files\amsys\msvcrt.dll
C:\Program Files\amsys\unins000.dat
C:\Program Files\amsys\unis000.exe
C:\Program Files\amsys\winam.dat
C:\Program Files\e-zshopper
C:\Program Files\e-zshopper\BarLcher.dll
C:\Program Files\p2pnetworks
C:\Program Files\p2pnetworks\amp2pl.exe
C:\WINDOWS\absolute key logger.lnk
C:\WINDOWS\aconti.exe
C:\WINDOWS\acontidialer.txt
C:\WINDOWS\adbar.dll
C:\WINDOWS\cbinst$.exe
C:\WINDOWS\daxtime.dll
C:\WINDOWS\dp0.dll
C:\WINDOWS\flt.dll
C:\WINDOWS\regedit.com
C:\WINDOWS\system32\8_exception.nls
C:\WINDOWS\system32\acespy
C:\WINDOWS\system32\acespy\__acelog.ndx
C:\WINDOWS\system32\acespy\systune.exe
C:\WINDOWS\system32\din.ip
C:\WINDOWS\system32\dpqaqlqx.bin
C:\WINDOWS\system32\drivers\smtpdrv.sys
C:\WINDOWS\system32\ESHOPEE.exe
C:\WINDOWS\system32\koos.exe
C:\WINDOWS\system32\kprof
C:\WINDOWS\system32\lt.res
C:\WINDOWS\system32\poof
C:\WINDOWS\system32\stfv.bin
C:\WINDOWS\system32\sznf.ascii
C:\WINDOWS\system32\taskmgr.com
C:\WINDOWS\system32\winsys.exe
C:\WINDOWS\vxddsk.exe
C:\WINDOWS\wml.exe

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_KPROF
-------\LEGACY_NDISWON
-------\LEGACY_POOF
-------\LEGACY_SMTPDRV
-------\NdisWon
-------\smtpdrv


(((((((((((((((((((((((((   Files Created from 2007-12-01 to 2008-01-01  )))))))))))))))))))))))))))))))
.

2008-01-01 18:45 . 2008-01-01 18:45	0	--a------	C:\WINDOWS\system32\6_exception.nls
2008-01-01 18:40 . 2000-08-31 08:00	51,200	--a------	C:\WINDOWS\NirCmd.exe
2008-01-01 18:38 . 2008-01-01 18:38	1,484,544	--a------	C:\ComboFix.exe
2008-01-01 17:53 . 2007-01-18 13:00	3,968	--a------	C:\WINDOWS\system32\drivers\AvgArCln.sys
2008-01-01 17:29 . 2008-01-01 17:29	<DIR>	d--------	C:\Program Files\PPedia Task Manager
2008-01-01 16:57 . 2008-01-01 16:57	<DIR>	d--------	C:\Program Files\Alwil Software
2008-01-01 16:57 . 2007-12-04 14:04	837,496	--a------	C:\WINDOWS\system32\aswBoot.exe
2008-01-01 16:57 . 2004-01-09 10:13	380,928	--a------	C:\WINDOWS\system32\actskin4.ocx
2008-01-01 16:57 . 2007-12-04 13:54	95,608	--a------	C:\WINDOWS\system32\AvastSS.scr
2008-01-01 16:57 . 2007-12-04 15:55	94,544	--a------	C:\WINDOWS\system32\drivers\aswmon2.sys
2008-01-01 16:57 . 2007-12-04 15:56	93,264	--a------	C:\WINDOWS\system32\drivers\aswmon.sys
2008-01-01 16:57 . 2007-12-04 15:51	42,912	--a------	C:\WINDOWS\system32\drivers\aswTdi.sys
2008-01-01 16:57 . 2007-12-04 15:49	26,624	--a------	C:\WINDOWS\system32\drivers\aavmker4.sys
2008-01-01 16:57 . 2007-12-04 15:53	23,152	--a------	C:\WINDOWS\system32\drivers\aswRdr.sys
2008-01-01 16:14 . 2008-01-01 17:34	<DIR>	d--------	C:\WINDOWS\system32\ActiveScan
2008-01-01 16:14 . 2008-01-01 16:19	30,590	--a------	C:\WINDOWS\system32\pavas.ico
2008-01-01 16:14 . 2008-01-01 16:19	2,550	--a------	C:\WINDOWS\system32\Uninstall.ico
2008-01-01 16:14 . 2008-01-01 16:19	1,406	--a------	C:\WINDOWS\system32\Help.ico
2008-01-01 14:54 . 2008-01-01 14:54	<DIR>	d--------	C:\Documents and Settings\Administrator\Application Data\Grisoft
2008-01-01 14:54 . 2007-05-30 13:10	10,872	--a------	C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-01 14:45 . 2008-01-01 16:03	<DIR>	d--------	C:\Documents and Settings\Administrator\Application Data\AVG7
2008-01-01 14:44 . 2008-01-01 14:44	<DIR>	d--------	C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-01 14:43 . 2008-01-01 14:54	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-01 14:43 . 2008-01-01 14:52	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\avg7
2008-01-01 14:10 . 2008-01-01 16:40	<DIR>	d--------	C:\Program Files\totalcmd
2008-01-01 14:10 . 2008-01-01 18:43	2,295	--a------	C:\WINDOWS\wincmd.ini
2008-01-01 14:10 . 2007-09-14 07:02	545	--a------	C:\WINDOWS\UC.PIF
2008-01-01 14:10 . 2007-09-14 07:02	545	--a------	C:\WINDOWS\RAR.PIF
2008-01-01 14:10 . 2007-09-14 07:02	545	--a------	C:\WINDOWS\PKZIP.PIF
2008-01-01 14:10 . 2007-09-14 07:02	545	--a------	C:\WINDOWS\PKUNZIP.PIF
2008-01-01 14:10 . 2007-09-14 07:02	545	--a------	C:\WINDOWS\NOCLOSE.PIF
2008-01-01 14:10 . 2007-09-14 07:02	545	--a------	C:\WINDOWS\LHA.PIF
2008-01-01 14:10 . 2007-09-14 07:02	545	--a------	C:\WINDOWS\ARJ.PIF
2008-01-01 14:10 . 2008-01-01 15:55	0	--a------	C:\23990098.$$$
2008-01-01 14:07 . 2008-01-01 14:07	<DIR>	d-a------	C:\WINDOWS\zts2.exe
2008-01-01 14:07 . 2008-01-01 14:07	<DIR>	d-a------	C:\WINDOWS\system32\vcmgcd32.dll
2008-01-01 14:07 . 2008-01-01 14:07	<DIR>	d-a------	C:\WINDOWS\system32\iifgfgf.dll
2008-01-01 14:07 . 2008-01-01 14:07	<DIR>	d-a------	C:\WINDOWS\rundll16.exe
2008-01-01 14:07 . 2008-01-01 14:07	<DIR>	d-a------	C:\WINDOWS\rundl132.dll
2008-01-01 14:07 . 2008-01-01 14:07	<DIR>	d-a------	C:\WINDOWS\logo1_.exe
2008-01-01 14:05 . 2004-08-10 13:00	146,432	--a------	C:\WINDOWS\R.COM
2008-01-01 14:05 . 2004-08-10 13:00	135,680	--a------	C:\WINDOWS\system32\T.COM
2008-01-01 14:05 . 2008-01-01 16:04	50	--a------	C:\WINDOWS\Lic.xxx
2008-01-01 13:57 . 2008-01-01 13:57	<DIR>	d--------	C:\Program Files\Lavasoft
2008-01-01 13:57 . 2008-01-01 13:57	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-01 13:00 . 2008-01-01 13:50	633	--a------	C:\WINDOWS\wininit.ini
2008-01-01 12:28 . 2008-01-01 13:57	<DIR>	d--------	C:\Program Files\Common Files\Wise Installation Wizard
2008-01-01 11:32 . 2008-01-01 11:32	<DIR>	d--------	C:\Program Files\CCleaner
2008-01-01 11:29 . 2008-01-01 12:21	<DIR>	d--------	C:\WINDOWS\SxsCaPendDel
2007-12-30 23:17 . 2008-01-01 11:50	21,760	--a------	C:\WINDOWS\Mud43.sys
2007-12-30 23:01 . 2007-12-30 23:01	<DIR>	d--------	C:\Documents and Settings\LocalService\Application Data\ICQ Toolbar
2007-12-30 23:01 . 2007-12-30 23:01	21,760	--a------	C:\WINDOWS\system32\drivers\Mud43.sys
2007-12-30 23:00 . 2007-12-30 23:00	69,632	--a------	C:\WINDOWS\system32\csrssw.dll
2007-12-30 22:49 . 2007-12-30 22:49	4	--a------	C:\WINDOWS\system32\jpewocmz.ini
2007-12-30 10:29 . 2008-01-01 10:54	5,614	--a------	C:\WINDOWS\system32\sft.res
2007-12-23 19:46 . 2007-12-23 19:49	<DIR>	d--------	C:\Program Files\FlatOut2
2007-12-10 20:40 . 2007-12-22 17:08	54,156	--ah-----	C:\WINDOWS\QTFont.qfn
2007-12-10 20:40 . 2007-12-10 20:40	1,409	--a------	C:\WINDOWS\QTFont.for
2007-12-03 20:30 . 2007-12-03 20:30	2,560	--a------	C:\WINDOWS\system32\bitcometres.dll
2007-12-02 16:20 . 2007-07-30 19:18	34,136	--a------	C:\WINDOWS\system32\wucltui.dll.mui
2007-12-02 16:20 . 2007-07-30 19:19	25,944	--a------	C:\WINDOWS\system32\wuaucpl.cpl.mui
2007-12-02 16:20 . 2007-07-30 19:19	25,944	--a------	C:\WINDOWS\system32\wuapi.dll.mui
2007-12-02 16:20 . 2007-07-30 19:18	20,312	--a------	C:\WINDOWS\system32\wuaueng.dll.mui

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
8205-11-25 11:26	---------	d-----w	C:\Program Files\CyberLink
8205-11-25 11:26	---------	d-----w	C:\Documents and Settings\All Users\Application Data\CyberLink
8205-11-25 10:42	---------	d-----w	C:\Program Files\Realtek AC97
8205-11-25 10:30	---------	d-----w	C:\Program Files\Windows XP MUI Pack
8205-11-25 10:10	---------	d-----w	C:\Program Files\CONEXANT
8205-11-25 09:58	---------	d-----w	C:\Program Files\microsoft frontpage
8205-11-25 09:50	---------	d-----w	C:\Program Files\Windows Plus
2099-11-25 12:41	---------	d-----w	C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-01-01 17:37	---------	d-----w	C:\Program Files\ICQToolbar
2008-01-01 15:40	---------	d-----w	C:\Program Files\Winamp
2008-01-01 15:36	---------	d-----w	C:\Program Files\Google
2008-01-01 15:34	---------	d-----w	C:\Program Files\BitComet
2008-01-01 14:21	---------	d-----w	C:\Program Files\Java
2008-01-01 13:15	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-01 10:09	---------	d-----w	C:\Program Files\Virtools Web Player 2.5
2007-12-30 16:37	---------	d-----w	C:\Program Files\WinTV
2007-12-27 21:44	---------	d-----w	C:\Documents and Settings\Administrator\Application Data\uTorrent
2007-12-14 17:13	19,264	----a-w	C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
2007-11-14 20:11	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Skype
2005-03-31 21:17	40,960	----a-w	C:\Program Files\Uninstall_CDS.exe
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 13:00 15360]
"BitComet"="C:\Program Files\BitComet\BitComet.exe" [2007-11-07 16:06 1881400]
"ICQ"="C:\Program Files\ICQ6\ICQ.exe" [2007-10-11 14:43 181496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:56 64512]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 14:43 7630848]
"nwiz"="nwiz.exe" [2006-08-11 14:43 1519616 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2005-10-04 13:12 90112 C:\WINDOWS\soundman.exe]
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-07-15 01:07 32768]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 17:28 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38 241664]
"DXDllRegExe"="dxdllreg.exe" []
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2005-06-10 15:20 1397760]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"Trans"="C:\PROGRA~1\Trans\Trans.exe" [2006-10-17 12:09 4494336]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 23:22 35328]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 14:43 86016]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-01 14:43 579072]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 13:00 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-01 14:43 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 05:19:24]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 11:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Mud43.sys]
@="Driver"

R0 Mud43;Mud43;C:\WINDOWS\system32\Drivers\Mud43.sys [2007-12-30 23:01]
R1 HCW88AUD;Hauppauge WinTV 88x Audio Capture;C:\WINDOWS\system32\drivers\hcw88aud.sys [2005-05-31 14:34]
R3 HCW88BDA;Hauppauge WinTV 88x DVB Tuner/Demod;C:\WINDOWS\system32\drivers\hcw88bda.sys [2005-05-31 14:34]
R3 HCW88TSE;Hauppauge WinTV 88x MPEG/TS Capture;C:\WINDOWS\system32\drivers\hcw88tse.sys [2005-05-31 17:43]
R3 HCW88TUNE;Hauppauge WinTV 88x Tuner;C:\WINDOWS\system32\drivers\hcw88tun.sys [2005-05-31 14:34]
R3 hcw88vid;Hauppauge WinTV 88x Video;C:\WINDOWS\system32\drivers\hcw88vid.sys [2005-05-31 17:43]
R3 HCW88XBAR;Hauppauge WinTV 88x Crossbar;C:\WINDOWS\system32\drivers\HCW88BAR.sys [2005-05-31 14:34]
R3 PSched;QoS Packet Scheduler;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-10 13:00]
S3 CrystalSysInfo;CrystalSysInfo;C:\WINDOWS\system32\SysInfo.sys [2006-06-01 10:22]
S4 FFI;FFI;C:\WINDOWS\system32\svchost.exe:exm.exe []
S4 Microsoft Inet Services;Microsoft Inet Services;C:\WINDOWS\system32\_svchost.exe []

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-01 18:45:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully 
hidden files: 0 

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\FFI]
"ImagePath"="C:\WINDOWS\system32\svchost.exe:exm.exe"
.
Completion time: 2008-01-01 18:49:49 - machine was rebooted
C:\qoobox\ComboFix-quarantined-files.txt  2008-01-01 17:49:42
A tady log z HijackThis:

Kód: Vybrat vše

Logfile of HijackThis v1.99.1
Scan saved at 19:20:28, on 1.1.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\totalcmd\TOTALCMD.EXE
C:\WINDOWS\regedit.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
c:\Install\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrum.cz/
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Trans] C:\PROGRA~1\Trans\Trans.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Stáhnout odkaz s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Stáhnout všechna videa s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Stáhnout všechny odkazy s použitím BitCometu - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1196608645265
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1196608621078
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Nahoru
paul27
Začátečník
Začátečník
Registrován: 07. zář 2007
Bydliště: Praha
Kontaktovat uživatele:
Kontaktovat uživatele paul27

Příspěvek od paul27 »

přesuňte Combofix na plochu (pokud ho tam ještě nemáte) - otevřete si poznámkový blok - do něj zkopírujte text z nasledujícího okna:
File::
C:\WINDOWS\system32\vcmgcd32.dll
C:\WINDOWS\system32\iifgfgf.dll
C:\WINDOWS\logo1_.exe
C:\WINDOWS\R.COM
C:\WINDOWS\system32\T.COM
C:\WINDOWS\Lic.xxx
C:\WINDOWS\QTFont.qfn
C:\WINDOWS\QTFont.for
C:\WINDOWS\system32\jpewocmz.ini
C:\WINDOWS\system32\sft.res
C:\WINDOWS\Mud43.sys
C:\WINDOWS\system32\csrssw.dll
C:\WINDOWS\system32\6_exception.nls

Driver::
FFi
Mud43

Registry::
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\FFI]
"ImagePath"=-



text uložte jako CFScript.txt na plochu - po uložení uchopte vámi vytvořený soubor .txt levým tlačítkem myši a přesuňte jej nad ikonu ComboFixu - nad ikonou ComboFixu soubor .txt upusťte - po provedení akce se opět zobrazí okno poznámkového bloku s textem, který sem zkopírujte a nedávejte ho prosím do code (špatně se mi to čte)
Nahoru
romandude
Nováček
Nováček
Registrován: 01. led 2008

Příspěvek od romandude »

OK,zda se to jiz byt OK, dekuji mnohokrat.

ComboFix 07-12-31.4 - Administrator 2008-01-02 16:48:00.5 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.175 [GMT 1:00]
Running from: c:\Downloads\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-12-02 to 2008-01-02 )))))))))))))))))))))))))))))))
.

2008-01-01 21:23 . 2008-01-01 21:46 50 --a------ C:\WINDOWS\Lic.xxx
2008-01-01 20:17 . 2008-01-01 20:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESET
2008-01-01 20:16 . 2008-01-01 20:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2008-01-01 19:14 . 2008-01-01 19:20 60 --a------ C:\WINDOWS\wcx_ftp.ini
2008-01-01 18:40 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-01 18:38 . 2008-01-01 18:38 1,484,544 --a------ C:\ComboFix.exe
2008-01-01 17:29 . 2008-01-01 17:29 <DIR> d-------- C:\Program Files\PPedia Task Manager
2008-01-01 16:57 . 2008-01-01 16:57 <DIR> d-------- C:\Program Files\Alwil Software
2008-01-01 16:14 . 2008-01-01 17:34 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-01-01 16:14 . 2008-01-01 16:19 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-01-01 16:14 . 2008-01-01 16:19 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-01-01 16:14 . 2008-01-01 16:19 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-01-01 14:43 . 2008-01-01 20:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-01 14:10 . 2008-01-01 16:40 <DIR> d-------- C:\Program Files\totalcmd
2008-01-01 14:10 . 2008-01-02 16:47 1,970 --a------ C:\WINDOWS\wincmd.ini
2008-01-01 14:10 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\UC.PIF
2008-01-01 14:10 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\RAR.PIF
2008-01-01 14:10 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\PKZIP.PIF
2008-01-01 14:10 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2008-01-01 14:10 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2008-01-01 14:10 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\LHA.PIF
2008-01-01 14:10 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\ARJ.PIF
2008-01-01 14:10 . 2008-01-01 22:01 0 --a------ C:\23990098.$$$
2008-01-01 14:07 . 2008-01-01 14:07 <DIR> d-a------ C:\WINDOWS\zts2.exe
2008-01-01 14:07 . 2008-01-01 14:07 <DIR> d-a------ C:\WINDOWS\system32\vcmgcd32.dll
2008-01-01 14:07 . 2008-01-01 14:07 <DIR> d-a------ C:\WINDOWS\system32\iifgfgf.dll
2008-01-01 14:07 . 2008-01-01 14:07 <DIR> d-a------ C:\WINDOWS\rundll16.exe
2008-01-01 14:07 . 2008-01-01 14:07 <DIR> d-a------ C:\WINDOWS\rundl132.dll
2008-01-01 14:07 . 2008-01-01 14:07 <DIR> d-a------ C:\WINDOWS\logo1_.exe
2008-01-01 14:05 . 2004-08-10 13:00 146,432 --a------ C:\WINDOWS\R.COM
2008-01-01 14:05 . 2004-08-10 13:00 135,680 --a------ C:\WINDOWS\system32\T.COM
2008-01-01 13:57 . 2008-01-01 13:57 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-01 13:57 . 2008-01-01 13:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-01 13:00 . 2008-01-01 13:50 633 --a------ C:\WINDOWS\wininit.ini
2008-01-01 12:28 . 2008-01-01 13:57 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-01 11:32 . 2008-01-01 20:15 <DIR> d-------- C:\Program Files\CCleaner
2008-01-01 11:29 . 2008-01-01 12:21 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2007-12-30 23:04 . 2007-12-30 23:04 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\ICQ Toolbar
2007-12-30 23:01 . 2007-12-30 23:01 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\ICQ Toolbar
2007-12-23 19:46 . 2007-12-23 19:49 <DIR> d-------- C:\Program Files\FlatOut2
2007-12-03 20:30 . 2007-12-03 20:30 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll
2007-12-02 16:20 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2007-12-02 16:20 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2007-12-02 16:20 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2007-12-02 16:20 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
8205-11-25 11:26 --------- d-----w C:\Program Files\CyberLink
8205-11-25 11:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
8205-11-25 10:42 --------- d-----w C:\Program Files\Realtek AC97
8205-11-25 10:30 --------- d-----w C:\Program Files\Windows XP MUI Pack
8205-11-25 10:10 --------- d-----w C:\Program Files\CONEXANT
8205-11-25 09:58 --------- d-----w C:\Program Files\microsoft frontpage
8205-11-25 09:50 --------- d-----w C:\Program Files\Windows Plus
2099-11-25 12:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-01-01 21:10 --------- d-----w C:\Program Files\ICQToolbar
2008-01-01 15:40 --------- d-----w C:\Program Files\Winamp
2008-01-01 15:36 --------- d-----w C:\Program Files\Google
2008-01-01 15:34 --------- d-----w C:\Program Files\BitComet
2008-01-01 14:21 --------- d-----w C:\Program Files\Java
2008-01-01 13:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-01 10:09 --------- d-----w C:\Program Files\Virtools Web Player 2.5
2007-12-30 22:00 14,336 ----a-w C:\WINDOWS\system32\svchost.exe
2007-12-30 16:37 --------- d-----w C:\Program Files\WinTV
2007-12-27 21:44 --------- d-----w C:\Documents and Settings\Administrator\Application Data\uTorrent
2007-12-14 17:13 19,264 ----a-w C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
2007-11-14 20:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2005-03-31 21:17 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((( snapshot@2008-01-01_18.49.08.70 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-01 17:45:37 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-01-01 20:08:04 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-01-01 17:45:37 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-01-01 20:08:04 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-01-01 17:45:37 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-01 20:08:04 49,152 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 13:00 15360]
"BitComet"="C:\Program Files\BitComet\BitComet.exe" [2007-11-07 16:06 1881400]
"ICQ"="C:\Program Files\ICQ6\ICQ.exe" [2007-10-11 14:43 181496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:56 64512]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 14:43 7630848]
"nwiz"="nwiz.exe" [2006-08-11 14:43 1519616 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2005-10-04 13:12 90112 C:\WINDOWS\soundman.exe]
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-07-15 01:07 32768]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 17:28 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38 241664]
"DXDllRegExe"="dxdllreg.exe" []
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2005-06-10 15:20 1397760]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"Trans"="C:\PROGRA~1\Trans\Trans.exe" [2006-10-17 12:09 4494336]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 23:22 35328]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 14:43 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 13:00 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 05:19:24]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 11:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Mud43.sys]
@="Driver"

R1 HCW88AUD;Hauppauge WinTV 88x Audio Capture;C:\WINDOWS\system32\drivers\hcw88aud.sys [2005-05-31 14:34]
R3 HCW88BDA;Hauppauge WinTV 88x DVB Tuner/Demod;C:\WINDOWS\system32\drivers\hcw88bda.sys [2005-05-31 14:34]
R3 HCW88TSE;Hauppauge WinTV 88x MPEG/TS Capture;C:\WINDOWS\system32\drivers\hcw88tse.sys [2005-05-31 17:43]
R3 HCW88TUNE;Hauppauge WinTV 88x Tuner;C:\WINDOWS\system32\drivers\hcw88tun.sys [2005-05-31 14:34]
R3 hcw88vid;Hauppauge WinTV 88x Video;C:\WINDOWS\system32\drivers\hcw88vid.sys [2005-05-31 17:43]
R3 HCW88XBAR;Hauppauge WinTV 88x Crossbar;C:\WINDOWS\system32\drivers\HCW88BAR.sys [2005-05-31 14:34]
R3 PSched;QoS Packet Scheduler;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-10 13:00]
S3 CrystalSysInfo;CrystalSysInfo;C:\WINDOWS\system32\SysInfo.sys [2006-06-01 10:22]
S4 Microsoft Inet Services;Microsoft Inet Services;C:\WINDOWS\system32\_svchost.exe []

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-02 16:49:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-02 16:50:36
C:\qoobox\ComboFix-quarantined-files.txt 2008-01-02 15:50:27
C:\qoobox\ComboFix2.txt 2008-01-01 21:10:19
C:\qoobox\ComboFix3.txt 2008-01-01 20:15:29
C:\qoobox\ComboFix4.txt 2008-01-01 19:55:14
C:\qoobox\ComboFix5.txt 2008-01-01 17:49:49
Nahoru
paul27
Začátečník
Začátečník
Registrován: 07. zář 2007
Bydliště: Praha
Kontaktovat uživatele:
Kontaktovat uživatele paul27

Příspěvek od paul27 »

No log je v pořádku, ale cosi tam chybí, takže předpokládám, že to není log, který vyjel po přetažení CFScrit.txt na ikonku ComboFixu, že? No to je už jedno, hlavně, že jste to dokázal i bez mé pomoci smazat. Mějte se dobře.
Nahoru
Odpovědět

Zpět na „Viry, antiviry a bezpečnost“