Internet jede ale tak napul.

[Damned]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

File::
C:\WINDOWS\SET8.tmp
C:\WINDOWS\SET4.tmp
C:\WINDOWS\SET3.tmp
C:\pmtimer.exe
C:\mute.exe
C:\makePNF.exe
C:\DSPdsblr.exe
C:\DPsFnshr.ini
C:\DPsFnshr.exe
C:\devcon.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys
E:\INSTALL\GMSIPCI.SYS
E:\install4\MSICPL.sys
E:\NTACCESS.sys
E:\NTGLM7X.sys


Folder::
c:\documents and settings\Administrator\Application Data\BSplayer
C:\Program Files\Webteh
D:\Program Files\VentriloMIX

DirLook::
C:\D

Driver::
catchme;catchme
catchme
GMSIPCI;GMSIPCI
GMSIPCI
MSICPL;MSICPL
MSICPL
NTACCESS;NTACCESS
NTACCESS
SetupNTGLM7X;SetupNTGLM7X
SetupNTGLM7X

Registry::
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"=-
"NoDrives"=-
"NoSMConfigurePrograms"=-
"NoResolveSearch"=-
"MemCheckBoxInRunDlg"=-
"NoSharedDocuments"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"MemCheckBoxInRunDlg"=-
"StartMenuFavorites"=-
"Start_ShowMyComputer"=-
"Start_ShowMyDocs"=-
"Start_ShowMyMusic"=-
"Start_ShowRun"=-
"Start_ShowSearch"=-
"NoDriveAutoRun"=dword:03ffffff
"NoDriveTypeAutoRun"=dword:0000015f
"NoDrives"=dword:00000000
"LinkResolveIgnoreLinkInfo"=dword:00000000
"NoResolveSearch"=dword:00000001
"HonorAutoRunSetting"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=dword:00000000
"DisableCAD"=-
"DisableStatusMessages"=-
"DisableRegistryTools"=dword:00000000
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DhcpNameServer]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{758cd463-497d-4e8b-94c2-508262794d3c}\DhcpNameServer]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DhcpNameServer]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{758cd463-497d-4e8b-94c2-508262794d3c}\DhcpNameServer]




Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT a popiš chování počítače

[Reklama]

[Cerb]

Ten log se tu cely nevleze tak jsem to dal do .txt souboru a uploadnul zde.A uz muzu naistalovat ventrilo na nem poznam jestli to uz funguje.

[Damned]

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Windows Registry Editor Version 5.00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"=-
"NoResolveTrack"=-
"NoSMConfigurePrograms"=-
"MemCheckBoxInRunDlg"=-

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000


Ulož si ho jako na Plochu jako fix.reg a jako typ všechny soubory , najdi tento soubor na Ploše a poklepáním ho spusť. Budeš dotázán na přidání hodnoty do registru. Schval.
*****************************************************************************************************************************************
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok).
Zkopíruj do něj následující celý text označený zeleně:

RegNull::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]



Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.


Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe
a když se oba soubory překryjí, skript upusť.


- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu. Zkus tedy ten Ventrillo, pokud ale není šmejd v něm.

[Cerb]

ComboFix 09-08-07.04 - Administrator 07.08.2009 22:28.5.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.723 [GMT 1:00]
Running from: c:\documents and settings\Administrator\My Documents\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
.

((((((((((((((((((((((((( Files Created from 2009-07-07 to 2009-08-07 )))))))))))))))))))))))))))))))
.

2009-08-07 20:12 . 2009-02-05 20:06 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-08-07 20:12 . 2009-02-05 20:06 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-08-07 20:12 . 2009-02-05 20:05 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-08-07 20:12 . 2009-02-05 20:08 93296 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-08-07 20:12 . 2009-02-05 20:08 94032 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-08-07 20:12 . 2009-02-05 20:07 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-08-07 20:12 . 2009-02-05 20:07 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-08-07 20:12 . 2009-02-05 20:04 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-08-07 20:11 . 2009-02-05 20:11 1256296 ----a-w- c:\windows\system32\aswBoot.exe
2009-08-07 20:11 . 2003-03-18 19:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2009-08-07 20:11 . 2003-03-18 18:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2009-08-07 20:11 . 2003-02-21 02:42 348160 ----a-w- c:\windows\system32\MSVCR71.dll
2009-08-07 19:03 . 2009-08-07 19:03 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2009-08-07 18:22 . 2009-08-07 18:22 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Opera
2009-08-07 18:20 . 2009-08-07 18:20 0 ----a-w- c:\windows\nsreg.dat
2009-08-07 18:20 . 2009-08-07 18:20 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-08-07 18:09 . 2009-08-07 20:15 -------- d-----w- c:\program files\trend micro
2009-08-07 16:51 . 2009-08-07 16:51 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Google
2009-08-07 16:51 . 2009-08-07 16:51 -------- d-----w- c:\program files\Google
2009-08-07 16:51 . 2009-08-07 16:51 1962544 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2009-08-07 16:51 . 2009-08-07 16:51 1886320 ----a-w- c:\documents and settings\All Users.WINDOWS\Application Data\NOS\Adobe_Downloads\GoogleToolbarInstaller_en_signed.exe
2009-08-07 16:51 . 2009-08-07 17:20 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\NOS
2009-08-07 16:51 . 2009-08-07 17:07 -------- d-----w- c:\program files\NOS
2009-08-07 16:39 . 2009-08-07 16:39 -------- d-----w- c:\windows\system32\xircom
2009-08-07 16:39 . 2009-08-07 16:39 -------- d-----w- c:\windows\system32\wbem\snmp
2009-08-07 16:39 . 2009-08-07 16:39 -------- d-----w- c:\program files\microsoft frontpage
2009-08-07 16:34 . 2001-08-17 13:59 3072 ----a-w- c:\windows\system32\drivers\audstub.sys
2009-08-07 16:34 . 2008-03-21 01:36 21504 ----a-w- c:\windows\system32\hidserv.dll
2009-08-07 16:33 . 2008-03-20 19:33 57600 ----a-w- c:\windows\system32\drivers\redbook.sys
2009-08-07 16:32 . 2008-03-21 01:36 74240 ----a-w- c:\windows\system32\usbui.dll
2009-08-07 16:30 . 2009-08-07 16:30 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-08-07 16:30 . 2009-08-03 12:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-07 16:30 . 2009-08-07 16:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-07 16:30 . 2009-08-07 16:30 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-08-07 16:30 . 2009-08-03 12:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-07 16:28 . 2006-06-19 03:37 36864 ----a-w- c:\windows\system32\drivers\AmdK8.sys
2009-08-07 16:27 . 2009-08-07 16:27 -------- d-----w- C:\D
2009-08-07 16:27 . 2009-08-07 16:26 -------- d--h--w- c:\documents and settings\Default User.WINDOWS
2009-08-07 16:27 . 2009-08-07 15:38 -------- d-----w- c:\documents and settings\All Users.WINDOWS
2009-08-07 16:20 . 2009-08-07 16:20 -------- d-----w- c:\documents and settings\Administrator\Application Data\Ventrilo
2009-08-07 16:18 . 2009-08-07 16:18 -------- d-----w- c:\windows\system32\Lang
2009-08-07 16:16 . 2008-01-03 14:10 105856 ----a-r- c:\windows\system32\drivers\Rtenicxp.sys
2009-08-07 16:13 . 2008-04-10 08:52 16861184 ------r- c:\windows\RTHDCPL.exe
2009-08-07 16:13 . 2007-06-28 08:44 2165760 ------r- c:\windows\MicCal.exe
2009-08-07 16:13 . 2005-05-03 10:43 69632 ------r- c:\windows\Alcmtr.exe
2009-08-07 16:13 . 2006-05-04 08:26 2808832 ------r- c:\windows\alcwzrd.exe
2009-08-07 16:13 . 2009-08-07 16:13 -------- d-----w- c:\program files\Realtek
2009-08-07 16:12 . 2009-08-07 16:12 315392 ----a-w- c:\windows\HideWin.exe
2009-08-07 16:12 . 2008-03-05 10:07 520192 ------r- c:\windows\RtlExUpd.dll
2009-08-07 16:12 . 2009-08-07 16:12 -------- dc----w- c:\windows\system32\DRVSTORE
2009-08-07 16:12 . 2009-08-07 16:12 -------- d-----w- c:\program files\AMD
2009-08-07 16:11 . 2009-08-07 16:11 -------- d-----w- c:\documents and settings\Administrator\Application Data\InstallShield
2009-08-07 16:11 . 2008-01-10 06:30 442368 ----a-r- c:\windows\system32\nvusmb.exe
2009-08-07 16:11 . 2008-03-06 15:23 442368 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-08-07 16:05 . 2009-08-07 20:13 -------- d-sh--w- c:\windows\Installer
2009-08-07 16:05 . 2009-08-07 18:58 -------- d-----r- C:\Program Files
2009-08-07 16:03 . 2009-08-07 21:28 -------- d-----w- c:\windows\system32\CatRoot2
2009-08-07 16:03 . 2009-08-07 16:03 -------- d-----w- c:\windows\system32\CatRoot
2009-08-07 16:02 . 2009-08-07 16:29 -------- d--h--w- c:\documents and settings\Default User
2009-08-07 16:02 . 2009-08-07 16:04 -------- d-----w- c:\documents and settings\All Users
2009-08-07 16:02 . 2009-08-07 15:40 -------- d-----w- C:\Documents and Settings

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-07 16:13 . 2009-08-07 15:45 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-07 16:12 . 2009-08-07 15:45 -------- d-----w- c:\program files\Common Files\InstallShield
2009-08-07 15:46 . 2009-08-07 15:46 0 ----a-w- c:\windows\ativpsrm.bin
2009-08-07 15:38 . 2009-08-07 15:38 8738 ----a-w- c:\windows\pchealth\helpctr\Config\Cntstore.bin
2009-08-07 15:38 . 2009-08-07 15:38 2112 ----a-w- c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
2009-08-07 15:38 . 2009-08-07 15:38 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-08-07 15:36 . 2009-08-07 15:36 21640 ----a-w- c:\windows\system32\emptyregdb.dat
.

------- Sigcheck -------

[-] 2008-05-03 12:00 361344 37D8387CBD4437C55F454209BE10EF11 c:\windows\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [8/7/2009 9:12 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [8/7/2009 9:12 PM 20560]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-07 22:29
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(712)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-08-07 22:30
ComboFix-quarantined-files.txt 2009-08-07 21:30

Pre-Run: 23 361 040 384 bytes free
Post-Run: 23 350 296 576 bytes free

140


Combofix na me vybaflo update coz jsem u zadneho programu po dobu toho viru nemohl vypada to ze je to uz vporadku? Jeste jsem nic nezkousel.

[Damned]

Zkus to a napiš

[Cerb]

Nepomohlo internet zas prestal fungovat tak restart a je to tu zas
A jedine co jsem udelal je ze jsme z officialnich stranek nainstaloval Firefox.
Malwarebytes' Anti-Malware 1.40
Database version: 2551
Windows 5.1.2600 Service Pack 3

7.8.2009 23:32:49
mbam-log-2009-08-07 (23-32-44).txt

Scan type: Quick Scan
Objects scanned: 88478
Time elapsed: 1 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 6
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.224 85.255.112.64 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{758cd463-497d-4e8b-94c2-508262794d3c}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.224 85.255.112.64 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.224 85.255.112.64 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{758cd463-497d-4e8b-94c2-508262794d3c}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.224 85.255.112.64 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.224 85.255.112.64 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{758cd463-497d-4e8b-94c2-508262794d3c}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.224 85.255.112.64 -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[Damned]

Toto 85.255.112.224 85.255.112.64 je Ukrajina.

MbAMem to smaž, restartuj a po restartu znova dej skenovat MbAMem.

Pak: Stáhni si Security Check by screen317 nebo Security Check by screen317 a ulož si ho na Plochu.
Dvojklikem ho spusť a následuj instrukce v černém okně. Po skončení se vytvoří soubor checkup.txt. Ten mi sem zkopíruj

[Cerb]

Takze jsem to udelal 2x jednou jak si mi rikal odstranil jsem to MBAM a uz dopredu jsme mel stahnuty ten security check ten jsem spustil takze v te dobe jsem ten trojan nemel pak jsem restartoval a udelal security check znova takze mam dva logy jeden v dobe kdy ten trojan nemam a druhy jak ho mam.

Tenhle je jak ho asi nemam

Results of screen317's Security Check version 0.98.7
Windows XP Service Pack 3
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Antivirus


WMIC entry does not exist for antivirus; attempting automatic update.
``````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
HijackThis 2.0.2
Adobe Flash Player 10
``````````````````````````````
Process Check:
objlist.exe by Laurent
Alwil Software Avast4 aswUpdSv.exe


``````````````````````````````
DNS Vulnerability Check:

`````````End of Log```````````

A tenhle jak ho mam kontroloval jsem to MBAM

Results of screen317's Security Check version 0.98.7
Windows XP Service Pack 3
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Antivirus


WMIC entry does not exist for antivirus; attempting automatic update.
``````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
HijackThis 2.0.2
Adobe Flash Player 10
``````````````````````````````
Process Check:
objlist.exe by Laurent
Alwil Software Avast4 aswUpdSv.exe


``````````````````````````````
DNS Vulnerability Check:
GREAT! (Very random)

`````````End of Log```````````

[Damned]

Spusť ještě jednou ten RSIT a vlož mi sem z něho log.

[Cerb]

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2009-08-08 01:19:52
Microsoft Windows XP Professional Service Pack 3
System drive C: has 22 GB (85%) free of 25 GB
Total RAM: 1023 MB (74% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:19:53, on 8.8.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5508)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Administrator\My Documents\Stažené soubory\RSIT.exe
C:\Program Files\trend micro\HijackThis\Administrator.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 1524 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-02-26 126976]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=
"NoResolveSearch"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 3 months======

2009-08-08 01:19:52 ----D---- C:\rsit
2009-08-07 22:39:48 ----D---- C:\Documents and Settings\Administrator\Application Data\Mozilla
2009-08-07 22:30:05 ----D---- C:\WINDOWS\temp
2009-08-07 22:30:04 ----A---- C:\ComboFix.txt
2009-08-07 22:27:59 ----A---- C:\WINDOWS\zip.exe
2009-08-07 22:27:59 ----A---- C:\WINDOWS\SWXCACLS.exe
2009-08-07 22:27:59 ----A---- C:\WINDOWS\SWSC.exe
2009-08-07 22:27:59 ----A---- C:\WINDOWS\SWREG.exe
2009-08-07 22:27:59 ----A---- C:\WINDOWS\sed.exe
2009-08-07 22:27:59 ----A---- C:\WINDOWS\PEV.exe
2009-08-07 22:27:59 ----A---- C:\WINDOWS\NIRCMD.exe
2009-08-07 22:27:59 ----A---- C:\WINDOWS\grep.exe
2009-08-07 22:27:18 ----D---- C:\WINDOWS\ERDNT
2009-08-07 22:27:16 ----D---- C:\Qoobox
2009-08-07 21:13:05 ----D---- C:\WINDOWS\system32\appmgmt
2009-08-07 21:11:51 ----A---- C:\WINDOWS\system32\MSVCR71.dll
2009-08-07 21:11:51 ----A---- C:\WINDOWS\system32\MSVCP71.dll
2009-08-07 21:11:51 ----A---- C:\WINDOWS\system32\MFC71.dll
2009-08-07 21:11:51 ----A---- C:\WINDOWS\system32\aswBoot.exe
2009-08-07 20:03:53 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2009-08-07 19:22:28 ----D---- C:\Documents and Settings\Administrator\Application Data\Opera
2009-08-07 19:09:25 ----D---- C:\Program Files\trend micro
2009-08-07 18:03:41 ----A---- C:\WINDOWS\ntbtlog.txt
2009-08-07 17:51:40 ----D---- C:\Documents and Settings\Administrator\Application Data\Macromedia
2009-08-07 17:51:38 ----D---- C:\Documents and Settings\Administrator\Application Data\Google
2009-08-07 17:51:38 ----D---- C:\Documents and Settings\Administrator\Application Data\Adobe
2009-08-07 17:51:31 ----D---- C:\Program Files\Google
2009-08-07 17:51:31 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Google
2009-08-07 17:51:21 ----D---- C:\Program Files\NOS
2009-08-07 17:51:21 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\NOS
2009-08-07 17:39:24 ----D---- C:\WINDOWS\system32\xircom
2009-08-07 17:39:24 ----D---- C:\Program Files\xerox
2009-08-07 17:39:24 ----D---- C:\Program Files\microsoft frontpage
2009-08-07 17:34:27 ----A---- C:\WINDOWS\system32\h323log.txt
2009-08-07 17:34:09 ----A---- C:\WINDOWS\system32\hidserv.dll
2009-08-07 17:32:58 ----A---- C:\WINDOWS\system32\usbui.dll
2009-08-07 17:31:45 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-08-07 17:31:44 ----A---- C:\WINDOWS\ODBCINST.INI
2009-08-07 17:31:40 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2009-08-07 17:31:40 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2009-08-07 17:31:40 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2009-08-07 17:31:38 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2009-08-07 17:31:38 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2009-08-07 17:31:38 ----RA---- C:\WINDOWS\system32\kbdur.dll
2009-08-07 17:31:38 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2009-08-07 17:31:38 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2009-08-07 17:31:38 ----RA---- C:\WINDOWS\system32\kbdru.dll
2009-08-07 17:31:38 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2009-08-07 17:31:38 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2009-08-07 17:31:38 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2009-08-07 17:31:38 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2009-08-07 17:31:38 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2009-08-07 17:31:38 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2009-08-07 17:31:36 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2009-08-07 17:31:36 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2009-08-07 17:31:36 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2009-08-07 17:31:36 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2009-08-07 17:31:36 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2009-08-07 17:31:36 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2009-08-07 17:31:36 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2009-08-07 17:31:35 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2009-08-07 17:31:35 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2009-08-07 17:31:35 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2009-08-07 17:31:35 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2009-08-07 17:31:35 ----RA---- C:\WINDOWS\system32\kbdest.dll
2009-08-07 17:31:33 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2009-08-07 17:31:33 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2009-08-07 17:31:33 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2009-08-07 17:31:33 ----RA---- C:\WINDOWS\system32\kbdro.dll
2009-08-07 17:31:33 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2009-08-07 17:31:33 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2009-08-07 17:31:33 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2009-08-07 17:31:33 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2009-08-07 17:31:33 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2009-08-07 17:31:33 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2009-08-07 17:31:33 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2009-08-07 17:31:33 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2009-08-07 17:31:33 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2009-08-07 17:31:29 ----A---- C:\WINDOWS\system32\irclass.dll
2009-08-07 17:31:28 ----A---- C:\WINDOWS\system32\spxcoins.dll
2009-08-07 17:31:28 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2009-08-07 17:31:28 ----A---- C:\WINDOWS\system32\dgsetup.dll
2009-08-07 17:31:28 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2009-08-07 17:31:26 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2009-08-07 17:31:26 ----A---- C:\WINDOWS\TASKMAN.EXE
2009-08-07 17:31:26 ----A---- C:\WINDOWS\system32\batt.dll
2009-08-07 17:31:25 ----A---- C:\WINDOWS\NOTEPAD.EXE
2009-08-07 17:31:22 ----A---- C:\WINDOWS\system32\storprop.dll
2009-08-07 17:31:15 ----ASH---- C:\Documents and Settings\All Users.WINDOWS\Application Data\desktop.ini
2009-08-07 17:30:20 ----D---- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2009-08-07 17:30:16 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-08-07 17:30:16 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-08-07 17:29:15 ----SD---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft
2009-08-07 17:28:13 ----A---- C:\WINDOWS\setuplog.txt
2009-08-07 17:27:40 ----A---- C:\DriverPack_MassStorage_wnt5_x86-32.ini
2009-08-07 17:27:40 ----A---- C:\DriverPack_CPU_wnt5_x86-32.ini
2009-08-07 17:27:39 ----D---- C:\D
2009-08-07 17:27:36 ----A---- C:\Boot.bak
2009-08-07 17:27:35 ----RASHD---- C:\cmdcons
2009-08-07 17:20:34 ----D---- C:\Documents and Settings\Administrator\Application Data\Ventrilo
2009-08-07 17:18:16 ----D---- C:\WINDOWS\system32\Lang
2009-08-07 17:14:32 ----R---- C:\WINDOWS\system32\ChCfg.exe
2009-08-07 17:14:16 ----D---- C:\WINDOWS\system32\RTCOM
2009-08-07 17:14:15 ----A---- C:\WINDOWS\system32\ksuser.dll
2009-08-07 17:14:11 ----R---- C:\WINDOWS\SoundMan.exe
2009-08-07 17:14:10 ----R---- C:\WINDOWS\SkyTel.exe
2009-08-07 17:14:08 ----R---- C:\WINDOWS\RtlUpd.exe
2009-08-07 17:14:03 ----R---- C:\WINDOWS\RTLCPL.exe
2009-08-07 17:13:50 ----R---- C:\WINDOWS\RTHDCPL.exe
2009-08-07 17:13:49 ----R---- C:\WINDOWS\MicCal.exe
2009-08-07 17:13:46 ----R---- C:\WINDOWS\Alcmtr.exe
2009-08-07 17:13:44 ----R---- C:\WINDOWS\alcwzrd.exe
2009-08-07 17:13:43 ----D---- C:\Program Files\Realtek
2009-08-07 17:12:42 ----R---- C:\WINDOWS\RtlExUpd.dll
2009-08-07 17:12:42 ----A---- C:\WINDOWS\HideWin.exe
2009-08-07 17:12:24 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-08-07 17:12:21 ----D---- C:\Program Files\AMD
2009-08-07 17:11:40 ----D---- C:\Documents and Settings\Administrator\Application Data\InstallShield
2009-08-07 17:11:16 ----RA---- C:\WINDOWS\system32\nvusmb.exe
2009-08-07 17:11:15 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-08-07 17:11:09 ----A---- C:\WINDOWS\system32\NVUNINST.EXE
2009-08-07 17:05:31 ----SHD---- C:\WINDOWS\Installer
2009-08-07 17:05:30 ----D---- C:\Program Files\Common Files\ODBC
2009-08-07 17:05:27 ----D---- C:\Program Files\Common Files\SpeechEngines
2009-08-07 17:05:26 ----RD---- C:\Program Files
2009-08-07 17:05:26 ----D---- C:\Program Files\Common Files\Microsoft Shared
2009-08-07 17:05:26 ----D---- C:\Program Files\Common Files
2009-08-07 17:03:03 ----D---- C:\WINDOWS\system32\CatRoot2
2009-08-07 17:03:03 ----D---- C:\WINDOWS\system32\CatRoot
2009-08-07 17:02:37 ----SHD---- C:\System Volume Information
2009-08-07 17:02:37 ----D---- C:\Documents and Settings
2009-08-07 17:01:43 ----RASH---- C:\boot.ini
2009-08-07 16:57:26 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-08-07 16:57:26 ----RSD---- C:\WINDOWS\Fonts
2009-08-07 16:57:26 ----RD---- C:\WINDOWS\Web
2009-08-07 16:57:26 ----RD---- C:\WINDOWS\Offline Web Pages
2009-08-07 16:57:26 ----HD---- C:\WINDOWS\inf
2009-08-07 16:57:26 ----D---- C:\WINDOWS\WinSxS
2009-08-07 16:57:26 ----D---- C:\WINDOWS\WBEM
2009-08-07 16:57:26 ----D---- C:\WINDOWS\twain_32
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\wins
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\wbem
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\usmt
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\spool
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\ShellExt
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\Setup
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\scripting
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\ras
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\oobe
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\npp
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\mui
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\inetsrv
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\IME
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\icsxml
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\ias
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\export
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\en-US
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\en
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\drivers
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\dhcp
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\config
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\3com_dmi
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\3076
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\2052
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\1054
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\1042
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\1041
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\1037
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\1033
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\1031
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\1028
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32\1025
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system32
2009-08-07 16:57:26 ----D---- C:\WINDOWS\system
2009-08-07 16:57:26 ----D---- C:\WINDOWS\security
2009-08-07 16:57:26 ----D---- C:\WINDOWS\Resources
2009-08-07 16:57:26 ----D---- C:\WINDOWS\repair
2009-08-07 16:57:26 ----D---- C:\WINDOWS\Provisioning
2009-08-07 16:57:26 ----D---- C:\WINDOWS\pchealth
2009-08-07 16:57:26 ----D---- C:\WINDOWS\PeerNet
2009-08-07 16:57:26 ----D---- C:\WINDOWS\Network Diagnostic
2009-08-07 16:57:26 ----D---- C:\WINDOWS\mui
2009-08-07 16:57:26 ----D---- C:\WINDOWS\msapps
2009-08-07 16:57:26 ----D---- C:\WINDOWS\msagent
2009-08-07 16:57:26 ----D---- C:\WINDOWS\Media
2009-08-07 16:57:26 ----D---- C:\WINDOWS\L2Schemas
2009-08-07 16:57:26 ----D---- C:\WINDOWS\java
2009-08-07 16:57:26 ----D---- C:\WINDOWS\ime
2009-08-07 16:57:26 ----D---- C:\WINDOWS\Help
2009-08-07 16:57:26 ----D---- C:\WINDOWS\ehome
2009-08-07 16:57:26 ----D---- C:\WINDOWS\Driver Cache
2009-08-07 16:57:26 ----D---- C:\WINDOWS\Debug
2009-08-07 16:57:26 ----D---- C:\WINDOWS\Cursors
2009-08-07 16:57:26 ----D---- C:\WINDOWS\Connection Wizard
2009-08-07 16:57:26 ----D---- C:\WINDOWS\Config
2009-08-07 16:57:26 ----D---- C:\WINDOWS\AppPatch
2009-08-07 16:57:26 ----D---- C:\WINDOWS\addins
2009-08-07 16:57:26 ----D---- C:\WINDOWS
2009-08-07 16:45:24 ----N---- C:\WINDOWS\system32\ati2sgag.exe
2009-08-07 16:45:15 ----HD---- C:\Program Files\InstallShield Installation Information
2009-08-07 16:45:07 ----D---- C:\Program Files\Common Files\InstallShield
2009-08-07 16:45:04 ----D---- C:\ATI
2009-08-07 16:40:59 ----D---- C:\Documents and Settings\Administrator\Application Data\Identities
2009-08-07 16:40:58 ----HD---- C:\Program Files\Uninstall Information
2009-08-07 16:40:47 ----SD---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2009-08-07 16:40:47 ----ASH---- C:\Documents and Settings\Administrator\Application Data\desktop.ini
2009-08-07 16:40:44 ----D---- C:\WINDOWS\SoftwareDistribution
2009-08-07 16:40:43 ----D---- C:\WINDOWS\Prefetch
2009-08-07 16:40:42 ----SD---- C:\WINDOWS\system32\Microsoft
2009-08-07 16:40:42 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-08-07 16:39:22 ----A---- C:\WINDOWS\control.ini
2009-08-07 16:39:13 ----A---- C:\WINDOWS\OEWABLog.txt
2009-08-07 16:39:09 ----D---- C:\WINDOWS\system32\dllcache
2009-08-07 16:39:09 ----A---- C:\WINDOWS\system32\mapi32.dll
2009-08-07 16:38:23 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2009-08-07 16:38:17 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-08-07 16:38:14 ----HD---- C:\Program Files\WindowsUpdate
2009-08-07 16:37:55 ----D---- C:\WINDOWS\system32\DirectX
2009-08-07 16:37:50 ----A---- C:\WINDOWS\system32\atrace.dll
2009-08-07 16:37:48 ----A---- C:\WINDOWS\system32\desktop.ini
2009-08-07 16:37:48 ----A---- C:\WINDOWS\desktop.ini
2009-08-07 16:37:42 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2009-08-07 16:37:41 ----A---- C:\WINDOWS\system32\acctres.dll
2009-08-07 16:37:40 ----D---- C:\Program Files\Common Files\Services
2009-08-07 16:37:38 ----SD---- C:\WINDOWS\Tasks
2009-08-07 16:37:38 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2009-08-07 16:37:37 ----D---- C:\Program Files\Common Files\MSSoap
2009-08-07 16:37:33 ----D---- C:\WINDOWS\system32\Macromed
2009-08-07 16:37:33 ----D---- C:\WINDOWS\srchasst
2009-08-07 16:37:30 ----A---- C:\WINDOWS\system32\wuweb.dll
2009-08-07 16:37:30 ----A---- C:\WINDOWS\system32\wups.dll
2009-08-07 16:37:30 ----A---- C:\WINDOWS\system32\wucltui.dll
2009-08-07 16:37:30 ----A---- C:\WINDOWS\system32\wuauserv.dll
2009-08-07 16:37:30 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2009-08-07 16:37:30 ----A---- C:\WINDOWS\system32\wuaueng.dll
2009-08-07 16:37:30 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2009-08-07 16:37:30 ----A---- C:\WINDOWS\system32\wuauclt.exe
2009-08-07 16:37:30 ----A---- C:\WINDOWS\system32\wuapi.dll
2009-08-07 16:37:30 ----A---- C:\WINDOWS\system32\bitsprx4.dll
2009-08-07 16:37:29 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2009-08-07 16:37:29 ----A---- C:\WINDOWS\system32\qmgr.dll
2009-08-07 16:37:29 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2009-08-07 16:37:29 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2009-08-07 16:37:26 ----D---- C:\Program Files\Movie Maker
2009-08-07 16:37:10 ----A---- C:\WINDOWS\system32\safrslv.dll
2009-08-07 16:37:10 ----A---- C:\WINDOWS\system32\safrdm.dll
2009-08-07 16:37:10 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2009-08-07 16:37:09 ----A---- C:\WINDOWS\system32\racpldlg.dll
2009-08-07 16:37:07 ----A---- C:\WINDOWS\system32\fltMc.exe
2009-08-07 16:37:07 ----A---- C:\WINDOWS\system32\fltlib.dll
2009-08-07 16:37:06 ----D---- C:\WINDOWS\system32\Restore
2009-08-07 16:37:06 ----A---- C:\WINDOWS\system32\srsvc.dll
2009-08-07 16:37:06 ----A---- C:\WINDOWS\system32\srrstr.dll
2009-08-07 16:37:06 ----A---- C:\WINDOWS\system32\srclient.dll
2009-08-07 16:37:05 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2009-08-07 16:37:05 ----A---- C:\WINDOWS\system32\msconf.dll
2009-08-07 16:37:05 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2009-08-07 16:37:05 ----A---- C:\WINDOWS\system32\mnmdd.dll
2009-08-07 16:37:05 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2009-08-07 16:37:05 ----A---- C:\WINDOWS\system32\ils.dll
2009-08-07 16:37:03 ----D---- C:\Program Files\NetMeeting
2009-08-07 16:37:02 ----A---- C:\WINDOWS\system32\msoert2.dll
2009-08-07 16:37:02 ----A---- C:\WINDOWS\system32\msoeacct.dll
2009-08-07 16:37:02 ----A---- C:\WINDOWS\system32\inetres.dll
2009-08-07 16:37:01 ----A---- C:\WINDOWS\system32\inetcomm.dll
2009-08-07 16:37:00 ----D---- C:\Program Files\Outlook Express
2009-08-07 16:37:00 ----A---- C:\WINDOWS\system32\schedsvc.dll
2009-08-07 16:37:00 ----A---- C:\WINDOWS\system32\mstinit.exe
2009-08-07 16:37:00 ----A---- C:\WINDOWS\system32\mstask.dll
2009-08-07 16:36:59 ----A---- C:\WINDOWS\system32\isign32.dll
2009-08-07 16:36:59 ----A---- C:\WINDOWS\system32\inetcfg.dll
2009-08-07 16:36:59 ----A---- C:\WINDOWS\system32\icwphbk.dll
2009-08-07 16:36:59 ----A---- C:\WINDOWS\system32\icwdial.dll
2009-08-07 16:36:54 ----D---- C:\Program Files\Common Files\System
2009-08-07 16:36:53 ----D---- C:\Program Files\Internet Explorer
2009-08-07 16:36:23 ----D---- C:\Program Files\ComPlus Applications
2009-08-07 16:36:21 ----A---- C:\WINDOWS\vbaddin.ini
2009-08-07 16:36:21 ----A---- C:\WINDOWS\vb.ini
2009-08-07 16:36:17 ----D---- C:\WINDOWS\Registration
2009-08-07 16:36:10 ----D---- C:\Program Files\Windows Media Player
2009-08-07 16:36:10 ----D---- C:\Program Files\Online Services
2009-08-07 16:36:04 ----D---- C:\Program Files\Messenger
2009-08-07 16:36:01 ----D---- C:\Program Files\MSN Gaming Zone
2009-08-07 16:36:01 ----A---- C:\WINDOWS\system32\write.exe
2009-08-07 16:35:52 ----A---- C:\WINDOWS\system32\sndvol32.exe
2009-08-07 16:35:52 ----A---- C:\WINDOWS\system32\hticons.dll
2009-08-07 16:35:52 ----A---- C:\WINDOWS\system32\avwav.dll
2009-08-07 16:35:52 ----A---- C:\WINDOWS\system32\avtapi.dll
2009-08-07 16:35:52 ----A---- C:\WINDOWS\system32\avmeter.dll
2009-08-07 16:35:51 ----A---- C:\WINDOWS\system32\winchat.exe
2009-08-07 16:35:45 ----A---- C:\WINDOWS\system32\charmap.exe
2009-08-07 16:35:45 ----A---- C:\WINDOWS\system32\getuname.dll
2009-08-07 16:35:45 ----A---- C:\WINDOWS\system32\calc.exe
2009-08-07 16:35:44 ----A---- C:\WINDOWS\system32\winmine.exe
2009-08-07 16:35:44 ----A---- C:\WINDOWS\system32\sol.exe
2009-08-07 16:35:44 ----A---- C:\WINDOWS\system32\reset.exe
2009-08-07 16:35:44 ----A---- C:\WINDOWS\system32\mshearts.exe
2009-08-07 16:35:44 ----A---- C:\WINDOWS\system32\freecell.exe
2009-08-07 16:35:43 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2009-08-07 16:35:43 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2009-08-07 16:35:43 ----A---- C:\WINDOWS\system32\tslabels.ini
2009-08-07 16:35:43 ----A---- C:\WINDOWS\system32\tskill.exe
2009-08-07 16:35:43 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2009-08-07 16:35:43 ----A---- C:\WINDOWS\system32\tscon.exe
2009-08-07 16:35:43 ----A---- C:\WINDOWS\system32\shadow.exe
2009-08-07 16:35:43 ----A---- C:\WINDOWS\system32\rwinsta.exe
2009-08-07 16:35:43 ----A---- C:\WINDOWS\system32\regini.exe
2009-08-07 16:35:43 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2009-08-07 16:35:43 ----A---- C:\WINDOWS\system32\qwinsta.exe
2009-08-07 16:35:43 ----A---- C:\WINDOWS\system32\qappsrv.exe
2009-08-07 16:35:43 ----A---- C:\WINDOWS\system32\msg.exe
2009-08-07 16:35:42 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2009-08-07 16:35:42 ----A---- C:\WINDOWS\system32\logoff.exe
2009-08-07 16:35:42 ----A---- C:\WINDOWS\system32\cdmodem.dll
2009-08-07 16:35:37 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2009-08-07 16:35:27 ----D---- C:\Program Files\MSN
2009-08-07 16:35:27 ----A---- C:\WINDOWS\system32\sndrec32.exe
2009-08-07 16:35:27 ----A---- C:\WINDOWS\system32\accwiz.exe
2009-08-07 16:35:26 ----D---- C:\Program Files\Windows NT
2009-08-07 16:35:26 ----A---- C:\WINDOWS\system32\mspaint.exe
2009-08-07 16:35:26 ----A---- C:\WINDOWS\system32\mplay32.exe
2009-08-07 16:35:26 ----A---- C:\WINDOWS\system32\hypertrm.dll
2009-08-07 16:35:26 ----A---- C:\WINDOWS\system32\clipbrd.exe
2009-08-07 16:35:25 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2009-08-07 16:35:25 ----A---- C:\WINDOWS\system32\spider.exe
2009-08-07 16:35:24 ----A---- C:\WINDOWS\system32\tsgqec.dll
2009-08-07 16:35:24 ----A---- C:\WINDOWS\system32\rhttpaa.dll
2009-08-07 16:35:24 ----A---- C:\WINDOWS\system32\mstscax.dll
2009-08-07 16:35:24 ----A---- C:\WINDOWS\system32\mstsc.exe
2009-08-07 16:35:24 ----A---- C:\WINDOWS\system32\aaclient.dll
2009-08-07 16:35:23 ----A---- C:\WINDOWS\system32\termsrv.dll
2009-08-07 16:35:23 ----A---- C:\WINDOWS\system32\sessmgr.exe
2009-08-07 16:35:23 ----A---- C:\WINDOWS\system32\remotepg.dll
2009-08-07 16:35:23 ----A---- C:\WINDOWS\system32\rdshost.exe
2009-08-07 16:35:23 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2009-08-07 16:35:23 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2009-08-07 16:35:23 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2009-08-07 16:35:23 ----A---- C:\WINDOWS\system32\rdpclip.exe
2009-08-07 16:35:23 ----A---- C:\WINDOWS\system32\rdchost.dll
2009-08-07 16:35:23 ----A---- C:\WINDOWS\system32\qprocess.exe
2009-08-07 16:35:23 ----A---- C:\WINDOWS\system32\icaapi.dll
2009-08-07 16:35:22 ----D---- C:\WINDOWS\system32\MsDtc
2009-08-07 16:35:22 ----A---- C:\WINDOWS\system32\xolehlp.dll
2009-08-07 16:35:22 ----A---- C:\WINDOWS\system32\mtxoci.dll
2009-08-07 16:35:22 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2009-08-07 16:35:22 ----A---- C:\WINDOWS\system32\msdtctm.dll
2009-08-07 16:35:22 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2009-08-07 16:35:22 ----A---- C:\WINDOWS\system32\msdtclog.dll
2009-08-07 16:35:22 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2009-08-07 16:35:21 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2009-08-07 16:35:21 ----A---- C:\WINDOWS\system32\mtxex.dll
2009-08-07 16:35:21 ----A---- C:\WINDOWS\system32\mtxdm.dll
2009-08-07 16:35:21 ----A---- C:\WINDOWS\system32\msdtc.exe
2009-08-07 16:35:21 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2009-08-07 16:35:20 ----D---- C:\WINDOWS\system32\Com
2009-08-07 16:35:20 ----A---- C:\WINDOWS\system32\stclient.dll
2009-08-07 16:35:20 ----A---- C:\WINDOWS\system32\comrepl.dll
2009-08-07 16:35:20 ----A---- C:\WINDOWS\system32\comaddin.dll
2009-08-07 16:35:20 ----A---- C:\WINDOWS\system32\colbact.dll
2009-08-07 16:35:20 ----A---- C:\WINDOWS\system32\clbcatex.dll
2009-08-07 16:35:20 ----A---- C:\WINDOWS\system32\catsrvut.dll
2009-08-07 16:35:20 ----A---- C:\WINDOWS\system32\catsrvps.dll
2009-08-07 16:35:20 ----A---- C:\WINDOWS\system32\catsrv.dll
2009-08-07 16:35:19 ----A---- C:\WINDOWS\system32\comuid.dll
2009-08-07 16:35:19 ----A---- C:\WINDOWS\system32\comsvcs.dll
2009-08-07 16:35:19 ----A---- C:\WINDOWS\system32\comsnap.dll
2009-08-07 16:35:19 ----A---- C:\WINDOWS\system32\clbcatq.dll
2009-08-07 16:35:14 ----A---- C:\WINDOWS\system32\servdeps.dll
2009-08-07 16:35:13 ----A---- C:\WINDOWS\system32\mmfutil.dll
2009-08-07 16:35:13 ----A---- C:\WINDOWS\system32\licwmi.dll
2009-08-07 16:35:13 ----A---- C:\WINDOWS\system32\cmprops.dll

======List of files/folders modified in the last 3 months======

2009-08-07 22:29:32 ----A---- C:\WINDOWS\system.ini
2009-08-07 16:39:21 ----A---- C:\WINDOWS\win.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-02-05 26944]
R1 AmdK8;AMD Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-06-19 36864]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-02-05 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-02-05 51376]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-05-03 14592]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-02-05 94032]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-02-26 2863616]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-05-03 144384]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-05-03 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-04-17 4707328]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2008-05-03 12160]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-01-03 105856]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-05-03 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-05-03 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-05-03 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-05-03 17152]
S3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-02-05 23152]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-02-05 18752]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-02-26 520192]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-08-07 182768]
S4 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2008-02-25 593920]
S4 avast! Antivirus;avast! Antivirus; D:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-02-05 138680]
S4 avast! Mail Scanner;avast! Mail Scanner; D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-02-05 254040]
S4 avast! Web Scanner;avast! Web Scanner; D:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-02-05 352920]

-----------------EOF-----------------

[Damned]

Start--> > Spustit a do řádku vlož celý tento řádek:

Kód: Vybrat vše

regedit /e "c:\regla.txt" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DhcpNameServer"

Klikni na OK.
V "C:\" se ti objeví texťák "regla.txt", zkopíruj mi ho sem.
*****************************************************************************************************************************************
Start--> > Spustit a do řádku vlož celý tento řádek:

Kód: Vybrat vše

regedit /e "c:\regl.txt" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{758cd463-497d-4e8b-94c2-508262794d3c}\DhcpNameServer"

Klikni na OK.
V "C:\" se ti objeví texťák "regl.txt", zkopíruj mi ho sem.
*****************************************************************************************************************************************
Stáhni si :Dr. Web CureIt
dej update , po aktualizaci dej start (úplný sken).
Tlačítky dole můzeš soubor léčit, smazat, přesunout nebo přejmenovat.
Potom mi sem dej log, co vyléčil a co smazal.

[Cerb]

Zadny soubor mi to nevytvori zkousel jsem i ten text po nakopirovani kontrolovat jestli tam nejsou nejake mezery ktere tam nemaji byt nebo tak nic ten soubor se nevytvori zkousel jsem ho i hledat.A ten program mi nejde stahnout zkousel jsme ho hledat ale vsechno to je zas jen odkaz na tu stejnou stranku ktere mi nefunguje.