sobi11 - privacy_danger

[sobi11]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:06:46, on 20.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\PROGRA~1\KYE\ERGOME~1\SyTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Common Files\YourPrivacyGuard\stm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ICQ6\ICQ.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Patrik\Plocha\HiJackThis.exe

R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ErgoMedia] C:\PROGRA~1\KYE\ERGOME~1\SyTray.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [SBI] C:\Documents and Settings\Patrik\Plocha\Patrik\install_sbd_en.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common Files\YourPrivacyGuard\stm.exe" dm=http://yourprivacyguard.com ad=http://yourprivacyguard.com sd=http://pinams.yourprivacyguard.com
O4 - HKLM\..\Run: [d8c1651b] rundll32.exe "C:\WINDOWS\system32\qgasdsek.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O4 - HKCU\..\Run: [MalwareAlarm] C:\Program Files\MalwareAlarm\MalwareAlarm.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BlueSoleil.lnk = ?
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint - Náhled - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Přidat na seznam k tisku - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint - Tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Vysokorychlostní tisk - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1A26F07F-0D60-4835-91CF-1E1766A0EC56} (WebInstall Class) - http://scanner2.malware-scan.com/setup/webinst.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 7743 bytes

[Reklama]

[fredik]

Vítej na fóru.

Stáhni si ComboFix (by sUBs) a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah

PS: příště si založ prosím tě vlastní téma, i kdyby si měl stejný problém jako se tu řeší. dík

[sobi11]

ComboFix 08-02-21 - Patrik 2008-02-21 20:17:09.1 - NTFSx86
Systém Microsoft Windows XP Professional 5.1.2600.2.1250.1.1029.18.1050 [GMT 1:00]
Running from: C:\Documents and Settings\Patrik\Plocha\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Patrik\Data aplikací\inst.exe
C:\Program Files\AntiSpywareSuite
C:\WINDOWS\system32\ahweayoh.dll
C:\WINDOWS\system32\ahweayoh.dllbox
C:\WINDOWS\system32\crtstwji.dll
C:\WINDOWS\system32\drivers\CWD55.sys
C:\WINDOWS\system32\drivers\symavc32.sys
C:\WINDOWS\system32\dyksqiaj.dll
C:\WINDOWS\system32\feeeg.ini
C:\WINDOWS\system32\feeeg.ini2
C:\WINDOWS\system32\geeef.dll
C:\WINDOWS\system32\ghvivmwi.dll
C:\WINDOWS\system32\hobxnukd.ini
C:\WINDOWS\system32\hqrxrpco.ini
C:\WINDOWS\system32\ioonrrlk.ini
C:\WINDOWS\system32\kesdsagq.ini
C:\WINDOWS\system32\klrrnooi.dll
C:\WINDOWS\system32\kpuhbfuc.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nnnoopn.dll
C:\WINDOWS\system32\qommmkh.dll
C:\WINDOWS\system32\sxjhdohs.dll
C:\WINDOWS\system32\tyfrgmlk.dll
C:\WINDOWS\system32\uepvavex.ini
C:\WINDOWS\system32\xevavpeu.dll
C:\WINDOWS\xpupdate.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_CWD55


((((((((((((((((((((((((( Files Created from 2008-01-21 to 2008-02-21 )))))))))))))))))))))))))))))))
.

2008-02-21 20:11 . 2008-02-21 20:12 <DIR> d-------- C:\Program Files\MalwareAlarm
2008-02-21 13:53 . 2004-08-17 15:16 468,713 -ra------ C:\txtsetup.sif
2008-02-21 13:53 . 2004-08-03 22:00 261,312 -ra------ C:\$LDR$
2008-02-20 18:22 . 2008-02-20 18:22 <DIR> d-------- C:\Program Files\ESET
2008-02-20 15:00 . 2008-02-20 15:00 <DIR> d-------- C:\_OTMoveIt
2008-02-19 22:51 . 2008-02-20 18:55 <DIR> d-------- C:\Program Files\Common Files\YourPrivacyGuard
2008-02-18 22:59 . 2008-02-18 23:02 <DIR> d-------- C:\Program Files\VDJ5
2008-02-18 22:59 . 2005-11-30 21:20 2,314,332 --a------ C:\WINDOWS\system32\LIBMMD.DLL
2008-02-18 22:59 . 2000-05-21 22:00 647,872 --a------ C:\WINDOWS\system32\mscomct2.ocx
2008-02-18 22:59 . 1998-06-23 22:00 609,584 --a------ C:\WINDOWS\system32\comctl32.ocx
2008-02-18 22:59 . 2001-03-13 11:49 120,320 --a------ C:\WINDOWS\system32\comdlg32.ocx
2008-02-18 22:59 . 2000-05-22 15:58 115,920 --a------ C:\WINDOWS\system32\msinet.ocx
2008-02-17 21:42 . 2008-02-17 21:42 <DIR> d-------- C:\Program Files\Gaming Mouse
2008-02-17 21:42 . 2003-12-30 10:02 49,152 --a------ C:\WINDOWS\system32\TaskKeyHook.dll
2008-02-17 21:42 . 2005-07-02 06:35 16,896 --a------ C:\WINDOWS\system32\drivers\GMFILTR.SYS
2008-02-17 21:42 . 2005-07-14 03:22 15,973 --a------ C:\WINDOWS\system32\drivers\gnsmouse.inf
2008-02-17 21:42 . 2005-07-24 19:11 15,855 --a------ C:\WINDOWS\system32\drivers\gnsmouse.cat
2008-02-17 21:42 . 2005-07-11 11:03 12,800 --a------ C:\WINDOWS\system32\drivers\gHidUsbF.sys
2008-02-17 21:42 . 2005-07-12 10:53 7,808 --a------ C:\WINDOWS\system32\drivers\gflmouhid.sys
2008-02-17 21:42 . 2005-07-20 08:44 3,490 --a------ C:\WINDOWS\system32\drivers\gHidUsbF.inf
2008-02-17 21:42 . 2008-02-20 14:08 2,958 --a------ C:\WINDOWS\system32\mouseconfig.inf
2008-02-17 10:10 . 2004-10-07 13:39 89,088 --a------ C:\WINDOWS\system32\atl71.dll
2008-02-17 10:10 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-02-16 16:26 . 2008-02-16 16:26 <DIR> d-------- C:\Program Files\Electronic Arts
2008-02-16 15:07 . 2008-02-16 15:08 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-02-16 14:48 . 2008-02-16 14:57 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-02-16 14:35 . 2008-02-16 14:37 25,787,976 --a------ C:\Program Files\wmp11-windowsxp-x86-CS-CZ.exe
2008-02-16 14:19 . 2008-02-16 14:19 473,632 --a------ C:\Program Files\OGAPluginInstall.exe
2008-02-15 15:12 . 2008-02-15 15:12 881,192 --a------ C:\Program Files\WGAPluginInstall.exe
2008-02-15 14:37 . 2008-02-15 14:38 <DIR> d-------- C:\Program Files\GamePark
2008-02-15 14:30 . 2008-01-16 13:07 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-02-15 14:17 . 2008-02-19 18:42 319 --a------ C:\WINDOWS\game.ini
2008-02-15 14:11 . 2008-02-19 18:48 <DIR> d-------- C:\Program Files\Activision
2008-02-15 14:09 . 2008-02-15 14:09 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-02-14 23:25 . 2008-02-14 23:25 <DIR> d--hs---- C:\Documents and Settings\Patrik\UserData
2008-02-14 22:39 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-14 22:39 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-02-14 20:43 . 2008-02-15 14:35 1,469 --a------ C:\WINDOWS\mozver.dat
2008-02-14 16:00 . 2008-02-14 16:00 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-02-14 12:41 . 2008-02-14 12:49 <DIR> d-------- C:\Documents and Settings\Patrik\Phone Browser
2008-02-14 12:34 . 2008-02-14 12:34 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-02-14 12:32 . 2008-01-15 22:10 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-02-14 12:32 . 2008-01-15 22:12 <DIR> d-------- C:\Program Files\Nokia
2008-02-14 12:32 . 2008-02-14 12:32 <DIR> d-------- C:\Program Files\DIFX
2008-02-14 12:32 . 2006-03-24 08:31 48,128 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-02-14 12:15 . 2008-02-14 12:15 <DIR> d-------- C:\Program Files\KYE
2008-02-14 12:15 . 2005-05-20 11:18 5,760 --a------ C:\WINDOWS\system32\drivers\yrtumdriver.sys
2008-02-14 12:11 . 2008-02-14 12:11 <DIR> d-------- C:\Program Files\IVT Corporation
2008-02-14 11:34 . 2008-02-15 10:12 <DIR> d-------- C:\Shoty
2008-02-14 11:34 . 2008-02-14 11:34 <DIR> d-------- C:\Program Files\ScreenShots
2008-02-14 11:13 . 2008-02-14 11:15 <DIR> d-------- C:\z bava
2008-02-14 11:13 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-02-13 23:49 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-02-13 23:49 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-02-13 23:49 . 2004-08-17 15:45 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-02-13 23:49 . 2004-08-17 15:45 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-02-13 23:13 . 2008-02-13 23:13 <DIR> d-------- C:\Program Files\EA SPORTS
2008-02-13 22:59 . 2008-02-13 22:59 <DIR> d-------- C:\Program Files\DaemonTools_WhenUSave_Installer
2008-02-13 22:58 . 2008-02-13 22:59 <DIR> d-------- C:\Program Files\DAEMON Tools
2008-02-13 22:51 . 2003-06-19 01:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-02-13 22:51 . 2008-02-13 22:51 390 --a------ C:\WINDOWS\ODBC.INI
2008-02-13 22:50 . 2008-02-13 22:51 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-02-13 22:50 . 2008-02-13 22:50 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-02-13 22:47 . 2008-02-13 22:47 <DIR> dr-h----- C:\MSOCache
2008-02-13 21:59 . 2006-06-14 10:00 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2008-02-13 21:59 . 2006-06-14 10:00 82,944 --a--c--- C:\WINDOWS\system32\dllcache\wdmaud.sys
2008-02-13 21:59 . 2001-08-17 22:00 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2008-02-13 21:59 . 2001-08-17 22:00 54,272 --a--c--- C:\WINDOWS\system32\dllcache\swmidi.sys
2008-02-13 21:59 . 2004-08-03 23:07 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2008-02-13 21:59 . 2004-08-03 23:07 52,864 --a--c--- C:\WINDOWS\system32\dllcache\dmusic.sys
2008-02-13 21:59 . 2006-06-14 09:47 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2008-02-13 21:59 . 2006-06-14 09:47 6,400 --a--c--- C:\WINDOWS\system32\dllcache\splitter.sys
2008-02-13 21:58 . 2008-02-13 21:58 <DIR> d-------- C:\Program Files\AvRack
2008-02-13 21:58 . 2008-02-13 21:58 <DIR> d-------- C:\Program Files\Avance Sound Manager
2008-02-13 20:52 . 2008-02-13 20:52 <DIR> d-------- C:\Program Files\Common Files\ATI Technologies
2008-02-13 20:48 . 2008-01-15 21:31 <DIR> d-------- C:\Program Files\ATI Technologies
2008-02-13 20:48 . 2007-04-18 14:19 1,311,202 --a------ C:\WINDOWS\system32\drivers\ativcaxx.cpa
2008-02-13 20:48 . 2008-01-22 14:42 593,920 --a------ C:\WINDOWS\system32\ati2sgag.exe
2008-02-13 20:48 . 2008-01-22 21:39 307,200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2008-02-13 20:48 . 2008-01-07 15:43 165,782 --a------ C:\WINDOWS\system32\atiicdxx.dat
2008-02-13 20:48 . 2007-09-09 04:37 47,360 --a------ C:\WINDOWS\system32\drivers\ativvpxx.vp
2008-02-13 20:48 . 2007-08-31 15:20 7,167 --a------ C:\WINDOWS\system32\atifglpf.xml
2008-02-13 20:48 . 2007-05-30 18:43 2,096 --a------ C:\WINDOWS\system32\drivers\ativckxx.vp
2008-02-13 20:48 . 2007-04-18 14:19 929 --a------ C:\WINDOWS\system32\drivers\ativcaxx.vp
2008-01-22 21:04 . 2008-01-22 21:04 46,080 --a------ C:\WINDOWS\system32\amdpcom32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-21 13:17 --------- d-----w C:\Program Files\ICQToolbar
2008-02-19 17:43 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-02-19 17:42 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-02-19 17:42 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-02-14 23:52 --------- d-----w C:\Program Files\Google
2008-02-13 20:06 --------- d-----w C:\Program Files\ICQ6
2008-02-13 18:51 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-13 18:46 --------- d-----w C:\Program Files\Skype
2008-02-13 18:46 --------- d-----w C:\Program Files\Common Files\Skype
2008-02-13 18:43 --------- d-----w C:\Program Files\Common Files\Ahead
2008-02-13 18:43 --------- d-----w C:\Program Files\Ahead
2008-02-13 18:35 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-13 18:29 611,064 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-13 18:26 --------- d-----w C:\Program Files\CyberLink
2008-02-13 18:14 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2008-02-13 18:14 --------- d-----w C:\Program Files\DVDFab Platinum 4
2008-02-13 18:14 --------- d-----w C:\Program Files\Codec Pack - All In 1
2008-02-13 18:13 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-02-13 18:13 --------- d-----w C:\Program Files\Webteh
2008-02-13 18:13 --------- d-----w C:\Program Files\Alwil Software
2008-02-13 18:09 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-13 18:08 --------- d-----w C:\Program Files\Lavasoft
2008-02-13 18:07 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-22 21:38 2,845,696 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-01-22 20:44 368,640 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2008-01-22 20:43 272,384 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2008-01-22 20:36 9,949,184 ----a-w C:\WINDOWS\system32\atioglx2.dll
2008-01-22 20:35 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2008-01-22 20:35 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2008-01-22 20:35 147,456 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2008-01-22 20:35 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2008-01-22 20:35 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2008-01-22 20:34 512,000 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2008-01-22 20:33 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2008-01-22 20:25 3,121,920 ----a-w C:\WINDOWS\system32\ati3duag.dll
2008-01-22 20:14 1,664,256 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2008-01-22 20:01 385,024 ----a-w C:\WINDOWS\system32\atikvmag.dll
2008-01-22 19:59 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2008-01-22 19:58 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2008-01-22 19:58 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2008-01-22 19:57 163,840 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2008-01-22 19:53 503,808 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2008-01-16 12:10 1,454,656 ----a-w C:\Program Files\Silverlight.exe
2008-01-16 12:10 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-01-16 12:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-16 06:52 --------- d-----w C:\Program Files\Common Files\ScanSoft Shared
2008-01-16 06:52 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-16 06:51 --------- d-----w C:\Program Files\ScanSoft
2008-01-16 06:50 --------- d-----w C:\Program Files\ArcSoft
2008-01-16 06:46 --------- d-----w C:\Program Files\Canon
2008-01-16 06:44 --------- d--h--w C:\Program Files\CanonBJ
2008-01-15 20:25 48,460,432 ----a-w C:\Program Files\8-2_xp32_dd_ccc_wdm_enu_58128.exe
2007-12-21 07:21 33,800 ----a-w C:\WINDOWS\system32\drivers\epfwtdir.sys
2007-12-21 07:20 30,216 ----a-w C:\WINDOWS\system32\drivers\easdrv.sys
2007-12-21 07:19 39,944 ----a-w C:\WINDOWS\system32\drivers\eamon.sys
2007-12-07 02:14 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-17 14:49 15360]
"ICQ"="C:\Program Files\ICQ6\ICQ.exe" [2007-11-07 09:23 177400]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-08-06 12:43 23165736]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-02-14 21:26 171448]
"Steam"="C:\Program Files\Steam\Steam.exe" [ ]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 03:01 32768]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SoundMan"="SOUNDMAN.EXE" [2002-07-09 01:50 46592 C:\WINDOWS\SOUNDMAN.EXE]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 21:09 157592]
"ErgoMedia"="C:\PROGRA~1\KYE\ERGOME~1\SyTray.exe" [2005-06-28 13:59 1855488]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-17 14:49 110592 C:\WINDOWS\system32\bthprops.cpl]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 13:16 185896]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 12:45 75304]
"SBI"="C:\Documents and Settings\Patrik\Plocha\install_sbd_en(2).exe" [ ]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 13:06 40048]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-12-21 08:21 1443072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-17 14:49 15360]

R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-12-21 08:21]
R3 genmcmnUSB;USB Scroll Mouse Driver;C:\WINDOWS\system32\DRIVERS\gflmouhid.sys [2005-07-12 10:53]
R3 gHidUsbF;USB Device Enhanced Function Driver;C:\WINDOWS\system32\Drivers\gHidUsbF.Sys [2005-07-11 11:03]
R3 PSched;Plánovač paketů technologie QoS;C:\WINDOWS\system32\DRIVERS\psched.sys [2004-08-03 22:04]
R3 YiRuanUSB;YiRuan device driver for 4d;C:\WINDOWS\system32\DRIVERS\yrtumdriver.sys [2005-05-20 11:18]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-21 20:24:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
SBI = C:\Documents and Settings\Patrik\Plocha\install_sbd_en(2).exe??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\EhttpSrv]
"ImagePath"="\"C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe\""

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ekrn]
"ImagePath"="\"C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe\""
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\MsiExec.exe
C:\WINDOWS\system32\MsiExec.exe
.
**************************************************************************
.
Completion time: 2008-02-21 20:26:34 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-21 19:26:31
.
2008-02-17 08:59:30 --- E O F ---

[fredik]

# Krok1:
Jdi přes Start -> Ovládací panely -> Přidat nebo odebrat programy a odinstaluj:
MalwareAlarm

# Krok2:
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok)
Zkopíruj do něj následující text označený zeleně:

Kód: Vybrat vše

Folder::
C:\Program Files\Common Files\YourPrivacyGuard
C:\Program Files\MalwareAlarm
C:\Program Files\DaemonTools_WhenUSave_Installer

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SBI"=-

Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť

- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu

# Krok3:
- vlož sem nový log z ComboFix po použití skriptu
- dej sem i nový log z HJT